Privacy notice

We value all our visitors, supporters and customers, and strive to meet the highest standards in managing your personal data. This privacy notice explains how and why we collect and manage personal data, what your data protection rights are and how you can exercise them. We have a separate privacy notice for job applicants.

One of our responsibilities is to ensure that the personal data we hold about you is accurate and current. Please keep us informed at hello@vam.ac.uk if your personal data changes during your relationship with us.

The Victoria and Albert Museum (V&A) is the world's leading museum of art, design and performance.

It is a public body linked to the Department for Culture, Media and Sport, and it is a charity exempt from registration under the Charities Act of 2011. It is governed by a Board of Trustees appointed by the Prime Minister.

The V&A is supported by:

Young V&A (formerly the Museum of Childhood) and V&A East are covered by this privacy notice. V&A Dundee has a separate privacy policy.

In this privacy notice and in the privacy statements that you will see when we collect your personal data, 'the V&A' and 'we' (or 'us' or 'our') refer to the Board of Trustees of the Victoria and Albert Museum, together with V&A Enterprises Limited and the V&A Foundation. We share personal data responsibly between these three components of the V&A.

We collect and process a range of personal data, that is, information about an identifiable individual. We only collect data that is necessary to provide you with services requested, to keep you informed and to carry out our business. There are occasions where you can limit the information you provide to us, but please bear in mind this may limit the service or level of personalisation we can offer.

Information we collect directly from you

We collect certain information directly from you. This may be via our website (for example data that you provide by filling in forms on our websites, including data provided at the time of requesting our newsletters, buying from our shop or tickets to an exhibition or event), when you enter a competition, when you make a request or query, whether by email, via our websites or on the telephone, when you register to use our free Wi-Fi service, or when you RSVP to an invitation-only event. You may provide some of this data to us when visiting one of our galleries, exhibitions, study rooms, learning facilities, our shop, or to one of our staff, or you may choose to complete comments cards, membership forms or surveys.

Examples of the types of personal data we may collect from you are as follows:

If you purchase a Membership for yourself or as a gift, there are more specific details about the data we collect and the way in which we use it in our Membership terms.

Information we collect from third parties about you

Some of the information we hold about you may be provided to us via third-party sources (i.e. from someone who is not part of the V&A). For example:

We recommend that you check the privacy policy/notice and statements of any third parties that you provide information to, as we are not responsible for the way in which they use, share or make available your personal data.

Sometimes we may use third parties to assist us in how we try to increase support and identify new supporters – please see below.

Sometimes we may collate personal data that you have provided to us via multiple direct interactions with us with information from third parties or the analytics data referred to below so that we can use this to try to improve the services and information we provide to you.

Information collected by us automatically about you

As you interact with our websites, we may automatically collect analytics data about your equipment, browsing actions and patterns, to provide you with the best experience and help you to make use of certain functionality such as online shopping. We collect this data by using cookies, server logs and other similar technologies. We may also receive data about you if you visit other websites employing our cookies. Please see our cookie policy for further details about what cookies are and how we use them.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or not function properly.

We use Google Analytics and retargeting via Google Ads, and have implemented Google’s latest update, Consent Mode v2, which ensures user consent settings are respected in accordance with data protection legislation. We have implemented Consent Mode v2 to support our marketing efforts and collection of visitor metrics while still protecting your privacy. If you choose not to accept targeting cookies, only anonymised data about interactions with our website and adverts will be sent to the Google server. Data modelling on anonymised and identifiable interactions using Google AI enables the V&A to more accurately measure website visitor metrics to make data-driven decisions, and to develop more cost-effective and efficient marketing strategy to provide you with the most relevant advertising if you have chosen to receive it.

Free Wi-Fi at the V&A

Free Wi-Fi access is available throughout the V&A. If you access the free Wi-Fi using your device, you will be asked to agree to our Wi-Fi terms and conditions of use (see section 10). We collect your MAC address and location in order to monitor the quality of your connection to the Wi-Fi as you move around the museum, and to ensure that you are connected to the nearest Wi-Fi access point. We do not link this information with any personal data that identifies you. It is retained for 90 days after your visit for diagnostic purposes only.

Identifying potential donors, supporters and sponsors and increasing our support

As an exempt charity, we believe it is in the V&A's legitimate interests, in pursuit of our mission to champion design and creativity in all its forms, advance cultural knowledge, and inspire makers, creators and innovators everywhere, to:

We would like to ensure that we understand the people who support us or who are likely to do so. This enables us to engage in more effective communications and offer information about our activities in a more tailored way, taking into account potential capacity and affinity for support, whether financially or in other ways.

This means that we may undertake research from publicly available information sources regarding individuals who are commonly known to be art and/or design enthusiasts and collectors, or who are known to have been involved with similar organisations, or who appear to have interests that align with the V&A's mission, or who are recognised philanthropists. These information sources include:

We sometimes use third parties to help us with research and analysis on our active Members, using personal data held by the V&A combined with publicly available information (including wealth indicators) such as from Companies House on corporate directorships and company ownership. For example, we are working with Pyro.Solutions to research Members who joined during the period that Chanel exhibition tickets were on sale. Information sourced by Pyro.Solutions on individuals whom we believe may be potential supporters will be retained for no longer than a year, unless you choose to deepen your relationship with the V&A.

If you do not want your data to be used in this way for supporter analysis, or have any questions about this activity, you can contact development@vam.ac.uk. Please note that we are legally required to carry out at least a minimum level of due diligence checks before seeking or accepting a donation, so we may still need to undertake some analysis even if you have objected, in order to be able to accept donations from you.

Children's personal data

We do not intentionally collect the personal data of children under 13 years old without ensuring we have consent from the parent or guardian, for example on photography permission forms. The exception to this is safeguarding disclosures where we may collect data, including special category data (see below), on children or vulnerable adults without their consent or that of a parent/guardian, due to the nature of the information.

If you believe a person under 13 years old has provided us with their personal data, other than for safeguarding reasons, or have any concerns regarding this aspect of our notice, please contact privacy@vam.ac.uk

Names and potentially contact details of children aged 14 – 17 will be collected as part of the booking-in process for back-of-house guests, as they are allowed to visit unaccompanied. Under 14s must be accompanied by an adult, who can choose to make the booking with the child's full name, or alternatively "[name of the adult] + child". Visit bookings are retained on the system for 21 days after the visit and then deleted.

We collect registration details with parental consent for workshops run by the Learning Department for 14 – 17 year olds, which are deleted after the event.

Where we provide online services likely to be accessed by a minor, the best interests of the child are our primary consideration. We have a separate privacy notice for Mused, the V&A's website for 10 – 14 year olds.

Special category data

Special category personal data is that which is considered more sensitive, for example, revealing your political or religious beliefs or concerning your health or ethnicity.

This type of information is sometimes necessary to ensure you can enjoy the V&A’s offers. For example, we may need information regarding accessibility requirements or dietary requirements so that you are able to access and enjoy our facilities and events. It is part of the V&A's inclusive policy to provide as similar an experience as possible to all visitors and individuals, regardless of any disability.

Similarly, when undertaking due diligence checks in order to accept support and donations, we may have access to special category data or information relating to criminal offences or convictions.

When we make efforts to increase our support and identify new supporters, we may collect some information that falls into this category where it is publicly known.

If you apply for some activities such as grant funding, a competition award or roles at the V&A (e.g. a residency), we may ask you to complete optional questions relating to special category data such as ethnicity in order to meet our equality monitoring obligations and understand and improve the diversity of our audiences.

We will only collect and process special category data about a child or vulnerable adult where we meet the necessary requirements to do so under data protection law which include processing necessary for the vital interests of the child/vulnerable adult, in the context of legal claims, for reasons of substantial public interest and in the context of health or social care.

The law requires us to ensure we have a lawful basis for processing your personal data. We only use your personal data when we believe it is lawful to do so.

Sometimes, we may ask you to consent to our collection and use of your personal data for certain purposes. Where this is the case, you can change your mind and withdraw your consent at any time by emailing us at privacy@vam.ac.uk.

Otherwise we process your personal data usually because it is necessary for one of the following lawful reasons:

For example, if you purchase an item from our shop, tickets to an exhibition, event or Academy Online course, or a Membership, then we must deliver our obligations under the contract we have with you as a result, and your personal data will often be required in order for us to do this.

For example, we believe it is in the V&A's legitimate interests in pursuit of its mission to be the world's leading museum of art, design and performance and to enrich people's lives by promoting knowledge, understanding and enjoyment of the designed world to keep certain people who have attended our events informed of ongoing and future events, activities and opportunities at and with the V&A, to keep in touch with existing supporters and identify potential supporters, and to track service usage in the Academy Online to ensure we are offering relevant content.

For example, the law requires us to retain certain information about donations and transactions for tax and audit purposes.

For example, some of our processing is necessary in order to enable us to fulfil our statutory obligations under the National Heritage Act 1983 such as that which is for the purposes of maintaining, extending and promoting our collections (including the use of CCTV for security, safety and crime prevention).

For example, safeguarding disclosures relating to children or vulnerable adults, or in relation to certain events where you may be requested to provide emergency contact details or similar information.

In relation to any marketing or promotional messages from us, you can always opt out of receiving these.

We use your personal data for:

Do you have to provide personal data?

If we need to collect personal data by law, or under the terms of a contract we have with you, and you choose not to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to deliver an item to you, or to sell you a ticket to an exhibition). In this case, we may be unable to process a transaction and/or may have to cancel something you have requested from us – but we will notify you if this is the case at the time.

Online outreach events

Some of our online outreach events may be recorded and published on V&A online channels including YouTube. You will be notified before the event and again as you join if it is going to be recorded. By joining a recorded event you are giving your consent to be recorded. The V&A has procedures in place to minimise the risk to your privacy and to ensure recordings are managed appropriately in line with data protection legislation. You can also protect your own privacy by muting your microphone, turning your camera off and using an appropriate pseudonymous screen name to join the session.

CCTV

CCTV is in use across all V&A sites to help ensure the safety and security of visitors, staff, collections and property, and for the prevention and detection of crime. Notices are displayed at all public entrances. As images are captured of everyone on and around the immediate perimeter of V&A sites, this may include children and vulnerable groups.

The system is managed in line with recommendations from the police, the Surveillance Camera Code of Practice published by the Biometrics & Surveillance Camera Commissioner, Security Industry Association requirements and the Information Commissioner’s Office guidance on Video surveillance.

Recordings are kept securely for a maximum of 31 days. Extracts may be kept longer for the purposes of an investigation into a security or safety incident, or for a Subject Access Request. Extracts may be shared with the police or other agencies for the purposes of an investigation. Any footage released in response to a Subject Access Request will obscure all individuals other than the data subject.

Where appropriate, your personal data may be accessed by and shared with all parts of the V&A. We will never sell your data.

From time to time, we run competitions or events with other organisations. When we do this, any relevant further details relating to any personal data you submit will be included in the competition or event terms and conditions.

A number of third-party service providers are engaged by the V&A to assist in the provision of our services, our operations and the running and maintenance of our systems. For example, when you make a payment to us this is likely to be processed via secure third-party payment process providers, and many of our systems are maintained and supported by external specialist providers.

When we use third-party service providers, we disclose only the personal data that is necessary to deliver the service. We aim to ensure that we have contracts and agreements in place that require them to keep your data secure and not to use it for their own direct marketing purposes. If you would like more information on the relevant service providers that we use, please contact us at privacy@vam.ac.uk.

The V&A Americas Foundation is an independent charity committed to supporting the V&A and its work, with whom we may occasionally share data. Please see the section below regarding international transfers of personal data.

Sometimes we may ask for your permission to share your details with others. For example, if you attend a training course, we may ask if delegates are happy for us to share their contact details with other delegates.

We may release your information to third parties beyond those described above only if we are required to do so by law (for example by a court order), or in connection with the prevention of fraud or other crime (for example, CCTV footage shared with the police).

We have appropriate security measures and procedures in place to protect your personal data from unauthorised access, disclosure, alteration and destruction. We limit access to your personal data to those employees, agents, contractors and other third-parties who have a business need to know. They will only process your personal data on our instructions (which, in the case of our employees and contractors, are set out in our policies) and they are subject to a duty of confidentiality.

We regularly review and update our procedures to deal with any suspected personal data breaches. In the event of any suspected personal data breach we will notify the individuals affected and the applicable data protection regulators, where legally required to do so.

International data transfers

Personal data may be transferred outside of the UK to other third-party service providers incidentally in the course of our activities. We will take steps to ensure that adequate protection is provided for information transferred overseas as required under data protection legislation.

To provide our digital membership cards, we share a restricted amount of personal data with Cuseum, a US-based company which is certified under the Data Privacy Framework and adheres to core data protection principles. In limited circumstances, we may share some data with the V&A Americas Foundation, an independent charity based in New York that supports the work of the V&A by raising gifts from US taxpayers towards acquisitions, exhibitions, scholarship and capital projects. These arrangements are reflected in dedicated international data-sharing agreements.

Data retention

We aim to keep personal data only for as long as is necessary to fulfil the purposes for which the data was collected.

By law we have to keep certain basic information about our customers and supporters and their transactions with us for specified periods of time. If you would like further information on this please email privacy@vam.ac.uk.

You can ask us to stop sending you newsletters and marketing messages at any time by:

We will implement your request as promptly as possible, but it can take up to 28 days to remove you from our mailing list, so you may still receive marketing communications during this time.

Where you opt out of receiving these newsletters and/or marketing messages, we keep a record of this so that we don't contact you again. We may also need to retain and use your personal data for other purposes (such as making bookings and other financial transactions).

You have a number of legal rights in relation to your personal data. You have the right to:

Request access to your personal data (commonly known as a 'data subject access request'). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which, if applicable, will be shared with you at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation that makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use, or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time of your request.

These don't apply in all circumstances, as there are also legal exemptions which may apply, depending on why we have collected the data, and the legal basis on which we are holding the data. We will be happy to explain if you have questions about this.

You can contact us at privacy@vam.ac.uk if you wish to:

Data Protection requests and enquiries

Please email privacy@vam.ac.uk with any data protection requests or enquiries, including requests to exercise your data protection rights (such as access, erasure or objection to processing).

Data Protection Officer

The V&A has appointed an independent Data Protection Officer (dpo@vam.ac.uk). The DPO is available to advise and assist members of the public, and members of V&A staff, in the exercise of their rights, for example by escalating an existing data protection request. The DPO of the V&A is Trilateral Research (trilateralresearch.co.uk).

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK Data Protection Authority (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO so please contact privacy@vam.ac.uk or dpo@vam.ac.uk first.

We keep this privacy notice under regular review and update it from time to time to make improvements and to reflect changes in our activities or in regulatory requirements.

This privacy notice was last updated on 31 July 2024.