Dorset Moon Privacy Policy

Last updated 21 May 2019 – Quick link to Cookie Policy

Dorset Moon, is a project commissioned by The Arts Development Company, funded through its project Culture+, in association with three partners:

  • Inside Out Dorset Festival (produced by Activate)
  • b-side Festival
  • Bournemouth Arts by the Sea Festival.

The Arts Development Company (ADC) is a UK-based community interest company (CIC) formed in 2015 and a public service mutual working in Dorset and beyond. For simplicity, throughout this notice, ‘we’ and ‘us’ means ADC and all our projects including Culture+, through which Dorset Moon is funded. For clarity, when you provide us with information you are providing ADC with this information.

This Privacy Policy describes ADC’s policies and procedures on the collection, use, storage and disclosure of your personal data in connection with the Dorset Moon service. By accessing the Dorset Moon website and providing your information you indicate your acceptance of this Privacy Policy, as amended from time to time.

Introduction

This Privacy Notice explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we will store and handle that data and keep it safe.

We want you to be fully informed about your rights, and how Dorset Moon, as a project commissioned by The Arts Development Company as well as its partners in this project uses your data.

How to contact us

We hope the following sections will answer any questions you have but if not, please do get in touch with us. You should contact The Arts Development Company’s Data Protection Officer:

Sarah James, The Data Protection Officer, The Arts Development Company, The Little Keep, Barrack Road, Dorchester, DT1 1SQ. Email hello@theartsdevelopmentcompany.org.uk

Explaining the legal bases we rely on

The law on data protection sets out several different reasons for which an organisation may collect and process your personal data. It will always be clear, when we collect your data, what we will be using it for. The likely lawful reasons for processing your data will, include:

Consent

In specific situations, we can collect and process your data with your consent, for example, when you tick a box to receive email newsletters.

Legal obligation

We may be required by law to process your data in specific situations. For example, we may be required to pass on details of people involved in fraud or other criminal activity affecting ADC or its festival partners to law enforcement.

Legitimate interest

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part providing our services, and which does not materially impact your rights, freedom or interests. Where we rely on legitimate interest, we will always make sure it is appropriate for us to do so.

When do we collect your personal data?

When you contact us by email or phone, for example to ask for more information about the Dorset Moon events, or because you have a complaint or query

If you contact us by email your name, email address and any other information you provide will be stored in our email package and on the computers we use to access our emails. We will only use the information you provide for the purposes of responding to your email. If your email relates to one of our partners, then we may pass your email on to them if it is appropriate to do so.

If you contact us by phone, we will only use the information you provide for the purposes of responding to your call (e.g. noting your name, number and query for response purposes). If your call relates to one of our partners, then we may pass the above details on to them if it is appropriate to do so. We may also record/pass on any additional information requested by us for the purposes of responding to your query, for example an email address (see above).  Any personal data or recorded notes from our conversation needed for future reference will be held securely on our password-protected systems.

When you use the Dorset Moon website

When someone visits the Dorset Moon website, we make use of the Google Analytics service to collect standard information about visitors to the sites and their behaviour (e.g. what pages they viewed). The data provided by Google Analytics is anonymised and in no way enables us to identify individual visitors, however, Google Analytics will place a cookie on your device to enable the service. For more information about how Google Analytics cookies work on websites visit: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage. For more information about cookies and how you can disable them, please visit http://www.allaboutcookies.org.

The Dorset Moon website is hosted in the UK using industry standard website hosting technologies and security.

When you fill out a form on the Dorset Moon website

If you fill out one of our contact forms or any other web form on the Dorset Moon website, it will send an email to us. A copy of your email is not stored by the website and will be stored within our secure email system. The data collected via the form will be used for the purposes of dealing with your enquiry.

When you sign up for our newsletters

We provide a newsletter which you can sign up to, to keep up to date with the Dorset Moon events. We may also use this newsletter to tell you about similar events we are organising and if you opt to do so (by providing consent when you sign up to the newsletter), we may pass your details to our partners so you can receive information about their services and events too.

We use a third-party system for storing our newsletter subscribers email address (and name) and we only use the data collected for the purposes set out above. We have made sure the third-party processor is compliant with UK data protection laws. Whilst your data within the system will not be stored within the UK or EU, they provide the necessary assurances with regards to restricted transfers of data.

When you interact with us via social media (e.g. Facebook, Instagram and Twitter)

If you contact us or interact with us via any of our social media channels, we do not record or hold any data about the interaction other than within the usual social media service provided.

In person at Dorset Moon events

You may be approached and asked to fill out an evaluation survey which may ask for such information as your postcode, age range, spending while at the event etc.  All information collected is anonymous and you will not be asked to give your name or any other identifiable information. It will be held for the purposes of assessing where attendees at Dorset Moon have come from, how far they have travelled, what ages they are, whether they have stayed in the area and what they have spent in Dorset.  This information will be held (anonymously) within a password-protected system until 2033 and processed to ascertain the economic impact of Dorset Moon within the three venue towns and wider Dorset.

Our processing of your data when received from a third-party (e.g. a partner or third-party website) where you have given consent to share the data

If we are provided, by a third-party, with your data for the purposes of contacting your about the Dorset Moon events, we will make sure you have consented to receive such information and notify you, that we have your data within one month of receiving it (so you know that we have it, why we have it and what we will be using it for).

When you provide comments or reviews of the Dorset Moon events

If you provide us with comments or reviews of the Dorset Moon events, we may publish these on our website and or social media. If your comment or review includes information about a team member or partner who provided a service, it may be passed on to them if you request us to do so.

When you fill in any forms at an event (e.g. a health and safety incident form)

If you fill out any other forms at a Dorset Moon event, for example, if an accident happens, an ADC team member (or a member of its partner organisations) may collect your personal data for the purposes of fulfilling health and safety regulations. Your data will only be used for this purpose.

When you use our car parks and premises which may have CCTV systems

We or our partners at the Dorset Moon venues may make use of CCTV systems. If CCTV is in use it will be clearly signposted and will be operated for the purposes of security and for the protection of you whilst at our events, the general public and our staff.

If we discover any criminal activity (alleged or otherwise) through our use of CCTV, we will process this data for the purposes of preventing or detecting crime and, if officially requested provide it to law enforcement, provided it is lawful for us to do so.

If you’re a partner

If you are one of our partners or affiliates for the Dorset Moon events, we may hold, for the purposes of managing our relationship, a contact name, job title, organisation name and address, contact phone number and email address. This data is held in a password-protected contact database.

Retention

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

Data collected for the Dorset Moon project will be kept until at least 31 December 2033 for evaluation purposes and to report to the Department for Communities and Local Government for monitoring purposes. After that time, it will be destroyed in a secure manner.

How we protect your personal data

We know how much data security matters to all Dorset Moon visitors and partners. We will treat your data with the utmost care and take all appropriate steps to protect it. We will always make sure we implement appropriate technical and organisational measures to ensure your data is kept securely. We regularly monitor our systems for possible vulnerabilities and attacks.

Who do we share your personal data with?

We may share your personal data with trusted third parties for evaluation and monitoring purposes, for example, our partnership organisations as listed above. We will rely on legitimate interest to do this and ensure:

  • We provide only the information they need to perform their specific services.
  • They may only use your data for the exact purposes we specify in our contract with them.
  • We work closely with them to ensure that your privacy is always respected and protected.
  • If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

We will only share your data with third parties for their own purposes in very specific circumstances, for example:

  • With your consent, given at the time you supply your personal data, we may pass that data to a third party for evaluation and monitoring purposes.
  • For fraud management, we may share information about fraudulent or potentially fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.

We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, in your country of origin or elsewhere, upon a valid request to do so. These requests are assessed on a case-by-case basis and we take your privacy into consideration before disclosing such information.

For further information please contact our Data Protection Officer.

Third party processors

Where we use third-party cloud-based services for the purposes of effectively running the Dorset Moon events, we will make use of these services and process your data via them only after carrying out due diligence for the purposes of ensuring their compliance with data protection, maintaining adequate security of your data and ensuring they apply adequate data protection principles to the processing of the data we supply. We also make sure that a data processing agreement or contract is in place to protect your data.

Your rights

Under current data protection legislation in the UK, you have rights as an individual which you can exercise in relation to the data we store and process about you. You can find more information about your rights on the Information Commissioner’s website: https://ico.org.uk/for-the-public/ 

Complaints

If you want to make a compliant about the way we are processing your data, you can contact our Data Protection Officer (using the contact details above). You also have the right to complain to the Information Commissioner’s Office: https://ico.org.uk/concerns/

How to withdraw consent and object to processing

Where we are processing your data and needed to ask your permission to do so, you are able to withdraw your consent at any time. If you wish to stop receiving our marketing emails you can do so, by clicking on the “unsubscribe” link at the bottom of the email. Please note that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated.

You also have a right to ask us about any automated processing of your data and ask us to stop that processing (although we do not carry out any automated processing of your data).

In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

If you wish to raise concerns about the way we are processing your data or would like to raise an objection, then please email us via hello@theartsdevelopmentcompany.org.uk

Keeping your data up to date

It is important that any of your data that we process is kept up to date. We may from time to time ask you to verify your contact details but if you wish to update any information, we hold about you, please contact us using the contact details below.

Erasure of your data (the “right to be forgotten”)

Under some circumstances you may request us to delete your data from our systems. Where this is possible (e.g. we don’t have any legal purpose for continuing to process your data) we will erase it from our systems.

If you wish to exercise your right to be forgotten, please contact us via the contact details below.

Portability

Your right to portability allows you to request a machine-readable format of the data you supplied to us and associated service logs (where we store them). Please contact us, using the contact details below, if you wish to receive a CSV export of your data.

Access to your data

You have the right to ask us about what data we hold about you, how we process it and provide you with a copy of the information, free of charge and within one month of your request.

To make a request for any personal information we hold and process about you, we would prefer it if you could put it in writing or in an email to our Data Protection Officer. We will need to verify your identity before providing the information and where necessary may contact you further to ensure we understand what data you are requesting.

Any questions?

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it. If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:

Email us on hello@theartsdevelopmentcompany.org.uk

Or write to us at:

Sarah James, Data Protection Officer, The Arts Development Company, The Little Keep, Barrack Road, Dorchester, DT1 1SQ

Changes to our privacy notice

We may change or update elements of this privacy notice from time to time or as required by law. The most current version of our privacy notice is available on the Dorset Moon website.

Produced by Dorset Festival Consortium:

Commissioned by:

Funded by:

Produced by Dorset Festival Consortium:

Commissioned by:

Funded by: