Privacy and Data Protection Policies
Vital Xposure is a registered charity and a company limited by guarantee. We engage in a range of artistic activities, but predominantly create bold, dynamic theatrical performances for the public.
As an organisation that processes personal data, we are classified as a Data Controller under the General Data Protection Regulation (GDPR) or Data Protection Act 2018. The data protection legislation covers the use of personal data, held on electronic systems, in paper filing and online identifiers such as location data and cookies.
We are registered with the Information Commissioner’s Office (ICO) (reference number: ZA330909).
We are committed to safeguarding the privacy of our website visitors, newsletter subscribers and audience members.
Access to your information
You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information held by us, please email firstname.lastname@example.org or write to us at Empire 2, 291 Mare Street, London E81EJ
Information we collect
We collect information about you when you use our site, or if you give consent for us to add you to our newsletter when you register online, or if you ask us to add you to our newsletter via email, or complete an audience feedback form. This is all done using Cookies and Mailchimp, which also stores the data on our behalf. This will include:
– Information about your use of our site and engagement with our newsletter including details of your visits such as pages viewed and the resources that you access. Such information includes traffic data, location data and other communication data. This information does not identify you in anyway.
– Information provided voluntarily by you. For example, when you register for information, make a purchase or communicate with us by any means.
For more information about Cookies, click here.
You can unsubscribe from our newsletter mailing list at any time by clicking the unsubscribe link at the bottom of the newsletter, sent via Mailchimp, or by emailing email@example.com.
How we use this information
As a production company creating artistic work for the public, keeping people informed about what we do is an essential aspect of our work. The majority of our contact with you will be to let you know about our activities but we may also tell you how you can support us, for example with a donation.
We are a National Portfolio Organisation funded by Arts Council, England. Subject to your prior consent, we share information gained from ticket purchases and any surveys you complete with Arts Council, England.
We may also use Google Forms to create and send online surveys. These are usually aimed to ask for your feedback if you have attended one of our events, online or physically. The data we collect in this way remains anonymous and does not identify you, unless you specifically provide us with
Disclosing Your Information
- In the event that we sell any or all of our business to the buyer.
- Where we are legally required by law to disclose your personal information.
- To further fraud protection and reduce the risk of fraud.
Data Protection Policy
Vital Xposure holds discreet information on all of its employees, volunteers and contributors. This may include information that allow to identify the individual, which is defined as ‘personal data’ under the law.
The Policy sets out our procedures for collection, storage and use of personal data
Personal data is defined by the Information Commissioners Office (“the ICO”) as data that relates to a living individual who can be identified
- from that data, or
- from that data and other information in the possession of (or likely to come into the possession of) the data controller e.g: expressions of opinion about an individual.
- from codified records that do not identify individuals by name but, for example, bear unique reference numbers that can be used to identify the individuals concerned.
Special categories of personal data means information that could be used in a discriminatory way, so needs to be treated with greater care than other personal data, i.e: information about:
- race or ethnic origin
- political opinions,
- religious beliefs or other beliefs of a similar nature,
- trade union membership
- physical or mental health or condition,
- sexual life,
- commission or alleged commission by the data subject of any offence, or
- any proceedings for any offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.
When we collect and process personal data we will ensure the individual (‘data subject’ under the law) has given us their consent beforehand and that they are aware of their right to withdraw their consent. The law defines consent as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’
We will seek consent in one of the following ways:
- in writing
- by asking individuals to tick a box
- verbally, followed by a written record and affirmation of the consent by the individual (‘data subject’)
- through acceptance of the proposed processing of personal data, such as accepting cookies when visiting our website
In processing personal data we will:
- not contact individuals for direct marketing purposes by email, the internet, phone, fax or any new electronic systems that may be introduced without prior consent. Business to business communications to generic addresses such as “admin@” “info@” do not require consent.
- provide opt-out opportunities in every e-newsletter mailing to ensure compliance and accuracy of the data we hold
When do we collect data?
Vital Xposure advertises paid and voluntary roles and places to participation programmes via online channels and a detailed information pack for each role and place is hosted on our website.
We ask potential applicants to submit specific information, such as a CV and a cover letter, or fill out an application form which is available in both online and word formats. In the application form we ask for contact details to allow us to get in touch with the applicant and notify them of the outcome of their application.
We ask potential applicants to complete and submit a separate Equality and Diversity Monitoring form. This is made available to download as a document from our website, so that it can be filled out and submitted along with other application documents, or included as a distinct section at the end of an online application form. In either formats of the form, there is clear information notifying the applicant that the Equality and Diversity Monitoring form:
- is used for statistics and diversity data monitoring
- is voluntary to complete
- will be kept separate to the recruitment process (shortlisting, interviewing and job or role offer).
After the shortlisting process, unsuccessful candidates will receive a letter to inform them about the outcome of the application. This letter is usually sent to the email address they have provided us with. In the letter we will offer the applicant the options to:
- have their personal data stored on our system for more than 12 months, should they wish to be considered for another role. If they give us their consent in writing, we will confirm receipt and record the date and method consent is given.
- continue to receive communications from Vital Xposure by registering to our e-newsletter mailing list; a link to sign up to our mailing list is also provided and, once clicked, it clearly shows that we use Mailchimp for our e-newsletter list (link and icon), which is a GDPR compliant online marketing tool.
We will also notify them that:
- Vital Xposure will never sell, trade or rent personal data to third parties
- their application documents will be destroyed after 12 months if unsuccessful
- they have the right to ask us further information on the data we hold for them (the process is defined by law as ‘data subject request’)
2. Employee records:
The employee contract will reflect the fact that it is necessary for Vital Xposure to hold and sometimes disclose certain personal data about employees, such as payroll and pension auto-enrolment.
- Any data the company holds about the employees will only be held for so long as the Employee works for Vital Xposure. Following termination of employment Vital Xposure will only keep records as deemed necessary to comply with its legal obligations and in line with minimum statutory retention periods (See the Company’s Data Retention Schedule).
- The Employee has the right to inspect data that we hold about them and, if necessary, update that data. Normally inspection of files can be within 10 working days of a request.
- If the Employee’s personal information changes at any time, they should inform the Executive Director or the General Manager as soon as possible to ensure that the information remains accurate.
3. Volunteers records:
The law does not provide clear guidelines for the retention of volunteer records. Vital Xposure will adhere to the following principles when collecting and processing volunteer data:
- we will only collect data that is relevant to the volunteer role
- we will process all volunteer data fairly and lawfully
- we will not keep any data for longer than required
- we will not sell, trade or rent their personal data to third parties
- we will ensure volunteers are aware of their rights to access the data we hold for them
- we will only collect and process volunteer personal data if we have their explicit consent
The volunteer data that we may need to collect will be based on the ‘need to know’ basis:
- Contact details, as provided by the individual
- Details of experience, skills and preferences used to assess suitability for a role (recorded on application form or gained through interview)
- Equality and Diversity Monitoring data, for statistics and diversity monitoring purposes
- Information relating to DBS checks
- Supervision notes
Some of this information is regarded as “sensitive data” under the law and will be processed accordingly.
4. Audiences records:
We ask audiences to provide feedback on a Vital Xposure production or show they are attending. The feedback is collected for:
- artistic purposes: to evaluate our learning about the audience experience and measure the impact of our work. and
- statistical purposes: to evaluate the reach of our work and understand the profile of our audiences.
If audiences book their ticket or confirm attendance via Vital Xposure, we ask for their feedback via a paper form or an online survey. We ensure that;
- we only ask questions relevant to the purpose (see above)
- we include our contact details on the form
- we tell audiences completion of the form is voluntary and anonymous
As a touring company, we normally rely on each venue’s booking system and do not have direct access to audiences. We endeavour to enter into data-sharing agreements with partnering venues to collect data and information on:
- total ticket sales and attendance, including breakdown of tickets sold and concessions / comps offered
- audiences profile and postcode breakdown
- comments and qualitative feedback
The agreements also allow the partnering venue to include an option to direct their customers to a marketing link where individuals can choose to register to our mailing list.
Data Retention Schedule
The Data Protection Act 2018 does not dictate how long an organisation should keep personal data for, however the guiding principle is that ‘personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes’.
Vital Xposure maintains a schedule to indicate the kind of personal data retained and the maximum period it will be retained for. If there is no need to keep personal data that long, then it will be disposed of securely. There are certain categories of data which may be anonymised after the retention timescale and still processed; these categories are clearly defined in the schedule.
The Data Retention Schedule can be provided upon request.
Data protection officer
Vital Xposure is not required to have a designated Data Protection Officer under the GDPR, however, the General Manager is responsible for ensuring Data Protection Compliance, in collaboration with the Executive Director.