Privacy Policy

• When you contact us over the telephone or by email
• When you contact us to arrange a research visit
• When you visit our websites, including if you sign up to one of our email newsletters, complete forms, apply for a job or volunteer with us, create an online account with us, or post a comment on a blog. If you have cookies enabled on your web browser, we may use cookies to collect information about your visit as you move through our websites. For more information, see section 10 below on Cookies.
• When we record information about you in respect of an incident on one of our sites
• When you respond to a survey we provide to you
• When you interact with us on social media (e.g., by ‘liking’ our pages on Facebook) depending on your privacy settings on such platforms
• When you complete online forms, such as for general contact, educational bookings, or group visits. These details are emailed to relevant staff within SMG to provide appropriate services and may be added to our customer relationship management system where we have said this will happen.
• We may also collect information about you from third parties (as detailed further in section 3).
• If you otherwise contact us by telephone, email, or post. Telephone calls to the contact centre are recorded for training purposes.

• Information obtained directly from you (e.g., in person, over the phone, by post, or when you interact with us online), such as:
  • Name.
  • Email address.
  • Postal address.
  • Contact telephone number.
• We may collect additional information where we believe you may be interested in supporting us.
• When visiting our websites (apps we provide), we may use cookies and other similar technologies, as described in section 10.
• We may also obtain information from external sources, combining it with information we hold about you (this will only be done if publicly available or if you have given permission to a third party to share it, as described in section 3).

Children’s personal data:

We do not intentionally collect children's personal data (under 13 years old) without explicit consent from their parent or guardian. Data about children is only accessible by our staff on a need-to-know basis and is used for their best interests. We won't use children’s data for marketing purposes.

Criminal conviction data:

We may process criminal conviction data (as defined in Article 10 UK GDPR) for due diligence research when accepting support or donations, or when you apply to work or volunteer with us.

To fulfil our obligations under a contract with you and to otherwise carry out our business.

This includes:

• Fulfilling purchases you have made of our goods and services (including our exhibitions and other commercial experiences).
• Securely processing your payments (we will not hold your payment details for any longer than necessary to process your transaction).
• Administering your tickets in your digital wallet (such as Apple Wallet or Google Wallet).
• Administering your donations, including processing Gift Aid and corresponding with you about your donations.
• Contacting you with important information about your purchase of goods or services, including order confirmations, reminders, and updates (via email, telephone, post, or SMS).
• Contacting you about renewals for regular agreements (e.g., annual passes, memberships) via email, telephone, or post.
• Contacting you regarding competitions you have entered.
• Internal administration of your purchases.
• Responding to your queries (e.g., if you email us with a question).
• Improving our websites and online services.
• Anonymously fulfilling reporting obligations to our funders.
• Managing venue bookings or brand licensing agreements.

When it is in our legitimate interest to do so.

We may use your information in our legitimate interest to:

• Learn about your interests and preferences to provide relevant information.
• Classify our audience into groups based on attitudes and behaviors to improve our services.
• Use pseudonymized data to guide advertising on social media platforms.
• Measure audience responses to marketing activities.
• Send marketing emails that do not require consent (e.g., business-to-business communications).
• Test and improve our websites and systems.
• Include accounts of your experiences or other information you provide us about your visit.

• Service providers working on our behalf, including those involved in payment processing, database services, website hosting, online and cloud services, printing and mailing organisations, marketing agencies, and email delivery services.
• Third-party data services and analytics platforms who assist us with segmenting and understanding our audiences (as described in section 3).
• Insurers when pursuing an insurance claim.

If we have your permission, or it is otherwise made expressly clear in advance, we may share your personal information with:

• Named third parties if you opted in to allow us to provide your details to such third parties when you purchased services from us.
• Other organisations such as competition organisers, sponsors, and exhibition collaborators where it is made clear that such organisations shall be provided with and permitted to use your personal information, subject to their terms (and privacy notices). We recommend that you check the data protection notices provided by such third parties and contact their Data Protection Officer (or equivalent) if you have any queries.
• Partner venues where you have bought tickets hosted at such venues.
• HMRC where we have your permission to claim Gift Aid on a donation you have made.

If we are required to do so by law (for example under money laundering or charity law legislation, or under a court order) we may share your personal information with the police, other law enforcement or regulatory bodies or a government authority investigating unlawful activities.

• To be informed about how we use your personal data (the purpose of this notice).
• To have accurate information held about you, and to have your details updated when they are inaccurate. If you have an online account, you may amend your personal details and email contact preferences at any time. If you prefer, you can contact us by email, telephone, by mail, or in person to update your details with us.
• To ask us to delete your data (often called the “right to be forgotten”). We might not always be able to delete it; under the law, there are some circumstances in which we will need to, or are entitled to, hold on to it.
• To get a copy of your personal data. A subset of your data (limited to data that you have provided to us) is available in a machine-readable format if required.
• To object to how we use your data, and request that we stop using it for certain purposes. There may be circumstances where you ask us to restrict such uses of your information, but we are entitled to refuse that request. However, we shall always stop using your data for email marketing purposes at your request. Each marketing email we send to you will include details on how to change your communications preferences or unsubscribe from future communications.
• To withdraw your consent, where we are using your personal information with your consent (as described above in the ‘Why We Collect Your Personal Data and How we use it” section).
• To ask us to transfer your data to another organisation, where your data is held in a machine-readable, commonly used way, and can be safely transferred.
• If we make a decision about you using automated means, you have the right to request that the decision be reviewed by a human.
• The right to make a complaint to the Information Commissioner (www.ico.org.uk) if you think that any of your rights have been infringed by us.

To exercise your rights, please use our contact details below.

We may request additional information so that we can verify your identity (and to ensure your personal information is not disclosed to any person who has no right to receive it). This may include:

• A colour copy of your driving licence, birth certificate, or utility bill.

We may contact you to ask you for further information in relation to your request to help us enact your rights in accordance with the law.

We try to respond to all legitimate requests within one month. However, occasionally it may take us longer than a month if your request is particularly complicated or you have made a number of requests. In such circumstances, we will notify you.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (‘EEA’). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details, and the provision of support services. By submitting your personal data, you agree to this transfer, storing, or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this notice.

In all such cases we shall ensure that any transfer of your information is compliant with data protection law.

However, please note that the transmission of data via the Internet is not completely secure. Your communications may be routed through a number of countries before being delivered. We cannot guarantee the security of any data transmitted to our websites, however, once we have received your data, we will use adequate security procedures to prevent unauthorised access.

Cookies are pieces of data that a website can transfer to a user’s web browser. Some cookies collect, use, and store personal data, such as IP address, device information, browsing behavior, and cookies consent preferences.

The cookies may remain on your computer after you leave the website, but you can manually delete them on most browsers. Most web browsers are pre-set to accept cookies. Some cookies store data just for the time you are on the website, such as any preferences, language selection, or what is in your shopping basket. These are called session cookies and are not stored on your computer after you have left the website.

Some cookies are referred to as 'first party' and means they are used by the website you are visiting. 'Third party' cookies are used by other organizations on our website but with our permission, such as advertisers or social media platforms.

A pixel tag (also known as a web beacon or clear GIF) is an invisible 1×1 pixel that is placed on web pages. When you access these web pages, pixel tags generate a generic notice of the visit and allow us to set or read our cookies. We use pixel tags in combination with cookies to track activity on our websites, particularly to track visits, times and dates of visits, pages viewed, country and city locations, devices used, purchases, sources visited before coming to our websites, demographics, and email sign-ups. We use these for reporting and for marketing purposes to retarget advertising and for lookalike modeling. This information is used to make our websites and advertising more relevant to your interests.

For more information on cookies and their uses, visit the cookies page on the Information Commissioner’s Office website.

If you agree to our websites placing cookies on your web browser, the websites will collect information about your visit as you move through them. We use cookies that enable you to navigate the sites, enhance your experience, and analyze how you are using our website to improve our functionality and marketing.

We use this data to report on high-level website visits and to inform the development of our services (for example, if we know which web browsers most of our visitors are using, we can allocate website development resources accordingly).

How to manage cookies?

You are in control of cookies on your device, and you can opt in and out of the cookies on our websites.

If you prefer not to receive cookies, you can select to reject them in the websites’ cookie consent banner or by visiting the Cookie Settings for each website listed in the previous section.

If you want to restrict or block web browser cookies on your device, you can do this through your browser settings. Here is some guidance for the most common browsers:

• Chrome
• Internet Explorer
• Safari
• Microsoft Edge
• Firefox

Third party cookies and similar technologies:

There are some third parties who might also collect cookie data on our behalf. You can find out more about their respective cookie policies here:

• Shopify, eCommerce platform
• Facebook and Instagram, Meta
• X
• Google and YouTube