Personal data is information about you: for example, your name, address, date of birth, images or video of you, credit card details and so on. It’s information that can be used to identify you. HAT collects personal data for various reasons which we explain here. HAT is the Data Controller. Sometimes we will process your data ourselves, sometimes (for example, selling you a ticket), a third party company will do the processing. This is called data processing. We’ll explain this too. The person in charge of Data Processing for HAT is the Data Protection Officer. You can contact them by email on email@example.com We only process your data if there is a legal basis to do so. We’ll explain this as we go along. There are several ways in which we might collect and process your personal data:
1 Mailing List and Surveys
We like to let you know what we’re doing and what’s coming up; and we like to know what you think about us and what we do. We do this through our mailing list and through surveys, and only with your consent. Your consent would provide the legal basis for us to do this. You can opt in to receive marketing and/or fundraising emails on Bell Square or via the email sign up form on our website. You can choose and update your preferences for what you want to hear about and unsubscribe at any time. The data processor is Mailchimp. We gather statistics about email opening and clicks, using industry standard technologies to help us monitor and improve our marketing. The legal basis for this processing would be your consent. No consent: no processing.
2 Direct Feedback
Whenever you get in touch with us to give direct feedback (by email, over the counter or over the phone) about your experiences of our service, we store and process the personal data you give, in order to assure that every piece of feedback is given an appropriate and timely response. This processing is done on site by our Customer Relations team. Our legal basis for this processing is in the legitimate interest of the organisation so that we can better serve you in future. Your data is retained in line with our retention statement (see the next section).
3 Consent Data
For certain events we might ask you to give additional information about a young person when you give consent for them to take part in an activity. This data is held alongside your normal customer data within Ticketsolve and then processed locally so that workshop leaders have it at their fingertips in case of an emergency. Our legal basis for this processing is so that we can fulfil our contract to safely support your young person throughout their visit. Paper copies of this data are made and then destroyed on the day of the event, and digital data is retained in line with our retention statement (see the next section).
4 Our Data Processing Partners
MailChimp and Survey Monkey have implemented appropriate technological measures to protect against accidental loss, destruction, damage, alteration and disclosure. If you’d like to know more about these organisations, here are links to their Privacy Policies.
We keep your data only as long as we need to, or the law tells us to, or you want us to.
We will retain your data until you tell us not to.
6 Examination, Correction and Deletion
At all times you have the right to view your personal data that we hold. This is called a Subject Access Request. Contact firstname.lastname@example.org and we’ll get onto it. You will be asked to verify your identity before we release any information to you, and we will endeavour to provide a full report within 30 days of verification. In fact if you would like to revise the information provided to us at any time, or feel what we currently have on record is incorrect, you can update the information by e-mailing email@example.com. We may from time to time ask you for further information in order to update our records or for particular purposes. We will always tell you how we will use any further personal information received from you.
7 Log Files
Every time someone visits our web site a log file is generated.
The log file records the time and date of your visit, the files that were requested, your IP (Internet Protocol) address, the referrer URL (if provided) and the browser version. We collect this information to help us diagnose problems and administer our systems and to audit the geographical make-up of users and how they have arrived at our site; that is, from what other sites have visitors arrived – this information being obtained from the referrer URL. We do not link IP addresses to anything personally identifiable, which means that you remain anonymous even though we include your IP address in our aggregate information. However, we can and will attempt to use IP addresses to identify a user when we feel it is necessary to enforce compliance with our terms and conditions, or to protect our services and other users.
Cookies are small pieces of information that are stored by your browser on your computer’s hard drive. They make it possible for us to provide our online ticketing service and track visitor statistics, such as returning visitors.
Universal Analytics (Google)
These cookies are used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website, device used, where visitors have come to the website from and the pages they visited.
9 Use and Disclosure of Personal Data
If we are requested by the police, or a regulatory or government authority investigating illegal activities to provide information concerning your activities whilst using the network, we must do so.
10 Protecting Your Personal Data
We take every precaution to protect your information. To this end all Personal Data is kept on a server in a secure environment. Only employees and approved contractors/developers we may appoint from time to time and who need the information to perform a specific job are granted access to Personal Data. Please note that our processors Mailchimp and Survey Monkey are based outside of the EEA and use servers located in the United States. These processors have proven to us that they robustly protect your data by carrying the EU-US Data Shield accreditation that is recognised by our own Information Commissioner’s Office as a standard of excellence.
11 Users Under 18
If you are under 18, please ensure that you obtain your parent/guardian’s consent beforehand whenever you provide Personal Information to the website. Users without such consent are not allowed to provide us with Personal Information.
12 Your Right to Query or Complaint
If you have any queries or concerns regarding your personal Information please contact HAT Data Controller, the Operations Manager 020 8232 1026 or email firstname.lastname@example.org. Should you feel that HAT have in any way mishandled your personal information or are operating illegally you can contact the Information Commissioner’s Office on 0303 123 1113 or navigate to https://ico.org.uk/concerns/ in your web browser.