1. Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the UK General Data Protection Regulation (the “UK GDPR”).
2. Who are we?
The Board of Trustees of Nuneaton Arts CIO is the data controller (contact details below). This means it decides how your personal data is processed and for what purposes.
3. How do we process your personal data?
The Board of Trustees of Nuneaton Arts CIO complies with its obligations under the “UK GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
Our data relates to several different categories of people:
- Members of Nuneaton Arts CIO
- Staff and Volunteers
- Suppliers where these are individuals
- Hirers where these are individuals
- Mailing list members
We use your personal data for the following purposes:
- Members of Nuneaton Arts CIO
- Maintaining a record of current members with contact details
- Advising members of matters relating to their membership
- Advising members of upcoming meetings
- Distributing agendas, minutes and other papers relating to meetings
- Staff and Volunteers
- Maintaining statutory information and administering payroll (Staff only)
- Maintaining a record of current volunteers with contact details
- Advising volunteers of vacant slots in the various theatre rotas
- Advising volunteers of events and other significant matters
- Volunteers who have committed to staffing an event may have their e-mail address passed on to the event organiser to improve event coordination
- Suppliers where these are individuals
- Maintaining records as required under accounting and government regulations
- Contacting suppliers to obtain quotations, place and progress orders, make payments, deal with queries
- Contacting suppliers regarding general matters (eg address or banking changes)
- Supplier details may be passed on to our solicitors and to the courts in the event of disputes
- Hirers where these are individuals
- Maintaining records as required under accounting and government regulations
- Contacting hirers regarding specific hires or hire enquiries
- Dealing with hire queries
- Chasing payments
- Contacting previous hirers regarding general matters (eg theatre availability and facilities)
- Hirer details may be passed on to our solicitors and to the courts in the event of non-payment of invoices
- Marketing mailing list members
- Our mailing list is opt-in at all times, and anyone receiving a mailing may opt-out of future mailings using the link in the e-mail
- Mailing list members may receive newsletters and other communications which we believe will be of interest to them
- Theatre users and visitors
- We record CCTV images throughout the public areas of the building and the forecourt and rear yard for security purposes
- Images may be handed over to the police or other authorities in connection with investigating criminal activities
- We record contact details for theatre users and visitors where required by government or local authorities
4. What is the legal basis for processing your personal data?
- Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement;
- Explicit consent of the data subject
5. Sharing your personal data
We only share information outside Nuneaton Arts CIO where required by legislation or as specifically detailed in section 3 or section 5.
- Processing is carried out by ourselves, using commercial mailing applications where appropriate (eg MailChimp). Mailing applications will store name and address data and will send out mailings only when specifically instructed to do so by Nuneaton Arts CIO. They will not use personal data for their own purposes or share it with any other party.
- Tickets are sold on our behalf by a commercial ticketing organisation (eg TicketSource). This organisation collects name and address data for the purpose of accepting payment and despatching tickets. If the ticket buyer opts-in than that personal data is shared with Nuneaton Arts CIO and is added to our mailing list. They will not use personal information for any other purpose or share it with any other party.
6. How long do we keep your personal data?
We keep data relating to current staff and volunteers. We keep data relating to former staff for 7 years and former volunteers for a maximum of 2 years following their leaving. CCTV images are stored only until overwritten, usually between 7 and 14 days after capture.
In accordance with rules set out by the Information Commissioner’s Office (ICO) we may at times provide copies on request of CCTV data as either stills or video recordings to appropriate authorities (eg police). Such copies will be managed by the NACIO data protection representative and will not be furnished to anyone without a legal right to view.
7. Your rights and your personal data
Unless subject to an exemption under the UK GDPR, you have the following rights with respect to your personal data: –
- The right to request a copy of your personal data which Nuneaton Arts CIO holds about you;
- The right to request that the Nuneaton Arts CIO corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for Nuneaton Arts CIO to retain such data;
- The right to withdraw your consent to the processing at any time
- The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means].
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data, (where applicable) [Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics]
- The right to lodge a complaint with the Information Commissioners Office.
8. Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
9. Contact Details
To exercise all relevant rights, queries or complaints please in the first instance contact the Secretary to the Trustees of Nuneaton Arts CIO, Abbey Theatre, Pool Bank Street, Nuneaton CV11 5DB e-mail enquiries@abbeytheatre.co.uk
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
Data held and data security
The personal data we comprises all or part of:
Name
Address
Date of birth/age
Telephone number(s)
e-mail address(es)
Next of Kin
DBS status
Staff records are held on paper in the Abbey Theatre office, which is kept locked when unattended.
Volunteer records are held electronically in passworded cloud storage locations and in commercial mailing software (eg MailChimp)
Supplier and hirer records are partially paper, held in the Abbey Theatre office, and partially electronic, mainly held in passworded cloud storage locations and web-based Outlook storage
Mailing lists are held in commercial mailing software (eg MailChimp)
Cloud-based storage and outlook storage may be located outside the European Union
July 2021
