David Hockney Group of Commercial and Charitable Entities Privacy Notice

Last updated: 24 October 2023

This privacy notice (notice) explains how we, the David Hockney Group including the entities listed in the appendix (we, us, our) process your personal data if you use our websites, app, service, content or feature or otherwise engage with us online or offline.

Our notice covers both commercial and not-for-profit activities which will apply to the relevant entities, depending on their commercial or charitable objectives.

If you have any question about your data protection rights or if you do not understand anything explained in this notice, please contact us by email at [email protected] or by writing to Privacy at PO Box 93519, Los Angeles, CA 90093, USA.

Who does this privacy notice apply to?

This notice applies to:
- visitors to museums and galleries which display our exhibits or information about us
- our private purchasers and other customers
- event participants
- our partners and suppliers
- job applicants
- users of our websites, app, online content and features
- anyone else who interacts with us, if you call, email or visit us or otherwise engage with us online or offline.
This notice applies to you if you act in your personal capacity, for example, as our customer, and if you act in your professional capacity, for example, as an employee or agent of our supplier.
What types of personal data do we process?

“Personal data” means any information that identifies you or relates to you.

This may include your contact details, information about your engagement with us, online behavioural data, and other information as set out in the "categories of personal data" section below.

However, the exact meaning of personal data and the scope of your data rights will be determined by the laws of your country.
Data accuracy

We will trust that your personal data is accurate, complete and up to date. We ask that you keep us informed of any changes.
How is your personal data collected?

We may collect your personal data as follows:
- From you, when you contact us, visit our exhibitions or events, complete a form on our websites, purchase from us, make a donation, download and use our app, during your engagement with us as our partner or supplier, when you visit our offices or otherwise deal with us.
- From third parties, such as your employer who may provide your professional details, recruitment agencies, your referees, social media platforms and other third parties.
- From your online user interactions with our websites, app, service, content and features.
- From the public domain, such as information on social media, the internet or other public records.
If you provide information about others, please ensure you have their consent to do so (where required by law) or let us know if you do not.

Why do we process your personal data?

In this section we explain why we process your personal data. We include general purposes and provide examples of the various processing activities. For more information about the specific categories of personal data processed, please see Section 14. If you have any questions, please get in touch. We keep our processes and data collection under review and will update this notice should any personal data no longer be necessary for the given purpose.

The "lawful basis" column explains how we comply with a technical legal justification for data processing under some data protection laws (e.g. the GDPR in the UK and Europe).

Purpose	Personal data	Lawful basis of processing (EU / UK only)
To assist with your enquiry.	general information contact information	Necessary for our legitimate interest in responding to enquiries and complying with best practice or, as the case may be, necessary for taking steps prior to entering into a contract or the performance of our contract with you.
To provide information and agree the terms of a loan of artworks to organisations in the museum and gallery sector or to sell artwork and other items to our private purchasers.	general information contact information financial information public information	Necessary for taking steps prior to entering into a contract or performing our contractual obligations in relation to loans or sales of artwork and necessary for our legitimate interests in promoting our activities and administering our business.
To receive your donation, including compliance checks and similar activities.	general information contact information financial information public information your background information	Necessary for taking steps prior to entering a contract or the performance of our contract with you as our donor and compliance with our legal obligations.
To organise and host our events such as exhibitions, fundraisers and other events.	general information contact information financial information public information	Necessary for contractual performance, for example, in providing visitors with access to the event they have requested, necessary for our legitimate interests in promoting our activities and administering our business, and necessary for compliance with our legal obligations such as health and safety laws.
To provide our online services including our websites, app, content and features to you and the general public which may remember your preferences or include personalised content and services.	technical information usage information profile information	Necessary for our legitimate interest in providing our online services to our members and the public and complying with best practice, the performance of our contract with you as our client and compliance with our legal obligations. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services.
To send you service communications about matters relevant to your use of our services and your engagement with us, and other feedback requests, etc.	general information contact information	Necessary for the performance of our contract with you and our legitimate interest in understanding how our services are used, views about our services and keeping our users informed.
To send you relevant marketing communications including our newsletter, by email, phone and/or text message.	contact information general information	Consent or, as the case may be, necessary for our legitimate interest in promoting our organisation.
To manage our professional relationship with our private purchasers and businesses and organisations we engage with in the museum and gallery and commercial sectors using our record management systems and engagement tools, identifying opportunities and contacting you by phone, email and other means.	general information contact information usage information	Necessary for our legitimate interest in winning new business and opportunities for our foundation, understanding and maintaining our business relationships and administering our business.
To send you relevant marketing communications including our newsletter, by email, phone and/or text message.	contact information general information	Consent or, as the case may be, necessary for our legitimate interest in promoting our organisation.
To develop and improve our information, services, content and features and organisation including measurement of engagement and activity, analytics, development of our tools, services and algorithms and development of our internal processes.	anonymised usage, profile and technical information	Necessary for our legitimate interest in service and process development and keeping our offering relevant. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device or to read information on your device except where necessary for essential services.
To ensure the proper administration of our organisations, including to: keep appropriate records; resolve complaints; enforce our terms; debt collection; and similar purposes.	all personal data as is necessary and proportionate	Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims and necessary for our legitimate interest in the proper administration of our organisations and services and protecting our reputation.
To ensure information security of our information systems, premises, meetings and communications.	general information security information your background information	Necessary for our legitimate interest in ensuring the security of people, our organisations and assets and compliance with our contractual obligations, and as necessary for compliance with our legal obligations.
To ensure your health and safety at our premises or to make reasonable adjustments on account of your disability.	general information special categories of personal data	Necessary for our legitimate interest in ensuring health and safety and good accessibility at our premises in the substantial public interest and complying with our legal obligations.
To engage our third-party service providers and advisors who may process your personal data on our behalf or otherwise to facilitate the provision of our services and the fulfilment of essential service functions including cloud storage, telecommunications, information security, professional advice and other services.	all personal data as is necessary and proportionate	Necessary for our legitimate interest in providing our services and running our organisations.
To monitor interactions and operations for the prevention and detection of crime including fraud and share information with law enforcement authorities and other stakeholders.	all personal data as is necessary and proportionate	Necessary for our legitimate interest in protecting people, our organisations and assets and detecting and preventing crime, and compliance with our legal obligations.
To share data with another organisation in accordance with the law for the purposes of a joint venture, collaboration, merger or acquisition.	all information as is lawful, necessary and proportionate	Necessary for our legitimate interest in engaging in activities to promote our organisations and complying with our legal obligations.
Processing and sharing your personal data in connection with legal claims, law enforcement or regulatory requests.	all personal data as is necessary and proportionate	Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims or for our legitimate interest in complying with best practice.

We may process your personal data for other purposes which are compatible with the existing ones. However, we will obtain your prior consent for any new purpose where required by law.

Who is your personal data disclosed to?

We may share your personal data with the following third parties:
- Our service providers in the context of the services and advice they provide to us
- Event organisers, for example, for event administration purposes
- Your employer, who may need information about your interactions with us
- Recruitment agent, your former employer or other person proving a reference about you
- Our professional advisers, including our legal advisers in the UK and US and our accountants
- Tax, law enforcement and other authorities where required by law or best practice
- The public if you interact with us on social media
- Third parties where ordered by the court or necessary in establishing, exercising or defending legal claims
- Another organisation in case of a merger, acquisition or collaboration
- Other third parties where you have provided consent, or as otherwise disclosed at the time of collection.
Digital analytics

We may work with third parties that collect data about your use of our websites and app and other sites or apps over time for non-advertising purposes. Specifically, we use Google Analytics to improve the performance of the websites and app and for analytics purposes.For more information about how Google Analytics collects and uses data when you use our websites and app, visit www.google.com/policies/privacy/partners, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout.

Additionally, your browser or device may offer tools to limit the use of cookies or to delete cookies; however, if you use these tools, our websites may not function as intended.
How do we secure your personal data?

We have put in place appropriate organisational and technical measures designed to safeguard your personal data that we keep on premise and on our systems. Access to your personal data is restricted on a "need to know" basis.

We seek to ensure our third-party service providers do the same. We appoint service providers only under an appropriate contract who provide sufficient guarantees about data security in accordance with applicable law.

No system is completely secure and we cannot fully guarantee the security of your personal data. We will deal with any personal data breach in accordance with our incident response procedure and will notify you and the regulator where we are legally required to do so.
How long is your data kept?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

After the retention period, your personal data will either be securely deleted or anonymised, and it may be used for analytical purposes.
Where we store your personal data

Generally, your personal data will be held in the UK, Europe and in the U.S.

We may also use or make available tools which require the transfer of your personal data outside the UK and Europe. We will only transfer your personal data where we are satisfied that your data protection rights are adequately protected by appropriate technical, organisational and contractual safeguards in accordance with data protection laws before any such transfer. These safeguards may include the standard contractual clauses.

You may request further information on the measures used for the international transfers or access to your personal data.
Your choices

If you would like us to stop sending you our newsletter or other marketing communications and to process your personal data for direct marketing purposes, please contact us.

You can request to stop receiving our newsletter or other marketing communications at any time by clicking on the unsubscribe link at the bottom of each marketing message and we will add you to a suppression list or otherwise arrange that you no longer receive marketing communications.
Your rights

Depending on the data rights granted to you by the laws of your country, you may have the following rights in relation to your personal data:
- Right to information about matters set out in this notice. You may also contact us for further details about our data retention policies, international data transfers and other matters that are unclear.
- Right to know about personal data collected, used, disclosure or sold or right to make an access request to receive a copy of your personal data held by us.
- Right to rectification of any inaccurate or incomplete personal data.
- Right to withdraw consent previously provided.
- Right to opt-out or object to our processing of personal data based on our legitimate interests.
- Right to erasure of personal data that is no longer needed.
- Restriction on the processing of personal data.
- Right to human intervention in respect of any automated decision-making without human involvement that significantly affected you.
- Right to data portability from one service provider to another, where applicable.
- Right to lodge a complaint with the relevant authority such as the Information Commissioner’s Office if you are in the UK or The Commission nationale de l'informatique et des libertés (CNIL) if you are in France.
To exercise any of your rights please contact us by email at [email protected] or by writing to Privacy at PO Box 93519, Los Angeles, CA 90093, USA. All requests will be processed without undue delay and no later than within one month. We will first require appropriate proof of your identity. Your data rights are not absolute and they are subject to exemptions and limitations under your country's laws. If we cannot process your request within this period, we shall explain why and process it as soon as possible thereafter.

Please note that we will not discriminate against you for exercising any of your rights, for example, by denying you our services, providing lower quality services, or amending our pricing.
Third parties may process your personal data

Our websites, app, content and features may involve the use of third-party services, social media platforms such as Twitter and Instagram, or other third-party services.

We may also share your personal data with third parties, such as credit reference agencies, payment services providers, public authorities and others who process your personal data for their own purposes.

You should check the privacy statements of these third parties, and we are not responsible for how they may process your personal data. Please note some of them may use your personal data for business administration or product development purposes.

Categories of personal data

We process the following categories of personal data about you:

Contact information	including your home or business address, telephone, email and similar information.
General information	including your name, job function, education status, age bracket, details of your enquiry or communication and similar information.
Profile information	including your demographic information from our analytics and advertising partners, your preferences and interests known, observed or inferred by using analytics, advertising or other tools and sources including notes of your past interactions with us.
Public information	from public registers, databases, social media, the Internet and similar sources.
Security information	including logs, network monitoring and logging data, antivirus scan and similar information.
Special categories of personal data	including your race, ethnic origin, religious or philosophical beliefs, sexual orientation, political or trade union affiliation and information about your health.
Technical information	including online identifiers, internet protocol (IP) address, details of operating system, browser type, language, time zone setting, location, date and time of access, local storage data and similar information obtained from your device, browser, an API or similar source.
Usage information	about how you navigate and engage with our online services and newsletters, features including online activity data such as downloads, clickstream data with URLs visited previously, page interaction, such as scrolling, clicks, and mouse-overs, methods used to browse away from our websites, information in security logs and similar information
Your background information	including your personal, professional and financial information obtained from you, public sources and third parties such as former employers, colleagues and similar information.

Updates to this notice

If we make any changes to our notice, you will be able to see them on this page, as indicated by the “Last updated” date at the top. We encourage you to visit this page periodically to learn of any updates.

If any such changes materially affect you, we will ask for your prior consent where we are required to do so by law.

Appendix: List of Entities

David Hockney UK Limited	Floor 8, 71 Queen Victoria Street, London, England, EC4V 4AY
The David Hockney Foundation (UK) Limited	Floor 8, 71 Queen Victoria Street, London, England, EC4V 4AY
David Hockney, sole trader in France	Floor 8, 71 Queen Victoria Street, London, England, EC4V 4AY
David Hockney, Inc.	PO Box 93519, Los Angeles, CA 90093, USA
The David Hockney Foundation, Inc	PO Box 93519, Los Angeles, CA 90093, USA