Last updated: 13 August 2026
Autograph ABP (“Autograph”, “we”, “us”, or “our”) is committed to protecting your personal information and being transparent about how we use it.

This Privacy Notice explains what personal data we collect, how and why we use it, who we share it with, how long we keep it, and your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1. Who we are – Data Controller
Autograph ABP
Registered Charity No. 1127712
Registered Address: 1 Rivington Place, London, EC2A 3BA
Email: info@autograph-abp.co.uk

Autograph ABP is the data controller for personal data collected and used in relation to our activities.

Data Protection Officer
Adrian Eaves – Sense of Place Limited
Contact email: info@rivingtonplace.org

You can contact our DPO with any questions about how your personal data is used or to exercise your data protection rights.

2. What personal data we collect

We collect personal data when you:
• purchase or book tickets;
• make a donation;
• buy items from our online shop;
• subscribe to our newsletter;
• complete surveys, feedback forms or registration forms;
• participate in open calls, events or programmes;
• interact with our website;
• engage with us on social media;
• communicate with us by email, telephone, post or other means;
• support Autograph as a donor, collector, advocate, trustee, peer or other supporter; or
• otherwise have a relationship with Autograph.

Depending on how you interact with us, this may include:
• name;
• postal address;
• email address;
• telephone number;
• employment information, including job title;
• booking and attendance records;
• donation and transaction history;
• Gift Aid information and declarations;
• print purchase and sales enquiry history;
• customer service communications;
• interests and preferences;
• information about your relationship and engagement with Autograph;
• fundraising and supporter relationship information;
• marketing preferences and audience segmentation information;
• information contained in correspondence and communications with us;
• information contained in documents or attachments provided to us, where relevant; and
• technical information such as IP address, browser type, device information and cookie/analytics data.

We only collect and use information that is relevant and proportionate to the purpose for which it is being processed.

2a. Supporter, donor and fundraising information
We use a Customer Relationship Management (“CRM”) system to manage relationships with donors, supporters, collectors, advocates, trustees, prospective donors and other people connected with Autograph.

Our CRM is currently provided by Beacon Apps Ltd (“Beacon”).

The CRM may contain information such as:
• contact details;
• donation and transaction history;
• Gift Aid declarations;
• print purchase or enquiry history;
• records of communications and interactions;
• interests and preferences;
• fundraising relationship information;
• audience segmentation information;
• records of supporter engagement;
• information about campaigns or fundraising activities;
• lawful basis and communication preference information;
• notes about interactions with Autograph; and
• attachments uploaded to the CRM where relevant.

The CRM does not contain payment card details or bank account details. Payments are processed through third-party payment providers.

Why we use supporter and fundraising information
We use this information to:
• administer donations and fundraising activity;
• process Gift Aid;
• maintain accurate records of our relationships with supporters;
• thank and communicate with donors and supporters;
• understand supporter interests and engagement;
• plan and manage fundraising campaigns;
• identify and develop relationships with prospective supporters;
• manage communications and marketing preferences;
• comply with data protection and fundraising requirements; and
• improve our fundraising and supporter stewardship.

Lawful basis
Depending on the circumstances, we rely on:
• Contract, where processing is necessary to provide a service or fulfil an agreement with you;
• Consent, where we have asked you to give consent;
• Legitimate interests, where processing is necessary for our legitimate interests and those interests are not overridden by your rights and interests; and
• Legal obligation, where we are required to process information by law, for example for certain financial, accounting or Gift Aid purposes.

Where we rely on legitimate interests for fundraising or supporter engagement, we consider whether the processing is necessary, proportionate and reasonably expected by the individual.

Fundraising research and publicly available information
Where appropriate and lawful, we may use publicly available information and other legitimate sources to understand the interests and charitable activities of prospective donors and supporters.

This may include information about:
• professional roles;
• publicly stated interests;
• charitable giving or philanthropic activity;
• organisations or causes with which an individual is publicly associated; and
• information relevant to an individual's relationship with Autograph.

We do not seek to collect unnecessary or intrusive information. We do not intentionally record sensitive assumptions about individuals.

Where personal data is obtained from a source other than the individual, we will provide the privacy information required by applicable data protection law, including information about the categories and source of the data, subject to any applicable legal exception.

2b. Participation in programmes, workshops and funded projects
When you take part in Autograph programmes, workshops, residencies, community projects or funded initiatives, including learning, participation and engagement programmes, we collect and use personal data to deliver activities safely, support safeguarding and evaluate the impact of our work.

What personal data we collect
Depending on the nature of the programme, we may collect:
• name and contact details;
• participation and attendance records;
• feedback, reflection and evaluation responses;
• monitoring information collected for equality, diversity and inclusion purposes; and
• information necessary for safeguarding and accessibility.

Monitoring information may include special category personal data such as:
• race or ethnicity;
• disability or access requirements;
• age;
• sexual orientation; and
• gender identity.

Providing monitoring information is voluntary. You can choose “prefer not to say” where this option is available. Choosing not to provide monitoring information will not affect your participation.

Children and young people
Some of our programmes involve children and young people under the age of 16.

Where participants are aged 13 and under, we collect personal data only from a parent or legal guardian, and parental responsibility is confirmed.

We provide information in clear, age-appropriate language and apply additional safeguards in accordance with our safeguarding policies.

Why we use this information
We use programme participation data to:
• deliver programmes, workshops and creative activities;
• support participant wellbeing and safeguarding;
• evaluate impact and outcomes;
• meet reporting and accountability requirements to funders and partners, such as Arts Council England;
• improve future programmes; and
• ensure our work is accessible and inclusive.

Where information is published, we use aggregated or anonymised information wherever appropriate so that individuals cannot reasonably be identified.

Lawful basis
Our lawful bases may include:
• Contract;
• Legitimate interests;
• Consent; and
• Legal obligation.

Where we process special category data, we rely on an appropriate Article 9 UK GDPR condition, which may include explicit consent or another applicable condition under the UK GDPR and Data Protection Act 2018.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Who we share programme data with
We may share programme information with:
• trusted project partners delivering activities on our behalf;
• independent evaluators;
• funders and partners, such as Arts Council England or trusts and foundations, where appropriate; and
• organisations supporting safeguarding or delivery of activities where there is a lawful basis for doing so.

Where possible, funders and partners receive aggregated or anonymised information rather than identifiable personal data.

We use SurveyMonkey to collect and securely store some survey and evaluation responses. SurveyMonkey acts as a data processor and processes personal data on our instructions and in accordance with applicable data protection law.

How long we keep programme data
Identifiable programme participation data is generally retained only for as long as necessary for the relevant programme, safeguarding, evaluation, reporting and legal requirements.

As a guide:
• identifiable participation information is typically retained for up to 12 months after programme completion;
• evaluation information may be anonymised or pseudonymised and retained for up to 6 years where required for reporting, audit and accountability; and
• longer retention may apply where required by law, safeguarding requirements or a funder's conditions.

Full details are set out in our organisational retention schedule.

3. Purposes and lawful bases for processing
We rely on different lawful bases depending on the processing activity.

a) Orders, bookings, shop purchases and donations
Purpose: Processing bookings, payments, fulfilling orders and providing customer service.

Lawful basis: Contract and, where applicable, legal obligation or legitimate interests.
b) Email newsletter

Purpose: Sending news, events, opportunities and other updates.
Lawful basis: Consent.
You can withdraw consent at any time.

c) Marketing to previous customers
Purpose: Sending information about similar products, services or events.
Lawful basis: Legitimate interests and, where applicable, the relevant provisions of the Privacy and Electronic Communications Regulations (“PECR”)
You can opt out of marketing communications at any time.

d) Supporter engagement and fundraising
Purpose: Understanding engagement, maintaining supporter records, managing donor relationships, planning fundraising activity and identifying potential supporters.
Lawful basis: Legitimate interests.

We assess whether this processing is necessary and proportionate and consider individuals' reasonable expectations and rights.

e) Prospect research
Purpose: Understanding publicly available information about potential supporters and their interests in order to develop appropriate fundraising relationships.
Lawful basis: Legitimate interests, where applicable.

We seek to ensure that prospect research is proportionate, relevant and does not involve unnecessary or intrusive information.

f) Analytics and website improvement
Purpose: Understanding website use and improving functionality.
Lawful basis:
• Consent for non-essential cookies;
• Legitimate interests for essential security and operational information.

g) Administrative, financial and legal obligations
Purpose: Accounting, reporting, fraud prevention, Gift Aid administration and complying with legal obligations.
Lawful basis: Legal obligation and, where applicable, legitimate interests.

h) Social media advertising and insights
We may use social media platforms to promote Autograph's activities and understand the performance of our campaigns.

Depending on the platform and activity, this may involve the use of aggregated or statistical information and may involve processing carried out by the platform itself.

Where required, we will obtain consent or rely on another lawful basis as appropriate.

We do not sell your personal data.

4. Who we share personal data with
We use trusted third-party suppliers and service providers who process personal data on our behalf where necessary.

These may include:
• Ticket Tailor – exhibition ticket bookings;
• Eventbrite – event ticket bookings;
• Mailchimp – email newsletters;
• Beacon Apps Ltd – CRM and supporter relationship management;
• SurveyMonkey – surveys and evaluation;
• e-commerce providers;
• payment processors, including providers used to process donations and shop transactions;
• website hosting and technology providers;
• analytics providers; and
• professional advisers and other service providers where necessary.

Where suppliers process personal data on our behalf, we require appropriate contractual and technical safeguards.

We may also disclose personal data where required by law or where necessary to protect individuals, Autograph or the public.

5. International transfers
Some of our suppliers may process or store personal data outside the UK.

Where this occurs, we ensure that appropriate safeguards are in place in accordance with applicable data protection law. These may include:
• an adequacy decision;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism.

You may contact us for further information about the safeguards applying to a particular transfer.

6. Data security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to our CRM is restricted to authorised staff who need access for their work.

Our CRM provider, Beacon Apps Ltd, acts as a data processor and is contractually required to maintain appropriate technical and organisational measures and to notify Autograph of relevant personal data breaches.

7. How long we keep your data
We only keep personal data for as long as it is necessary for the purpose for which it was collected, or for as long as required by law.

Retention periods vary depending on the type of information and our relationship with you.

Typical retention periods include:
• Ticketing and shop transactions: generally 6 years where required for accounting and legal purposes;
• Newsletter subscribers: until you unsubscribe or, where appropriate, following a period of inactivity;
• Donor and Gift Aid records: generally at least 6 years, with longer retention where required by applicable Gift Aid, accounting or legal requirements;
• CRM supporter information: reviewed periodically and retained only where there is a continuing lawful and proportionate purpose;
• Fundraising and prospect research information: reviewed periodically and deleted or amended where it is no longer necessary or accurate;
• Programme participation information: as described in section 2b;
• Analytics information: according to the applicable analytics provider and our cookie settings.

We periodically review information held within our systems and seek to delete information that is no longer required.

Where possible and appropriate, we anonymise information so that it can no longer be associated with an identifiable individual.

8. Your rights
Under the UK GDPR, you may have the right to:
1. Be informed about how your personal data is used;
2. Access your personal data;
3. Have inaccurate or incomplete personal data corrected;
4. Have your personal data erased in certain circumstances;
5. Restrict processing in certain circumstances;
6. Object to certain processing, including direct marketing;
7. Data portability, where applicable;
8. Withdraw consent where processing is based on consent; and
9. Rights relating to solely automated decision-making and profiling where applicable.

The availability of particular rights depends on the lawful basis for processing and the circumstances.

For example, you have an absolute right to object to direct marketing.

To exercise your rights, contact:
info@autograph-abp.co.uk
You may also contact our DPO at:
info@rivingtonplace.org

We will respond to requests in accordance with applicable data protection law.

If we cannot fulfil a request because an exemption or legal requirement applies, we will explain this where we are legally able to do so.

9. Email marketing
With your consent, we send newsletters containing news, events, opportunities and other information about Autograph.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us.

Where permitted by PECR, we may contact previous customers about similar products or services. You can opt out of these communications at any time.

We use Mailchimp to deliver newsletters and manage email communications.

10. Social media
We use social media platforms such as Meta and TikTok to communicate about Autograph's work and, where appropriate, promote our activities.

Social media platforms may provide us with aggregated or statistical information about the performance of our content or advertising.

The social media platform may itself process personal data in accordance with its own privacy notice and terms.

We do not control how those platforms process personal data on their own behalf.

11. Links to other websites
Our website may contain links to external websites.

We are not responsible for the privacy practices or content of external websites. We recommend that you read the privacy notice of any external website you visit.

12. Cookies
Cookies may be used to:
- operate our website;
- remember preferences;
- enable online purchases;
- understand how visitors use our website;
- improve functionality; and
- support appropriate marketing or advertising activity.

Non-essential cookies will only be used with your consent where required by law.

Necessary cookies
These cookies are required for the website to operate correctly. They may support functions such as navigation, shopping baskets and other essential website functions.

Performance and analytics cookies
These cookies help us understand how visitors use our website so that we can improve its performance and functionality.

For example, we may use Google Analytics where appropriate consent has been obtained.

Functionality cookies
These cookies remember choices and preferences to provide a more personalised experience.

Advertising or targeting cookies
Where used, these cookies may be operated by third parties and may be used to understand browsing behaviour for advertising purposes.

We do not knowingly use cookies to collect information for the sale of personal data to third parties.

Managing cookies
You can manage your cookie preferences using our cookie preference tool.

Most web browsers also allow you to refuse or delete cookies.
If you disable certain cookies, some parts of the website may not function correctly.

13. Automated decision-making and profiling
Autograph does not currently make decisions about individuals that produce legal or similarly significant effects based solely on automated processing.

We may use segmentation or categorisation within our CRM to help organise fundraising and communications activity. This does not mean that decisions about individuals are made solely by automated means.

Where applicable, individuals will be provided with further information about any automated decision-making or profiling that is subject to the UK GDPR.

14. Contact and complaints

If you have questions about this Privacy Notice or how Autograph uses your personal data, please contact:

Autograph ABP
Email: info@autograph-abp.co.uk

You can also contact our Data Protection Officer:

Adrian Eaves – Sense of Place Limited
Email: info@rivingtonplace.org

If you are unhappy with how we have handled your personal data, please contact us first so that we can investigate your concern.

You also have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Information Commissioner's Office (ICO)