Privacy policy

Last updated 17 October 2020.

At Impressions Gallery we are committed to protecting your personal information and will only use it legally and responsibly. This policy covers details of what information we collect from you (whether online, at the gallery, by phone, by email, or through correspondence with third parties); what we do with it; and with whom it might be shared.

If you have any queries about our privacy policy, please contact us by e-mailing or write to us at Data Protection, Impressions Gallery, Centenary Square, Bradford, BD1 1SD.

We reserve the right to change this policy at any time, so please check this information occasionally to see if we have included any updates or changes, and that you are happy with them. We will always state at the top of the policy the date on which it was last amended or updated.

Impressions Gallery is a charity that helps people understand the world through photography. The Gallery works internationally to bring the best of contemporary photography to wide and culturally diverse audiences.

Impressions Gallery
Centenary Square

We are the controller of your data.

We currently operate the following website:

Impressions Gallery complies with all applicable UK and EU data protection legislation in force in respect of any personal information you submit to us. The personal data you submit to us will only be used for the specified purposes indicated to you and will not be passed onto unauthorised third parties without your explicit consent.

We only collect information that is necessary to run the Gallery, fulfil our obligations to you, and keep you informed about the Gallery and its activities.

The personal information we collect may include:

– Your name and title.
– Your email address, phone number, postal address, billing address, delivery address.
– Current interests and preferences.
– Feedback you may have submitted related to Gallery services.
– Ticket purchase and event registration/attendance.
– Purchases of goods or services.
– Donations you have made to the Gallery
– Credit card or other payment information (we only store this for as long as we need to process payment).
– Contact preferences.
– Bank details for setting up a regular direct debit.
– Gift Aid declaration.
– Details of correspondence sent to you, or received from you.
– Any other information provided by you to Impressions Gallery.
– Images of you recorded on our CCTV cameras.
– Images captured on film or photography taken in the Gallery.

In addition to the above, when you visit our website we use cookies to improve your experience and personalise the service you receive. See our ‘Cookies and Data Privacy’ below for more information.

Special categories of personal data

Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘special category data’). We only collect such information in limited cases, and where there is a clear reason for doing so, such as in relation to accessibility, recording accidents, or dietary requirements for events.

Information you give us

We collect personal information that you may provide to us including when you:

– Sign up to our email updates.
– Make a donation.
– Complete a visitor survey or enter a competition.
– Purchase products in our Gallery shop.

Information we get from your use of our website and services

We collect information about the services you use and how you use them in a number of ways including:

– When you visit our website, including through the use of cookies. See ‘Cookies and Data Privacy’ below for more information.
– When you view and interact with our website content.
– Information about contact you have with us as a visitor, customer, or supporter of Impressions Gallery.
– Information collected through use of CCTV in and around the Gallery.

Information from third parties

We may also receive information about you from third parties, for example when:

– You follow Impressions Gallery’s social media channels, subject to your privacy settings on those channels.
– You view and interact with our email newsletters sent via Mailchimp.
– You book tickets for events through Eventbrite.
– You purchase products through the Gallery’s website using PayPal.

We will only process your information if we have a legal basis for doing so under current UK data protection legislation, including:

Processing your information because it is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, for example:
– To process payments.
– To fulfil orders for event bookings or services.

Where we are required by law to process your information, for example:
– To make a Gift Aid claim.

Where we have your consent to process your information, for example:
– Where you have agreed to receive updates by email and / or post in relation to the Gallery.
– Where you have agreed to receive information about our education programme.
– Where you have agreed to receive press releases.

Where you have given consent to the processing of your data you may withdraw it at any time.

For further information see below ‘Your rights in relation to your personal information’ and ‘Your marketing preferences’

Where processing your information is necessary for our legitimate interests, for example:
– To process donations.
– To administer payments such as purchases from our Shop.
– Where we conduct analysis and research in relation to our supporters.
– To process job applications.
– Where we collect and view images recorded on our CCTV cameras, which we use only for security reasons, to help us keep our visitors, staff, and collection safe.
– Where (from time to time) we (or a third party) carry out any filming, including interviews or filming/photographing of talks or events in the Gallery. Where particular areas of the Gallery are going to be used for filming or photography, we will always flag this in advance with clear signage or otherwise make you aware of the filming in advance, so that you can avoid being filmed or photographed.

Where we are relying on this basis of processing you have the right to object to this. See below ‘What rights do you have in relation to your personal information?’

We may process special category data (for example, health data) on the basis of additional grounds, including where it is necessary to protect an individual’s vital interests (for example where you have a life-threatening accident or illness while visiting the Gallery and we have to process your personal data in order to make sure you receive appropriate medical attention).

We will not sell your personal information to any third parties or external organisations.

Sharing your information with our service providers/external data processors

We may share some of your personal information with our service providers/external data processors, to carry work out on our behalf. Examples of such service providers/data processors include:

– City of Bradford and Metropolitan District Council (BMDC), which provides our CCTV services within the Gallery; we share CCTV footage and other information about security incidents in the Gallery with BMDC.
– Our email distribution service provider who sends out our marketing emails (Mailchimp).
– Our ticketing service provider (Eventbrite).
– Our merchant service providers for shop sales and donations (PayPal, Charities Aid Foundation).
– Payments, finance, governance, legal auditing requirements or any others who undertake work on our behalf.
– External consultants evaluating our projects and education programmes.

Any such companies are acting as our data processors and the contracts we enter into with them require them to comply with UK data protection laws, to process only for the purposes we specify, and ensure they have the appropriate controls in place to protect the security of your information.

Anonymised customer and visitor statistics are published in our Annual Report and Accounts and other reporting to Stakeholders and Funders, and we may work additionally with third parties to conduct this type of research.

Sharing CCTV footage

CCTV footage may, in the event of a security incident, be shared with the police and/or local authorities where it is lawful and appropriate to do so, in accordance with our legitimate interests outlined above.

We will keep your information for as long as is necessary for the purposes set out in this privacy policy to fulfil our contractual obligations to you, to comply with legal requirements, tax, and accounting rules, or for other reasonable legal purposes.

The retention period will vary according to the nature of the purpose under which the information is held.

For example: We retain Gift Aid declarations in accordance with HMRC guidance, which in the case of a one-off donation is generally six years from the end of the accounting period in which the donation is received; the period is longer in the case of a  declaration which applies to a series of donations or if an HMRC query is received during the normal retention period.

We follow strict security procedures in the storage and disclosure of information which you have given us to try to prevent:

– Unauthorised access;
– Improper use or disclosure;
– Unauthorised modification; and
– Accidental loss, damage, and destruction.

We are required to make sure any transfers of information will be done securely, in accordance with best practice, and in compliance with Data Protection regulations.

All our staff and data processors who have access to, and are associated with the processing of, personal information are legally obliged to respect the confidentiality of the personal information of our visitors, email subscribers, customers, supporters, and all those who engage with us.

Transfers of data outside the EEA

In some cases, some of the services we provide or some of the processes we use may involve personal information being transferred outside the European Economic Area, for example where any data processors’ servers are located outside the EEA (such as Mailchimp).

If you access our website or use any of the services we provide while you are outside the EEA, your information may be transferred outside the EEA in order to provide you with those services.

If we do transfer personal data outside the EEA, it will only be done on one of the lawful bases, including:

– The transfer is to a recipient in a country or territory approved by the European Commission as providing an adequate level of protection for personal data.
– The transfer is to a recipient that has entered into European Commission standard contractual clauses with us.
– The transfer is to a recipient in the United States of America who has registered under the EU/US Privacy Shield.
– You have explicitly consented to the transfer.

If you wish to find out more about the transfer by us of your data outside the EEA, then please get in touch. See below ‘How to contact us’.

You have certain rights in relation to your personal information. They are:

– The right to obtain confirmation that we are processing your personal information (see below our Subject Access Request process);
– The right to access your information (see below our Subject Access Request process);
– The right to have your personal information rectified if it is incomplete or inaccurate;
– The right to have your personal information removed or deleted in certain circumstances, for example when you have withdrawn consent to it being processed and we have no other basis for processing it;
– The right to restrict the processing of your personal information in certain circumstances;
– The right to object to certain processing including the right to not be subject to automated decision-making and the right to object where we are processing your information on the basis of our legitimate interest;
– Where you have provided your consent to the processing, the right to withdraw consent to the processing of your data (without affecting the lawfulness of processing based on consent before its withdrawal); and
– The right to require us not to send you marketing communications.

Please note that the above rights are not absolute, and requests may be refused where exceptions apply.

For a more detailed explanation of these rights, please see the Information Commissioner’s Office guidance

Subject Access Request

You can ask us to confirm if we are keeping any personal information about you and you can also request to receive a copy of that personal information – this is called a Subject Access Request.

To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate, or driving license before your request can be processed. Please try to be as clear as possible about the information you are seeking, as this will help us respond to your request more efficiently. Once we have received your Subject Access Request and proof of identity, you will receive a response from us within a month.

If you want to submit a Subject Access Requests or exercise any of the other rights referred to above, please email or write to Data Protection, Impressions Gallery, Centenary Square, Bradford, BD1 1SD.

If you are not happy with how we handle any of your requests, queries, or concerns, you can contact the Information Commissioner’s Office (, which oversees the protection of personal information in the UK.

Cookies are pieces of data that a website can transfer to an individual’s computer hard drive for record keeping. Cookies can make websites easier to use by storing information about your preferences on a particular website. The information may remain on your computer after the Internet session finishes and you leave the website but you can delete them using some browsers, manually or using system utilities. Most internet browsers are pre-set to accept cookies.

If you prefer not to receive cookies, you can adjust your internet browser to refuse cookies or to warn you when cookies are being used. This site will work more efficiently if receipt of cookies is enabled but it will still operate correctly if you disable cookies.

For more information on cookies and their uses, visit All About Cookies


We use analytic services provided by Cloud Above who host our website to collect information about how our visitors use and navigate this website. We use this information to report to funders such as Arts Council England to analyse usage of the website so that we can work to add new features and improve your experience of it.

The cookies collect information such as the number of visitors to the site, which pages they visited and whereabouts they came to the site from. When you browse our website, we may collect:
– Information on your online browsing behaviour
– Information about the devices you have used

This information is anonymous and cannot be used to identify you personally.

Cookies Set by Third Parties

These are cookies served by a third party service provider and are usually used to identify your computer when it visits another website, for example, when you log in to a social media site to share an article.

Some pages on our website contain embedded content from third party websites, for example YouTube, Google Maps, Soundcloud. You may be sent cookies from these websites. If you are not logged in to these services they will not be able to identify you, but they may collect anonymous usage information, such as number of times loaded or viewed. We endeavour to use YouTube’s Enhanced Privacy Mode method of embedding videos wherever possible. This prevents cookies from being set by YouTube unless the user interacts with the video player.

We use a third party site [External Link] to securely collect the information required to process donations. This site may also set cookies, for example, analytics cookies to help them analyse and improve the donation process, and session cookies to remember your personal details as you complete the sections of the forms. For further details of the cookies used by these services please visit the respective website at the link above.

We do not control the setting of cookies by third parties. For more information on what cookies these sites use and how to manage them we recommend that you check their websites.

To unsubscribe from receiving future marketing emails, you can follow the instructions at the bottom of each email and we will promptly remove you from all bulk correspondence, although you may receive emails from individuals

Please contact us using the details below if you would like to be removed from ALL correspondence from the gallery.

The following documents provides additional information specific to our mailing list subscribers
Additional Information for Mailing List Subscribers

The following document provides additional information specific to our visitors to the gallery.
Additional information for visitors to the Gallery

The following document provides additional information specific to our donors and potential supporters.
Additional information for donors and potential supporters

The following document provides additional information specific to applicants and candidates for employment.
Additional Information for job applicants

Using our website

When using our website, you are stating that you are 13 years of age or over. If you are 12 years or younger, you are stating that you are acting with parental or guardian consent.

Signing up to our email updates

We suggest that our email updates are only suitable for those aged 16 years or over.

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Every effort has been made to ensure that this website site is free from viruses, but Impressions Gallery offers no warranties that its site is free from viruses, and the user is responsible for ensuring that they have installed adequate virus-checking software.

If you have any queries about our privacy policy, or want to raise a concern about how we process the information we hold about you, please contact us by email at or write to us at Data Protection, Impressions Gallery, Centenary Square, Bradford, BD1 1SD.