CHANGES TO DATA PROTECTION LEGISLATION -25 MAY 2018

Fri 25 May 2018

Privacy Notice – Music & Arts Service/Bradford Music Education Hub

(This is a working document which will be updated as appropriate and should be taken alongside Bradford Council policies)

CHANGES TO DATA PROTECTION LEGISLATION

New data protection legislation will come into force on the 25th May 2018 and will replace the current UK Data Protection Act. The new General Data Protection Regulation provides a modernised, accountability-based compliance framework for data protection in Europe. It is intended to strengthen privacy rights in relation to personal information.

The new accountability principle in Article 5(2) of the GDPR requires data controllers to demonstrate that they comply with the good practice principles set out in the Regulation,

and states explicitly that this is their responsibility.

This Notice sets out most of your rights under the new laws. We’ll update it again between now and 25 May 2018 when changes come into effect.

Further information about the new law can be found on the Information Commissioners website: https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/

Department or Service Area: Music & Arts Service/Bradford Music Education Hub

City of Bradford Metropolitan District Council (CBMDC) is registered with the information Commissioners Office (ICO) under the provisions of the Data Protection Act 1998. The Council takes its responsibilities under the Act very seriously. This notice provides details of how CBMDC collects and uses information about you. For more general information about how CBMDC uses your information, please refer to the general ‘Privacy Notice’ on CBMDC website. You can find this here: https://www.bradford.gov.uk/privacy-notice/

Music & Arts Service is run and managed by Bradford Council. Bradford Music Education Hub runs alongside the Music & Arts Service.

What is this information?

You give us your information when you sign up for one of our events, or training, update your preferences on our website, book an instrumental/vocal lesson or sign up for ensemble membership. We also keep your details when you sign up to receive email from us. The Music & Arts Service may collect some or all of the following information about you:

  • Name
  • Address
  • Telephone number(s)
  • Medical information for medical emergencies
  • Date of Birth
  • School attended
  • Special Needs information
  • Dietary requirements (trips/conferences/concerts)
  • Email address
  • Credit / Debit card details – if purchasing tickets/paying for instrumental lessons/trips and accessories

Social Media

We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests. Depending on your settings or the privacy policies social media and messaging services like Facebook or Twitter, you might give third parties (like Music & Arts Service) permission to access information from those accounts or services.

Website

You do not have to give us any personal data or private information about yourself to access the information on this site, unless you want to buy items online wish to sign up for instrumental/vocal lessons or ensemble membership or complete online registration forms for events etc. Customer database for instrumental/vocal and Ensembles is provided by Paritor Ensemble and they have a separate privacy policy.

This system does automatically gather certain usage information. This collective data helps us determine how much visitors use specific parts of our site, so that we can improve it and make sure that it is as accessible as we can make it for as many people as possible. We use a system called Google Analytics to find out how people use our site.

Cookies

Cookies themselves are small pieces of information that are stored by your browser on your computer’s hard drive. Our cookies do not contain any information that could be used to discover your identity. We only use cookies when you are providing us with personal data or private information, such as filling in a form online. These hold only a sequential session identification number and are deleted at the end of the transaction. Read more about this in our Cookie Policy.

Future developments may include the use of cookies to enhance our personalised services to customers, but this usage will always be optional. Users can set their computer to accept all cookies, to notify them when a cookie is issued, or not to receive any cookies at any time. The last of these options may mean that personalised services cannot then be provided to that user. See further Council Policy on Cookies.

Who uses this information?

Music & Arts Service officers use this information. See the section on “who are we likely to share this information with.”

What authority does CBMDC have to collect and use this information?

Under the General Data Protection Regulations, Music & Arts Service collects and uses this information under the following categories of lawfulness:

    • Processing is necessary for the performance of a contract with the data subject or to take steps to enter into a contract
    • Processing is necessary to protect the vital interests of a data subject or another person
  • Processing is necessary for compliance with a legal obligation

 

  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party

In general, any information you provide will only be accessed by authorised employees of Music & Arts Service , part of the City of Bradford Metropolitan District Council. We will never share your personal data or private information outside of the Council without first obtaining your consent, unless we are required by law to disclose it. We pass on information with other music services/hubs and outside bodies when dealing with events in order to obtain performance licences and safeguard young people with your consent.

What is ‘person identifiable data’?

The term ‘person identifiable data’ relates to any data that could potentially identify a specific individual. The following fields in Music & Arts Service are classified as person identifiable: Name, age, address, postcode, place of birth, date of birth, gender, telephone number, email address, ethnicity, school, credit or debit card payment – any information about an individual that can be used directly, or in connection with other data, to identify, contact or locate that person.

Why do we use this information?

We aim to be clear when we collect your data and not to do anything you wouldn’t reasonably expect.

If you make a purchase or sign up for an event we usually collect your name, contact details and your bank or credit card information (if making a transaction). Where it is appropriate (and you have the right to decline to give this information) we may also ask for your age, gender or ethnicity.

We use this data to provide you with the events, products, services or information you asked for, ensure we know how you prefer to be contacted, understand how we can improve our communications or events.

Giving you control

With your consent, we will tell you about events, concerts, offers, priority booking and information about our site (for example updates on building works on site). Occasionally, we may include information in these communications from partner organisations or organisations who support us. We make it easy for you to tell us how you want to hear from us (by logging onto our website and updating your preferences in the “My Account” section) or by telling our Box Office team over the phone or in person. You can opt out from these marketing communications at any time – every email sent to you will tell you how to do this.

We do not sell personal details to third parties for any purpose. We only share personal details where appropriate with other music services, hubs and third parties to comply with licencing laws and grant funding. We will only share personal details for the purposes of marketing if you have given explicit consent for us to do this.

If you have opted out of marketing communications, we may still get in touch with you. For example we may email you to give you important information about the events you’ve booked or to tell you about any changes (for example, if a performance has been cancelled or postponed due to unseen circumstances).

We will give you the opportunity to opt out, at any time, from any marketing email and postal communications you receive from us.

Who are we likely to share this information with?

Third Parties

We may share anonymised personal information with other organisations, for example other music services or music hubs and/or Arts Council England, who use this to analyse our pupil/customer base to understand the impact of music provided across the Bradford district in relation to other Council areas.

We will not otherwise share your personal information with third party organisations.

How do we keep this information secure?

Your information will be held and processed on Music & Arts Service systems or systems managed by suppliers on behalf of  Music & Arts Service . We maintain a customer relationship management system called Paritor Ensemble to hold contact details and a record of your interactions with ourselves such as, memberships and registration details, queries, complaints and attendance at special events.

Your information is stored securely on a database with stringent access and use policies. We also undertake quality checks and monitoring to ensure the information we hold is accurate at the time and being used appropriately. The CRM system can only be accessed by people who need it to do their job. Certain data, for example some sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it. Any debit or credit card details that you might supply us for any payments are not retained by the Council, and are not accessible by any Council employee.

We may need to disclose your details if where it is necessary, lawful and fair to do so to

the police, regulatory bodies or legal advisors. We will only ever share your data in other circumstances if we have your explicit and informed consent.

How long do we keep this information?

We have a record retention schedule which details how long we keep different types of records and what we do with them when we no longer need them. Please contact us to find out more.

What are your rights?

You have the right to request CBMDC (Music & Arts Service) to stop processing your personal data in relation to any council service. Wherever possible, we will seek to comply with your request but we may need to hold or process information in connection with one or more of the Council’s legal functions.

If you have any questions about our use of these data, or you wish to request a copy of the information we hold about you, or you wish to discuss your rights in relation to opting out from these processes, please contact the Corporate Information Officer- Dani Mistry, by email at gdpr@bradford.gov.uk or by post to Information Governance Team, CBMDC, 1st Floor, Britannia House, Bradford, BD1 1HX.

If you log in to the Charanga eLearning system

The privacy and GDPR statements for all data processed and controlled by Charanga can be found on Charanga’s main website. Links to specific pages can be found here: