1. Your personal data – what is it?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”) which are effective from 25 May 2018.
2. Who are we?
The York Mystery Plays Supporters Trust (YMPST) is the data controller. This means the Trust decides how your personal data is processed and for what purposes.
3. How do we process your personal data?
YMPST complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
We use your personal data for the following purposes: –
- To enable us to inform members and other interested individuals about news, events
and activities concerning the York Mystery Plays;
- To circulate information about auditions and productions of York theatrical productions in general which an especial emphasis on Mystery Plays related productions
- To administer membership records;
- To coordinate the work of our volunteers;
- To maintain our own accounts and records (including the processing of gift aid applications);
- Carry out our contractual obligations;
- To respond when an individual or group contacts YMPST.
4. What is the legal basis for processing your personal data?
- YMPST has a legitimate interest in keeping members and other interested parties informed of news, events and activities concerning the York Mystery Plays as well as theatre in York
- Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement;
- Processing is carried out by a not-for-profit body and the processing relates to members or former members and those who have contact with YMPST in connection with the purposes detailed above.
5. Sharing your personal data
Your personal data will be treated as strictly confidential save where we are legally required to disclose information (e.g. HMRC for Gift Aid claims; to the police for the purpose of crime prevention; to the NHS to protect individuals at risk). We will never sell or rent your data to third parties. We will only share your data with third parties with your explicit consent.
6. How long do we keep your personal data?
When we use your data because of the legitimate interest of keeping you informed of news, events and activities your information will be retained for as long as you are either a member of the Trust or have asked to be included in our circulation list. If you have made a donation to us under Gift Aid we will keep a record of this in line with HMRC requirements.
7. Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –
- The right to request a copy of your personal data which YMPST holds about you;
- The right to request that YMPST corrects any personal data if it is found to be
inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for
YMPST to retain such data;
- The right to request that the data controller provide the data subject with his/her
personal data and where possible, to transmit that data directly to another data
controller, (known as the right to data portability
- The right, where there is a dispute in relation to the accuracy or processing of your
personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data.
- The right to lodge a complaint with the Information Commissioners Office.
8. Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
9. Photographs, Videos and Other Media
YMPST will use photographs, videos and other media formats to publicise the activities of YMPST and for no other purpose. If a person or persons used in the material asks for it to be destroyed that will be done. In general, the material will not be held for longer than necessary however some material may be collected as part of the historical record and archives of the Mystery Plays in which case they may be held for an indefinite period.
Before photographing or filming children or vulnerable adults, their parent/guardian must be informed, and their written permission obtained. They will be told what the material will be used for and if the images are to be used on the web or on social media. Until the written permission of their parent/guardian is obtained photographs and videos of children and vulnerable adults will not be taken.
Adults and young people will be asked to consent to being photographed or filmed. If they do not consent they will not be photographed or filmed.
10. Sending Data Outside of the EEA/Mailchimp
The only instance that would involve YMPST sending your personal information outside of the EAA is to add to our Mailchimp account. Mailchimp is software that provides easy options for sending emails. Mailchimp uses multiple data centres in the USA.
Mailchimp have certified their compliance with the EU-US/Swiss-US Privacy Shield Frameworks. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA.
11. Contact Details
To exercise all relevant rights, queries or complaints please in the first instance contact YMPST at the De Grey Rooms, St Leonards Place, York YO17HD or by email at firstname.lastname@example.org or by telephone 01904638173.
You can contact the Information Commissioners Office on 0303 123 1113, via their email contact form or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.