Privacy Notice for Brewery Customers*
Kendal Brewery Arts Centre (The Brewery) is committed to a policy of protecting the rights and privacy of our customers. In accordance with General Data Protection Regulations 2018, this Privacy Notice outlines the basis on which any personal data we collect from you, or that you provide to us, will be stored, processed and deleted by the Brewery.
Who we are and how to contact us
The Kendal Brewery Arts Centre Trust Ltd is the Data Controller for this organisation.
Our address is The Brewery Arts Centre, 122a Highgate, Kendal, Cumbria. LA9 4HE
Tel No: 01539 722833
Email: admin@breweryarts.co.uk
Our Information Commissioner’s Office Registration No is Z4869165
Information we may collect from you
We will only collect enough personal data from you to provide you with the service you have requested. We may collect and process the following data about you:
- Information you give us. You may give us information about yourself by filling in forms on our site www.breweryarts.co.uk or by corresponding with us by phone or email. This includes information you provide when you register to use our site, subscribe to our services, search for a product, place an order on our site, participate in social media functions on our site, enter a competition, promotion or survey, and when you report a problem with our site or services. The information you give us may include but may not be limited to your name, address, email address and phone number, financial and credit card information, communication preferences.
- Information we collect about you. With regard to each of your visits to our site, we may automatically collect the following information – the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
- Sensitive personal data. We may collect sensitive personal information about you including information about your racial or ethnic origin. Such Sensitive Personal Data shall only be collected after having obtained your explicit consent to do so or where it is necessary to do so to comply with legal requirements.
*Excluding Students on Creative Learning Courses
How we will use the information you give us and the legal basis we will adopt for processing your data.
General Data Protection Regulations require us to process data based on the following six criterion…
- Consent: the individual has given clear consent for the Brewery Arts Centre to process their personal data for a specific purpose
- Contract: the processing is necessary for a contract the Brewery Arts Centre has with an individual, or because they have asked us to take specific steps before entering in a contract
- Legal obligation: the processing is necessary for the Brewery Arts Centre to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life
- Public tasks: the processing is necessary for the Brewery Arts Centre to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law
- Legitimate interests: the processing is necessary for the legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
Below we outline how we will use the information you give us and the legal basis on which it is processed…
- To undertake the purchase of a ticket, undertake a membership, make a reservation for a service e.g. table reservation or attend an event or performance at the Brewery.
- To ensure existing customers (as outlined above) are aware of similar performances, events, courses, services, appeals and activities available at the Brewery or offered by third-party theatre companies or festivals associated with the Brewery
- To undertake analysis of box office data, to understand the reach, levels of engagement, impact of our programme, marketing, public relations and social media activity.
In circumstances 1, 2 & 3, we assess that the processing is necessary for the legitimate interests of the Brewery (unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests).
- To make specific and particular invitations to those who engage in the Brewery’s programme to support our work through a donation.
We assess in circumstance 4 the specific and time-limited consent of the individual must be obtained for data processing to be undertaken.
Who will process your data?
Your data will only be processed by designated members of the Brewery Arts Centre, in particular, Sales, Marketing, Fundraising and House Management departments. Your data will not be shared with any other third party organisations without your specific consent.
How will data be stored and managed?
All data, excluding table reservations, including name, address, age, telephone numbers communication preferences and email address will be stored by Spektrix Ltd, 3 Dorset Rise, London EC4Y 8EN
ECA
Your data will not be transferred outside the European Economic Area
How long will your data be stored?
Below we identify the length of time we will process specific types of your data. These timescales vary with different legal and operational criterion, as noted below…
Customers – booking performances, screenings, events, courses or workshops 5 years
Customers – making reservations in our catering outlets 5 years
Customers with Brewery Membership or Business Club Membership during Membership and for 3 years afterwards
Artists submitting requests to exhibit work 1 year
Parents & guardians of young people engaging with our learning programme. 20 months
After the time noted above you will be asked to sign up for further data processing and communication with the Brewery. If you do not sign up[ your data will be removed from our system
Your rights
You have a number of statutory rights. Subject to certain conditions, and in certain circumstances, you have the right to:
- request access to personal information – this is usually known as making a data subject access request and it enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
- request rectification of personal information – this enables you to have any inaccurate or incomplete personal information we hold about you corrected
- request the erasure of personal information – this enables you to ask us to delete or remove personal information where there’s no compelling reason for its continued processing
- restrict the processing of personal information – this enables you to ask us to suspend the processing of personal information, e.g. if you contest its accuracy and so want us to verify its accuracy
- object to the processing of personal information – this enables you to ask us to stop processing personal information where we are relying on the legitimate interests of the business as our legal basis for processing and there is something relating to your particular situation which makes you decide to object to processing on this ground.
Access request
Based on your individual rights you can request access to personal information held by contacting the Brewery Arts Centre on 01539 722833
- The Brewery Arts Centre will not charge for complying with a Data Subject Access Request
- We will respond to your Access Request within 30 days
- We reserve the right to refuse or charge for a request which the Data Controller considers to be manifestly unfounded or excessive. The Brewery Arts Centre will inform you of the Data Controller’s decision within 30 working days. The Brewery Arts Centre will charge £10 + VAT per hour for the time taken to process a manifestly unfounded or excessive request. If you disagree with the assessment of the Data Controller you have the right to complain to the Information Commissioner’s Office (ICO) or seek judicial remedy.
Data breaches
The Brewery Arts Centre has a duty to report certain types of data breach to the ICO, and in some cases to contact you e.g. when it could result in discrimination, damage of reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage to you.
The Brewery’s GDPR Privacy Policy Document outlines in detail how we will detect, report and investigate a breach, based on the types of data held and where we will be required to notify the ICO and you.
Information Commissioner’s Office (ICO)
If you think your data has been misused or that the Brewery hasn’t kept it secure, you should contact us. 01539 722833, email: admin@breweryarts.co.uk.
If you’re unhappy with our response or if you need any advice you should contact the Information Commissioner’s Office ( ICO ).
Telephone: 0303 123 1113.
https://www.gov.uk/data-protection/make-a-complaint
Privacy Notice for Creative Learning Students
Kendal Brewery Arts Centre (The Brewery) is committed to a policy of protecting the rights and privacy of our customers. In accordance with General Data Protection Regulations 2018, this Privacy Notice outlines the basis on which any personal data we collect from you, or that you provide to us, will be stored, processed and deleted by the Brewery.
Who we are and how to contact us
The Kendal Brewery Arts Centre Trust Ltd is the Data Controller for this organisation.
Our address is The Brewery Arts Centre, 122a Highgate, Kendal, Cumbria. LA9 4HE
Tel No: 01539 722833, Email: admin@breweryarts.co.uk
Our Information Commissioner’s Office Registration No is Z4869165
Information we may collect from you
We will only collect enough personal data from you to provide you with the service you have requested. We may collect and process the following data about you:
- Information you give us. You may give us information about yourself by filling in forms on our site www.breweryarts.co.uk or by corresponding with us by phone, email or by visiting in person. This includes information you provide when you register to use our site, subscribe to our service, search for a product, place an order on our site, participate in social media functions on our site, enter a competition, promotion or survey, and when you report a problem with our site or services. The information you give us may include but may not be limited to your name, address, email address and phone number, financial and credit card information, communication preferences.
- Information we collect about you. With regard to each of your visits to our site we may automatically collect the following information – the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
- Sensitive personal data. We may collect sensitive personal information about you including information about your racial or ethnic origin and acknowledgement of proof of concessionary status. Such Sensitive Personal Data shall only be collected after having obtained your explicit consent to do so or where it is necessary to do so to comply with legal requirements.
- Children under 16 attending classes, workshops etc. A record of Parents/ guardians consent for data processing activity including a record of: age, any know medical conditions which may affect their participation or which may require urgent intervention or medical support, consent for young people to be filmed and/ or photographed, consent for direct contact by youth arts tutors with children for the specific delivery of classes or workshops.
How we will use the information you give us and the legal basis we will adopt for processing your data.
General Data Protection Regulations require us to process data based on the following six criterion…
- Consent: the individual has given clear consent for the Brewery Arts Centre to process their personal data for a specific purpose
- Contract: the processing is necessary for a contract the Brewery Arts Centre has with an individual, or because they have asked us to take specific steps before entering in a contract
- Legal obligation: the processing is necessary for the Brewery Arts Centre to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life
- Public tasks: the processing is necessary for the Brewery Arts Centre to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law
- Legitimate interests: the processing is necessary for the legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
Below we outline how we will use the information you give us and the legal basis on which it is processed…
Adult students
- To undertake enrolment on a course, workshop or class, to assess the skill/ experience of students and inform about equipment required for the course before starting, administer the course during its duration and to obtain student feedback and to assess the quality, learning outcomes and impact of our learning programmes.
In circumstance 1 we assess that the student will have given consent for data processing to take place
- To ensure existing students are aware of similar courses, workshops and classes, appeals and activities available at the Brewery or offered by third-party theatre companies or festivals associated with the Brewery
- To undertake analysis of box office data, to understand the reach, levels of engagement, impact of our classes and workshops, marketing, public relations and social media activity.
In circumstances 2 & 3 we assess that consent will be given by the processing is necessary for the legitimate interests of the Brewery (unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests).
Young People under 16
Parents or guardians will be asked to supply information’s about/ for their children…
- To maintain a record from parents/ guardians of their consent for data processing activity to take place.
- To record the age, the known medical conditions which may affect their participation or which may require urgent intervention or medical support, the parents/ guardians consent for young people to be filmed and/ or photographed, parents/ guardian’s consent for direct contact by youth arts tutors with children for the specific delivery of classes or workshops. Social media?
- To undertake enrolment on a course, workshop or class
- To conduct regular feedback from learners (via their parent/ guardian) to assess the quality, learning outcomes and impact of our learning programmes.
In circumstance 1, 2, 3 & 4 we assess that the parent/ guardian of the student will have given consent for data processing to take place
- To ensure the parents/ guardians of existing students are aware of similar courses, workshops and classes, appeals and activities available at the Brewery or offered by third-party theatre companies or festivals associated with the Brewery
- To undertake analysis of sales data, to understand the reach, levels of engagement, impact of our classes and workshops, marketing, public relations and social media activity.
In circumstances 5 & 6, we assess that consent will be given consent that processing is necessary for the legitimate interests of the Brewery (unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests).
Who will process your data?
Your data will only be processed by designated members of the Brewery Arts Centre, in particular, the Creative Learning Managers, Tutors and administrators; the Box Office, Marketing, and House Management departments. Your data will not be shared with third party organisations without your specific consent.
How will data be stored and managed?
All digital data, including name, address, age, communication preferences, medical details, photographic consent and email addresses will be stored by Spektrix Ltd, 3 Dorset Rise, London EC4Y 8EN
Paper records will be securely stored. Registers will include the minimum of data. Information about medical conditions needed in the case of emergency will be stored securely and separately from the register.
For children, we will also retain parent/ guardian contact details and photographic consent details in a similar manner to records of medical conditions and these will be used only in the case of an emergency.
ECA
Your data will not be transferred outside the European Economic Area
How long will your data be stored?
Below we identify the length of time we will process specific types of your data. These timescales vary with different legal and operational criterion, as noted below…
Adult Learning students – course information 20 months
for marketing and communication 5 years
Parents & guardians of young people engaging with our learning programme – 20 months
Children attending classes or workshops – 20 months
After the time noted above you will be asked to sign up for further data processing and communication with the Brewery. If you do not sign up your data will be removed from our system.
Your rights
You have a number of statutory rights. Subject to certain conditions, and in certain circumstances, you have the right to:
- request access to personal information – this is usually known as making a data subject access request and it enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it
- request rectification of personal information – this enables you to have any inaccurate or incomplete personal information we hold about you corrected
- request the erasure of personal information – this enables you to ask us to delete or remove personal information where there’s no compelling reason for its continued processing
- restrict the processing of personal information – this enables you to ask us to suspend the processing of personal information, e.g. if you contest its accuracy and so want us to verify its accuracy
- object to the processing of personal information – this enables you to ask us to stop processing personal information where we are relying on the legitimate interests of the business as our legal basis for processing and there is something relating to your particular situation which makes you decide to object to processing on this ground.
Access request
Based on your individual rights you can request access to personal information held by contacting the Brewery Arts Centre 01539 722833
- The Brewery Arts Centre will not charge for complying with a Data Subject Access Request
- We will respond to your Access Request within 30 days
- We reserve the right to refuse or charge for a request which the Data Controller considers to be manifestly unfounded or excessive. The Brewery Art Centre will inform you of the Data Controller’s decision within 30 working days. The Brewery Arts Centre will charge £10 + VAT per hour for the time taken to process a manifestly unfounded or excessive request. If you disagree with the assessment of the Data Controller you have the right to complain to the Information Commissioner’s Office (ICO) or seek judicial remedy.
Data breaches
The Brewery Arts Centre has a duty to report certain types of data breach to the ICO, and in some cases to contact you e.g. when it could result in discrimination, damage of reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage to you.
The Brewery’s GDPR Privacy Policy Document, available on our website, outlines in detail how we will detect, report and investigate a breach, based on the types of data held and where we will be required to notify the ICO and you.
Information Commissioner’s Office (ICO)
If you think your data has been misused or that the Brewery hasn’t kept it secure, you should contact us. 01539 722833
If you’re unhappy with our response or if you need any advice you should contact the Information Commissioner’s Office ( ICO ).
Telephone: 0303 123 1113.
https://www.gov.uk/data-protection/make-a-complaint
Who to contact about the policy
Please email boxoffice@breweryarts.co.uk or call 01539 725133.
