Privacy Notice
How your data is recorded, processed, and destroyed
This Privacy Notice details the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe.
We know that there is a lot of information here, but we want you to be fully informed about your rights, and how TAPE uses your data. We hope that the following sections will answer any questions you have. If not, please do get in touch with us.
TAPE have implemented data protection procedures that will ensure compliance with data protection legislation and give our people and service users assurance that we keep their data safe and secure.
What sort of data do we collect and how do we use it?
The type of data we collect depends on why we are processing your data. The data we collect about you will typically be your:
- Name
- Mobile
- Date of Birth
- Address
- Interests
- Access needs
We are only entitled to hold and process your data where the law allows us to. The current law on data protection sets out a number of different reasons for which we may collect and process your personal data. These include:
- Marketing/ Promotion
- Customer feedback collection
- Administration and delivery of our services
- Site protection
Legitimate Interests
In most situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. This may include to satisfy our external quality auditors or our regulators, or to properly report to funders.
Legal compliance
If the law requires us to, we may need to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity.
Consent
In some situations, we can collect and process your data with your consent. For example, when you send a message via our website. When collecting your personal data, we will always make clear to you which data is necessary in connection with a particular service/purpose.
Personal data must be processed lawfully, fairly and in a transparent (principle of ‘lawfulness, fairness and transparency’).
Your data is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. If personal data collected about you is used for a purpose different from that for which it was collected in the first place, we will seek consent for the use for this new purpose or consider another appropriate legal basis. You will be informed prior to using your data for any new purpose.
All data we hold is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (principle of ‘data minimisation’).
To ensure data we hold is accurate and up to date; every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, is erased or rectified without delay (principle of ‘accuracy’).
We keep information about you for no longer than is necessary for the purposes for which your data are processed; (principle of ‘storage limitation’, ‘data retention’).
How we protect your data
We take protecting your data very seriously.
We will treat your data with the utmost care and take all appropriate steps to protect it. We have clear data protection and information security policies and procedures in place, along with Regulatory and other legal obligations to keep your data safe.
We process data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
We have clear data protection and information security policies and procedures in place, along with Regulatory and other legal obligations to keep your data safe.
We protect our IT system from Cyber Attack. Access to your personal data is password-protected, and sensitive data is secured by encryption.
We regularly monitor our system for possible vulnerabilities and attacks, and we carry out penetration testing to identify ways to further strengthen security.
IT Systems
TAPE cares to ensure the security of personal data. When we collect information about you, we also make sure that your information is protected from unauthorized access, loss, manipulation, falsification, destruction or unauthorized disclosure. This is done through appropriate technical measures.
Staffing and Internal Management
We undertake regular reviews of who has access to information that we hold, to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Staff have access to personal information on a ‘need-to-know’ basis so, for example, highly sensitive data such as employment records are only available to managers with the designated permissions to access and process that data.
Your rights – How to access or change your data
You have certain rights under UK Data Protection legislation. These rights include:
- the right to be informed about the collection and the use of your personal data (e.g. through the use of an appropriate privacy notice)
- the right of access to your personal data (by making a subject access request) the right to have inaccurate personal data rectified, or completed if it is incomplete
- the right to erasure (to be forgotten) in certain circumstances
- the right to restrict processing in certain circumstances
- the right to data portability
- the right to object to processing in certain circumstances
- rights in relation to automated decision making and profiling
- the right to withdraw consent at any time (where relevant)
- the right to complain to the Information Commissioner
Subject access requests
You can ask for a copy of the information we hold about you at any time. When you do, we have to respond within a calendar month. A request can be made by any method, e.g. in person, by telephone or in writing. You do not need to say explicitly that you are making a subject access request, for example, you may ask for a copy of your file.
We may need to check that you are who you say you are and that you are entitled to the information you are requesting. This is to ensure the safety of everyone’s data. We may also need to ensure that we do not release anyone else’s data in responding to your request.
You have the right to obtain:
- confirmation that your data is being processed
- access to your personal data
- other supplementary information – this largely corresponds to the information that should be provided in a privacy notice
Any request for personal data must be referred to the Director of Operations and Development (DO&O) as soon as possible. They can be contacted at info@tapemusicandfilm.co.uk. The DO&D will follow current guidance from the ICO on how to deal with the request https://ico.org.uk/for-organisations/sme-web-hub/how-to-deal-with-a-request-for-information-a-step-by-step-guide/.
Complaints
If you have any queries or concerns about the processing of your information that is available with us, you may email our Complaints Officer at TAPE Community Music and Film, Berthes Road, Old Colwyn, Conwy LL29 9SD, email: info@tapemusicandfilm.co.uk. We will address your concerns in accordance with applicable law.
The Regulator
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113, or visit www.ico.org.uk/concerns (opens in a new window). Please note that we cannot be responsible for the content of external websites.
