Castle Park Arts Centre

GDPR Policy

16 August 2024

Introduction

Castle Park Arts Centre is committed to protecting the privacy and personal data of all individuals we interact with, in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. This policy outlines how we collect, use, store, and protect personal data.

Policy Statement

We respect the privacy of our employees, volunteers, artists, unit holders and all users of the Arts Centre. We are dedicated to ensuring that personal data is processed lawfully, fairly, and transparently.

Definitions

Personal Data: Any information relating to an identified or identifiable individual.
Processing: Any operation performed on personal data, such as collection, storage, use, disclosure, and destruction.
Data Subject: An individual whose personal data is being processed.
Data Controller: Castle Park Arts Centre that determines the purposes and means of processing personal data.

Data Protection Principles

We adhere to the following principles when processing personal data:

Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and transparently.
Purpose Limitation: We collect personal data for specified, explicit, and legitimate purposes and do not process it further in ways incompatible with those purposes.
Data Minimization: We collect only the personal data that is necessary for our purposes.
Accuracy: We ensure that personal data is accurate and kept up to date.
Storage Limitation: We retain personal data only as long as necessary for our purposes.
Integrity and Confidentiality: We process personal data securely, protecting it from unauthorized access, alteration, or destruction.
Accountability: We are responsible for complying with these principles and can demonstrate our compliance.

Lawful Basis for Processing

We process personal data based on at least one of the following lawful bases:

Consent: The data subject has given clear consent for processing.
Contract: Processing is necessary for a contract we have with the data subject.
Legal Obligation: Processing is necessary to comply with the law.
Legitimate Interests: Processing is necessary for our legitimate interests, provided these interests are not overridden by the rights and interests of the data subject.

Rights of Data Subjects

Data subjects have the following rights regarding their personal data:

Right to be Informed: About how their data is being used.
Right of Access: To their personal data.
Right to Rectification: Of inaccurate personal data.
Right to Erasure: Of their personal data, also known as the 'right to be forgotten'.
Right to Restrict Processing: Under certain circumstances.
Right to Data Portability: To obtain and reuse their personal data across different services.
Right to Object: To the processing of their personal data.
Rights in Relation to Automated Decision Making and Profiling: Not to be subject to a decision based solely on automated processing.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

Encrypting data where appropriate.
Using secure servers and strong passwords.
Limiting access to personal data to those who need it for their work.
Regularly reviewing our data security practices.

Data Breaches

In the event of a data breach, we will:

Notify the Information Commissioner’s Office (ICO) within 72 hours if the breach is likely to result in a risk to the rights and freedoms of individuals.
Inform affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
Document all breaches, regardless of their impact.