Henley Symphony Orchestra – Privacy notice
What is this guide for?
Whenever we need to collect any of your data, we will let you at that point why we need to do so and what it will be used for, but this guide provides a useful overview of all of those situations and provides more detail on how we keep your data secure and up to date, how long we might hold it for and what your rights are in relation to it.
Henley Symphony Orchestra (HSO) is committed to protecting your personal data and will use any personal or sensitive data we collect from you in line with the General Data Protection Regulation (GDPR).
Who is responsible for data the group collects?
HSO is a Data Controller under the GDPR. HSO’s Data Protection Officer is the Chair who can be contacted at email: firstname.lastname@example.org.
What data do we collect and what do we use it for?
HSO collects data from individuals to help us plan, organise and run the day-to-day operations of the group (e.g. co-ordinating rehearsals or collecting subscription payments) and to promote and market the group’s activities (e.g. Friends of HSO, Business Friends of HSO, marketing mailing lists and photography/video capture).
Members: for administering membership
When you join HSO as a member, or during your membership with us, we may need to collect some of the following information from you:
This data will be used by committee members to manage your membership with HSO and to organise and run our activities.
If you give us your consent to do so, we may also use your contact details to send you marketing/promotional communications from the group.
Any marketing/promotional communications we send you will include a clear option to withdraw your consent (i.e. to ‘opt out’ of future emails). You can also withdraw consent at any point by contacting the Data Protection Officer – Judy Whittaker, Chair, at email: email@example.com.
HSO Friends and Business Friends
When you join HSO as a Friend/Business Friend, or during your time as a Friend/Business Friend, we will need to collect some of the following information from you: name, address, email address, phone number and gift aid declaration. This data will be used by committee members to manage your subscription and to send you information about our events and activities (e.g. forthcoming performances, social events, and fundraising events). We may also ask for your preferred topics and communication methods. These allow us to tailor the information we provide to suit your preferences (e.g. email vs post). We will only send you information that is related to the group and will not use your data to send you marketing messages from third parties.
Event attendees: for processing and managing tickets for events
Where our events are ticketed, we need to collect data on the person booking (name and email) in order to allow you access to the event and to send you a confirmation of your reservation/purchase. This data will only be used for administering your access to the event/s for which you have booked and will not be used to send you marketing/promotional messages from the group unless you have also provided your consent to receive these (see below).
Employees and contractors: for administration and legal/regulatory purposes
We may need (for administration or for legal/regulatory reasons) to collect personal or sensitive data on employees or contractors of the group. Where this is the case, we will explain what this is for at the point of collection.
Mailing list subscribers: for marketing and promotion
We offer everybody the opportunity to sign up (consent) to receive marketing and promotional information on the group’s activities (e.g. emails about forthcoming events).
When you sign up to our marketing mailing list we will ask for your name and email address and will use this data to send you information about our events and activities (e.g. forthcoming performances, social events and fundraising events). We may also ask for your preferred topics and communication methods. These allow us to tailor the information we provide to suit your preferences (e.g. email vs post).
We will only send you information that is related to the group and will not use your data to send you marketing messages from third parties.
Anything we send you will include a clear option to withdraw your consent (i.e. to ‘opt out’ of future emails) and you can also do so at any time by contacting the Data Protection Officer – Judy Whittaker, Chair, at email: firstname.lastname@example.org.
Website visitors: for running and improving our website
We use cookie technology when a person visits our website to collect and analyse anonymised data on how many people have visited, what pages they have looked at and other statistical information.
We use a pop-up banner to let users know about this on their first visit, and they can disable cookies in their browser at any time if they do not wish their (anonymised) data to be tracked.
You can find out more about cookies at http://www.allaboutcookies.org
Do we share your data with anyone else?
We will never pass your details on to third parties for marketing purposes.
We sometimes use third-party services to process your data (e.g. Google Drive). We will always make sure any third parties we use are reputable and secure and will process your data in accordance with your rights under GDPR.
Are there special measures for children’s data?
How can you update your data?
You can contact us at any time by contacting the secretary at email: email@example.com to update or correct the data we hold on you.
How long we will hold your data?
The HSO data retention policy is to review all data held on individuals at least every two years and remove data where we no longer have a legitimate reason to keep it.
Where you have withdrawn your consent for us to use your data for a particular purpose (e.g. unsubscribed from a mailing list) we may retain some of your data for up to two years in order to preserve a record of your consent having been withdrawn.
- When a member leaves HSO and all administrative tasks relating to their membership have been completed, any potentially sensitive data held on them will be deleted – this might include bank details or medical data.
- Unless consent has been given, data will be removed from all email mailing lists.
- All other data will be stored safely and securely and reviewed as part of the next two-year review.
Data stored by HSO may be retained based in statutory requirements for storing data other than data protection regulations. This might include but is not limited to:
- Gift aid declaration records
- Details of payments made and received (e.g. in bank statements and accounting records)
- Trustee meeting minutes
- Contracts and agreements with suppliers/customers
- Insurance details
- Tax and employment records
What rights do you have?
Under the GDPR, you have the following rights over your data and its use:
- The right to be informed about what data we are collecting on you and how we will use it
- The right of access – you can ask to see the data we hold on you
- The right to rectification – you can ask that we update or correct your data
- The right to object – you can ask that we stop using your data for a particular purpose
- The right to erasure – you can ask us to delete the data we hold on you
- The right to restrict processing – you can ask that we temporarily stop using your data while the reason for its use or its accuracy are investigated
Though unlikely to apply to the data we hold and process on you, you also have rights related to portability and automated decision making (including profiling)
All requests related to your rights should be made to the Data Protection Officer – Judy Whittaker, Chair, at email: firstname.lastname@example.org.
We will respond within one month.
You can find out more about your rights on the Information Commission’s Office website
What will we do if anything changes?
If we make changes to our privacy statements or processes we will post the changes here. Where the changes are significant, we may also choose to email individuals affected by the new details. Where required by law, we will ask for your consent to continue processing your data after these changes are made.
What are cookies?
‘Cookies’ are small text files that are stored by the browser (for example, Internet Explorer) on your computer or electronic device. They allow websites to ‘remember’ you for a period of time so that they can store things like user preferences and make the website quicker and easier for you to use.
Without cookies, some things on websites would not be able to work: for example, without cookies it might not be possible to know whether or not you are logged in on a website, which would prevent you from being able to see content restricted to logged-in users.
Every time someone visits our website, software provided by other organisations (Google Analytics, WordPress) generates an ‘anonymous analytics cookie’.
These cookies can tell us whether or not you have visited the site before and what pages you visit. Your browser will tell us if you have these cookies and, if you don’t, we generate new ones. This allows us to track how many individual users we have, and how often they visit the site. We use them to gather statistics – for example, the number of visits to a page
– to help us identify whether visitors would benefit from more information on a particular area.
How do I turn cookies off?
It is usually possible to stop your browser accepting cookies, or to stop it accepting cookies from a particular website.
All modern browsers allow you to change your cookie settings. You can usually find these settings in the ‘options’ or ‘preferences’ menu of your browser. To understand these settings, the following links may be helpful, or you can use the ‘Help’ option in your browser for more details.
- Cookie settings in Internet Explorer
- Cookie settings in Firefox
- Cookie settings in Chrome
- Cookie settings in Safari
Please note: switching off cookies may prevent some aspects of our website from working fully.
You can find out more about cookies and their use on the internet from www.allaboutcookies.org
23 May 2018
Resources & Further Information
Overview of the GDPR – General Data Protection Regulation
Privacy and Electronic Communications Regulations 2003
The Guide to the PECR 2003