Data Protection and Privacy Policy

Introduction

This Policy sets out Seeta Patel Dance’s procedures for the collection, storage, use and sharing of personal data and data for electronic business to business communications.

The Policy will be reviewed by Seeta Patel Dance’s Trustees every 2 years, or earlier if there are changes to legislation and/or SPD’s use of data. Current relevant legislation is: the Data Protection Act (“the Act”), the General Data Protection Regulations (“the GDPR”) and the Privacy and Electronic Communications Regulations (“PECR”).

What data is relevant?

Data Protection legislation is concerned with the use of personal data, held on electronic systems, in paper filing and online identifiers such as location data and cookies.

Personal data is defined by the Information Commissioner’s Office (“the ICO”) as data that relates to a living individual who can be identified:

From that data
From that data and other information in the possession of (or likely to come into the possession of) the data controller e.g. expressions of opinion about an individual
From codified records that do not identify individuals by name but, for example, bear unique reference numbers that can be used to identify the individuals concerned.

Special categories of personal data means information that could be used in a discriminatory way, so needs to be treated with greater care than other personal data, i.e. information about:

Race or ethnic origin
Political opinions
Religious beliefs or other beliefs of a similar nature
Trade union membership
Physical or mental health or condition
Sexual life
Commission or alleged commission by him of any offence
Any proceedings for any offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.

Who’s who in data processing

A data subject: Anyone whose data is processed.

A data controller: The organisation/person who decides how and personal data is/will be processed. Data controllers will usually be organisations, but can be individuals, for example self-employed consultants.

A data processor: Any person (other than an employee of the data controller) who processes the data on behalf of the data controller, e.g. external payroll service providers.

Consent

In line with the GDPR we will ensure that when we process personal data we have the data subject’s explicit consent and that the data subject has been made aware that they have the right to withdraw their consent. Consent must be:

Specific to the purpose for which we are using the data e.g. Seeta Patel Dance mailing list
Unambiguous
Active not implied: Silence is not consent; pre-ticked boxes, inactivity, failure to opt-out or passive acquiescence will not constitute valid consent
Freely given: Consent will not be valid if the data subject does not have a genuine and free choice or cannot refuse or withdraw consent without detriment.

Ways in which we may ask for consent include:

Written consent
Ticking a box on a web page (opting in)
Choosing technical settings in an app
Verbal consent (which is then recorded in writing)
Any other statement/conduct that clearly indicates (in this context) the data subject’s acceptance of the proposed processing of personal data e.g. cookie acceptance.

In line with PECR we will not contact individuals for direct marketing purposes by email, the internet, phone, fax or any new electronic systems that may be introduced without prior consent. (NB: business to business communications to generic addresses such as “admin@” “info@” do not require consent.)

We provide opt-out opportunities in every mailing to ensure compliance with the principle that data held should be accurate and up to date.

All our mailings make it clear who the sender is, so the recipient’s ability to opt out is viable.

Our website makes it clear we use cookies to collect details of visitors to our website and gives them an opportunity to refuse their operation.

Who does Seeta Patel Dance collect/process/store data from?

Website users: Current, past and potential – this is unlikely to be personal data, but it can be in some cases.

Mailing list subscribers: This will be personal data. Only those who have opted in will receive communications from us.

Talent Development: This will be personal data. We will not contact artists following the training or workshops without their explicit consent.

Audience members: This will be personal data. We will not contact audiences for feedback or about future SPD work without their explicit consent.

Staff recruitment/freelance contracts: This will be personal data.

Staff/freelance records: This will be personal, and some may be special category data.

Donors/supporters: This will be personal data. Only those who have opted in will receive communications from us.

How do we deal with data?

Website users: We do not share data with any third parties and website users are given the choice to opt in to:

SPD processing any personal data they may provide
SPD using their data for marketing purposes, i.e. to share jobs, news, opportunities, training and events information.

Mailing list subscribers: We collect personal data from you when you register (opt in) to join our mailing list. This information is protected by UK data protection law. We use MailChimp to store email addresses and names; to send our newsletters and to track interactions from those newsletters. Please see MailChimp privacy policy for more information.

When you choose to sign up for our Mailing List:

We will collect your name and email address
You agree to the collection, storage and processing of your personal information by us, using MailChimp
Your personal information will be used to inform you about events and news that we think will interest you
The information we hold about you will be accurate and up to date. You can contact us to check this information. If you find any inaccuracies, we will delete or correct them promptly.

We do not share your personal information with third parties except MailChimp. If you want to end your subscription to our newsletter you will find an unsubscribe link at the bottom of each newsletter.

Talent development: Artists will be asked for their name and email address in order to attend training and/or workshops with Seeta Patel Dance. We will ask for consent to contact them via email, over the phone and to send feedback surveys following their workshop.

Audience members: Audiences will be asked their name and email address before and/or during the booking process. We will ask their permission to contact them via email or over the phone for feedback.

Staff recruitment/freelance contracts: Sensitive data in the Equal Opportunities Monitoring form is processed anonymously. The form is separated from job applications immediately and destroyed as soon as the data they contain has been processed. This is indicated on the form. Statistics drawn from this data will be kept for future use. We do not share your personal data with third parties. Applicants have the option to have personal data kept on record for more than a year if they want to be considered if another suitable vacancy arises.

Staff/freelance records: Our staff contracts/freelance letters of agreement reflect the fact that the law allows us to collect some data about employees and that employees have the right to access this. For more information on the UK’s data protection legislation, visit this link.

Deletion of data

Data subjects have the right to request to be “forgotten”, Seeta Patel Dance will delete records in line with GDPR as follows:

When processing can cause substantial damage or distress
Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
If the personal data was unlawfully processed.

If personal data being erased has been disclosed to third parties we will inform them about the erasure, unless it is impossible or involves disproportionate effort.

If personal information has been processed online, for example on social networks, forums or websites we will inform any other organisations who are involved to erase links to, copies or replication of “forgotten” personal data.

Seeta Patel Dance will not always delete records, a request to be forgotten can be refused where data has been processed:

To exercise the right of freedom of expression and information
To comply with a legal obligation for the performance of a public interest task or exercise of official authority
For public health purposes in the public interest
For archiving purposes in the public interest, scientific research historical research or statistical purposes
For the exercise or defence of legal claims.

Data Protection Officer

Seeta Patel Dance does not need a designated Data Protection Officer under the GDPR, however, the Board of Trustees are responsible for ensuring Data Protection Compliance, working with SPD’s Senior Management as appropriate.

We agree to comply with the relevant legislation and the principles of good data protection.