Privacy

 

The RWA is the Royal West of England Academy, Queens Road, Bristol BS8 1PX.  Registered Charity No 1071063, Limited Company Number 3567088 

If you have any questions about this Privacy Policy or our privacy practices, please contact us via email at info@rwa.org.uk. You can also write to us at the address above or call 0117 973 5129 

Purpose of this Privacy Policy.

This Privacy Policy aims to give you information on how we collect and process your personal data through your use of this website, including any data you may provide when you sign up to a newsletter, purchase a product, or sign up to an event or membership on this website. 

Age limit. If you are aged 12 or under, by using our website you are confirming that you have the permission of your parent or guardian to do so, and for your data to be collected. 

Other policies. It is important that you read this Privacy Policy together with any other policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements other notices and policies and is not intended to override them. 

Data Controller. The data controller responsible for your personal data is: The Royal West of England Academy (RWA), Queens Road, Bristol BS8 1PX.  Registered Charity No 1071063, Limited Company Number 3567088 

Contact details. If you have any questions about this Privacy Policy or our privacy practices, please contact us via email at Info@rwa.org.uk You can also write to us at the address above or call 0117 973 5129 

Making a complaint. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). However, please contact us in the first instance - we would appreciate the chance to deal with your concerns before you approach the ICO. 

Changes to the Privacy Policy and your duty to inform us of changes. We keep our Privacy Policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. 

Third-party links. This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Privacy Policy of every website you visit. 

The Data we collect about you 

Types of data. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).  

We may collect, use, store and transfer different kinds of personal data about you as follows: identity data (e.g. name, date of birth), contact data (e.g. address, email address, telephone number), visual identity data (e.g. images captured on CCTV or still photography) financial data (e.g. bank account and payment card details), transaction data (e.g. details about payments and products and services you have purchased from us), technical data includes (e.g. IP address, login data), profile data (e.g. username and password, purchases or orders made by you, preferences, survey responses), usage data (e.g. information about how you use our website, products and services), and marketing and communications data (e.g. your preferences in receiving marketing and your communication preferences).. 

Other data. We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy. 

If you fail to provide personal data. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have ordered from us but we will notify you if this is the case at the time. 

How is your personal data collected? 

Data collection methods. We use different methods to collect data from and about you including through: 

  • Direct interactions. You may give us your details (data) by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when for example you:  

  • buy a ticket to an exhibition  

  • subscribe to our mailing list 

  • register for an Art Pass  

  • buy a work of art 

  • hire one of our spaces 

  • book tickets for an event, course or workshop 

  • donate or provide sponsorship to us, or meet to discuss potential support you may give 

  • If you register a complaint, report a problem with our website, or register for lost property 

  • complete a comment card 

  • enter a competition 

  • sign up as a volunteer 

  •  apply for a job 

  • become a member of our Academician body, Friend of the RWA scheme or other membership scheme 

  • Automated technologies or interactions. As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. Please see our Cookie Policy for further details.  LINK 

  • CCTV. We use CCTV to record images in our gallery and areas used by members of the public and tenants, for the purposes of public safety and the prevention and detection of crime. CCTV images will not be released to the media for entertainment purposes or placed on the internet. In most circumstances, you have the right to see CCTV images of yourself and view the footage or be provided with a copy, but we can only disclose CCTV images of third parties for the prevention and detection of crime. For more information please visit https://www.gov.uk/request-cctv-footage-of-yourself 

How we use your data 

Use of data. Most commonly, we will use your personal data in the following circumstances: 

  • Where we need to perform the contract we are about to enter into or have entered into with you.   

  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. 

  • Where we need to comply with a legal obligation. 

 Examples of how we may use your data include, but are not limited to; 

  • If you buy a ticket to an exhibition and agree to make a Gift Aid donation, or become a member (as an Academician, Friend of the RWA or other membership scheme), Patron or donor we ask for your Postal Address for claiming Gift Aid and delivering our service. 

  • We may use some of the data in your address for the purposes of researching where our audience comes from, to inform our marketing or to report to funders and donors about our audience and impact.  This data will be anonymized and will not be used to send marketing communications to you. 

  • When you book tickets for any of our events, courses or workshops we may collect your telephone number so that we can contact you in case of changes to the booking. 

  • If you sign up to the RWA Mailing List, we will collect your email address and send you regular information about events, news and opportunities to support the RWA. If you supply us with details about your interests, we may use this information to send you tailored information relevant to these preferences. Unless you withdraw your consent, we’ll keep a record of previous communications and other relevant details in order to optimise the services we recommend to you in the future. 

  • We will use your personal data for the purposes of processing your Art Pass application and for administering the scheme, for example to monitor usage.  We may use your email address to remind you to renew your card. 

  • We may also use your personal information for internal analysis of our Art Pass holders, customer surveys and to provide the RWA with audience insights, in order to improve our offering to our customers. Data used for this purpose is anonymised and your personal details will not be visible in any resulting reports or analysis. 

  • If you correspond with us generally, for example to raise a query, comment or complaint about any of our services, we will also collect any other information you choose to send to us in that correspondence. 

  • If you apply to work at or volunteer with the RWA, we will use the information you supply to us to process your application and to monitor recruitment statistics. We may disclose personal information to a third party, for example where we want to take up a reference or obtain a check from the Disclosure and Barring Service, and where appropriate we will let you know first. 

  • We send regular emails to volunteers regarding rotas and volunteer shifts 

  • When using our website, we may also collect some technical (not personal) information about how you use our sites, for example the type of device you are using, your operating system, IP address, the web address you arrived at our site from, and length of visit. 

Payment Details 

Payment. When you make a payment to the RWA, as standard, we will not collect payment information from you such as credit or debit card details or bank information for the purposes of taking payment. 

Consent. We rely on consent as a legal basis for processing your personal data and we will get your consent before sending marketing or appeals communications to you via email or text message. You have the right to withdraw consent to marketing at any time. 

Third-party marketing. We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.  

Opting out. You can ask us or third parties to stop sending you marketing messages at any time by checking or unchecking relevant boxes to adjust your marketing preferences, following the opt-out links on any marketing message sent to you, or contacting us at any time at info@rwa.org.uk. Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase or other transactions. 

Change of purpose. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

Disclosure of your personal data 

Who we may share your personal data with: 

  • Internal third parties within our business. 

  • External third parties, such as service providers who provide IT and system administration services, including CRM providers and installers, professional advisers including lawyers, bankers, auditors and insurers based), and HM Revenue & Customs, regulators and other authorities. We may outsource functions, such as the use of marketing apps including Eventbrite and the RWA Shop using Shopify. 

  • When you visit our site we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our site.  

  • When we are under a duty to disclose for a legal obligation. 

Third Parties. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. 

International transfers. If we need to transfer your personal data out of the UK to certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK. Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK. 

Data Security 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

Data Retention 

How long we will retain your data. 

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. 

Retention of types of data. 

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. 

Deletion of your data.

 In some circumstances you can ask us to delete your data: see below for further information. 

Use of anonymised data. In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you. 

Legal Rights 

Rights over your data. You have rights under data protection laws in relation to your personal data. These include the right to; 

  • be informed about how your data is being used 

  • access personal data 

  • have incorrect data updated 

  • have data erased 

  • stop or restrict the processing of your data 

  • data portability (allowing you to get and reuse your data for different services) 

  • object to how your data is processed in certain circumstances 

If you wish to exercise any of these rights, please contact us at info@rwa.org.uk. 

No fee usually required. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. 

What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 

Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.  

Changes to this Policy. Any changes we make to this policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice. 

Questions, comments and requests regarding this policy are welcomed and should be addressed to info@rwa.org.uk . These terms were reviewed in February 2026 

Cookie Policy 

About Cookies.  A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.  More information about cookies generally can be found at All About Cookies https://allaboutcookies.org/. Or from the Information Commissioner’s Office website: https://ico.org.uk/for-the-public/online/cookies/  

How we use Cookies. Our website uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. 

We use Cookies to help identify your computer so that we can tailor your user experience, track shopping basket contents and remember where you are in the order process.  You can disable cookies already stored on your computer, but these may stop our website from functioning properly.  We also use Cookies to track the pages you visit via Google Analytics and to allow you to share pages with social networks such as Facebook.  However, this website will not share any personal information with third parties. 

Our Legal Basis. We process cookies based on: 

  • Legitimate interest: For strictly necessary cookies essential to website operation 

  • Consent: For functional and analytics cookies, obtained through our cookie banner 

Data Retention We retain data in the following timescales; 

  • Strictly necessary cookies: Active session or up to 1 year 

  • Functional cookies: Up to 2 years to maintain preferences 

  • Analytics cookies: 24 months for meaningful trend analysis 

Cookies We Use  

We have identified 23 cookies across three categories:  

Strictly Necessary Cookies (5 cookies)  

These cookies are essential for website operation and secure transactions:  

  • _shopify_essential: Enables core e-commerce functionality and secure checkout processes  

  • shopify_essential: Provides essential Shopify platform services  

  • cart_currency: Remembers your selected currency (GBP) for consistent pricing  

  • localization: Stores your location preferences for relevant content  

  • keep_alive: Maintains secure session connectivity  

Functional Cookies (7 cookies)  

These cookies enhance your experience with personalized features:  

  • _merchant_essential: Enables enhanced merchant features and personalization  

  • _shop_app_essential: Integrates with the Shopify Shop mobile app  

  • swym-email: Manages your email preferences for wishlist notifications  

  • swym-pid: Identifies products in your wishlist and recommendations  

  • swym-session-id: Manages your wishlist session continuity  

  • swym-swymRegid: Stores your Swym account registration and preferences  

  • swym-v-ckd: Tracks viewed products for personalized recommendations  

Analytics and Performance Cookies (11 cookies)  

These cookies help us understand website usage and improve performance:  

  • _tracking_consent: Records your cookie consent preferences  

  • _ga, _ga_CKDXSSPLPF, _ga_W6NECZNE63: Google Analytics for visitor behavior analysis  

  • FPAU: Shopify analytics for attribution and performance measurement  

  • FPID: First-party identifier for cross-session analytics  

  • is_shopify_merchant: Identifies merchant account access for analytics  

  • master_device_id: Enables cross-device experience tracking  

  • _shopify_v, _v, _y: Additional Shopify analytics parameters  

Use of cookies by third parties. Third parties, including, for example, advertising networks and providers of external services like web traffic analysis services, also use cookies. These cookies are likely to be analytical/performance cookies or targeting cookies. They are used, for example, to track how many users have seen a particular ad and to ensure that you see ads that are relevant to you. These cookies are placed by the relevant third party and we have no control over these cookies other than allowing them to be served. 

We use the following third-party services that set cookies: 

  • Shopify: E-commerce platform and analytics 

  • Google Analytics: Website performance analysis 

  • Swym: Wishlist and product recommendation features 

  • MailchimpFunctional / Marketing Tracks email sign-ups and attributes site activity to email campaign 

  • Meta PlatformsAdvertising / TrackingMeasures ad effectiveness (Meta Pixel) and enables retargeting on Facebook/Instagram  

Your Rights. Under UK GDPR, you have the right to: 

  • Withdraw cookie consent at any time 

  • Request information about cookie processing 

  • Lodge complaints with the ICO (Information Commissioner's Office) 

Managing Your Cookie Preferences. You can control cookies through: 

  • Our cookie banner: Appears on first visit. 

  • Browser settings: Most browsers allow cookie management in privacy settings 

If you set your browser to not accept cookies, it may result in certain sections of our website not working properly and certain personalised services not being provided to users of your computer. 

Where to get more information. If you have any queries about these cookies or would like more information about them, please contact us at info@rwa.org.uk or on the details at the top of this page 

Changes to this Policy. Any changes we make to this policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy notice. 

Questions, comments and requests regarding this policy are welcomed and should be addressed to info@rwa.org.uk   

These terms were reviewed in February 2026