BlackFest Privacy Policy
About this policy
Here at BlackFest, we take your privacy seriously. We promise to respect any personal data you share with us and keep it safe.
This policy explains who we are, what information we collect, how and why we use it, how it is stored, how we fundraise, which partners we work with, and your rights regarding any information you share with us.
We promise to use the information we collect about you in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (DPA) and the Privacy and Electronic Communications Regulations (PECR). We aim to be clear when we handle your data, and not do anything you would not reasonably expect.
By visiting www.blackfest.co.uk you are accepting and consenting to the practices described in this policy.
This Privacy Policy outlines how we process data for:
- Ticket buyers, online users, participants, and supporters
- Artists and freelancers
- Employees, Board members and volunteers
- Job/paid for opportunity/volunteer applicants
- Suppliers, industry
Please read this information carefully, as by providing your data to us you acknowledge you have read this policy and understand we will process your data in accordance with its terms.
Who we are
BlackFest (ICO registration ZB102784) is the Data Controller for the personal information we process.
BlackFest is a private company limited by guarantee without share capital (Company No. 12577304) with a voluntary Board of Trustees.
For this policy, “we,” “us,” and “our” refers to BlackFest.
Contact Us
Questions, comments, and requests regarding this Privacy Policy are welcomed.
Email us: info@blackfest.co.uk
Write to us: Data Protection, BlackFest, 37-45 Windsor Street, Liverpool, L8 1XE
Call us: 07506405720
Data collection
We only collect the information that is necessary to carry out normal business operations, to provide any goods or services you have asked for, and to keep you updated about our current and future work. The types of personal information we collect are listed below:
Ticket buyers, online users, participants, and supporters
We may collect or store the following information from you when you: buy a ticket or other item from us, sign up to one of our events or workshops, attend an event or participate in an activity, workshop or project, become a friend, make a donation, visit our website or premises, enter a competition, promotion or survey, sign up to receive marketing communications from us, or contact us with an enquiry.
- title, first name, and last name
- contact details including organisation/company name and job title (if appropriate), postal address, email address, and telephone number(s)
- if you are a teacher with whom we have professional relationship, your professional email, the name, address and telephone number of school/college, the type of school/college, and the subject and key stage taught
- if you are a young person, we may collect the contact details (including name, address, email address and telephone number) of your parent/guardian
- a record of your communication preferences
- if you are on site and an incident occurs, we will collect you name, address, email address and telephone number
- date of birth and age
- transaction history, including billing and payment card information (last four digits and card expiry date)
- donation history
- qualitative opinions or attitudes about our services and programme through surveys
- image and likeness (as captured on our CCTV cameras, and in photographs and videos we may use for promotional purposes)
- social media handle
- any other information you provide to us by email, letter, telephone, social media, via our websites, or in person
- technical information gathered when you visit our website; including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform
Sensitive information
This includes health information (if supplied) related to your booking such as access need, allergy, and dietary requirements (for you or your party).
We sometimes request sensitive personal data in our audience surveys to assist us with our diversity monitoring. This data is not obligatory to provide, is analysed anonymously, and not linked to individual customer records.
Online information
We keep a record of the emails we send you (and that you send to us), and we may track whether you receive or open them so we can make sure we are sending you the most relevant information.
We use social media to provide updates on our activities and to promote events and projects. We may tailor adverts on social media and elsewhere online relevant to your interests. Depending on your own privacy settings, you may control BlackFest’s permission to access information via social media platforms.
We use Google Analytics to find out how our website is being used, which campaigning activities are working best, and how we can improve customer experience.
Data received from third parties
We may also obtain or collect personal information about you from other third-party sources, for example:
- If you purchase a ticket to one of our events through a third party e.g., Eventbrite or a partner venue, and you consent to sharing your data with us – you should check their Privacy Policy when you provide your information to understand fully how they will process your data
- If you donate to us via PayPal
- Publicly available information, such as information found in places such as Companies House, your biography on your work website, or information that has been published in articles/newspapers
- From our Board members or other volunteers, for example if they invite you to an event
Artists and freelancers
We may collect or store the following information from you when you work with us as an artist or freelancer or express your interest in working with us in the future.
- title, first name, and last name
- contact details including organisation/company name and job title (if appropriate), postal address, email address, and telephone number(s)
- if you are on site and an incident occurs, we will collect you name, address, email address and telephone number
- date of birth and age
- bank details (e.g., for invoicing purposes)
- qualitative opinions or attitudes about our services and programme through surveys
- image and likeness (as captured on our CCTV cameras, and in photographs and videos we may use for promotional purposes)
- social media handle
- any other information you provide to us by email, letter, telephone, social media, via our website, or in person
Sensitive information
This includes health information (if supplied) related to your engagement such as access need, allergy, and dietary requirements (for you or your party).
We sometimes request sensitive personal data e.g., ethnicity, gender, disability, socio-economic background etc. in order to assist us with our diversity monitoring. This data is not obligatory to provide and not linked to your record.
Data from third parties
We may also obtain or collect personal information about you from other third-party sources, for example:
- References from previous employers
- Publicly available information about you online
Employees, Board members and volunteers
We may collect or store the following information when you join our organisation as an employee or Board member.
- title, first name, and last name
- contact details including postal address, email address, and telephone number(s)
- date of birth
- biography
- recruitment information including copies of right to work documentation (please note this is not stored and only used for internal checks), references and other information included in a CV or cover letter or as part of the application process
- offer letter, contract of employment, details of job/role duties
- salary, annual leave entitlement, pension, and benefits information
- employment record (including job title, work history, working hours, holidays, health and sickness absence, maternity/paternity/adoption leave, training record and professional memberships, evidence of skills and qualifications)
- bank account details, tax and national insurance information and payroll details
- information about performance
- details of any disciplinary and grievance investigations and proceedings
- leaving date and exit interview notes
- contact details for your emergency contact / next of kin such as title, first and last name, address, email address, contact telephone number(s)
- image and likeness (as captured on our CCTV cameras, and in photographs and videos we may use for promotional purposes)
- social media handle
- any other information you provide to us by email, letter, telephone, social media, via our website, or in person
Sensitive information
This includes health information related to your employment such as access need, allergy, and dietary requirements.
We sometimes request sensitive personal data e.g., ethnicity, gender, disability, socio-economic background etc. in order to assist us with our diversity monitoring. This data is not obligatory to provide and not linked to your record.
Data from third parties
We may also obtain or collect personal information about you from other third-party sources, for example:
- References from previous employers
- Publicly available information about you online
Job/paid for opportunity/volunteer applicants
We may collect or store the following information about you if you apply for a job or paid opportunity with us or apply to volunteer.
- title, first name, and last name
- contact details including organisation/company name and job title (if appropriate), postal address, email address, and telephone number(s)
- details of your experience and qualifications
- any other information you provide to us by email, letter, telephone, social media, via our website, or in person
Sensitive information
This includes health information (if supplied) such as access need, allergy, and dietary requirements. We may ask for other information specific to the opportunity you are applying for.
Data from third parties
We may also obtain or collect personal information about you from other third-party sources, for example:
- References from previous employers
- Publicly available information about you online
Suppliers, industry contacts
We may collect or store the following information from you when you supply goods or services to us, purchase services from us, or are recommended to us.
- title, first name, and last name of designated contact
- contact details including organisation/company name and job title (if appropriate), postal address, email address, and telephone number(s)
- if you are a contractor, we may ask for details about your professional accreditation/qualifications
- if you are on site and an incident occurs, we will collect you name, address, email address and telephone number
- billing information and bank details (e.g., for invoicing purposes if you are a supplier)
- record of goods/services received/supplied
- any other information you provide to us by email, letter, telephone, social media, via our websites or apps, or in person
- image and likeness (as captured on our CCTV cameras, and in photographs and videos we may use for promotional purposes)
- social media handle
- any other information you provide to us by email, letter, telephone, social media, via our website, or in person
Data from third parties
We may also obtain or collect personal information about you from other third-party sources, for example:
- Recommendations from other organisations/clients
- Publicly available information about you online
Online information
Like most websites, we receive and store certain details whenever you use the BlackFest website. We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events and information, they might be interested in. Find out more in our Cookie Policy.
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information.
We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests. Depending on your settings or the privacy policies on social media and messaging services like Facebook, Instagram, LinkedIn, or X, you might give third parties (like BlackFest) permission to access information from those accounts or services.
We use some online tracking and analysis services such as Google Analytics to find out how our websites are being used, which campaigning activities are working best, and how we can improve customer experience
Use of data
We will use your information for the purposes listed below using one of the following lawful bases:
- consent (where we require it)
- performance of a contract between us and you
- to comply with a legal obligation
- our legitimate interests or those of a third party
Ticket buyers, online users, participants or supporters
We will use your information to:
Inform you of any change to or additional information regarding a booking, visit, or membership
Performance of a contract
Send you an item you have purchased in our online shop
Performance of a contract
Analyse your personal information to create a profile of your interests and preferences so that we can contact you with information most relevant to you
Legitimate interests
Inform you about relevant events or activities we believe will be of interest, as well as opportunities to support our work
Consent
Process donations and payments, including making Gift Aid claims and thanking donors
Performance of a contract / Legitimate interests
Assist us with reporting and analysis for our own business needs, and those of our funding partners
Legitimate interests
Keep a record of the relationship we have with you and a record of how you would like to be contacted
Legitimate interests
Promote our work to funders, supporters and the public via media and social media outlets
Legitimate interests
Ensure we cater for any specific needs you may have such as dietary or access requirements
Legitimate interests
Maintain the security of property and individuals in and around our building using CCTV footage
Legitimate interests
Undertake audience research
Performance of a contract / Legitimate interests
Invite individual supporters to BlackFest VIP events and press nights and administer the guest list
Legitimate interests
Administer competitions
Consent
Artists and freelancers
We will use your information to:
Contact you regarding the contract we have, or may wish to have with you
Performance of a contract
Ensure we cater for any specific needs you may have such as dietary or access requirements
Legitimate interests
Ensure we cater for any specific needs you may have such as dietary or access requirements
Legitimate interests
Process payments to/from you when required
Performance of a contract
Keep a record of the relationship we have with you and a record of how you would like to be contacted
Legitimate interests
Promote our work to funders, supporters and the public via media and social media outlets
Legitimate interests
Assist us with reporting and analysis for our own business needs, and those of our funding partners
Legitimate interests
Keep you update on future opportunities
Legitimate interests
Invite identified individuals to BlackFest VIP events and press nights and administer the guest list
Legitimate interests
Ensure compliance with policies, procedures, and laws
Legal obligation
Maintain the security of property and individuals in and around our building using CCTV footage
Legitimate interests
Employees, Board members and volunteers
We will use your information to:
Recruit and onboard to the organisation
Performance of a contract / Consent (for special category data)
Ensure we cater for any specific needs you may have such as dietary or access requirements
Consent / Legal obligation
Maintain a record of your employment / Board membership / volunteering
Performance of a contract / Legal obligation
Keep a record of Board meeting attendance and communicate minutes to members
Legal obligation / Legitimate interests
Administer payroll
Performance of a contract / Legal obligation (e.g., tax purposes)
Evaluate your performance
Performance of a contract
Provide a training and development programme
Legal obligation / Legitimate interests (depending on type of training)
Keep Health and Safety records
Legal obligation
To keep a record of and administer employee benefits
Performance of a contract / Legal obligation
Keep a record of any disciplinary and grievance procedures
Legal obligation / Legitimate interests
Nominate and elect Board members
Legitimate interests / Consent
Ensure compliance with policies, procedures, and laws
Legal obligation
Maintain the security of property and individuals in and around our building using CCTV footage
Legitimate interests
Job/paid for opportunity/volunteer applicants
We will use your information to:
Process your application and communicate with you regarding the selection and interview process
Consent
Ensure we cater for any specific needs you may have such as dietary or access requirements
Legitimate interests
Ensure compliance with policies, procedures, and laws
Legal obligation
Maintain the security of property and individuals in and around our building using CCTV footage
Legitimate interests
Suppliers and industry contacts
We will use your information to:
Contact you regarding the contract we have, or may wish to have with you
Performance of a contract
Process payments to/from you when required
Performance of a contract
Keep a record of the relationship we have with you and a record of how you would like to be contacted
Legitimate interests
Keep you informed of our activities
Legitimate interests
Promote our work to funders, supporters and the public via media and social media outlets
Legitimate interests
Invite identified individuals to BlackFest VIP events and press nights and administer the guest list
Legitimate interests
Ensure compliance with policies, procedures, and laws
Legal obligation
Maintain the security of property and individuals using CCTV footage
Legitimate interests
Fundraising
We may combine information you provide to us with information publicly available from external sources to gain a better understanding of our audiences, visitors, and supporters to improve our fundraising methods. We will tell you about current and future fundraising campaigns that we think are relevant to you, and how you can make a difference to our reach and impact through a donation or other involvement.
Sharing your data with third parties
Unless you give us your consent, the personal information that you give us will only be shared with third parties where we:
- need to use the services of ‘data processors’ to fulfil our contract with you;
- are obliged or permitted by law to disclose it;
- and to support analysis and research for BlackFest or the Arts Sector
We have data processing agreements in place with each third party we share data with to ensure that your data is always secure and cannot be accessed or used for any other purpose.
As part of the services offered to you, the personal information you provide may be transferred to countries outside the European Economic Area (EEA). For example, the servers for our email platform are in the United States. If we transfer your personal information outside of the EEA in this way, we will take steps to ensure that your privacy rights continue to be protected as outlined in this Privacy Policy.
Your personal data is never sold to any agencies or companies.
Instances where we may share your personal information with selected third parties include:
Performance of a contract: Business partners, suppliers, and sub-contractors for the performance of any contract we enter into with them or you. In general, any third-party providers used by us to fulfil our contract with you will only collect, use, and disclose your information to the extent necessary to allow them to perform the services they provide to us.
Legitimate interests: We may make data available to approved suppliers for analysis and research purposes, for example identifying sales trends, assessing campaign effectiveness, postcode mapping etc. This assists us with reporting and with our strategic planning, helping us apply our resources more intelligently.
Keeping your data secure
We take every precaution to protect your personal data, and we hold regular security reviews to ensure that the website is safe and secure for your protection.
Your data is processed in secure systems and digital environments. Only authorised and trained employees and approved contractors/developers are granted access to personally identifiable information. This will be from time to time, and only when they need to perform a specific job or task.
If we need to share personal data with a third party, we ensure that the appropriate data sharing agreements are in place.
If required by law (e.g., by police, regulatory bodies, or legal advisers) we may need to disclose your details.
How long we keep your data
We will keep your information for as long as is necessary to provide you with the services you have requested or require from us or to fulfil our contract with you, unless:
- we must keep it to comply with applicable laws or evidence compliance with such applicable laws;
- there is an outstanding issue, claim or dispute requiring us to keep such information until the issue, claim or dispute is resolved; or
- the information must be kept for our legitimate business interests, such as fraud prevention and enhancing users’ safety and security.
We regularly review email and paper correspondence and minimise our storage through archiving and destruction of out-of-date materials. We will store audience data for a maximum of xx years after your last transaction or communication with us.
We have considered the nature, relevance and volume of this data, the potential risks, and the purposes for which we process your data. We have also considered legal requirements including financial (e.g., Gift Aid declaration and reporting timescales).
For employees, we store data for the length of their employment and for 7 years post-employment.
For suppliers, we store data in our financial systems for 7 years.
Giving you control
How to update your details
You can set and update your personal contact information at any time, by emailing info@blackfest.co.uk
Every email we send to you will contain an option to unsubscribe, or you can contact us via the details set out at the beginning of this Privacy Policy.
Unless you ask us not to, we will tell you about news, events, offers and opportunities to get involved with supporting BlackFest.
If you are a supplier, you can update any of the business information we hold about you by contacting accounts@blackfest.co.uk
Your individual rights in relation to your personal data
Under data protection law, you have rights including:
- Your right of access: you have the right to ask us for copies of your personal information.
- Your right to rectification: you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure: you have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing: you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing: you have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
- Your right related to automated decision-making including profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
Where you have provided your consent to the collection, processing, and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us as set out at the beginning of this Privacy Policy. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to.
How to make a complaint
If you wish to make a complaint about how we are using your data, please email info@blackfest.co.uk
If you are unhappy with how we are processing your personal data and take the view that we are not complying with UK GDPR, you have the right to complaint to the Information Commissioner’s Office (ICO). You can contact them at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
https://ico.org.uk/concerns/
Changes to this policy
We may change or update this Privacy Policy from time to time. Any significant changes will be communicated on our website or by contacting you directly.
Last updated June 2024