Wellcome privacy statement

Information on how we collect, store and use personal information in connection with grant-making is set out in our Wellcome Grants Privacy Statement. Information on how we collect, store and use Wellcome staff personal information is set out in our Staff Privacy Statement, available to staff on our intranet.

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information where we have your consent, where we need to perform the contract we have entered into with you, where we need to comply with a legal obligation or where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests. Where our collections in Wellcome Collection contain personal information, we collect and use this information for archiving purposes in the public interest.

It is important that you read this Statement, together with any other privacy statement we provide on specific occasions when we are collecting or using personal information about you, so that you are aware of how and why we are using your information. We will make changes to this Statement where required, so please check from time to time for any updates. For ease of reference, we have organised this Statement into the following sections:

In this Privacy Policy, “Wellcome”, “we”, or “our” means

• The Wellcome Trust Limited, who are a charitable company registered in England and Wales (company number 2711000) (as trustee of the Wellcome Trust (a registered charity with number 210183)).
• Its group companies:
  • Wellcome Trust Trading Limited, who are a company incorporated in England and Wales (company number 03227027), and is a trading subsidiary of the Wellcome Trust.
  • Wellcome Trust Residential 1 Limited (company number 06262798) and Wellcome Trust GP Limited (company number 05867101) which hold residential properties on behalf of the Wellcome Trust

Wellcome is the “data controller” of your personal information. This means that we are responsible for deciding how we hold and use personal information about you.

Your personal data, or personal information, is any information about you from which you can be identified directly or indirectly. This may be information you give to us or that we collect from you when you visit Wellcome Collection, Wellcome’s offices, one of our websites or when you contact us. We also look at how you and other visitors use our websites, to ensure that we can give the best experience possible; whether you’re looking for more information on one of our exhibitions or interested in hearing about our funding activities. We also receive personal information from third parties who sell, donate or lend material to our collections within Wellcome Collection (see Lending, selling or donating items to Wellcome Collection and making exhibition loan requests).

The main reasons we collect your information are to carry out and perform our contract with you, comply with legal obligations and in some cases, we use your personal information to pursue legitimate interests of our own or those of third parties (provided your interests and fundamental rights do not override those interests). The information we collect is, and will, only be used for one of the purposes outlined in this Statement and where we have a valid legal basis for doing so.

The technical information we collect when you visit our websites is used for site administration and internal operations (i.e. troubleshooting, data analysis, testing, research, statistical and survey purposes). This enables us to improve our websites to ensure that content is presented in the most effective manner for you and for your device, to allow you to participate in interactive features of our services when you choose to do so, and as part of our efforts to keep our sites safe and secure.

(a) I’m a visitor to Wellcome’s Website

You may choose to give us certain information through our websites when:

• setting up an online account with us;
• registering for or enquiring about our activities, events and services;
• registering to enter a Wellcome online competition and when (subsequently) submitting an entry;
• subscribing to our publications, newsletters and updates;
• participating in website testing and research activities;
• filling in surveys on our websites;
• participating in our online discussion groups;
• contacting us about booking an event space at Wellcome Collection; or
• contacting us for another purpose through our websites. 

The information may include:

• title, forename and last name;
• contact phone number(s);
• email address(es);
• information about any access needs you might have (that you tell us about when you book to attend a ticketed event at Wellcome Collection). Read HHow we use particularly sensitive information for further information on how we handle and use this information;
• when you participate in website testing and research activities, we will collect your name, access needs, age, location, your areas of interest and description of your status (i.e. student). Read How we use particularly sensitive information for further information on how we handle and use information about access needs;
• when you participate in an online Wellcome competition, we will typically also collect details of your location and job description.

Additionally, certain technical information relating to you and your device are collected automatically when you use one of our websites, such as your:

• Internet log information: We use third-party services to collect certain technical information from your device including standard internet log information such as Internet Protocol (IP) address, browser type and version, and page interaction information; and
• Cookies: We use essential cookies to make our websites work. If you agree, we also use analytics cookies. We use analytics cookies to give you the best possible experience on our website, analyse how people use our websites and make improvements. We work with digital partners using marketing cookies to measure how you are interacting with our marketing and advertising materials. For more information about cookies on our websites, please see our Cookies statement.

We collect this information from you:

• to register you for activities, events or services you have registered for;
• to send you publications, newsletters and updates you have opted in to receive;
• to respond to queries raised through our websites;
• to administer any online accounts you have with us;
• to administer any online competitions you have entered, including to process entries, judge submissions, award prizes and publicise winning submissions.
• in the case of technical information collected when you use our sites, for site administration and internal operations (i.e. troubleshooting, data analysis, testing, research, statistical and survey purposes). This enables us to improve our sites to ensure content is presented in the most effective manner for you and your device, and that our sites are safe and secure; and
• to conduct surveys and website testing activities and process your response to any survey or website testing you participate in for research, evaluation and statistical purposes, and contact you to follow up on surveys and website testing completed on our websites..

We use this information on the legal basis that:

• Most commonly we use information we collect about you through our websites in pursuit of our legitimate interest of engaging and informing the public about Wellcome and its charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.
• Where you opt-in to subscribe to publications, newsletters and updates, or agree to cookies being set, your consent is the legal basis for our use of your information. You have the right to withdraw your consent at any time by using the ‘unsubscribe’ option in the emailed publications sent to you. You can change your cookie preferences at any time clicking the 'Manage cookies' link in the footer. You can then adjust the toggles to ‘on’ or ‘off’ and save. You may need to refresh your page for your settings to take effect. We will ask you to revisit your preferences if you haven’t visited our websites in over six months, so that we can check that they are accurate.
• Where you register for activities, events or services, we use your information to provide those activities, events or services to you.

We share your information with third parties where you have submitted an entry to a Wellcome online competition and where independent judges require access to information, such as your age and professional status, for the purpose of selecting prize winners. We also share information such as your age, location and professional status with the public when publishing details of prize winners and their winning submissions.

Read How we share your information for further details on how your information is shared.

(b) I’m applying for a Wellcome grant, acting as a participant, external reviewer or adviser

You may choose to give us certain information about you in connection with Wellcome’s grant-making activities (i.e. as a grant applicant, holder, participant, external adviser or reviewer). Information on the personal information we collect in connection with the grant making process, how we use this and our legal basis for doing so can be found in our Wellcome Grants Privacy Statement.

(c) I’m applying for a Wellcome job or contract opportunity

You may provide the following information to us when you apply for a job at Wellcome, either directly via one of our application systems or through a recruitment agency or background check provider:

• forename, middle name and last name;
• email address;
• contact phone number;
• home address;
• CV and other application information including your work experience, education history, volunteering experience, interests and the results of any psychometric or technical testing you undertake with Wellcome;
• information about your right to work in the UK;
• salary expectations (not relevant to Graduate Scheme or Internship Programme applications);
• current notice period and planned periods of leave (not relevant to Graduate Scheme or Internship Programme applications);
• information about criminal convictions and offences. Read Sensitive information collected relating to criminal convictions below for further information on how we handle and use this information;
• information about your health or disability status. Read How we use particularly sensitive information for further information on how we handle and use this information.

We will sometimes collect additional information from third parties including former employers and publicly available sources.

Where you are applying for a contract opportunity as a sole trader, we may also conduct due diligence checks, including financial stability, that you are not subject to international sanctions, and to evaluate risks associated with modern slavery and human trafficking.  

We collect this information in order to:

• set up and administer your account on our application system (where you apply directly to Wellcome via one of our application systems);
• consider your application for a Wellcome job;
• check you are legally entitled to work in the UK
• check your suitability for roles when working with others, including children and vulnerable adults

Where necessary we share your information with third parties that we work with when we recruit for Wellcome jobs i.e. recruitment agencies, background check providers. Your information will also be shared with the third parties that provide our application systems. Read How we share your informationn for further details on how your information is shared.

We use this information on the legal basis that we are taking steps at your request (considering the information in your application) to enter into an employment contract, or contract as a sole trader with you, and on the basis that it is necessary to pursue our legitimate interest of assessing your suitability to work for Wellcome in the role you have applied for. We use information about your right to work in the UK to meet our legal obligation of making sure our staff are legally entitled to work in the UK.

We use information about your health or disability status so that we can meet our legal obligations by providing reasonable adjustments to our recruitment process.

With your consent, you may choose to provide the following optional diversity monitoring information to us (when you apply for a Wellcome job:

• the age bracket you are in;
• whether you identify as disabled;
• your gender identity;
• your ethnicity or background;
• your religion or strongly held belief;
• whether your parents attended university (if you are applying for our Graduate Scheme or Internship Programme);
• if you were entitled to free school meals (if you are applying for our Graduate Scheme or Internship Programme).

This information is only used by Wellcome for equal opportunities monitoring and reporting purposes, both internally and externally.

If you are successful in your application, and become an employee, this data will be transferred to our employee systems.

(d) I’m visiting Wellcome Collection and the Wellcome Shop

We collect the following information about you when you visit Wellcome Collection:

• when making a purchase in the Wellcome Shop using your payment card: your payment card details. When returning an item to the Wellcome Shop: [your name, address, payment card details and reason for return];
• when booking a ticket to visit Wellcome Collection: title, forename and last name, phone number, email address of the lead booker; and access needs of the lead booker or anyone in their group. Read How we use particularly sensitive information for further information on how we handle and use information about access needs;
• when registering to use the library at Wellcome Collection (including the loan of laptops): title, forename and last name, home address, phone number, email address, your areas of interest and description of your status (i.e. undergraduate student);
• when you enter the library at Wellcome Collection by scanning your library card, the system records the point at which you enter;
• when you apply for access to restricted material held in our collections: reader membership number, forename and last name, email address, the full reference for each file that you have requested to access;
• when you opt-in to receive further information from us (i.e. publications, newsletters and updates);
• when you complete a survey in person or following a ticketed event or library visit, the following information is collected from you on an anonymous basis: name, email, ethnicity, gender, disability, age, location;
• when your photograph is taken or you are filmed at a Wellcome Collection event;
• in the event you receive first aid from us whilst in our premises, the following information: your full name, occupation or status (i.e. visitor or member of public), injury details, contact details (phone number, email or contact address), location and description of accident or incident.

We collect this information from you to:

• comply with our contractual obligations (i.e. to process card payments when you use a payment card to make a purchase in the Wellcome Shop, or to process the return of an item when you return a purchase to the Shop);
• provide you with access to a Wellcome Collection service (e.g. membership to the library at Wellcome Collection, or access to restricted material where such access is granted);
• contact you by email to remind you about a Wellcome Collection event you have booked to attend or discuss particular access needs you have specified at the time of registering for an event;
• provide you with access to a Wellcome Collection event you have registered to attend;
• send you a feedback survey about a Wellcome Collection event you have attended;
• analyse and report on Wellcome Collection visitor surveys;
• with your consent, add you to our mailing list and send you email communications you have opted-in to receive (i.e. publications, newsletters and updates);
• showcase and promote Wellcome Collection events through photographs or film taken i.e. on our websites;
• monitor your use of our IT and communication systems to ensure compliance with our IT policies (most commonly in the library at Wellcome Collection);
• comply with our legal health and safety obligations (i.e. in connection with first aid and reporting certain health and safety incidents);

We use this information on the legal basis that: 

• To pursue our legitimate interest of engaging the public through Wellcome Collection’s library, exhibition space and programme of activities and events. In connection with this, we evaluate Wellcome Collection events by obtaining visitor feedback in order to make improvements where we need to.
• Where you opt-in to subscribe to publications, newsletters and updates, your consent is the legal basis for our use of your information. You have the right to withdraw your consent at any time by using the ‘unsubscribe’ option in the emailed publications sent to you.
• Where you register for activities, events or services, we use your information to provide those activities, events or services to you.
  For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

Use of CCTV and body-worn cameras

We may collect the following when you visit Wellcome Collection:

• CCTV footage collected in public areas of our premises (inside and out);
• CCTV footage at entry and exit points of our buildings
• Body worn camera (BWC) footage (audio and video) may be collected at the entrance and exits of our buildings in the instances of incidents that may be potentially confrontational or criminal. Body worn cameras are not in constant use, and are only activated in response to an incident where visitors, staff or property are at an increased risk. Staff using these cameras will be clearly identifiable, and a verbal warning will always given before cameras are activated

We collect this information from you to assist with the detection and prevention of crime, ensure public and staff safety and enforce parking regulations on our premises.

We may share images or audio images with the police or other agencies if they are required to investigate a crime or other serious incidents.

We retain images recorded by fixed CCTV cameras and body worn cameras for 30 days before deleting them deleted. Images relating to incidents will be kept longer, according to requirements and to support any ongoing investigations.

We use this information on the legal basis that it is necessary to pursue our legitimate interest of ensuring the security of our premises, and where necessary preventing and detecting crime. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

(e) I’m lending, selling or donating items to Wellcome Collection 

You provide the following information to us when you lend, sell or donate items to our collections within Wellcome Collection, or make an exhibition loan request:

• name and (where applicable) organisation name;
• contact phone number;
• email address;
• address;
• details of items loaned/donated.

We collect this information from you to administer the agreement between us and meeting our obligations under that agreement.

We use this information on the legal basis that we are taking steps at your request to enter into an agreement with you. 

(f) I’m visiting Wellcome’s Offices

We collect the following information about you when you visit our offices:

• to provide you with access to our premises: title, forename and last name, organisation name;
• the following information: your full name, occupation or status (i.e. visitor or member of public), injury details, contact details (phone number, email or contact address), location and description of accident or incident.

We collect this information from you to:

• issue you with a security pass and provide you with access to our office premises (i.e. where you are attending a meeting or event at our offices);
• comply with our legal health and safety obligations (i.e. in connection with first aid and reporting certain health and safety incidents).

We use this information on the legal basis that it is necessary to pursue our legitimate interest of ensuring the security of our premises, and where necessary preventing and detecting crime. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

Use of CCTV and body worn cameras

We may collect the following when you visit our premises:

• CCTV footage collected in public areas of our premises (inside and out);
• CCTV footage at entry and exit points of our buildings
• Body worn camera (BWC) footage (audio and video) may be collected at the entrance and exits of our buildings in the instances of incidents that may be potentially confrontational or criminal. Body worn cameras are not in constant use, and are only activated in response to an incident where visitors, staff or property are at an increased risk. Staff using these cameras will be clearly identifiable, and a verbal warning will always given before cameras are activated

We collect this information from you to assist with the detection and prevention of crime, ensure public and staff safety and enforce parking regulations on our premises.

We may share images or audio images with the police or other agencies if they are required to investigate a crime or other serious incidents.

We retain images recorded by fixed CCTV cameras and body worn cameras for 30 days before deleting them deleted. Images relating to incidents will be kept longer, according to requirements and to support any ongoing investigations.

We use this information on the legal basis that it is necessary to pursue our legitimate interest of ensuring the security of our premises, and where necessary preventing and detecting crime. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

(g) I’m working at Wellcome’s premises (non-Wellcome staff)

We collect the following information about you when you work at our premises:

• to provide you with access to our premises: title, forename and last name, organisation name;
• Security pass information showing where and when you access different areas in our buildings;
• if you access our intranet (Trustnet) and IT systems: your name, email address, phone number and information about your organisation and role to grant you access, as well as the information you place in those systems;
• in the event you receive first aid from us whilst at our offices, the following information: your full name, occupation or status (i.e. visitor or member of public), injury details, contact details (phone number, email or contact address), location and description of accident or incident;
• information about any access needs you might have (that you tell us about in the context of your collaboration with Wellcome Collection). Read How we use particularly sensitive information for further information on how we handle and use this information;
• information relating to any concern you raise about suspected wrongdoing at Wellcome via one of our Speak Up channels. Read Sensitive information collected through our Speak Up channels for further information on how we handle and use this information;

We collect this information from you to:

• issue you with a security pass and provide you with access to our office premises (i.e. where you are attending a meeting or event at our offices);
• provide you with access to our intranet and IT systems, as appropriate;
• comply with our legal health and safety obligations (i.e. in connection with first aid and reporting certain health and safety incidents to help ensure the health and safety of those working in Wellcome’s offices);
• discuss particular access needs you have specified in the context of your collaboration with Wellcome Collection, and provide related support to you;
• investigate and deal with concerns about suspected wrongdoing at Wellcome for safeguarding and serious incident reporting purposes, as required by our regulator the Charity Commission; and
• comply with legal or regulatory obligations, including checking you are legally entitled to work in the UK, fraud and corruption prevention and searching, locating and reviewing information held in Wellcome systems, applications and records and other systems and applications used for Wellcome purposes, in order to respond to data subject requests in accordance with data protection law and other legal disclosure requests.

We use this information on the legal basis that it is necessary to pursue our legitimate interests of ensuring the security and safety of our premises and ensuring that concerns about suspected wrongdoing at Wellcome are reported and investigated fairly and appropriately, and in some cases on the legal basis that it is necessary to comply with our legal and regulatory obligations. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

(h) I’ve been invited to, or are attending a conference, meeting or forums organised by Wellcome

We may collect the following information from you when you register or apply to attend, conferences, meetings and forums (and associated travel, as applicable) organised by Wellcome.

• name and (where applicable) organisation name;
• contact phone number;
• email address;
• address;
• photo and biography (for use in the event booklet, as applicable);
• dietary requirements;
• information about any access needs you might have. Read How we use particularly sensitive information for further information on how we handle and use this information;
• for visa applications: date of birth, nationality, passport name;
• for booking your travel to the event: passport name and number and gender. 

We may also receive this information from companies that organise events in Wellcome Collection and from our third-party ticketing provider.

We also collect information about you from public domain sources (i.e. websites, social media sites) including your name and work email address in order to invite you to Wellcome events.

We will only use your information for the purpose of inviting you to Wellcome events. You will have the option to unsubscribe from hearing from us in every email we send to you. We use your information for this purpose in pursuit of our legitimate interest of engaging and informing the public about Wellcome and its charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

We collect this information from you to:

• register you for the event you have applied to attend and where applicable, organise any travel and visa applications associated with the event;
• where we are organising your travel and you are travelling on Wellcome business, notifying our travel security service provider of your travel details so that we can track you whilst
• travelling and alert you of any security issues, so we can meet our health and safety obligations; and where you opt-in to receiving further information, sending you updates you have opted in to receive.

We share your information for this purpose with various third parties we work with in connection with the events we organise. These include:

• the provider of our web-based event registration system to send out and administer event invites and registration forms;
• provide you with access to our premises;
• contact you in relation to your booking of one of our events;
• administer a contract that we have entered into with you;
• where you have opted-in to hearing from us, send email updates about our latest exhibitions, research or other news; and
• where you have opted in to hearing from us about evaluation of an event, to contact you about this.
• our travel management company (where Wellcome is also funding the travel associated with an event) to make travel arrangements, including sharing your details (name, date of birth, passport information, seating/meal preferences, mobility/accessibility information) with hotels and transportation companies. Read How we use particularly sensitive information for further information on how we handle and use mobility/accessibility information;
• the event venue, for the purpose of them administering the event; and
• our travel security partner, for the purpose of sending you relevant travel alerts whilst travelling to/from a Wellcome event.

Read How we share your information for further details on how your information is shared.

We use this information on the legal basis that:

• We organise events in pursuit of our legitimate interest of enabling the exchange and sharing of expertise in fields related to health research. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team
• We may also need this information to fulfil our contractual obligations to you, or on the basis that is necessary to pursue our legitimate interest of contacting you regarding an event you have booked.
• We evaluate Wellcome Collection events by obtaining visitor feedback in order to make improvements where we need to in pursuit of our legitimate interest of engaging with and informing the public about Wellcome and its charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.
• If you have opted-in to hearing from us, your consent is the legal basis for our use of your information. You have the right to withdraw your consent at any time by using the ‘unsubscribe’ option in the emailed publications sent to you.

We receive your title, forename, surname, email address and any access needs you mention when booking, from companies that organise events in Wellcome Collection and from our third-party ticketing provider. 

We use this information to:

• provide you with access to our premises;
• contact you in relation to your booking of one of our events;
• administer a contract that we have entered into with you;
• where you have opted-in to hearing from us, send email updates about our latest exhibitions, research or other news; and
• where you have opted in to hearing from us about evaluation of an event, to contact you about this.

We use this information on the legal basis of fulfilling our contractual obligations to you, or on the basis that is necessary to pursue our legitimate interest of contacting you regarding an event you have booked. We evaluate Wellcome Collection events by obtaining visitor feedback in order to make improvements where we need to in pursuit of our legitimate interest of engaging with and informing the public about Wellcome and its charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

If you have opted-in to hearing from us, your consent is the legal basis for our use of your information. You have the right to withdraw your consent at any time by using the ‘unsubscribe’ option in the emailed publications sent to you.

(i) I’m contacting Wellcome over the phone, by email or social media

We may collect the following information from you when you Wellcome over the phone, by email or by social media, such as your:

• title, forename and last name;
• job title and company or institution name;
• contact phone number(s);
• contact email address(es). 

We collect this information from you to:

• to provide you with access to the Wellcome colleague or service you are contacting us about;
• to handle your query or otherwise engage with you;
• for business contacts only, to contact you about similar matters or opportunities in the future and to develop our business relationship with you.

We use this information on the legal basis that it is necessary to pursue our legitimate interest of answering your queries and engaging with you. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

(j) I’m engaging with Wellcome as part of the research community

We may collect the following information from you when you engage with Welcome as part of the research community (including through surveys, workshops and interviews), either directly with us or through a third-party provider:

• name and (where applicable) organisation name;
• contact phone number;
• email address;
• address or location;
• IP address;
• time and date of completing the survey (if applicable);
• information that you share whilst taking part in Wellcome research, including your responses, experiences, views, opinions and/or other content;
• audio, video and/or photo footage of you that is taken during the research, but only if you agree to this footage being recorded.

We will give you more detailed information about the specific engagement that you will be taking part in, including how your information will be used, shared and kept safe. 

We collect this information from you to:

• make any necessary arrangements with you for the engagement activity (for example, to arrange a time and date for an interview or workshop);
• further the aims and objectives of the engagement activity that you are taking part in, as will be explained in further detail when you take part;
• where possible, anonymise or pseudonymise some or all of the information that you provide as part of the research, where applicable;
• include information and insights from the engagement activity in reports, analysis, publications and other media;
• invite you to take part in further research.

We use this information on the legal basis that: (i) it is necessary to pursue our legitimate interest of furthering the aims and objectives of the Wellcome’s research and public engagement activities; or that (ii) we have your consent to do so.

For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

Separately, we may also commission research that is carried out for Wellcome by third party organisations. If you are involved in a Wellcome-commissioned research project, we and/or the relevant third party will provide further privacy information to you at the time of the project.

With your consent, you may choose to provide the following optional diversity monitoring information to us (on an anonymous basis) when you engage with Welcome as part of the research community (including through surveys, workshops and interviews):

• the age bracket you are in;
• whether you identify as disabled;
• your gender identity;
• your ethnicity or background;
• your religion or strongly held belief;
• whether your parents attended university;
• if you were entitled to free school meals.

Your name is not associated with this information and it is not linked to your engagement with Wellcome. It is only used by Wellcome for equal opportunities monitoring and reporting purposes, both internally and externally.

(k) I’ve asked to hear more about Wellcome and/or Wellcome Collection 

Our email marketing providers will automatically collect information about you when you access Wellcome newsletters and updates emailed by our third-party providers on our behalf. The information they collect on our behalf will include your usage information, IP address, access times, browser type and language, device type, device identifiers, and Wi-Fi information.

We use this information to record whether you have read the email you have been sent and to understand how you have interacted with the email so that we can measure its effectiveness.

We use this information on the legal basis that it is necessary for us to understand how you interact with Wellcome newsletters so we can make improvements where we need to in pursuit of our legitimate interest of engaging with and informing the public about Wellcome and its charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

(l) I’m engaging with Wellcome on its properties and developments

We may collect the following information from you when you choose to register for updates about our activities, proposals and events related to Wellcome properties and developments;

• participate in online discussion groups, meetings and forums related to Wellcome properties and developments;
• respond or object to applications and proposals related to Wellcome properties and developments;
• report issues and complaints, insurance claims and/or health and safety incidents in relation to Wellcome properties; and
• contact us directly (or via our communications consultants) about matters related to Wellcome properties and developments through our websites, by email, telephone or post (read Contacting Wellcome over the phone, by email or social media).

We may also source information from third parties, in particular, public sources such as local government planning portals.

The information may include:

• title, forename and last name;
• contact phone number(s);
• email address(es);
• your property address;
• additional information in relation to nature of a complaint;
• health or medical information in relation to health and safety issues;
• other information when you complete a website form, such as information about your support for a proposal; and
• other information that you may choose to provide to us, such as when you raise a concern or make an objection.

Additionally, certain technical information relating to you and your device are collected automatically when you use oneof our websites. Where the website is operated by a third party on our behalf, you should also refer to their cookies notice and privacy notice.

We collect this information on you to further understand and engage on changes to Wellcome’s properties or land holdings. 

We use this information on the legal basis that:

• When you participate in our online discussion groups, meetings and forums, or respond or object to our applications and proposals, we use the information for purposes related to Wellcome properties and developments and generally in pursuit of our legitimate interests of informing and progressing our applications and proposals, effectively managing neighbours’ concerns and allowing local residents, businesses and key stakeholders to participate with Wellcome on this as recommended by the National Planning Policy Framework, and of protecting our legal and commercial interests, including for insurance purposes.
• We may also use information we collect about you in pursuit of our legitimate interest of engaging and informing the public about Wellcome and its charitable aims. In relation to health and safety issues, we process your data in order to comply with our legal health and safety obligations. For further information on how we balance our legitimate interests with your rights as an individual, please contact our Data Protection Team.
• Where you opt-in to subscribe to updates, your consent is the legal basis for our use of your information. You have the right to withdraw your consent at any time by using the ‘unsubscribe’ option in the email sent to you
• We may sometimes also process your personal data in connection with Wellcome properties and developments where we have a legal obligation to do so, such as under laws relating to property, planning and insurance.

We may share your information with third parties, in particular:

• local government and planning authorities for the purpose of managing our applications and proposals;
• our legal advisors and other professionals such as consultants, auditors and accountants, for the purpose of obtaining specialist advice and support;
• our insurers for the purpose of obtaining insurance relevant to our developments and proposed developments; and
• service providers, such as management companies, communications consultants and marketing services companies, that support us in relation to Wellcome properties and developments
• if we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets; 

Read How we share your information for further details on how your information is shared.

We will take steps to protect your data, such as requiring third parties to give contractual commitments to protect your data and using measures such as anonymisation and pseudonymisation where appropriate. For example, Wellcome and our consultants will review feedback that you provide, and we will submit an anonymised summary using aggregated data to the local council as part of a planning application.

(m) I have dealings with Wellcome properties and developments,

We may collect the following information from you when you are

• involved in the sale, purchase or letting in relation to any Wellcome property;
• involved in any lease extension or leasehold enfranchisement in relation to any Wellcome property;
• involved in any lease assignments or property licences (whether by way of occupation or consent) in relation to any Wellcome property;
• in communication on arrears and/or insurance claims/issues in relation to any Wellcome property; and
• involved in any rent review in relation to any Wellcome property;

We may also source information from third parties such as property agents and conveyancers in relation to the above, including references, mortgage details and dealings with insurance companies.
The information may include:
•    title, forename and last name;
•    contact phone number(s);
•    email address(es);
•    your property address; and
•    financial information.

We collect this information on you to enable us to fulfil our contractual obligations with tenants and third parties, and manage our properties effectively. 

We use this information on the legal basis of fulfilling our contractual obligations to you, or on the basis that is necessary to pursue our legitimate interest of making arrangements with you for potential dealings with Wellcome properties and developments. For further information on how we balance our legitimate interests with your rights as an individual, please contact our Data Protection Team.

We may share your information with third parties, in particular:

• our legal advisors and other professionals such as consultants, auditors and accountants, for the purpose of obtaining specialist advice and support;
• our insurers for the purpose of progressing your insurance claim/issue;
• service providers, such as management companies, that support us in relation to Wellcome properties and developments.

Read How we share your information for further details on how your information is shared.

We also receive information about you from third-parties, in the following circumstances:

(n) Collections within Wellcome Collection

We receive personal information about you from those who donate, sell or lend material to Wellcome Collection, i.e., information about you contained in collections transferred to Wellcome Collection.

In line with Wellcome Collection’s Access Policy and procedures, we hold this material within Wellcome Collection on the legal basis that we are archiving in the public interest. This may include “special categories” of sensitive personal information (in which case please read How we use particularly sensitive information. In line with Wellcome Collection’s Access Policy and procedures, we conduct risk assessments before any personal data of living individuals is made available.

(o) Publicly available information

In some cases we receive personal information about you from publicly available sources, such as social media platforms or media reports. This information is only collected on an aggregated and non-identifiable basis, unless you are a public figure or a social media influencer (in which case your social media posts may be quoted directly). We use this information as part of Wellcome’s research and public engagement activities including to carry out sentiment analysis and see social media trends, in pursuit of our legitimate interest of understanding public discourse in order to further Wellcome’s charitable aims. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

If you are a business contact, we may obtain information about you from colleagues at Wellcome, online search engines and other publicly available sources in order to contact you about opportunities to work with us and to develop our business relationship with you. This information includes your contact details, job title and company or institution name. We use this information in pursuit of our legitimate interests of having effective procurement processes in place to support our charitable aims, and your legitimate interests of being informed about relevant business opportunities. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team. 

• Certain types of particularly sensitive personal information that we hold about you require higher levels of protection under data protection law. We need to have further justification for collecting, storing and using this type of personal information.

We collect the following types of “special category” personal information and use them for the purposes and on the bases set out below:

• information relating to your health where you are taken unwell or injured on our premises and receive first aid treatment. This information is only used to record and manage first aid. We record and use this information on the basis that we are legally required to or in some cases, because it is necessary to protect someone’s vital interests where they are physically or legally incapable of giving consent;
• information relating to access needs that you choose to tell us about when you are registering to attend a Wellcome Collection event, or when you are working or collaborating with Wellcome Collection. This information is only used to ensure that your access requirements are met on the basis that you consent to providing this information to us;
• information relating to access needs, special educational needs and cognitive impairment that you tell us about in the course of website testing activity. We use this information on the basis that we need to, to pursue our legitimate interest (and that of our website users) of ensuring the content on our websites is presented in the most effective manner for all website visitors, on the basis that you consent to providing this information to us;
• information about your physical or mental health, or disability status that you choose to tell us about so that we can provide reasonable adjustments to our recruitment process. We record and use this information in order to comply with our legal obligations.

(p) Sensitive information in our collections- Wellcome Collection

In addition, we collect and use special categories of personal data such as information relating to the physical and mental health and sexual life of individuals for archiving purposes in the public interest within Wellcome Collection. Our activities include acquiring, appraising, describing, storing, promoting and providing access in order to ensure the preservation and accessibility – now or in the future – of records of public interest. In line with Wellcome Collection's Access Policy and procedures, we conduct risk assessments before any personal data of living individuals is made available.

(q) Sensitive information collected relating to criminal convictions

We will only use information relating to criminal convictions where the law allows us to do so. This will usually be where it is necessary to pursue our legitimate interest of assessing your suitability to work for Wellcome in the role you have applied for. 

For some roles, we may request that applicants undertake a Disclosure and Barring Service (DBS) Check. A DBS check is only requested after a thorough risk assessment has indicated that one is both proportionate and relevant to the position concerned. For those positions where a DBS check is required, all application forms, job adverts, and recruitment briefs will contain a statement that a DBS check will be requested in the event of the individual being offered the position.

• Some roles may require Basic Disclosure and Barring Service (or equivalent) criminal record check to disclose any ‘unspent’ criminal convictions or conditional cautions under the Rehabilitation of Offenders Act 1974. You will not be required to disclose anything that is ‘spent’.
• Some roles may require a Standard or Enhanced Disclosure and Barring Service (or equivalent) criminal record check. This will require disclosure of any ‘unspent’ convictions or conditional cautions and any ‘spent’ convictions or adult cautions that are not protected (i.e. that are not filtered out) as defined by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 (as amended in 2020).

We use this information on the legal basis that where we undertake standard and enhanced DBS checks, we will only do so if required by law, and the role or activities are included in the Rehabilitation of Offenders Act (ROA) 1974 (Exceptions) Order 1975 (access to standard DBS certificates), and are also covered by the Police Act 1997 or Police Act 1997 (Criminal Records) regulations (access to enhanced DBS certificates.

(r) Sensitive information collected through our Speak Up channels

We collect and use information obtained through our Speak Up channels when someone working at our premises reports a concern about suspected wrongdoing at Wellcome. This information includes name and contact details (unless the report is made anonymously), the nature of the person’s relationship with Wellcome and details of the concern being raised. The information provided may include information about other people.

Any personal information provided via one of our Speak Up channels will be used for the purposes described in our Speak Up Policy (available on our intranet), in pursuit of our legitimate interest of ensuring that concerns about suspected wrongdoing at Wellcome are reported and investigated fairly and appropriately. For further information on how we balance our legitimate interests with your rights as an individual please contact our Data Protection Team.

Where the information provided contains “special categories” of personal data (i.e. revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information about health, a person’s sex life or sexual orientation) or information relating to criminal offences, this information will be handled by Wellcome on the basis that this is necessary in order for us to meet our safeguarding and serious incident reporting obligations (as required by our regulator the Charity Commission), or on the legal basis that this is necessary for the establishment, exercise or defence of legal claims.

As our Speak Up reporting line (phone and online) is provided by a third party, on behalf of Wellcome, any information provided when these channels are used will be shared with that provider. When a concern is reported using our Speak Up line, this will be logged and routed through to Wellcome’s Ethics, Governance and Compliance team in Wellcome’s Legal Division in the first instance. Concerns will be handled by Wellcome’s Ethics, Governance and Compliance team in accordance with our Speak Up Policy. The information provided when a concern is raised will only be shared with a limited number of senior people on a need-to-know basis. We will only share this information further where we are required to do so by law (i.e. to report wrongdoing to the Charity Commission or other authorities), or where this is necessary to investigate the matter further. We will do everything we reasonably can to protect the privacy of everyone involved.

If you fail to provide the information required to set up an online account on one of our websites, to subscribe to our newsletters or to register for our events, we will not be able to provide these services to you.

If as a job participant you fail to provide the personal information requested via our application system during the job application process, we will not be able to process your job application.

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

Where necessary for the purposes described in this Statement, may share your personal information within Wellcome as well as with our third-party service providers.

Where necessary for the purposes described in this Statement, we may share your information as follows:

(s) Third-party service providers

We share your personal information with third-party service providers and suppliers, some of whom may be based outside the UK and the European Economic Area (“EEA”) (in which case please read the section International transfers of your information- outside of the UK and the EEA). Some of our service providers will have access to your information to perform services on our behalf. We share your information with the following types of service providers:

• our systems providers i.e. for our library management system, CRM system, IT and communications systems, job application systems, Speak Up reporting line
• our integrated services provider which operates our reception, security and mail room functions within our premises at 183 and 215 Euston Road;
• our email marketing and communications provider that distributes email publications on our behalf, where you opt-in to receive such publications;
• the provider of our web-based event registration system, to send out event invites and registration forms to those invited to Wellcome events;
• our card payment service providers in the Wellcome Shop (Wellcome Collection);
• third party survey providers that we use i.e. for collecting visitor feedback on Wellcome Collection events and collecting feedback and pre-screening information for website evaluation and research;
• external research agencies that we use for analysing and reporting on Wellcome Collection surveys;
• third parties we work with when we recruit for Wellcome jobs and Wellcome contract opportunities i.e. recruitment agencies, background check providers;
• our travel management company, hotels and transportation providers and travel security partner (where Wellcome is organising travel associated with an event you are attending) for the purpose of making travel arrangements and sending you relevant travel alerts whilst you are travelling to/from a Wellcome event;
• event venue operators, where you are attending a Wellcome-organised event, for the purpose of them administering the event;
• in the event that you are involved in a significant accident or suffer a significant injury whilst on our premises, we will share your contact details with our insurers;
• independent judges used to select the winner(s) of Wellcome online competitions which you have entered;
• local government and planning authorities for the purpose of managing planning applications and proposals for our property developments;
• external legal advisors and other professionals such as consultants, auditors, accountants, management companies, communications consultants and marketing services companies; and
• our insurers for the purpose of obtaining insurance relevant to our developments and proposed developments.

(t) Partners and associated organisations

We will share your information with partner organisations where it is necessary for us to do so i.e., where you are applying to attend a Wellcome-organised event and your application needs to be considered by those we are partnering with to put on the event.

(u) Internally within Wellcome

We will share your personal information within Wellcome for the purposes set out in this Statement.

(v) Where otherwise required to do so

In exceptionally rare circumstances, we will share your information if required to do so under a court order, if requested by the police or other regulatory or governmental authority or if otherwise required by law. 

For further information on how we share your information, contact our Data Protection Team.

Wellcome is committed to safeguarding your personal information and your privacy. We have put in place appropriate security measures to prevent your information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Where we have given you (or where you have chosen) a password to access certain parts of our sites, you are responsible for keeping this password confidential.

Technical solutions

We securely store all information you provide to us using one or more technical measures considering the nature, scope, context and purpose for which we are using the information. Such measures will always be appropriate to the risk.

Card transactions

Where we take card payments through the Wellcome Collection shop, your card information is encrypted in transit, and the tokenised to complete payment. No staff member has access to your full card details. 

Breach Procedures

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

International transfers of your information- outside of the UK and the EEA

We transfer personal information we collect about you outside of the UK and the EEA where we use service providers that store information on servers based outside of the UK and the EEA. To ensure that your personal information is protected, since the data protection regimes in these locations might be less exacting than within the UK and the EEA, we ensure that one of the following safeguards is already in place, or will be put in place prior to transfer:

• the recipient is in a country that has been deemed to provide an adequate level of protection for personal data by the Information Commissioners Office or by adequacy regulations under the Data Protection Act 2018;
• the recipient has entered into Binding Corporate Rules;
• the recipient is registered with the US-EU Data Bridge Framework, to which the UK subscribes
• the recipient has entered into appropriate contractual arrangements with us and we have conducted a Transfer Risk Assessment to be assured that information will be sufficiently protected; or
• a derogation applies under data protection law for the specific situation .

Where necessary we also transfer your personal information outside the UK and the EEA to partners and associated organisations for the purposes set out in this Statement. For example, where you are applying for a funded place at a Wellcome event and we need to share your application with our event partners outside the UK and the EEA to assess your application.

We will only retain your personal information for as long as necessary to fulfil the purposes for which we collected it. This may mean holding on to your personal information for a certain period of time after you have ceased to have a relationship with Wellcome, such as for the purposes of satisfying any legal, accounting, or reporting requirements.

When determining the appropriate period of time to retain your personal information, we consider several factors, including the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your information, the purposes for which we handle and use your information and whether we can achieve those purposes through other means, and the applicable legal requirements. We securely erase your information once it is no longer needed.

For the purpose of archiving in the public interest, we permanently archive certain information, which we hold within our corporate archive and our collections in Wellcome Collection. This includes information that supports the preservation of Wellcome’s historical, cultural and public engagement resources and activities, and funding activities, as well as the information held in our collections that is transferred to Wellcome Collection by lenders and donors. Further information on how we handle these collections and make them available is set out in Wellcome Collection’s Access Policy and procedures.

Details of retention periods for different aspects of your personal information are set out in our retention policy. Contact our Data Protection Team for further information.

If you have an online account with us, or in any other instances where we process your personal data as set out in this Statement, we hope that you find your information is easy to access and update as it is important that the personal information we hold about you is accurate and current.

At any time, you have the right to, amongst other things, access the information we hold on you or notify us that you no longer wish to be included on our database for marketing purposes. If you wish to contact us regarding your information, please speak to our Data Protection Team.

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third-party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Withdraw your consent for us to use your personal information at any time, where we are handling your information on the basis of your consent.

If you’d like to exercise any of the rights mentioned above, please contact our Data Protection Team  or you can or complete this form.

In almost all circumstances, you can exercise any of these rights free of charge. However, in circumstances where your request for access is unfounded or excessive, we reserve the right to charge you a reasonable administrative fee or simply refuse to respond.

Although we hope that you would never feel that you had to, you do have the right to lodge a complaint with the supervisory authority, the Information Commissioner’s Office: www.ico.org.uk.

If you wish to contact us in relation to this Statement, or to discuss any other matters relating to how we handle your personal data you can do so by contacting our Data Protection Team using the following details:

Data Protection Team 
Wellcome Trust
215 Euston Road 
London NW1 2BE 
United Kingdom

dataprotection@wellcome.org 

This Statement was last updated on the 9 July 2025. Changes to this Statement may be made in response to changes to regulation, legislation or Wellcome itself. Therefore, we ask that you come back every now and then to check for any updates.