Beyond Face Data Protection & Privacy Policy 2022
Beyond Face CIC is a performance company based in the South West of England, whose mission is to be at the forefront of providing opportunities for artists of the Global Majority to live, work and thrive in the South West theatre sector. Beyond Face aim to reframe the narrative around what is perceived as quality and to bring focus to the region.
The beyondface.co.uk website is operated by Beyond Face CIC and provided by wix.com.
This Policy Statement sets out Beyond Face’s procedures for the collection, storage, use and sharing of personal data and data for electronic business to business communications. We collect data from the artists who work with us, from audiences who attend our work, partners that we work with and from staff, freelancers and suppliers. We agree to comply with the relevant legislation and the principles of good data protection.
WHAT DATA IS RELEVANT?
Data Protection legislation is concerned with the use of personal data, held on electronic systems, in paper filing and online identifiers such as location data and cookies.
Personal data is defined by the Information Commissioners Office (“the ICO”) as data that relates to a living individual who can be identified:
• from that data, or
• from that data and other information in the possession of (or likely to come into the possession of) the data controller e.g. expressions of opinion about an individual.
• from codified records that do not identify individuals by name but, for example, bear unique reference numbers that can be used to identify the individuals concerned.
Special categories of personal data mean information that could be used in a discriminatory way, so needs to be treated with greater care than other personal data, i.e. information about:
• race or ethnic origin
• political opinions,
• religious beliefs or other beliefs of a similar nature,
• trade union membership
• physical or mental health or condition,
• sexual life,
• commission or alleged commission by him of any offence, or
• any proceedings for any offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.
WHO’S WHO IN DATA PROCESSING?
A data subject: Anyone whose data is processed.
A data controller: The organisation/ person who decides how and personal data is/will be processed. Data controllers will usually be organisations, but can be individuals, for example self-employed consultants.
A data processor: Any person (other than an employee of the data controller) who processes the data on behalf of the data controller, e.g. external payroll service providers.
WHO DOES BEYOND FACE COLLECT/PROCESS/STORE DATA FROM?
Website users - Current, past, and potential – this is unlikely to be personal data, but it can be in some cases, particularly entry level organisations or independent artists where people may be working from a home address and using personal email.
Mailing list subscribers - this will be personal data. Only those who have opted in will receive communications from us or signed up via the website form.
Artists we support– this will be personal data. We will not contact artists following a meeting without their explicit consent.
Young people who are part of our programmes- this will be personal data and those under 18 will be required to obtain consent from their parent/guardian. Without such consent, young people are not allowed to provide us with personal information.
Audiences who have purchased tickets to an event, production, or workshop. This will be personal data. Personal data will only be retained by us if audiences opt in to receive further communications. Personal information will be held on our database and used for operational purposes, such as for mailing list subscriptions. Beyond Face will occasionally work with partner venues who operate as “Data Controller” and audience data will be shared through a GDPR compliant data sharing agreement.
Through programme recruitment- this will be personal data. We will not contact artists following a meeting without their explicit consent.
Through staff recruitment – this will be personal data.
Staff records including contractors and freelance artists - this will be personal, and some may be special category data.
CONSENT
We ensure that when we process personal data, we have the data subject’s explicit consent and that the data subject has been made aware that they have the right to withdraw their consent at any time.
Consent must be:
• Specific to the purpose for which we are using the data e.g. Signing up to the Beyond Face Newsletter or signing up to receive further information having taken part in a workshop or event.
• Active not implied: Silence is not consent; pre-ticked boxes, inactivity, failure to opt-out or passive acquiescence will not constitute valid consent.
• Freely given: Consent will not be valid if the data subject does not have a genuine and free choice or cannot refuse or withdraw consent without detriment.
Ways in which we may ask for consent include:
• Written consent
• Ticking a box on a web page or form (opting in)
• Choosing technical settings in an app
• Verbal consent (which is then recorded in writing)
• Any other statement/conduct that clearly indicates (in this context) the data subject's acceptance of the proposed processing of personal data e.g. cookie acceptance.
In line with PECR we will not contact individuals for direct marketing purposes by email, the internet, phone, fax, or any new electronic systems that may be introduced without prior consent. (NB: business to business communications to generic addresses such as “admin@” “info@” do not require consent.)
We provide opt-out opportunities in every mailing to ensure compliance with the principle that data held should be accurate and up to date.
All our mailings make it clear who the sender is, so the recipient’s ability to opt out is viable.
Our website makes it clear we use cookies to collect details of visitors to our website and gives them an opportunity to refuse their operation.
HOW DO WE DEAL WITH DATA?
Website users: We do not share data with any third parties unless we are required to do so by law. We may occasionally share anonymous usage information to partners to help with data analysis. Our website is hosted on wix.com. Website users are given the choice to opt in to:
Beyond Face processing any personal data they may provide.
Beyond Face using their data for marketing purposes, i.e. to share jobs, news, opportunities, training and events information.
Publication of email address/phone number on the Beyond Face website.
Beyond Face will use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this data. Google’s privacy policy is available here. We makes use of cookies which are files placed on your computer that enable us to track certain information relating to your use of www.beyondface.co.uk. By being on this website you consent to Google Analytics tracking cookies being used. You can configure your web browser to prevent the use of cookies, although some functions or services may not be available.
Mailing List subscribers: We collect personal data from you when you register (opt in) to join our mailing list. This information is protected by UK data protection law. We use MailChimp to store email addresses and names; to send our newsletters and to track interactions from those newsletters. Please see MailChimp privacy policy for more information. When you choose to sign up for our Mailing List:
We will collect your name and email address.
You agree to the collection, storage, and processing of your personal information by us, using MailChimp as the provider.
Your personal information will be used to inform you about events and news that we think will interest you.
The information we hold about you will be accurate and up to date. You can contact us to check this information. If you find any inaccuracies, we will delete or correct them promptly.
We do not share your personal information with third parties except MailChimp. If you want to end your subscription to our newsletter you will find an unsubscribe link at the bottom of each newsletter or contact Beyond Face on info@beyondface.co.uk at any time.
Artist Support: Artists will be asked for their name, email address, address and access requirements which will support their taking part in activities led by Beyond Face. We will ask for consent to contact them via email, over the phone or video conferencing software, and to send feedback surveys to them post-taking part in an activity. If you are participating in an event or project, we may ask you for additional personal information. At this point we will provide you with an additional Privacy Notice so that you are informed about what information we will be asking for and how we will be using it.
Young people who are part of our programmes: With parental/guardian consent, we will ask for participants name, email address, address, an emergency contact, and access requirements. Users under 18 will not be allowed to provide information without parent/Guardian consent. We will ask for consent to contact participants via email, over the phone or video conferencing software, and to send feedback surveys to them post-taking part in an activity. If you or a child you care for is participating in an event or project, we may ask you for additional personal information. At this point we will provide you with an additional Privacy Notice so that you are informed about what information we will be asking for and how we will be using it.
Audiences: To process a transaction, Personal Information and payment details may be passed to third party service providers, only for the purpose of handling an individual transaction. We will ask audiences for consent to contact them via email, over the phone and to send feedback surveys to them. Beyond Face occasionally use Eventbrite as the provider for processing tickets for events. Eventbrite Privacy Policy can be accessed here. Beyond Face will contact audiences via Eventbrite in relation to that event, which might involve event reminders, and optional post-event surveys. We will ask audiences for consent to contact them via email post the event.
Staff & programme recruitment: sensitive data in the Equal Opportunities Monitoring form is processed anonymously. We do not share your personal data with third parties. Applicants have the option to have personal data kept on record for more than a year if they want to be considered if another suitable vacancy arises.
Staff recruitment-diversity monitoring: These forms contain special category data by definition; however, they are anonymous, separated from job application forms immediately and destroyed as soon as the data they contain has been processed. This is indicated on the form. Statistics drawn from this data will be kept for future use.
Staff records: Our staff contract reflects the fact that the law allows us to collect some data about employees and those employees have the right to access this. The relevant clause says:
Data Protection
• For the purposes of administration, such as payroll and pension auto-enrolment, it is necessary for the Company to hold and sometimes disclose certain personal data about employees.
• Any data the Company holds about the Employee will only be held for so long as the Employee works for the Company, unless the Company is required to hold it for longer in order to comply with the law. The Company shall take every care to ensure personal data is held securely and in confidence.
• The Employee has the right to inspect data that the Company holds about him/her and, if necessary, update that data.
• If the Employee’s personal information changes at any time, they should inform Helen Bovey, Executive Producer as soon as possible to ensure that the information remains accurate.
WHAT DO WE DO WITH YOUR INFORMATION?
We use your data to personalise your experience of our communications and website, and with your permission, to inform you of future events based on your interests, past purchasing history and/or involvement in past projects with us.
We use anonymised data to analyse audiences for reporting to Arts Council England and other funders/supporters, to help us plan marketing and audience development campaigns and improve our services. It is usually a condition of receiving a grant that we report back to the funding body on number of people engaging in our activities, including statistics about the different range of people who participate. Therefore, we often ask for Equal Opportunity information alongside survey, evaluation or booking forms.
You may at any time update your communication preferences, opting to receive or stop receiving information from us.
DELETION OF DATA:
Data subjects have the right to request to be “forgotten”, Beyond Face will delete records in line with GDPR as follows:
When processing can cause substantial damage or distress.
Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing.
If the personal data was unlawfully processed.
If personal data being erased has been disclosed to third parties, we will inform them about the erasure unless it is impossible or involves disproportionate effort.
If personal information has been processed online, for example on social networks, forums, or websites we will inform any other organisations who are involved to erase links to, copies or replication of “forgotten” personal data.
Beyond Face will not always delete records, a request to be forgotten can be refused where data has been processed:
To exercise the right of freedom of expression and information;
To comply with a legal obligation for the performance of a public interest task or exercise of official authority.
For public health purposes in the public interest;
For archiving purposes in the public interest, scientific research historical research or statistical purposes; or
For the exercise or defence of legal claims.
AMENDING OUR PRIVACY POLICY
This policy will be reviewed at least every 2 years, and when it is updated, we will publish a new version on our website. You should check this page occasionally to ensure you are happy with any changes to this policy.
Current relevant legislation is: the Data Protection Act (“the Act”), the General Data Protection Regulations (“the GDPR”) and the Privacy and Electronic Communications Regulations (“PECR”).
ACCESS TO YOUR PERSONAL INFORMATION
You have the right to obtain from us an electronic or paper copy of all Personal Information concerning yourself, or to speak to a Beyond Face CIC representative on any matter, by e-mailing Helen Bovey on info@beyondface.co.uk or writing to Beyond Face CIC, C/O Fuel Accountancy, C3 Apollo Court 4A Neptune Park, Plymouth, PL4 0SJ. You may be asked to provide proof of your identity and proof of your address as part of this process.