How we use your data
How we use your data
When you buy from us or make a donation
We ask for your name and contact details any time you make a transaction on our website. A transaction means anything that involves spending money at the Barbican. This could include booking tickets, making a donation, joining as a member, buying food or drink, or buying something in our shop.
We process donations on behalf of the Barbican Centre Trust. We keep a record of the details of the donation and whether you have made a Gift Aid declaration. For some donations we may ask for the details of your partner or family if you are donating in their name. Your personal data may be passed to the Barbican Centre Trust in order to administer your donation.
We use your credit or debit card details to process transactions online and over the phone. We don't store your card details. If you save your card details on our website we store the first 6 and and last 4 digits for reference, along with a code from your card provider that gives us permission to take certain payments under a scheme called continuous payment authority. You can manage your stored cards in your online Barbican Account or by contacting us. Read more about continuous payment authority.
When you work with us on behalf of an organisation
If you work for or are affiliated with an organisation such as a school, charitable trust, foundation, community group, or corporate supporter, we may ask about your job role and for information on the organisation for you work for or with which you are affiliated. We may store this information for future use in relation to your work with that organisation.
When you attend a special event
If you attend a reception, dinner, private view or other special event, we may ask you before or during the event about your access requirements and dietary preferences.
When you use our website
Your IP address is a unique number that can be associated with your internet connection and is considered personal data. Our website processes your IP address, as do any third-party services that your computer connects to when you use our website. We use tracking code on our website to help us understand how people use our website and inform our digital advertising. This may connect you to non-essential third-party services. We only do this if you give your consent when prompted. For more on tracking and cookies, see below.
When you apply for a job
The Barbican is a department of the City of London Corporation and most job applications are made through the City of London recruitment website, although recruitment for some casual staff roles is managed on our own website. Please see the City of London privacy notice for more on how your personal data is processed in relation to a job application and when you work at the Barbican. We process the personal data your provide for the purpose of processing your job application and to meet statutory requirements. With your permission the data you provide may be used to check your right to work, validate references or carry out background checks. We will keep you informed throughout the application process of how we are using your personal data. We will keep your data you provide as long as necessary to complete the application process and to meet statutory requirements.
When you take part in a Creative Collaboration project
We use your name and email address to identify you and your work, and to contact you about your involvement with the project. We sometimes collect your home borough or the first part of the postcode for evaluation and research purposes. Sometimes as part of an application process we will ask for information on your education, qualifications, or details of prior artistic experience.
When we work with you individually (rather than through a school, for example) or over a sustained period of time, we may ask you to provide special category data. This may include details of your ethnicity, gender, sexual orientation disability and/or health. This information will be used by our team in order to plan and deliver artistic and educational experiences for you and to keep you safe throughout your experience with us.
For projects run with the Guildhall School, your personal data may be shared with the Guildhall School whose privacy notices can be found at gsmd.ac.uk/privacy. The Guildhall School and the Barbican are both departments of the City of London Corporation.
When we collect special category data, we'll tell you exactly how we will use it and we will ask for your consent. If you are under 18, we will ask your parent or guardian for consent.
If you are under 13, you should not give us any personal data. If you are note sure what this means, you should ask your parent or guardian. You should ask your parent or guardian to fill in forms, or to provide any other information we ask for, so that they can make the right decision about your personal data.
Marketing and fundraising communications
Marketing and fundraising communications
If you have given your consent, the Barbican may contact you for marketing purposes. This could be to let you know about upcoming events, offers from our shop and restaurants, updates on our plans as an organisatoin, and to ask you to join as a member. Additionally, we may contact you about donations you have made, to tell you about upcoming fundraising events and to ask you to donate or consider other types of support. Occasionally, we may include information about other supporters or sponsors. When you donate, your donation is made to the Barbican Centre Trust, but it is the Barbican that administers your donation and processes your personal data. We will share data with the Barbican Centre Trust as necessary in order to administer your donation, and to ensure that we comply any relevant legislation.
We want to make it easy for you to tell us what marketing you would like to receive from us. We aim to use clear marketing preference questions and we include information on how to opt out whenever we send you marketing. If you don’t want to hear from us, that’s fine. You can let us know any time by changing the relevant settings in your online Barbican account or contacting us.
We may also share your data for marketing purposes with partner companies (see below), but only if you have given specific consent.
We use various techniques, including market research and audience profiling, to help us understand our audiences, customers, members, donors and potential supporters. We do this because it allows us to send appropriate communications and make appropriate requests to those who may be interested in buying tickets or donating.
Sharing your data with others
Sharing your data with others
Except as set out in this policy, we will not disclose your personal information unless obliged to, or allowed to do so by law, or where we need to in order to run our business (for example where other people process information for us). In such circumstances, we ask those people to give us confidentiality, non-disclosure or other relevant compliance undertakings.
We will not share your information other than as described in this policy without your express consent.
Sharing data with partner companies
Many of the events at the Barbican are presented with partners, including London Symphony Orchestra (LSO), the Guildhall School of Music & Drama (GSMD) and the Royal Shakespeare Company (RSC). The Barbican sells tickets on behalf of our partners on barbican.org.uk, over the phone and in person.
When you buy tickets from us, we may share some of your personal data with our partners in the following ways:
- We share our customer database with the LSO, our resident orchestra. Your name, contact details and a record of the tickets you have bought will be visible to the London Symphony Orchestra, who may use your data for customer services and analysis.
- When you book for a Guildhall School event, your name, contact details and a record of the tickets you have bought will be transferred to the Guildhall School from time to time. The Guildhall School may use your data for customer services and analysis.
- If you opt in to receive marketing emails from the LSO, GSMD or any other partner company, we will give them your email address for this purpose.
If you opt in to marketing email from one of our partners and wish to opt out in the future, please do this directly with the relevant partner. Our partners will always tell you how you can unsubscribe in any marketing email you get from them.
Further details about how our partners use your personal information can be found within in their own privacy policies: LSO privacy policy, Guildhall School privacy policy and Royal Shakespeare Company privacy policy.
See also Cookies and Tracking below.
Who else we might share your personal information with
Your personal information might be passed to a third party if they need it to fulfil your order(s) for our goods and services, to execute the communications we send to you, to conduct market research and audience profiling outlined above, to process a donation, or where you have otherwise consented to being contacted by selected third parties, such as artistic partners and associates. We do comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal information they have collected or have access to.
Examples of these third parties include our bank (in order to process Direct Debit and other payments), mailing houses (for distributing our events guides), our bulk email distribution service provider, and audience analyses and data cleansing suppliers, for example to access the Post Office National Change of Address (NCOA) database.
Surveys and analysis
Surveys and analysis
Sometimes we may ask you to fill in an online survey that includes questions on your ethnicity and gender and other special category personal data. We ask questions like this when you complete the More about you section of any of our surveys, and other customer and staff surveys. We ask these diversity monitoring questions to help us understand more about the people who visit, perform at and work with the Barbican.
We store the results of surveys in a database, but in a way that is carefully designed not to let us identify individuals. Survey responses, as far as possible, are anonymous. We never store responses alongside your other personal data, so this data cannot affect your individual experience at the Barbican.
Under certain circumstances it may be possible in theory to work out an inidividual's identity from their answers to our diversity monitoring questions. To avoid this happening, we try to make survey samples as large as possible and redact data from analysis, reports and presentations when there are fewer than 5 people who have given a particular answer.
Sometimes we offer incentives to encourage people to complete our surveys. When we do this, we ask for your email address and usually your name. We have designed the way we collect and store survey data so that we cannot link your email address to your survey response.
If you are under 18
If you are under 18
If you are under 13, please don't give us any personal data at all, even your name or email address. You can ask a parent or guardian to buy tickets or fill in forms on your behalf.
If you are over 13 and under 18, you can use our website, buy tickets and sign up to participate in Creative Collaboration projects. However, there may be times where we will need consent from a parent or guardian, for example if we ask you give us any sensitive personal data, such as information about your ethnicity, gender or disability.
Cookies and tracking
Cookies and tracking
Our website uses code written by the Barbican, built on open source code. Your web browser connects to a number of web services when you access our website, not just our web server at barbican.org.uk. We rely on various web services, some of which are operated by the Barbican, and some of which are operated by third-party companies. These web services may host website code that runs in your browser, or they may host digital assets such as images, video and audio.
We use some third-party web services to load scripts (code) that run in your browser when you access our website. Some of these scripts are essential for our website to work, and include scripts used for security and maintenance. Some help us analyse how people are using our website. Others help us understand how well our online advertising is working, including advertising placed by our agents, and by our artistic partners and their agents.
Scripts may send data, such as data about the page you are viewing and the tickets or other products you buy, to a third party. We ask for your consent before we allow non-essential scripts to send data to third parties. Please see below for more on what we consider essential.
The web services we use, including those provided by third parties, may save information on your computer using your web browser's cookies and local storage features, then access that information during your visit and when you return to our website later. What are cookies? Some cookies help our site work properly and others improve your experience. Others support our analytics and targeting. When third-party web services save data on your computer, they can build up a record of your visits to many websites. This is known as cross-site tracking. If you only consent to essential cookes, no cross-site tracking will take place.
Most browsers, unless you have changed the settings, will allow our website to save and retrieve the information it needs to work. If your browser blocks third-party cookies then you can still use all the features on our website and no cross-site tracking will take place. Some features of our website will not work if your web browser is configured not to allow any cookies to be set at all.
Essential
Essential scripts and cookies enable site functionality.
The homepageCookieMessage cookie is set for a year to note your agreement to the use of cookies so that you are not presented with the consent request message again.
Cookies whose names start with _cf are set by Cloudflare to help prevent automated use of our website.
We use New Relic (cookies set by nr-data.net) and Datadog (cookies set by datadoghq.eu) to help us monitor how well our website is performing and to note when users are encountering errors.
Cookies set by tickets.barbican.org.uk and spektrix.barbican.org.uk are essential cookies used by our ticketing and CRM platform Spektrix and are generally deleted after a few days or when you close your browser.
Some of the cookies set by shop.barbican.org.uk are essential cookies. For a complete list of Shopify cookies, please see the Merchant Storefronts section of the Shopify cookie policy.
Analytics
Analytics scripts provided by third-party web services send data in real time to third-party web services. They allow us to count page visits and traffic sources and to collect information about how users interact with our site. These services set cookies on your computer. Analytics code will only be run, and the associated cookies set, if you select Yes, that's fine on the popup that appears when you first visit our website, or if you select Let me choose and then opt in to Analytics.
We use services provided by Google (cookies set by google.com or whose names start with _g) and Hotjar (cookies set by hotjar.com or whose names start with _hj).
Cookies set by shop.barbican.org.uk are for our shop platform Shopify. Some of these cookies, along with the cookies _landing_page, _orig_referrer, _s and _y are Shopify analytics cookies. For a complete list of Shopify cookies, please see the Merchant Storefronts section of the Shopify cookie policy.
Tracking & Targeting
We include scripts on our website that send data in real time to third-party companies about your behaviour on our website, including the pages you visit and the products you buy. These services identify you by a cookie and may track your behaviour across websites. This code will only run, and cookies will only be set and retrieved, if you choose Yes, that's fine from the popup that appears when you first visit, or if you select Let me choose and then opt in to Tracking & Targeting.
We place tracking code provided by:
- Google (cookies starting with _g)
- Meta (cookies set by facebook.com or starting fb)
- TikTok (cookies starting _ttp or _pangle)
- Microsoft (cookies called MUID, MSPTC or starting _uet, SRC or OID)
We use a service to track visits to pages on our website about specific events, as well as confirmed ticket purchases for those events, using code that sets a cookie for adsrvr.org provided by our media partner FiftyMedia.
On behalf of the Royal Shakespeare Company (RSC) we may include a tracking script from Quantcast that will run when you look at information about or buy a ticket for an RSC event. Your personal data may be processed on behalf of the RSC by Quantcast and the RSC's agency DeWynters.
On behalf of Trafalgar Entertainment we may include a tracking script from Facebook that will run when you look at information about or buy a ticket for a show they produce. Your personal data may be processed on behalf of Trafalgar Entertainment by Meta and by Trafalgar Entertainment's agency Sine Digital.
Keeping your data safe and accurate
Keeping your data safe and accurate
How do we protect your personal data?
Access to systems that hold personal data is restricted and all of our staff have to do data protection training. We always use some form of encryption when personal data is transferred over the internet, including between your device and our website. Where possible we encrypt personal data where it is stored. We avoid storing data we do not need.
If you have any passwords for our website, you are responsible for keeping it confidential. Please do not share it with anyone.
Some of our suppliers run their operations outside the European Economic Area (EEA). They may not have to follow the same data protection laws as companies based in the UK, but we make sure they provide similar protections by getting commitments from them in contracts.
You have a right to contact us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments).
How long do we keep your personal data?
We will store your personal information for as long as is reasonably necessary for the purposes for which it was collected. Sometimes we may store your personal information for longer periods of time, for instance:
- where we have to keep data to personal data to meet legal, regulatory, tax or accounting requirements, such as our requirements to report on the sources of our funding and donations received,
- if we are required to report on audience activities and expenditure to one or more of our funders,
- so that we have a record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there may be some litigation relating to your personal data.
How do we keep your information up-to-date?
We do our best to keep your personal information accurate. Where possible, we use publicly available sources to keep your records up to date; for example, the Post Office National Change of Address (NCOA) database and information provided to us by other organisations as described in this policy.
You can update your online account any time. Alternatively, please feel free to contact us to change or correct your details.
Your rights
Your rights
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal information. We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.
You can exercise your rights by contacting us using the contact details below. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request.
We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
Right to access personal information
You have a right to request that we provide you with a copy of your personal information that we hold and you have the right to be informed of; (a) the source of your personal information; (b) the purposes, legal basis and methods of processing; (c) the data controller’s identity; and (d) the entities or categories of entities to whom your personal information may be transferred.
Right to rectify or erase personal information
You have a right to request that we rectify inaccurate personal information. We may seek to verify the accuracy of the personal information before rectifying it.
You can also request that we erase your personal information:
- when it is no longer needed for the purposes for which it was collected; or
- if you withdraw your consent (where the data processing was based on consent); or
- following a successful right to object (see right to object); or
- if it has been processed unlawfully; or
- to comply with a legal obligation to which we are subject.
We are not required to comply with your request to erase personal information if the processing of your personal information is necessary:
- for compliance with a legal obligation; or
- for the establishment, exercise or defence of legal claims
Right to restrict the processing of your personal information
You can ask us to restrict your personal information, but only where:
- its accuracy is contested, to allow us to verify its accuracy; or
- the processing is unlawful, but you do not want it erased; or
- it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
- you have exercised the right to object, and verification of overriding grounds is pending.
We can continue to use your personal information following a request for restriction, where:
- we have your consent; or
- to establish, exercise or defend legal claims; or
- to protect the rights of another natural or legal person
Right to object to the processing of your personal information
You can object to any processing of your personal information which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests.
If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction
You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the European Union.
We may redact data transfer agreements to protect commercial terms.
Right to lodge a complaint with your local supervisory authority
The Information Commissioner is the UK's independent authority set up to uphold information rights and data privacy for individuals. You have the right to lodge a complaint with the Information Commissioner if you are dissatisfied with any aspect of the way that we collect and use your personal information.
The Information Commissioner's website can be found at www.ico.org.uk or you can call their helpline on 0303 123 1113.
We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.
How to contact us or exercise your rights
Depending on which of us is using your personal information in accordance with the above, either the Barbican Centre or the Barbican Centre Trust will be 'data controller' in relation to your personal information, i.e. either of us will determine the purposes for which your personal information is processed, and how that information is processed.
If you would like any further information about our approach to data protection and privacy, or to request details about the information we hold, or exercise any of the rights listed above, please contact us.
The City of London has appointed a Data Protection Officer, who can be contacted by email at [email protected].
Summary of legal bases for processing
Summary of legal bases for processing
We will collect, use and share your personal information only when we have an appropriate legal basis. Read more on legal bases for processing personal data. Depending on the preferences you have indicated and your relationship with the Barbican Centre or the Barbican Centre Trust, the purposes and legal bases for processing your personal data are:
| Purpose | Legal basis |
|---|---|
| To provide goods and services to you or your organisation, process donations including Gift Aid, process payments for fundraising events or auction items, or to respond to enquires. | Contract |
| To send you communications by post, telephone or electronic means in order to inform you of other products, services or events related to the Barbican, or to inform you of the impact of your donation, programme priorities, and other giving opportunities. This may include emails containing relevant news or competitions from our sponsors. | Consent |
| To conduct evaluation surveys and market research to help us better serve your needs or refine our fundraising programmes | Public task |
| To conduct fundraising activities and ensure our fundraising resources are used in the most effective and efficient manner and that any communications we may send are appropriate and of interest to you | Usually consent, but sometimes we rely on public task (Barbican Centre, City of London Corporation) or legitimate interest (Barbican Centre Trust) |
| To improve our understanding of our audience and supporters through profiling, tracking of your activity on our site and your response to direct marketing activity | Public task |
| To tailor your participation in Creative Collaboration and Learning projects based on protected characteristics | Consent |
| To notify you of important changes to events, services, our website and this privacy policy | Public task |
