Last updated: September 2026
The Arts Society is committed to protecting and respecting your privacy. References to “The Arts Society”, “we” or “us” in this privacy policy include:
- The National Association of Decorative and Fine Arts Societies, a charitable company
- NADFAS Enterprises Limited (“The Arts Society Enterprises”)
- NADFAS Tours Limited (“The Arts Society Tours”)
Who each have their registered office at 90 High Holborn, Office 4.55, London, WC1V 6LJ
This privacy policy explains how we collect, use, disclose, and protect your personal data across all your interactions with us—whether you are a member, a volunteer, a visitor to our website, or an attendee at one of our lectures or events.
This privacy policy describes how we use your personal data when you visit and submit information through our website (https://theartssociety.org) and generally engage with us.
It is important that you read this privacy policy together with any other privacy policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data.
1. Who we are and how to contact us
The Arts Society is the "data controller" for the purposes of UK and EU data protection legislation (i.e. UK General Data Protection Regulation (UK GDPR) and the General Data Protection Regulation (GDPR)). This means that we make decisions about how and why your information is used and have a responsibility to make sure your rights are protected when we do so.
If you have any questions about this privacy policy, or how we handle your personal data, please contact us:
- By email: enquiries@theartssociety.org
- By writing to us at: The Arts Society, 90 High Holborn, London, WC1V 6LJ
2. The personal data we collect
When we refer to “personal data”, we mean information that can be used to identify, or can be directly linked to, a person. Please note that personal data does not include information where the identity of the individual has been fully and effectively removed (this is anonymous data). We collect the following personal data about you:
| General Category | Types of Personal data |
| Identity data | This is data relating to your identity such as your name and job or role title. |
| Contact data | This is data about how we can contact you, such as your email, address and country. |
| Membership data | Your full name, postal address, email address, telephone number, and your choice regarding Gift Aid. |
| Online account data | Your name, email address, and your chosen account password (which is securely encrypted). |
| Event data | Your name, contact details, payment information (processed securely through Stripe), and the names of any guests. |
| Media data | Your photograph or video footage in which you are captured |
| Grantee data | Your name, contact details, payment information and information relating to your work or project. |
| Volunteer data | Your name, contact details and information relating to your project or host organisation. |
| Lecturer application data | Your name, contact details, information relating to your membership, academic and professional qualifications and experience, any other information you provide in your application to become an accredited lecturer with us. |
| Recruitment data | This is data about your current and past employment, job title or role, qualifications, certifications, CV and visa information where required. |
| Device data | Technical data including your online identifiers (such as your anonymised IP address), your browser type, your operating system, and details about your journey through our website. For more information, please see our Cookie Policy. |
| Marketing data | This is data relating to your marketing and communications preferences |
| Communications data | Any other personal data you provide to us directly in the course of communicating with us. |
Sensitive personal data
Under data protection laws, certain personal data is considered more ‘sensitive’ (e.g., information relating to racial or ethnic origin, religion, political opinions and health). This is also known as ‘special category data’. Information relating to criminal offences is also considered more sensitive under data protection law.
3. How is your personal data collected?
We collect and retain personal data about you that you have given us in different contexts, for example:
- Direct interactions such as where you create an online account with us, use our website, use our contact or enquiry forms, subscribe to our newsletter, apply for a role with us, apply to receive a grant from us and/or correspond with us by phone, email or otherwise.
- Contact details, for example where your organisation makes a grant application to us and you are listed as the relevant contact point.
- Membership Information, for example when you become a member of The Arts Society (whether you sign up with us directly, or when you become a member by signing up to become a member of one of our local societies).
- Third party references When you apply for a role within our organisation or to be a lecturer, we may ask you to send us details of individuals who can provide a reference on your behalf. If you do so, we will obtain personal data about you from these referees as part of the application process.
- Third parties’ services We receive personal data from analytics providers such as Google Analytics
4. Why we need your information and the legal bases we rely upon
We will only use your personal data where this is consistent with our obligations under data protection law. Usually, we will use your personal data in the following circumstances:
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, we have a legitimate interest in providing our services to you;
- Where it is necessary for the performance of a contract with you;
- Where it is necessary to comply with a legal obligation that applies to us (for example, reporting to HM Revenue and Customs or the Charity Commission).
We use your personal data for the following purposes:
| Purpose | Type of data | Lawful basis for processing including legitimate interests |
| To register or renew your membership, administer your membership record, send you society communications, distribute event schedules, enable local societies to claim Gift Aid from HMRC, and manage your renewals. | Membership data | Contractual necessity: to fulfil our agreement to provide your membership benefits. Legal obligation: Processing of Gift Aid declarations to comply with UK tax law. |
| To register for an online account and allow you to log in securely, update your details, and access member-only content. | Online account data | Legitimate interests. It is necessary for us to process this information to provide you with a functional, secure online account. |
| To respond to you when you have shared your details with us through an online enquiry or contact form. | Contact data | Legitimate interests. It is necessary for us to process this information in order to respond to your enquiry.
|
To manage the booking you have made to attend an event, study day or outing, verify attendance, process payments, and contact you with vital event updates or cancellations.
| Event data | Contractual necessity. We cannot manage your booking or accept your transaction without processing this information. |
| To capture media in order to publicise the society's activities in our newsletters, website, or promotional materials. | Media data | Legitimate interests, provided it does not override your personal rights. We will always display clear notifications if photography is taking place, and you have the right to object (see section 7).
|
| To provide grants to local arts organisations and museums | Grantee data | Legitimate interests to issue grants in pursuit of our charitable purpose. Contractual necessity to fulfil any obligations or enforce rights under the grant agreement |
To invite applications for and assess the suitability of The Arts Society Accredited Lecturers.
| Lecturer application data | Consent to processing by the individual |
| To undertake staff (including volunteer) recruitment | Recruitment data, Identity data, contact data | Legitimate interests in building a workforce to meet our organisation’s needs. |
To monitor and secure our website, troubleshoot technical errors, and analyse overall visitor trends to improve our layout and content.
| Device data | Legitimate interests for essential operational data provided it does not override your personal rights Consent for performance and statistical analytics data (managed via our cookie preference panel). |
| To undertake direct marketing or share marketing information from our affiliate partners and sponsors | Marketing data | Consent to marketing Legitimate interests to send you marketing where we obtain your details in the course of your expressing an interest in, or supporting/offering to support our charitable purposes |
| To communicate with you and handle concerns and queries | Communications data | Legitimate interests in providing good customer service and complying with our legal obligations Legal obligation |
| Generally to protect our legal rights and comply with laws | All of the above | Legitimate interests Legal obligation |
5. Who we share your personal data with
We restrict access to your personal data to our committee members and volunteers on a strict need-to-know basis. We never sell your personal data. However, we do share your personal data:
- With professional service providers: Our providers need access to certain personal data to provide their services, such as our payment processor or website services provider.
- With Google (Analytics and video integrations): We use Google Tag Manager, Google Analytics 4, and YouTube to monitor website performance and embed video content. These providers process anonymised technical tracking markers.
- With local societies: for example to administer your dual membership with both a local society and The Arts Society, to facilitate your communications and interactions with each of us, and to allow local societies to contact you when you have submitted an enquiry to us
- In accordance with law: pursuant to a court order, or other legal process or as otherwise required or requested by law, regulation, or government authorities (such as HMRC), or to protect our rights or the rights or safety of third parties
- As part of a sale, merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding
- With other third parties, when you have consented or as otherwise disclosed at the time of data collection or sharing.
Where third parties act as "data processors" on our behalf, we ensure strict contracts are in place requiring them to keep your data secure, treat it confidentially, and process it only on our instructions.
6. Data storage and international transfers
Your personal data is stored securely in password-protected digital files or secure cloud services hosted and securely backed up in the UK.
Some of our third-party service providers (such as Stripe or Google) operate globally, meaning your data may occasionally be processed outside the UK or the European Economic Area (EEA). Where this occurs, we ensure that adequate safeguard measures (such as UK International Data Transfer Agreements or Standard Contractual Clauses) are in place to ensure your data receives the same high level of protection required under UK law or EU law (as applicable)
7. Data retention: How long we keep your data
We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including any legal, accounting, or reporting requirements, to exercise our legal rights and to protect ourselves from legal claims.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data (including any ongoing business or other relationships with you), whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements (including any ongoing disputes that require us to protect or defend our legal position). After expiration of the relevant retention period, information will be deleted, as long as it is no longer necessary for the fulfilment of a contract, the initiation of a contract or to protect or defend our position or that of a third party (or for any other purposes for which we collected the relevant data).
If you have any questions about our retention periods, please contact us at enquiries@theartssociety.org.
8. How do we keep your personal data safe?
To protect your privacy, we will make sure your personal data is kept securely and disclosed only to relevant organisations or representatives who need to access it to perform their roles. We use appropriate organisational, technical and administrative measures to protect personal data within our organisation. While we seek to use appropriate organisational, technical and administrative measures to protect personal information within our organisation, unfortunately no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below.
9. Your legal rights
Under data protection laws, you have rights in relation to your personal data. You have the right to:
- Request access to request a copy of the personal data we hold about you.
- Request correction of any incomplete or inaccurate data we hold.
- Request erasure of your personal data where there is no good reason for us continuing to process it.
- Object to processing of your personal data where we are relying on a legitimate interest.
- Request restriction of processing your personal data to suspend its use.
- Request data portability to request the transfer of your personal data to you or to a third party in certain circumstances. We will provide your personal data to you (or the third party you have chosen) in a structured, commonly used, machine-readable format;
- Withdraw consent at any time where we are relying on your consent to process your data (such as for marketing emails) unless we are required to process it for a different purpose (for example, the information is necessary to comply with a legal obligation). If you decide to withdraw your consent, this will not affect the lawfulness of our processing before your consent was withdrawn.
These rights may be limited, for example if answering your request would reveal personal data about another person or if you ask us to delete information we are required by law to keep.
If you wish to exercise any of these rights, please email us at enquiries@theartssociety.org.
10. Marketing and communication choices
You can control how you receive communications from us:
- Email updates: We will only send you email notices about lectures, events, or newsletters if you have consented to receive them or, in some cases, where we obtained your information in the course of you expressing an interest in, or providing/offering support to, our charitable purposes. You can opt out of receiving any marketing at any time by clicking the 'Unsubscribe' link at the bottom of our emails or contacting enquiries@theartssociety.org. You can also update your email preferences at any time by logging into your account.
- Photography opt-out: If you are attending an event and prefer not to be included in any images, or want an existing photo removed, please notify a member of staff on the day or contact us in advance at enquiries@theartssociety.org.
11. Cookies and how we track you
Our website uses cookies to allow you to log in, handle secure transactions, and measure performance. For full details on the exact cookies we set and how you can accept, decline, or adjust your tracking preferences using our shield icon tool, please read our dedicated Cookie policy.
12. How to complain
If you are unhappy with how we have handled your personal data, please contact us by emailing enquiries@theartssociety.org so we can resolve the matter.
You also have a legal right to lodge a formal complaint at any time to your local data protection authority. For details of the relevant authorities in the EEA see here. The UK’s data protection authority is the Information Commissioner’s Office (or its successor body, the Information Commission) (ICO), which you can contact here. We would appreciate the chance to deal with your concerns before you approach the relevant authority, so please contact us in the first instance.
13. Contact us
If you have any questions about this privacy policy, including any requests to exercise your legal rights outlined above, please contact us at enquiries@theartssociety.org.
14. Other websites
Our website may contain links to other websites, including the websites of our local societies. Please note that when you click on one of these links, you are entering another website for which we have no responsibility (even if you access the website via a link to our websites). We encourage you to read the privacy policies or notices on all such websites (please note in particular that each of our local societies has its own privacy notice which explains how that society will handle the data of its members).
15. Updates to this policy
We may update this notice to reflect changes at our organisation, changes in the way we use personal data or changes in data protection law. Updates to this notice will be posted on this page, so please check back from time to time. When we update this notice with significant changes, we will also take appropriate measures to inform you, for example via email.
Last updated: September 2026