Using personal information allows us to develop a better understanding of our visitors and supporters and in turn to provide you with relevant and timely information about the work that we do. As a charity, it also helps us to engage with potential donors and supporters.

The purpose of this notice is to give you a clear explanation about how we (and our subsidiaries) collect and use the information we collect from you directly and from third parties.

We use your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. This notice explains:

• What information we may collect about you
• How we may use that information and our legal basis for doing so
• In what situations we may disclose your details to third parties
• Our use of cookies to improve your use of our website
• Information about how we keep your personal information secure, how long we retain it and your rights

If you have any queries about this notice or wish to exercise your rights, please contact the Data Protection Officer at Pallant House Gallery or email privacy@pallant.org.uk

 

Who we are

Pallant House Gallery is a charity and is funded by Chichester District Council, various trusts, foundations and individual donors and supporters. Our registered charity number in England and Wales is 1102435 and we are registered as a company limited by guarantee in England and Wales under registration number 05045130. We are registered with the Information Commissioner’s Office (ICO) under registration number Z214301X.

Pallant House Gallery Services Ltd is a company that operates to manage income from various commercial activities. We are registered as a company in England and Wales under registration number 05526158.

Under this notice, ‘Pallant House Gallery’, ‘we’, ‘us’, and ‘our’ refers to both Pallant House Gallery and Pallant House Gallery Services Ltd. We share personal data responsibly between our legal entities where necessary for the purposes set out in this privacy notice.

Our principal address is: Pallant House Gallery, 9 North Pallant, Chichester, PO19 1TJ

We operate the following website: pallant.org.uk

 

What information we collect about you

We only collect personal information that is necessary to run the Gallery, fulfil our obligations to you and keep you informed about our activities. Personal information means any information about an individual from which that person can be identified.

We collect various types of information and in a number of ways:

 

Information you give us

For example when you register on our website, buy tickets or make a donation, we will store personal information you give us such as your name, email address, postal address, telephone number and card details. We will also store a record of your purchases and donations. You may be asked to give your personal information on a feedback form or comments card.

 

Information about your interactions with us

For example, when you visit our website, we collect information about how you interact with our content, including your IP address and browsing behaviour. When we send you a mailing we store a record of this, and in the case of emails we keep a record of which ones you have opened and which links you have clicked on.

We may choose to find out more about you, using publicly available sources, on an individual basis, in order to tailor our relationship with you.

 

Information collected when you visit our premises

We may collect the following information when you visit the Gallery:

• Images recorded on our CCTV cameras for security and safety purposes
• Images captured in photographs or video documenting events or activities at the Gallery
• MAC (Media Access Control) addresses of devices you bring to the Gallery when connecting to our Wi-Fi service

Special categories of personal data

Under data protection law, certain categories of personal information are recognised as sensitive (‘special category data’), including information regarding health, race, religious beliefs, and political opinions. We only collect such information in limited cases and where there is a clear reason for doing so, such as:

• Supporting participants in our Community Programme with health information (collected with explicit consent)
• Recording accessibility requirements for events and visits
• Dietary requirements for catered events
• Equal opportunities monitoring during recruitment (voluntary)

The Community Programme provides people with disabilities, health issues and those who are isolated with meaningful and long-term opportunities to increase their confidence and improve their health through their interest in art. For the Community Programme, where appropriate, we ask people to share their health information with us in order to support them. Participants can opt out of providing this information at any time.

 

Legal basis for processing your information

We will only process your personal information where we have a lawful basis to do so under UK data protection law. The legal bases we rely on include:

Contract: Where processing is necessary to perform a contract with you (e.g. processing ticket purchases, membership services, event bookings, shop purchases).

Legal obligation: Where we are required by law to process your information (e.g. Gift Aid declarations for HMRC, safeguarding requirements, financial record keeping).

Consent: Where you have given clear consent for us to process your personal information for a specific purpose (e.g. receiving marketing emails, participating in research). Where we rely on consent, you may withdraw it at any time.

Legitimate interests: Where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our legitimate interests include:

• Conducting analysis to understand our visitors and supporters better
• Sending postal marketing communications about exhibitions and events
• Fraud prevention and security
• Operating CCTV for security purposes
• Fundraising activities in support of our charitable mission

You have the right to object to processing based on legitimate interests. See ‘Your rights’ below.

 

How we use your information

Processing your admission ticket, purchase or donation

When you buy an admission ticket, book for an event, make a purchase, make a donation, become a Friend or Patron, you are entering into a contract with us. In order to perform this contract we need to process and store your data. For example, we may need to contact you by email or telephone in the case of cancellation of an event, or in the case of problems with your payment.

If you choose to include Gift Aid with a donation to us, then we will also ask for your address and UK taxpayer status as this information is required by law. Information associated with Gift Aid declarations must be retained for 6 years as required by HMRC. This information will be shared with HMRC for tax regulation purposes and may also be shared with the Fundraising Regulator and the Charity Commission in the event of an enquiry.

 

Analysis and insight

We may use your data to understand more about our visitors – for example, analysing what types of tickets people purchase, mapping the postcodes of our visitors, understanding those people who are more likely to donate to us and grouping our data into different segments in order to help understand who is engaging with our work. We may use this information to generate insight reports which can be shared with our funders and supporters – these reports will not include personal data.

 

Marketing communications

We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful. To do this we use data that we have stored about you, such as what events you have booked for in the past, as well as any preferences you may have told us about.

Sending emails is one of our main ways of communicating with you and we include a variety of information in our emails including news, exhibition information, activities and fundraising appeals. We will provide you with an option to unsubscribe in every email that we send you, or you can alternatively use the contact details at the end of this policy.

Where you have provided your postal address or telephone number we may send this information to you by post or by calling your telephone unless you have asked us not to. If you would like to opt out of information at any time please contact us using the details at the end of this policy.

 

Responding to enquiries

If you contact us then we will keep a record of this correspondence and any associated documents so that we have the information available in the event of a follow-up.

 

Notifying you of changes

If we make significant changes to our privacy notice or policies which may affect you, we will use your contact details to inform you of the changes.

 

Fraud prevention

We may analyse data we hold about you in order to identify and prevent fraud.

 

Your debit and credit card information

If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).

We optionally allow you to store your card details for use in a future transaction. This is carried out in compliance with PCI-DSS and in a way where none of our staff members can see your full card number. We never store your 3 or 4 digit security code.

 

Fundraising

Fundraising is vital for Pallant House Gallery’s work. As a charity, we rely on the generosity of individuals, trusts and foundations and corporate supporters to enable  our activities.

We consider fundraising activity to be within our legitimate interests as a charity. You can opt out of receiving fundraising communications at any time by contacting us.

We are registered with the Fundraising Regulator and committed to following the Code of Fundraising Practice.

 

Analysis and research of our supporters and potential supporters

We use tools, including information segmentation and profiling, to help us build a picture of our supporters and potential supporters to target our resources more effectively, as well as to improve the level of service we provide (for example, by briefing staff about guests in advance of meetings, dinners, and other events at which supporters and potential supporters may be present).

When building a profile we may use gift history, geographic, demographic, and other information you have provided, in order to better understand your interests and preferences.

On occasion, we may collect publicly available information to create a profile of your interests, preferences, and level of potential donations, so we can contact you in the most appropriate way and with the most relevant information.

Sources of publicly available information include Companies House, The Charity Commission, 192.com (UK Electoral Roll and Directory Enquiries), and information that has been published in articles and newspapers. We also carry out due diligence in respect of major donations.

 

Who we share personal information with and why

We will never sell, rent or exchange your details with other organisations to use for their own purposes. Pallant House Gallery will not share your personal information to any third party for marketing purposes and you will not receive offers from other companies or organisations as a result of giving your details to us.

There are certain circumstances under which we may disclose your personal information to third parties:

• To the subsidiaries described above when it is necessary for them to be able to provide you with products or services that you’ve requested
• To our service providers who process data on our behalf and on our instructions (for example our ticketing system software provider, email distribution service, or a company who manages our postal mailings). These providers act as data processors under UK GDPR and must comply strictly with our instructions and with data protection laws
• To our research service providers who process limited personal and sensitive data (such as postcode and demographic information), submitted voluntarily by those that consent to take part in our visitor surveys
• Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies, HMRC, and law enforcement agencies)
• CCTV footage may be shared with the police in the event of a security incident where it is lawful and appropriate to do so

We may receive your personal details from other organisations for our marketing purposes where you have consented for this information to be shared. These organisations have their own data protection and privacy policies, and we urge you to make yourself aware of these before signing up.

 

How we use cookies

Cookies are small text files that are automatically placed onto your device by some websites that you visit. They are widely used to allow a website to function (for example to keep track of your basket) as well to provide website operators with information on how the site is being used.

When you access our websites, some cookies are saved to your computer, for example if you have chosen a particular language setting or created a user account. You can also turn off your cookies so that we can’t access that information.

You can find out more in our website and cookies notice at pallant.org.uk/cookies-policy

 

If you are applying for a role

Pallant House Gallery is the data controller for the information you provide during the recruitment process. This section includes the application process for voluntary roles with us.

 

What will we do with the information you provide to us?

All of the information you provide during the process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

 

What information do we ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we ask for is used to assess your suitability for employment.

 

Recruitment Agencies

For certain roles we may use recruitment agencies. These agencies will ask for your personal data during the process – please review their privacy notices at this stage.

 

Application stage

We ask you for your personal details including name and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our recruitment team will have access to all of this information.

You will also be asked to provide equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

 

Conditional offer

If we make a conditional offer of employment we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability.

 

Final offer

On acceptance of a final offer, we would ask you for the following:

• Bank details and tax status – to process salary payments
• Emergency contact details – so we know who to contact in case you have an emergency at work
• Start date

Transfer of personal information outside the UK

In some cases, some of the services we provide or processes we use may involve personal information being transferred outside the United Kingdom, for example where our service providers’ servers are located outside the UK.

If we do transfer personal data outside the UK, it will only be done on a permitted basis under UK law, including:

• Transfer to a country or territory approved as providing an adequate level of protection for personal data
• Transfer to a recipient that has entered into UK standard contractual clauses or the UK International Data Transfer Agreement with us
• Where you have explicitly consented to the transfer

How long we keep your information

We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected, comply with legal requirements, and for other legitimate purposes. Specific retention periods include:

• Gift Aid declarations: 6 years as required by HMRC
• Recruitment records for unsuccessful candidates: 12 months from closure of the campaign
• Employee records: Duration of employment plus 6 years
• Transaction records: 7 years for accounting purposes
• Donation records: 7 years for accounting purposes
• Marketing preferences and suppression lists: Retained to honour your preferences
• CCTV footage: 31 days unless an incident requires longer retention

Any objections you make to any processing of your data will be stored against your record on our system so that we can comply with your requests.

 

Security of your personal information

Pallant House Gallery protects your personal information in a range of ways including secure servers, firewalls, password controlled access to our systems and SSL encryption. We follow payment card industry (PCI) security compliance requirements when processing credit card payments.

We limit access to your personal data to those employees, contractors, and service providers who have a business need to access it. They are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office of a breach where we are legally required to do so.

 

Children’s information

We are committed to protecting the privacy of children. Where we collect personal information about children under 13, we will obtain consent from a parent or guardian. Information about children and vulnerable adults is secured with additional safeguards and is only accessible to staff who have been through appropriate safeguarding checks. We will only share information about safeguarding concerns with relevant agencies as appropriate and in line with our safeguarding policy.

 

Your rights

Under data protection law, you have the following rights in relation to your personal information:

Right of access: You have the right to request a copy of the personal information we hold about you (known as a Subject Access Request).

Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal information.

Right to erasure: You have the right to request that we delete your personal information in certain circumstances.

Right to restrict processing: You have the right to request that we restrict the processing of your personal information in certain circumstances.

Right to object: You have the right to object to processing of your personal information, including for direct marketing purposes.

Right to data portability: You have the right to request transfer of your personal information to you or a third party in certain circumstances.

Right to withdraw consent: Where we rely on consent to process your personal information, you have the right to withdraw that consent at any time.

Please note that these rights are not absolute and may be subject to legal exceptions.

You can find out more about your data protection rights on the Information Commissioner’s Office (ICO) website: ico.org.uk

How to complain

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

 

Changes to this notice

This privacy notice was last updated on 12 February 2026. We may update this notice from time to time. We will notify you of any significant changes by placing a prominent notice on our website or by contacting you directly where appropriate.

 

Contacting us

If you have any questions about this privacy notice, wish to exercise your rights, or want to raise a concern about how we process your personal information, please contact us:

Data Protection Officer
Pallant House Gallery
9 North Pallant
Chichester
PO19 1TJ

Email: privacy@pallant.org.uk
Telephone: 01243 774557

We will respond to your request within one month. If your request is complex, we may extend this by a further two months, but we will inform you if this is the case.