Purchases

When you make a purchase at the ticket desk, café, shop, or online shop, we process personal data necessary to complete the transaction. The legal basis is the performance of a contract.

The personal data we process includes:

name
contact details
delivery information
payment details
order data

For purchases linked to a user account (membership account/online shop), we retain data for up to three years after the account is closed.

For ticket sales, we also process your preferred visit time to manage visitor numbers. The legal basis is our legitimate interests in operating safely and efficiently.

We are legally obliged to further process sales data to comply with accounting legislation. Data is deleted in accordance with statutory requirements once the retention obligation ceases.

Membership

When you become a member of MUNCH, we process personal data to administer your membership and send you relevant communications.

The data includes:

name
contact details
membership profile (e.g. year of birth and stated interests)
administrative membership data

For under-25 memberships, we also process date of birth to verify eligibility.

The legal basis is the membership contract.
Data is retained for up to one year after the membership ends.

Events

MUNCH organises various events, including previews, guided tours, concerts, talks, workshops and family activities.

We process personal data to:

inform relevant audiences about events
manage participation

The data includes:

name
contact details
participation details

For children’s activities, we may also process age information to ensure suitability.

The legal basis is our legitimate interests in promoting and administering events.

For certain activities (e.g. competitions), separate consent is required.

Data is stored for three years after the last participation.

Special categories of data

For some events, we may process sensitive personal data (e.g. food allergies or health conditions) to make necessary adjustments.
The legal basis is explicit consent.

Invitations

We may process personal data to send invitations to individuals such as journalists, artists, public figures, and business representatives.

The data includes:

name
contact details
employer
role

The legal basis is consent and/or legitimate interests in inviting relevant individuals.

Data is retained for up to three years after last contact.

Enquiries

We process enquiries from the public, including:

general questions
feedback
survey responses
artwork enquiries

The data processed is what the individual provides.

The legal basis is:

legitimate interests, or
consent, depending on the nature of the enquiry

Retention:

up to three years after last contact (legitimate interests)
as specified when consent is obtained

Group Visits and School Visits

For group and school visits, we process personal data to plan and manage visits.

The data includes:

contact person’s name and details
other information provided in correspondence

The legal basis is the contract.

Retention period: up to three years after the visit.

Special categories of data

Where necessary (e.g. allergies or health conditions), we process sensitive data to facilitate participation.
The legal basis is explicit consent.

Venue Hire

When hiring out our premises, we process personal data to communicate with current and prospective hirers and to administer rental arrangements.

The data includes:

name
contact details
information provided in correspondence

The legal basis is our legitimate interests.

Retention period: up to three years after the rental ends.

Newsletter and Marketing

We primarily market our services through newsletters and advertising.

Newsletters

We process:

name
contact details
age group
interest profile

The legal basis is consent.

You may withdraw consent at any time by unsubscribing via the link in the email.

Retention period: up to 36 months after unsubscribing.

Advertising

We process data about interactions with adverts to measure effectiveness.

The data includes:

digital identifiers (e.g. advertising ID)
interaction data (timing and engagement)

The legal basis is our legitimate interests.

Retention period: up to three years after last interaction.

Website Use

When you visit our website, we process data using cookies to:

ensure functionality
improve the website
compile statistics

The data includes:

digital identifiers (e.g. IP address, consent ID)
browser type and operating system
session data (pages visited, clicks, duration)

Processing is based on:

legitimate interests (necessary cookies)
consent (other cookies)

Consent can be withdrawn via the icon in the browser window.

Retention period: up to three years after last interaction.

CCTV

MUNCH uses CCTV to ensure the safety of individuals, artworks, and property.

The legal basis is our legitimate interests.

Recordings are deleted on an ongoing basis in accordance with applicable law.

Privacy Notice

Data Controller

Data Protection Officer

Copyright: