Privacy

This website is run by Afterall Research Centre, University of the Arts London (UAL). UAL is recognised as a data controller under the General Data Protection Regulation and the Data Protection Act 2018.

UAL’s Data Protection Officer is Kastur Kerai, contactable at dpo@arts.ac.uk or University of the Arts London, 272 High Holborn, London, WC1V 7EY (switchboard 020 7514 6000).

Under GDPR, you have:

• The right to be informed of how your data will be used and protected
• The right to access your information and obtain a copy
• The right to make changes to your personal data
• The right to delete your data in certain circumstances, or otherwise to restrict processing
• The right to data portability
• The right to object to direct marketing and other processing
• Rights in relation to automated decision making and profiling

For more information visit the Information Commissioner’s Office (ICO) website.

You have the right to request access to information, subject to certain restrictions. To make a Subject Access Request for your personal data, report a breach or to request the sharing of personal data outside of normal processes, please email contact@afterall.org.

To request a correction, restriction of processing, the deletion of personal data or the review of an automated decision please email contact@afterall.org.

University of the Arts London is regulated by the Information Commissioner’s Office (ICO), registration number Z5620514.

Please address any complaints in the first instance to contact@afterall.org. If you are not satisfied with the response, complaints about handling of personal data by either organisation can be addressed directly to the ICO by using their complaints page or by calling 0303 123 1113.

The personal data we collect or create may include:

• Identity and contact details
• Complaints or enquiries made by you
• Survey data
• Records of goods or services provided
• Financial details

Among other things we process personal information to enable us to:

• Provide access to our public and subscription-only content
• Advertise and promote Afterall and its activities
• Conduct surveys
• Fundraising
• Manage our accounts
• Provide commercial services to our clients

Under GDPR and the Data Protection Act 2018, we will process personal data under the following bases:

Contact details and other personal data related to marketing.

Legal basis under GDPR: Held under 6(1)(f) legitimate interests, but consent will be obtained for the marketing activity in accordance with PECR. We will obtain explicit consent for direct marketing, including campaigning, fundraising or marketing contact.

Purpose: To promote the activities of Afterall and partner organisations, to raise awareness of opportunities and events of potential interest to subscribers and others.

Personal data processed for commercial activity, support services or as part of commercial transactions, including enquiry, subscriber and third party contact details.

Legal basis under GDPR: 6(1)(f) legitimate interests.

Purpose: To provide additional services, to develop and maintain enquirer, subscriber, commercial and donor relationships; to protect Afterall assets.

Sensitive personal data

Legal basis under GDPR: 9(2)(a) explicit consent, (but if provided, shared with HESA for statistical purposes under basis 9(2)(j).

Purpose: To adhere to statutory requirements to monitor and report on diversity.

Who the information may be shared with:

Any personal data may be shared with UK law enforcement or tax collection officials on request if they provide a court order or otherwise can demonstrate the specified information is necessary for the prevention or detection of crime of the collection of taxes.

We will share personal data with third parties who are engaged as data processors on our behalf, including service providers Google, The University of Chicago Press, Mailchimp and The Useful Arts Ltd.

• We use Google to track analytics for www.afterall.org, if consent is given by website users through Cookies settings.
• Afterall journal subscriptions are managed by The University of Chicago Press. For further information please visit The University of Chicago Press Privacy Policy page.
• We use Mailchimp to manage our Newsletter mailing list subscriptions. For further information please visit the Mailchimp Privacy Policy page.
• The Useful Arts Ltd. process personal data on behalf of Afterall, storing log files which contain IP addresses for auditing and security.  The Useful Arts Ltd is a Data Controller with the UK Information Commissioners Office, for further information please visit The Useful Arts Ltd. Privacy Policy page.

Unless otherwise specified in a relevant Privacy Notice or to comply with a specific legal obligation under the law of the United Kingdom, we will only share personal data with others with the explicit consent of the individual.

Personal data will not normally be transferred outside the EEA. Where this is necessary, it will be the consent of the individual or otherwise with appropriate safeguards as prescribed by GDPR. Full information will be provided in detailed Privacy Notices at the point of data collection or sharing.

For information on how UAL process personal data more generally, please visit UAL General Data Processing Information page.