Privacy Notice
WHO WE ARE
Zaha Hadid Foundation is a registered data controller, ICO registration number ZB455193, and the following privacy notice describes the data we collect, how we use it and how to find out more.
OUR CONTACT DETAILS
Zaha Hadid Foundation
10 Bowling Green Lane,
London, EC1R 0BQ
Email: mail@zhfoundation.com
Phone 020 7250 3000
WHAT DATA WE COLLECT
The Zaha Hadid Foundation collects and manages different categories of data, depending on your interaction with us.
VISITORS TO OUR WEBSITE
See our ‘Cookie Notice’.
VISITORS TO OUR PREMISES
What data do we collect?
Name, contact details, records of your interaction with us as relevant for managing your visit. The Foundation operates a CCTV system on its premises and your images may be captured on this system.
What do we do with the data?
Manage your visit to our premises.
What is the legal reason we use for our use of the data?
We process your data for our legitimate interest in managing access to our buildings and staff. Where the Foundation needs to process any personal data in order to ensure our premises are accessible to you, we will do this as necessary for our obligations for laws covering health and safety or equalities and diversity.
How long do we keep the data for?
We retain records of visitors to our office for 6 months. Our CCTV footage is generally retained for 30 days. If your meeting relates to a wider project, a record of your visit may be managed under another section of this privacy notice (such as ‘Project Collaborators’).
Who do we share it with?
Our data processors.
If there is a reason to share CCTV footage with the police for law enforcement purposes in relation to a specific incident, we will do so in line with data protection legislation.
MAILING LIST SUBSCRIBER
What data do we collect? Name, contact details, records of your interaction with us and any contact
preferences. We will record in some cases information on whether you have opened or read a newsletter.
What do we do with the data? Send you emails to keep you up to date with our latest news, projects and events.
What is the legal reason we use for our use of the data? We ask for your consent to be added to our mailing lists for the purposes of direct marketing.
How long do we keep the data for? We retain your data on our mailing list until you wish to unsubscribe.
Who do we share it with? Our data processors.
ENQUIRERS
What data do we collect? Name, contact details, records of your interaction with us.
What do we do with the data? Manage and respond to your enquiry.
What is the legal reason we use for our use of the data? We process your data for our legitimate interest in managing enquiries to the Foundation.
How long do we keep the data for? We retain your data according to the nature of your enquiry and in line with the fifth data protection principle, ‘storage limitation’.
Who do we share it with? Our data processors.
JOB APPLICANTS
What data do we collect?
If you make an application for a job with us, we will collect contact details and details of your application (CV, references etc.). In the course of the recruitment process we may generate feedback about your application during shortlisting or interview. Where the Foundation needs to process any personal data in order to ensure our recruitment process is accessible to you, we will do this as necessary for our obligations for laws covering health and safety or equalities and diversity.
What do we do with the data?
We use this data to assess your suitability for the role we are recruiting for and manage the recruitment process.
What is the legal reason we use for processing your data?
Where it is necessary for steps taken at your request prior to entering into a contract. For processing criminal convictions data in relation to your employment, the Foundation will rely on the employment conditions set out in the Data Protection Act 2018 the Foundation’s ‘appropriate policy document’.
How long do we keep the data for?
If you are successful, your data will be managed as part of your staff personnel file (please see above). If you are unsuccessful, your application details will be retained for 6 months and then securely deleted.
Who do we share it with?
Our data processors.
PROJECT COLLABORATORS
What data do we collect?
Name, contact details, records of your interaction with us in the delivery of the project.
What do we do with the data?
To manage the delivery of the project.
What is the legal reason we use for our use of the data?
We process your data for our legitimate interest in delivering the project and, where
relevant, where the processing may be necessary for any contract agreed with us.
How long do we keep the data for?
As relevant to the nature of the project.
Who do we share it with?
See “Our data processors” section.
EVENTS ATTENDEES
What data do we collect?
Name, contact details, any access requirements, in some cases a biography if you are speaking or presenting.
What do we do with the data?
Manage the event you are attending.
What is the legal reason we use for our use of the data?
We process your registration details as necessary for the performance of our contract with you as an attendee or participant in our events. If you are speaking or presenting, we may create content in relation to you for the Foundation’s legitimate interests in promoting our activities. Where the Foundation needs to process any personal data in order to ensure our events are accessible to you, we will do this as necessary for our obligations for laws covering health and safety or equalities and diversity.
How long do we keep the data for?
Events data is retained for x months after the event is concluded. Accessibility requirements are retained for 3 years.
Who do we share it with?
We may share an attendee list with other attendees or partners in the delivery of the event or activity where required, such as a freelance trainer or the venue hosts.
Our data processors.
COLLECTIONS DEPOSIT / SUBMISSION ENQUIRIES
What data do we collect?
Name, contact details and any information relevant to the deposit you are making.
What do we do with the data?
Manage the deposit to the archive, including appraisal, cataloguing and access.
What is the legal reason we use for our use of the data?
We process your details as necessary for the performance of our contract with you as depositor to our archive. If the deposit has a suitable level of public interest, we may create content in relation to you for the Foundation’s legitimate interests in promoting our activities.
How long do we keep the data for?
Records related to our archival deposits will be kept permanently. Any correspondence data or contact details not required for archival purposes will be deleted 6 years following the date of formal deposit.
Who do we share it with?
We may share an attendee list with other attendees or partners in the delivery of the event or activity where required, such as a freelance trainer or the venue hosts.
Our data processors.
COMPLAINANTS
What data do we collect?
Name, contact details, records of your complaint with us.
What do we do with the data?
To manage and respond to your complaint.
What is the legal reason we use for our use of the data?
We process your data for our legitimate interest in managing complaints to the Foundation or, where relevant, any legal obligation in regard to your complaint. If the Foundation needs to process any special category data in order to manage your complaint, we will do this as necessary for our obligations for laws covering health and safety or equalities and diversity.
How long do we keep the data for?
We retain your data on our mailing list until you wish to unsubscribe.
Who do we share it with?
Our data processors.
SOCIAL MEDIA INTERACTIONS
What data do we collect?
Your comments on our posts or accounts and your social media handle if you mention us.
What do we do with the data?
We may share your comment or post in line with the conventions of the social media platform (e.g., a retweet or a share to our Instagram followers). We may collect the data in order to manage our communications strategy to particular event or issue.
What is the legal reason we use for our use of the data?
We process your data for our legitimate interest in managing our social media platform. We do not solicit any special category data via our social media platforms. If you choose to provide or post special category data in our comments or mentions, the Foundation will consider that this data has been made public by yourself as the data subject.
How long do we keep the data for?
We retain your data according to the nature of your enquiry and in line with the fifth data protection principle, ‘storage limitation’.
Who do we share it with?
YOUR RIGHTS AS A DATA SUBJECT
As someone who we process data about (“a data subject”), you have a number of rights in regard to your data.
Right of access (or “Subject Access Request,” “SAR” or “DSAR”): You have the right to receive a copy of your personal information that we hold about you and information about how we use it.
Right to rectification: You have the right to ask us to correct your personal information where it is incorrect or incomplete.
Right to erasure (or “right to be forgotten”): You have the right to ask that your personal information be deleted in certain circumstances, such as where consent has been withdrawn, where it is no longer necessary to keep it or where it legally needs to be deleted.
Right to restrict the use of personal information: You have the right to request that we suspend our use of your personal information in certain circumstances.
Right to data portability: You have the right to obtain some of your personal data in a structured, commonly used, and machine-readable format and for it to be transferred to another organisation, where this is technically feasible. The right only applies to data provided to us by you or obtained in monitoring and where that data is processed under the legal bases of consent and contract.
Right to object to the use of personal information (including to object to direct
marketing, automated decision making and profiling): You have the right to object to the use of your personal information in certain circumstances and subject to certain exemptions.
Right to withdraw consent: You have the right to withdraw your consent at any time where we rely on consent to use your personal information.
DEALING WITH YOUR RIGHTS REQUEST
If you wish to exercise these rights, please contact us at comms@zhfoundation.com. We will respond to your request as soon as possible and within one month.
We may need to request specific information from you to confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
KEEPING YOUR DATA SECURE
We have robust processes, procedures, contracts and agreements in place to ensure secure collection, storage and processing of personal data. Only authorised employees, consultants and third-party data processors (e.g. those who process data on our behalf) have access to personal data we hold. All our suppliers and contractors meet the standards we require. Training is undertaken and checks are made to ensure data quality is maintained.
Personal data is stored securely on our network and within third party systems whose tools we use to process data.
Your information is generally held within in the UK. If we transfer data outside of the UK, or where our suppliers (data processors) host data outside of the UK we will ensure that there are adequate protections in place in line with the requirements of UK GDPR and the Data Protection Act 2018.
OUR DATA PROCESSORS
The Foundation uses the following data processors for the provision of its services. These processors only manage the data according to our instructions and are bound by contract.
Data may also be shared with us by our third-party partners and in collaborating with other parties such as for specific training courses or event. Any data sharing will be secure and have an appropriate legal basis.
AGGREGATED STATISTICS AND REPORTING
In many of the following categories, the Foundation may aggregate personal data in order to monitor its business outcomes and inform decision making.
We process this data for our legitimate interest in recording and analysing how the Foundation is meeting its objectives.
Data used in these reports will not identify individuals or lead to specific decisions or interventions in regard to those included in the statistics.
CHANGES TO OUR PRIVACY POLICY
If you would like to find out more about how we process data, or if you wish to make a complaint, please contact us at comms@zhfoundation.com.
If we are unable to resolve your complaint, you also have the right to complain to the Information Commissioner’s Office if you feel that your data had been processed in a way that is not compliant with this policy or in line with the UK GDPR and the Data Protection Act 2018. You can contact the ICO by visiting their website, http://www.ico.org.uk or by calling 0303 123 1113.
NOTIFICATION OF CHANGES
We keep this Policy under regular review and will update this page. You should check this page from time to time to ensure that you are aware of any changes.
This privacy policy was last updated on 15 April 2025.