Privacy notice
Last updated: 9 June 2026
Frank Bowling Group of Commercial and Charitable Entities Privacy Notice
This privacy notice (notice) explains how we, the Frank Bowling Group including the entities listed in the appendix (we, us, our), process your personal data if you use our websites, service, content or feature or otherwise engage with us online or offline.
Our notice covers both commercial and not-for-profit activities, which will apply to the relevant entities depending on their commercial or charitable objectives. The Frank Bowling Foundation is a Charitable Incorporated Organisation registered with the Charity Commission for England and Wales (charity number 1206694). Sir Frank Bowling OBE RA trades as a sole trader in the United Kingdom; his studio team and agents act on his behalf in managing his artistic practice, including commercial enquiries relating to his work. Depending on your engagement with us, one or more group entities may act as data controller; the entity you deal with will be identified when we collect your data or in our correspondence with you.
If you have any question about your data protection rights or if you do not understand anything explained in this notice, please contact us by email at info@frankbowlingfoundation.org (mark your message “Privacy”) or by writing to Privacy, The Frank Bowling Foundation, 5A Peacock Yard, Iliffe Street, London SE17 3LH. For matters relating to Sir Frank Bowling’s commercial practice, you can also contact the studio at info@frankbowling.com.
Who does this privacy notice apply to?
This notice applies to:
- visitors to museums and galleries which display our exhibits, loans or information about us;
- people who enquire about acquiring or borrowing Sir Frank’s work;
- our donors, supporters and funders;
- event participants;
- participants in our education and outreach programmes, workshops, talks and events;
- researchers and others who enquire about the Frank Bowling Archive;
- our partners and suppliers;
- job applicants;
- users of our websites, online content and features;
- anyone else who interacts with us, if you call, email or visit us or otherwise engage with us online or offline.
This notice applies to you if you act in your personal capacity, for example as an enquirer or supporter, and if you act in your professional capacity, for example as an employee or agent of our supplier, a museum, gallery, school or other organisation we work with.
What types of personal data do we process?
“Personal data” means any information that identifies you or relates to you. This may include your contact details, information about your engagement with us, online behavioural data, and other information as set out in the categories of personal data section below. The exact meaning of personal data and the scope of your data rights are determined by the laws of your country.
Data accuracy
We will trust that your personal data is accurate, complete and up to date. We ask that you keep us informed of any changes.
How is your personal data collected?
We may collect your personal data as follows:
- from you, when you contact us, visit our exhibitions or events, complete a form on our websites, make a donation, enquire about acquiring or borrowing works, enquire about the archive, during your engagement with us as a partner or supplier, when you visit our premises or otherwise deal with us;
- from third parties, such as your employer or institution which may provide your professional details, recruitment agencies, your referees, social media platforms and other third parties;
- from your online interactions with our website, services, content and features;
- from the public domain, such as information on social media, the internet or other public records.
If you provide information about others, please ensure you have their consent to do so (where required by law) or let us know if you do not.
Why do we process your personal data?
In this section we explain why we process your personal data. We include general purposes and examples of the various processing activities. For more information about the specific categories of personal data processed, please see the categories of personal data section below. We keep our processes and data collection under review and will update this notice should any personal data no longer be necessary for the given purpose.
The “lawful basis” column explains how we comply with a technical legal justification for data processing under some data protection laws (e.g. the GDPR in the UK and Europe).
Art loans and acquisition enquiries
Our group carries out distinct but related activities in respect of Sir Frank Bowling’s work:
- Charitable loans and access. The Frank Bowling Foundation lends works from its collection to public museums and galleries, supports research into the archive, and provides access for education and scholarship. Processing in connection with these activities is carried out for charitable purposes.
- Commercial art enquiries. Sales of Sir Frank Bowling’s work are handled by the galleries that represent him. Where you contact us (Sir Frank, trading as a sole trader, and those acting on his behalf) about acquiring a work, we will usually respond to your enquiry and refer you to the representing gallery, and we may provide provenance, condition and catalogue information. The gallery handling a sale acts as the data controller for that sale, including any contract, payment, due diligence and shipping; we do not take payment or arrange shipping ourselves.
We process personal data in each case only as necessary for the specific transaction or relationship. If you enquire through a gallery that represents Sir Frank Bowling, that gallery may also process your personal data under its own privacy notice; we may receive information from galleries and advisers involved in a transaction.
| Purpose | Personal data | Lawful basis of processing (EU / UK only) |
|---|---|---|
| To assist with your enquiry. | General information; contact information. | Necessary for our legitimate interest in responding to enquiries and complying with best practice; or, where relevant, taking steps at your request prior to entering into a contract (for example, a loan). |
| To provide information and agree the terms of a loan of artworks to organisations in the museum and gallery sector, or to respond to archive and research requests. | General information; contact information; financial information; public information. | Necessary for taking steps prior to entering into a contract or performing our contractual obligations in relation to loans and access requests, and necessary for our legitimate interests in promoting our activities and administering our business. |
| To respond to enquiries about acquiring Sir Frank’s work, refer you to the representing gallery, and provide provenance, condition and catalogue information. | General information; contact information. | Necessary for our legitimate interests in responding to enquiries, promoting Sir Frank’s work and administering our activities. |
| To receive and administer your donation, including compliance and due-diligence checks and thanking you. | General information; contact information; financial information; public information; your background information. | Necessary for taking steps prior to entering a contract or the performance of our contract with you as our donor, our legitimate interest in fundraising and administering donations, and compliance with our legal obligations. |
| To organise and deliver our education and outreach programmes, exhibitions, fundraisers and other events. | General information; contact information; financial information; public information. | Necessary for contractual performance (for example, in providing access to an event or programme you have requested), necessary for our legitimate interests in promoting our charitable activities and administering our business, and necessary for compliance with our legal obligations such as health and safety laws. |
| To provide our online services including our website, content and features, which may remember your preferences or include personalised content and services. | Technical information; usage information; profile information. | Necessary for our legitimate interest in providing our online services to the public and complying with best practice, and compliance with our legal obligations. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device, except where necessary for essential services. |
| To send you service communications about matters relevant to your use of our services and your engagement with us, and other feedback requests. | General information; contact information. | Necessary for our legitimate interest in understanding how our services are used, views about our services and keeping our users informed. |
| To send you relevant marketing communications including our newsletter, by email, phone and/or text message. | Contact information; general information. | Consent; or, as the case may be, necessary for our legitimate interest in promoting our organisation. |
| To manage our relationships with the galleries, museums, schools and other organisations and supporters we engage with, using our record management systems and engagement tools, identifying opportunities and contacting you by phone, email and other means. | General information; contact information; usage information. | Necessary for our legitimate interest in developing our activities, understanding and maintaining our relationships and administering our organisations. |
| To develop and improve our information, services, content and organisation including measurement of engagement and activity, analytics, development of our tools, services and internal processes. | Anonymised usage, profile and technical information. | Necessary for our legitimate interest in service and process development and keeping our offering relevant. Where required by law, we rely on your consent to deploy cookies or similar technologies on your device, except where necessary for essential services. |
| To ensure the proper administration of our organisations, including to keep appropriate records; resolve complaints; enforce our terms; debt collection; and similar purposes. | All personal data as is necessary and proportionate. | Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims, and necessary for our legitimate interest in the proper administration of our organisations and services and protecting our reputation. |
| To ensure your health and safety at our premises or to make reasonable adjustments on account of your disability. | General information; special categories of personal data. | Necessary for our legitimate interest in ensuring health and safety and good accessibility at our premises in the substantial public interest, and complying with our legal obligations. |
| To engage our third-party service providers and advisers who may process your personal data on our behalf or otherwise to facilitate the provision of our services and the fulfilment of essential service functions including website hosting, cloud storage, telecommunications, information security, professional advice and other services. | All personal data as is necessary and proportionate. | Necessary for our legitimate interest in providing our services and running our organisations. |
| To monitor interactions and operations for the prevention and detection of crime including fraud and share information with law enforcement authorities and other stakeholders. | All personal data as is necessary and proportionate. | Necessary for our legitimate interest in protecting people, our organisations and assets and detecting and preventing crime, and compliance with our legal obligations. |
| Processing and sharing your personal data in connection with legal claims, law enforcement or regulatory requests. | All personal data as is necessary and proportionate. | Necessary for compliance with our legal obligations, to establish, exercise or defend legal claims, or for our legitimate interest in complying with best practice. |
We may process your personal data for other purposes which are compatible with the existing ones. However, we will obtain your prior consent for any new purpose where required by law.
Who is your personal data disclosed to?
We may share your personal data with the following third parties:
- our service providers in the context of the services and advice they provide to us;
- gallery partners and other intermediaries involved in the sale or loan of artwork;
- event organisers, for example for event administration purposes;
- your employer or institution, which may need information about your interactions with us;
- recruitment agents, your former employer or other person providing a reference about you;
- our professional advisers, including our legal advisers and accountants;
- tax, law enforcement and other authorities where required by law or best practice;
- the public if you interact with us on social media;
- third parties where ordered by the court or necessary in establishing, exercising or defending legal claims;
- other third parties where you have provided consent, or as otherwise disclosed at the time of collection.
Digital analytics
We may work with third parties that collect data about your use of our website and other sites or apps over time for non-advertising purposes. Specifically, we may use Google Analytics to improve the performance of the website and for analytics purposes. For more information about how Google Analytics collects and uses data when you use our website, visit www.google.com/policies/privacy/partners, and to opt out of Google Analytics, visit tools.google.com/dlpage/gaoptout.
Additionally, your browser or device may offer tools to limit the use of cookies or to delete cookies; however, if you use these tools, our website may not function as intended.
How do we secure your personal data?
We have put in place appropriate organisational and technical measures designed to safeguard your personal data that we keep on our systems. Access to your personal data is restricted on a “need to know” basis.
We seek to ensure our third-party service providers do the same. We appoint service providers only under an appropriate contract who provide sufficient guarantees about data security in accordance with applicable law.
No system is completely secure and we cannot fully guarantee the security of your personal data. We will deal with any personal data breach in accordance with our incident response procedure and will notify you and the regulator where we are legally required to do so.
How long is your data kept?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
After the retention period, your personal data will either be securely deleted or anonymised, and it may be used for analytical purposes.
Where we store your personal data
Generally, your personal data will be held in the UK and Europe, and may be held in the U.S. through our service providers.
We may also use or make available tools which require the transfer of your personal data outside the UK and Europe. We will only transfer your personal data where we are satisfied that your data protection rights are adequately protected by appropriate technical, organisational and contractual safeguards in accordance with data protection laws before any such transfer. These safeguards may include the standard contractual clauses.
You may request further information on the measures used for international transfers or access to your personal data.
Your choices
If you would like us to stop sending you our newsletter or other marketing communications and to process your personal data for direct marketing purposes, please contact us.
You can request to stop receiving our newsletter or other marketing communications at any time by clicking on the unsubscribe link at the bottom of each marketing message, and we will add you to a suppression list or otherwise arrange that you no longer receive marketing communications.
Your rights
Depending on the data rights granted to you by the laws of your country, you may have the following rights in relation to your personal data:
- right to information about matters set out in this notice (you may also contact us for further details about our data retention policies, international data transfers and other matters that are unclear);
- right to know about personal data collected, used or disclosed, or to make an access request to receive a copy of your personal data held by us;
- right to rectification of any inaccurate or incomplete personal data;
- right to withdraw consent previously provided;
- right to opt out or object to our processing of personal data based on our legitimate interests;
- right to erasure of personal data that is no longer needed;
- restriction on the processing of personal data;
- right to human intervention in respect of any automated decision-making without human involvement that significantly affected you;
- right to data portability from one service provider to another, where applicable;
- right to lodge a complaint with the Information Commissioner’s Office (ICO) if you are in the UK.
To exercise any of your rights please contact us by email at info@frankbowlingfoundation.org (or, for commercial matters, info@frankbowling.com) or by writing to Privacy, The Frank Bowling Foundation, 5A Peacock Yard, Iliffe Street, London SE17 3LH. All requests will be processed without undue delay and no later than within one month. We will first require appropriate proof of your identity. Your data rights are not absolute and they are subject to exemptions and limitations under your country’s laws. If we cannot process your request within this period, we shall explain why and process it as soon as possible thereafter.
We will not discriminate against you for exercising any of your rights, for example by denying you our services, providing lower quality services, or amending our pricing.
Third parties may process your personal data
Our websites, content and features may involve the use of third-party services, social media platforms such as Instagram, or other third-party services.
We may also share your personal data with third parties, such as credit reference agencies, public authorities and others who process your personal data for their own purposes.
You should check the privacy statements of these third parties. We are not responsible for how they may process your personal data. Please note some of them may use your personal data for business administration or product development purposes.
Categories of personal data
We process the following categories of personal data about you:
| Contact information | Including your home or business address, telephone, email and similar information. |
|---|---|
| General information | Including your name, job function, education status, age bracket, details of your enquiry or communication and similar information. |
| Profile information | Including your demographic information from our analytics partners, your preferences and interests known, observed or inferred by using analytics or other tools and sources including notes of your past interactions with us. |
| Public information | From public registers, databases, social media, the internet and similar sources. |
| Special categories of personal data | Including your race, ethnic origin, religious or philosophical beliefs, sexual orientation, political or trade union affiliation and information about your health. |
| Technical information | Including online identifiers, internet protocol (IP) address, details of operating system, browser type, language, time zone setting, location, date and time of access, local storage data and similar information obtained from your device, browser or similar source. |
| Usage information | About how you navigate and engage with our online services and newsletters, features including online activity data such as downloads, clickstream data with URLs visited previously, page interaction such as scrolling, clicks and mouse-overs, methods used to browse away from our website and similar information. |
| Your background information | Including your personal, professional and financial information obtained from you, public sources and third parties such as former employers, colleagues and similar information. |
Updates to this notice
If we make any changes to our notice, you will be able to see them on this page, as indicated by the “Last updated” date at the top. We encourage you to visit this page periodically to learn of any updates.
If any such changes materially affect you, we will ask for your prior consent where we are required to do so by law.
Appendix: list of entities
Sir Frank Bowling OBE RA, sole trader in the United Kingdom
9A Peacock Yard, Iliffe Street, London SE17 3LH
The Frank Bowling Foundation
5A Peacock Yard, Iliffe Street, London SE17 3LH