DATA PROTECTION AND PRIVACY POLICY

Overview

Key details

​This Data Protection and Privacy Policy supersedes all previous Data Protection policies.

Introduction

In order to operate, Hurn Court Opera needs to gather, store and use certain forms of information about individuals (data subjects).

These can include members, employees, contractors, suppliers, volunteers, audiences and potential audiences, business contacts and other people the group has a relationship with or regularly needs to contact.

This policy explains how this data should be collected, stored and used in order to meet Hurn Court Opera’s data protection standards and comply with the law.

Why is this policy important?

This policy ensures that Hurn Court Opera:

• Protects the rights of our members, volunteers and supporters

• Complies with data protection law and follows good practice

• Protects the group from the risks of a data breach

 

Roles and responsibilities

Who and what does this policy apply to?

This applies to all those handling data on behalf of Hurn Court Opera, e.g.:

• Members and trustees

• Committee members

• Employees and volunteers

• Contractors/3rd-party suppliers

It applies to all data that Hurn Court Opera holds relating to data subjects, including:

• Names

• Email addresses

• Postal addresses

• Phone numbers

• Any other personal information held (e.g. financial)

Everyone who has access to data as part of Hurn Court Opera has a responsibility to ensure that they adhere to this policy.

Data Controller

The Data Controller for Hurn Court Opera is the Company Secretary. That person is responsible for why data is collected and how it will be used. Any questions relating to the collection or use of data should be directed to the Data Controller.
 

Data protection principles

1. We fairly and lawfully process personal data

Hurn Court Opera will only collect data where lawful and where it is necessary for the legitimate purposes of the group.

• The name and contact details of members, trustees, committee members, employees, volunteers, contractors, suppliers and performers will be collected when they take up a position or are contracted, and will be used to contact them regarding group administration related to their role.
  Further information, including personal financial information and criminal records information may also be collected in specific circumstances where lawful and necessary (in order to process payment to the person or in order to carry out a DBS check).

• A data subject’s name and contact details will be collected when they make a booking for an event. This will be used to contact them about their booking and to allow them entry to the event.

• A data subject’s name, contact details and other details may be collected at any time (including when booking tickets or at an event, or when they become a Patron, Friend or supporter), with their consent, in order for Hurn Court Opera to communicate with them about group activities, and/or for Direct Marketing. See ‘Direct Marketing’ below.

2. We only collect and use personal data for specified and lawful purposes

When collecting data, Hurn Court Opera will always explain to the data subject why the data is required and what it will be used for, e.g.

'Please enter your email address in the form below. We need this so that we can send you email updates for group administration including about rehearsal and concert schedules, subscription payments and other business.'

We will never use data for any purpose other than that stated or that can be considered reasonably to be related to it. For example, we will never pass on personal data to 3rd parties without the explicit consent of the data subject.

3. We ensure any data collected is relevant and not excessive

Hurn Court Opera will not collect or store more data that the minimum information required for its intended purpose.

For example, we need to collect e-mail addresses from supporters in order to be able to contact them about future activities, but data on their marital status or sexuality will not be collected, since it is unnecessary and excessive for the purposes of group administration.​

4. We ensure data is accurate and up to date

Hurn Court Opera will ask members, volunteers and staff to update their data on an annual basis. This will be done through an email request for changes to personal data.

A data subject will also be able to update their data at any point by contacting the Data Controller.

5. We ensure data is not kept longer than necessary

Hurn Court Opera will keep data on individuals for no longer than two (2) years from the last contact with the data subject, except where Gift Aid has been agreed, in which case we do not hold the information for more than seven (7) years.

6. We process data in accordance with data subjects’ rights

Under Data Protection law, data subjects have certain rights, in particular:

• The right of access - the right to receive a copy of the personal information we hold

• The right of rectification - the right to require us to rectify personal information that is inaccurate; this includes the right to ask us to complete information that is incomplete

• The right of erasure - the right to require us to erase and permanently remove personal information from our database.

These rights can be exercised by writing to the Data Controller. Any such request will be actioned within thirty (30) days of the request being received.

7. We keep personal data secure

Hurn Court Opera will ensure that data held by us is kept secure.

• Electronically held data will be held within a password-protected and secure environment

• Passwords for electronic data files will be re-set each time an individual with data access leaves their role/position

• Physically-held data (e.g. membership forms or email sign-up sheets) will be stored in a locked, fireproof cupboard

• Keys for locks securing physical data files should be collected by the Data Controller from any individual with access if they leave their role/position. The codes on combination locks should be changed each time an individual with data access leaves their role/position

• Access to data will only be given to relevant trustees/ committee members/ contractors where it is clearly necessary for the running of the group. The Data Controller will decide in what situations this is applicable and will keep a master list of who has access to data

8. Data breach

In the event of a data breach, each data subject will be contacted by email or telephone to explain what has happened and the action being taken to remedy the breach.

9. Transfer to countries outside the UK

Hurn Court Opera will not transfer data to countries outside the United Kingdom (UK), unless the country has adequate protection for the individual.

 

Direct marketing

Hurn Court Opera will regularly collect data from consenting supporters for marketing purposes. This includes contacting them to promote concerts, updating them about group news, fundraising and other group activities.

Any time data is collected for this purpose, we will provide:

• A clear and specific explanation of what the data will be used for (e.g. ‘Tick this box if you would like Hurn Court Opera to send you email updates with details about our forthcoming events, fundraising activities and opportunities to get involved’)

• A method for users to show their active consent to receive these communications (e.g. a ‘tick box’)

Data collected will only ever be used in the way described and consented to (e.g. we will not use email data in order to market 3rd-party products unless this has been explicitly consented to).

Every marketing communication will contain a method through which a recipient can withdraw their consent (e.g. an ‘unsubscribe’ link in an email). Opt-out requests such as this will be processed within thirty (30) days.

 

Cookies on the Hurn Court Opera website

A cookie is a small text file that is downloaded onto ‘terminal equipment’ (e.g. a computer or smartphone) when the user accesses a website. It allows the website to recognise that user’s device and store some information about the user’s preferences or past actions.

​

Hurn Court Opera employs essential cookies on our website www.hurncourtopera.org in order to monitor and record its activity. This allows us to improve users’ experience of our website by, for example, allowing for a ‘logged in’ state, and by giving us useful insight into how users as a whole are engaging with the website.

A pop-up banner on the Hurn Court Opera website activates when a new user visits the website. This advises the user that the website employs only essential cookies and invites the user to confirm that they have read the banner. The user can ignore the banner and continue browsing, which implies confirmation. The banner also includes a link to this Data Protection and Privacy Policy.

The cookies employed are listed below. It is possible to delete, disable or block cookies in most computers and smartphones in the device's settings.

​

Cookie name                        Purpose                                                                        Duration                                       Cookie type

XSRF-TOKEN                    Cookie for fraud detection of calls                          Session                                          Essential

hs                                            Security cookie for Hive (legacy)                            Session                                          Essential

svSession                               Session cookie for identification                              6 months                                      Essential

SSR-caching                        Performance cookie for rendering                          24 hours                                       Essential

TS*                                         Cookies for attack detection                                    Session                                          Essential

bSession                               Used for system effectiveness measurement        24 hours                                       Essential

fedops.logger.sessionld      Tracking session errors and issues (resilience)        12 months                                    Essential

_wixAB3|*                             Cookie for site experiments                                      6 months                                      Essential

server-session-bind            Cookie for API protection                                         Session                                         Essential

client-session-bind             Cookie for API protection                                         Session                                         Essential

​