Our café is currently closed due to unforeseen circumstances. Sorry for any inconvenience.
The Gainsborough's House logo. A landscape ratio rectangle with a light, slate blue colour is accompanied with white typography within.

Privacy Policy

Last updated: October 2026

At Gainsborough’s House, we value your support and are committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, how we keep it secure and the choices you have about how we contact you.

Who we are

Gainsborough’s House Society is a registered charity in England and Wales (Charity No. 1170048) and a Company Limited by Guarantee (Company No. 10413978).

Gainsborough’s House Society
Gainsborough’s House
46-47 Gainsborough Street
Sudbury
Suffolk
CO10 2EU

Telephone: 01787 372958
Email: mail@gainsborough.org
Website: www.gainsborough.org

For the purposes of data protection law, Gainsborough’s House Society is the data controller responsible for the personal information we hold about you.

We process personal data in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Gainsborough’s House Society and our trading company Gainsborough’s House Enterprises Limited are both registered with the Information Commissioner’s Office.

Gainsborough’s House Society registration: Z8063443
Gainsborough’s House Enterprises Limited registration: ZB829090

If you have any questions about how we use your personal information, please contact us using the details above.

What information do we collect?

We collect personal information that you provide to us when you interact with Gainsborough’s House. This may include when you:

  • Visit Gainsborough’s House
  • Purchase tickets or register for an event
  • Become a member
  • Make a donation
  • Complete a Gift Aid declaration
  • Make a purchase
  • Sign up to receive our newsletters or other communications
  • Take part in a survey or provide feedback
  • Volunteer with us
  • Apply for a job or other opportunity with us
  • Work with us as an artist, lender, partner or supplier
  • Contact us with an enquiry
  • Otherwise engage with us as a visitor, supporter or member of our community

Depending on how you interact with us, the information we collect may include:

  • Your name and title
  • Your postal address
  • Your email address
  • Your telephone number
  • Your communication preferences
  • Your date of birth, where relevant
  • Information about your membership
  • Ticket bookings and event attendance
  • Details of purchases and donations
  • Gift Aid information
  • Payment information where necessary to process a transaction
  • Details of correspondence between you and Gainsborough’s House
  • Information about your interests and activities where you choose to share this with us
  • Information about your relationship with Gainsborough’s House
  • Professional or employment information where relevant to our relationship with you
  • Information included in job applications, CVs and supporting documents
  • Information relating to your recruitment or job application
  • Information you provide when completing surveys or giving feedback

We may also collect anonymous information through visitor surveys to help us understand our audiences and improve our services. This may include demographic information such as age, gender, ethnicity and disability. Where survey responses are collected anonymously and cannot be linked back to an identifiable individual, this information is not treated as personal data.

We may also collect information about your interactions with our website and digital services, including information collected through cookies and similar technologies. Please see our Cookie Policy for more information.

We will only collect personal information that is relevant to the purpose for which we need it.

How do we collect your information?

We collect information in a number of ways, including:

  • Directly from you when you provide it to us
  • When you purchase a ticket, membership or product
  • When you make a donation or Gift Aid declaration
  • When you sign up for communications from us
  • When you attend an event or activity
  • When you contact us by email, telephone, post or through our website
  • When you complete a survey or provide feedback
  • When you interact with our website and digital services
  • From publicly available sources, where appropriate and lawful

When we ask you for personal information, we will explain why we need it and how we intend to use it. Where required, we will ask for your consent.

How do we use your information?

We use personal information for a range of purposes, depending on your relationship with Gainsborough’s House.

This may include:

Providing our services

We use your information to:

  • Process ticket bookings and event registrations
  • Manage memberships
  • Process purchases and donations
  • Administer Gift Aid
  • Respond to enquiries
  • Provide information or services you have requested
  • Manage your relationship with Gainsborough’s House

Communications and marketing

Where we have the appropriate permission or another lawful basis to do so, we may contact you about:

  • Exhibitions and events
  • What’s On information
  • News and updates from Gainsborough’s House
  • Membership
  • Volunteering opportunities
  • Fundraising and appeals
  • Ways to support our work
  • Relevant activities and opportunities connected with Gainsborough’s House

The communications we send will depend on your relationship with us and the preferences you have provided. You can change your communication preferences or ask us to stop sending marketing communications at any time by contacting us.

You can also unsubscribe from email marketing communications by using the unsubscribe link included in our emails.

Some communications are essential to providing a service or managing our relationship with you and are not marketing communications. These may include booking confirmations, membership information, donation acknowledgements, Gift Aid administration and other important administrative messages.

Donor research and profiling

We may carry out research and profiling to help us understand our donors and potential donors and to make our fundraising and engagement more relevant and appropriate.

For example, we may use information you have provided to us alongside information that is publicly available, such as information from Companies House, the Charity Commission register, professional or business websites and public news coverage.

This may help us understand whether you or an organisation you are connected with may have an interest in supporting our charitable work or help us avoid making inappropriate or irrelevant approaches.

We only carry out this type of research where we consider it appropriate and proportionate, taking into account your privacy and rights. We do not use special category data, such as information about your health, religion or political opinions, for supporter research and profiling.

We do not use profiling to make solely automated decisions that have a legal or similarly significant effect on you.

Legal basis for this work: Where we carry out donor research and profiling, we generally rely on our legitimate interests in developing relationships with donors and fundraising effectively for our charitable purposes. We consider whether the processing is necessary and proportionate and balance our interests against your rights and interests.

You have the right to object to processing based on our legitimate interests. If you object to donor research or profiling, please contact us and we will consider your request in accordance with data protection law. You can also object at any time to the use of your personal information for direct marketing.

We keep donor research and profiling information only for as long as it is necessary for these purposes and review it periodically to ensure that it remains relevant and appropriate.

Due diligence research

As a charity, Gainsborough’s House may carry out due diligence before accepting certain significant gifts, donations, grants or other forms of support. This helps our trustees to identify and manage potential financial, legal or reputational risks and to meet our responsibilities as a charity.

Where appropriate, we may check publicly available sources such as Companies House, the Charity Commission register, sanctions lists, politically exposed person (PEP) information and relevant media coverage.

The extent of any due diligence will depend on the circumstances and the nature and value of the proposed support. We will only collect and use information that is relevant and necessary for this purpose.

Where we carry out due diligence, the lawful basis for processing will depend on the circumstances and may include our legal obligations and our legitimate interests in responsible fundraising and protecting Gainsborough’s House.

Further information about charity due diligence is available from the Charity Commission in its guidance on due diligence checks and monitoring the end use of funds.

Gift Aid

If you choose to make a Gift Aid declaration, we need to collect and retain certain information, including your name, address and details of your donation.

We use this information to administer your Gift Aid declaration and make claims to HM Revenue & Customs (HMRC). We need to retain certain records to meet our legal and financial obligations.

It is important that the information you provide is accurate so that we can claim Gift Aid correctly and can increase the value of the donations you give us.

Sharing your information

We do not sell, rent or trade your personal information.

We may share personal information with trusted organisations that provide services to us, where this is necessary for us to operate effectively and provide our services. These organisations act as data processors on our behalf and are required to protect your information and only process it in accordance with our instructions.

These may include providers that support activities such as:

  • Ticketing and event bookings
  • Membership administration
  • Payment processing
  • Email, newsletter and postal communications
  • IT and technical services
  • Database and CRM management
  • Website hosting and maintenance
  • Survey and research services

We use Mailchimp to manage and send some of our email communications. Where we use Mailchimp to process your personal information, Mailchimp acts as a data processor on our behalf.

Some of our service providers may process or store personal information outside the UK. Where this happens, we ensure that appropriate safeguards are in place in accordance with applicable data protection law.

We may also share information where we are legally required to do so, for example with HMRC in relation to Gift Aid, or where necessary to comply with our legal obligations.

Data accuracy and keeping your information up to date

We aim to keep the personal information we hold about you accurate and up to date.

Where appropriate, we may use publicly available sources and specialist services to help us check or update contact information, such as postal addresses.

For example, we may use address information to help ensure that communications are sent to the correct address and to avoid sending communications to people who have moved or died.

If you believe any information we hold about you is incorrect, please contact us and we will update our records where appropriate.

How we keep your information secure

We take appropriate technical and organisational measures to protect your personal information against:

  • Unauthorised access
  • Accidental loss
  • Improper use or disclosure
  • Unauthorised alteration or destruction

Access to personal information is limited to those who need it for legitimate business or organisational purposes.

Our employees and relevant service providers who have access to personal information are required to respect its confidentiality and handle it securely.

While we take appropriate steps to protect your information, no method of storing or transmitting information can be guaranteed to be completely secure.How long do we keep your information?

We keep personal information for as long as we need it for the purposes for which it was collected, or for as long as we are required to keep it by law.

The length of time we retain information will depend on the type of information and our relationship with you.

For example, we may need to retain certain financial, donation and Gift Aid records to meet legal and accounting requirements.

When personal information is no longer required, we will securely delete it or, where appropriate, anonymise it.

Job applicants: We keep information relating to your job application for the duration of the recruitment process and for six months after the recruitment process has concluded, after which it is securely deleted unless we have a lawful reason to retain it for longer.

Your rights

Under data protection law, you have a number of rights in relation to your personal information. Depending on the circumstances, these include the right to:

  • Ask for a copy of the personal information we hold about you
  • Ask us to correct inaccurate or incomplete information
  • Ask us to delete your personal information in certain circumstances
  • Ask us to restrict how we use your information in certain circumstances
  • Object to certain uses of your information, including direct marketing
  • Withdraw your consent where we rely on consent to use your information
  • Request the transfer of your information to another organisation in certain circumstances

If you wish to exercise any of these rights, please contact us using the details below. We may need to ask you to confirm your identity before providing personal information.

We will respond to your request without undue delay and normally within one calendar month. If your request is complex or you have made a number of requests, we may need up to a further two months to respond. If this applies, we will let you know within one month and explain why.

In most cases, you will not have to pay a fee to exercise your data protection rights. However, we may charge a reasonable fee or refuse a request where the law allows us to do so.

Your communication preferences

You can change your communication preferences at any time.

If you no longer wish to receive marketing communications from us, you can:

  • Click the unsubscribe link in any marketing email
  • Contact us at mail@gainsborough.org
  • Call us on 01787 372958
  • Write to us at Gainsborough’s House, 46-47 Gainsborough Street, Sudbury, Suffolk, CO10 2EU

If you ask us to stop sending you marketing communications, we may retain limited information, such as your name and contact details, on a suppression list. This allows us to respect your request and ensure that we do not contact you again for marketing purposes.

We may still need to contact you with essential administrative or service-related communications where necessary.

Cookies and website analytics

Our website may use cookies and similar technologies to help us provide and improve our online services, understand how visitors use our website and, where applicable, support marketing and advertising activities.

For more information about the cookies we use and how you can manage your preferences, please see our Cookie Policy

Contact us

If you have any questions about this Privacy Notice, how we use your personal information or your data protection rights, please contact us:

Gainsborough’s House Society
Gainsborough’s House
46-47 Gainsborough Street
Sudbury
Suffolk
CO10 2EU

Email: mail@gainsborough.org
Telephone: 01787 372958

Complaints

We take concerns about privacy and the use of personal information seriously.

If you have a concern about how we have handled your personal information, please contact us first using the details above so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights.

Further information about making a complaint can be found on the ICO’s website.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our activities, the way we process personal information or changes in data protection law.

When we make changes, we will update the ’Last updated‘ date at the top of this page.