CCA Privacy Notice
Updated 01/03/2024
Cambridge Community Arts is committed to protecting and safeguarding your personal data. We are required by data protection law to provide the information in this Privacy Notice. It is important that you read the Privacy Notice carefully, together with any other similar or additional information that we might give you from time to time about how we collect and use your personal data. We may update this Privacy Notice at any time. This Privacy Notice relates to Cambridge Community Arts and its projects.
Our contact details:
Name: Cambridge Community Arts
Address: 16-18 Arbury Court, Cambridge, CB4 2JQ
Phone Number: 07763280029
Email: info@camcommarts.org.uk
1. LEARNERS AND PARTICIPANTS
What information do we hold?
We hold personal data and personal sensitive data shared with us by our learners and participants and collected during the duration of their engagement (i.e. attendance, achievements).
How is it being held?
This data is held on encrypted and secure Google Sheets, that meets GDPR requirements. Google’s privacy notice can be read here. The data is then transferred to a secure cloud platform, Salesforce, that meets GDPR requirements. Their Privacy Information can be found here. Some personal information is held on Squarespace Acuity Scheduling if an application appointment is booked.
How is it collected?
Information is voluntarily shared by learners and participants during the enrolment process, this may include completing an online Expression of Interest Form, booking an application appointment and an application appointment.
Why is it collected and what do we use this data for?
We use this data to identify people, enrol onto courses and projects, check their eligibility for funding and their suitability. We use personal data for direct communications and to analyse and demonstrate our social impact. Details of health and education support needs are used to ensure and record that support needs of learners on our courses are met.
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
(a) We have a contractual obligation; (b) We have a legitimate interest
Who do we share this data with?
Some personal sensitive data is shared with our educational partner, Cambridge Regional College. Please read how they use your data and their privacy notice here. We may also share personal sensitive data with funding partners and their auditors. This is for enrolment purposes, monitoring, eligibility for public funding and equality monitoring. CCA does not share any details with third parties. Our education and funding partners have individual policies specifying who they share data with.
How long do we keep this data?
It is important that we hold data relating to learners who are on our current courses. We keep details of our learners for three years when engagement with CCA finishes. Our education and funding partners have individual policies that specify how long they keep shared data.
2. COMMUNITY MEMBERSHIP
What information do we hold?
We hold personal data (name and email address) shared with us by our learners who would like to join our Community Membership. We sometimes hold addresses if learners would like to be added to our Postal Community Membership.
How is it being held?
This data is held on an encrypted and secure Google Sheet, that meets GDPR requirements. Read their privacy notice here. This data is then transferred to MailerLite, a fully GDPR-compliant email marketing platform. Read their GDPR compliance information here. The Postal Community Membership details are stored on an encrypted, secure and password protected SharePoint document.
How is it collected?
Consent to be added to the Community Membership is obtained during course feedback or by completing a voluntary sign-up form on our website.
Why is it collected and what do we use this data for?
We hold this data in order to keep in touch with our Community Members about creative activities happening in the local area. Those online receive regular emails. Those on the Postal Community Membership may receive information in the post. Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
(a)Your consent. You are able to remove your consent at any time. You can do this by contacting admin@camcommarts.org.uk or unsubscribing from emails.
Who do we share this data with?
We do not share the data from our Community Membership with any parties without consent. If you sign up for an event run by an external organisation, your name and/or email address may be given to them for reasons of accessing the event / ticket.
How long do we keep this data?
We hold data relating to the Community Membership indefinitely. Community Members may unsubscribe from emails at any time at the bottom of each email. Or they can contact admin@camcommarts.org.uk to be taken off the list.
3. COMMUNICATIONS, MARKETING & FUNDRAISING
What information do we hold?
We collect personal data – names, email addresses, phone numbers and postal addresses.
How is it being held?
We have a mailing list operating on MailerLite for Cambridge Community Arts and Mailchimp for Creative Fenland. We also hold contact detail data on an encrypted, secure and password protected SharePoint document of the following:
Organisations and individuals who have expressed an interest in our work and requested that we send them information on our courses.
Individuals in organisations who work in Arts, Education and Health sectors.
Individuals and organisations that are interested in supporting our work by making generous donations.
How is it collected?
Individuals actively sign up to our mailing lists on our websites. Learners are asked if they would like to be added to the mailing list at the start and end of their course and are manually added to the mailing lists. CCA directly researches relevant and appropriate contacts with a shared interest in the benefits of our work. Contact details are shared by interested parties in person, by email and telephone.
Why is it collected and what do we use this data for?
CCA directly researches relevant and appropriate contacts with a shared interest in the benefits of our work. This enables us to effectively market our courses to people who are at risk of social isolation that we could not contact directly. We also collect information to illicit donations from appropriate contacts.
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
(a) Your consent. You can remove your consent at any time. You can do this by contacting admin@camcommarts.org.uk or unsubscribing from emails.
(b) We have a legitimate interest. Due to the difficultly of communicating directly with socially isolated potential learners, it has been assessed that it is a Legitimate Interest to hold data relating to professionals working to promote the Health and Wellbeing of people at risk of social isolation to distribute information about CCA courses only.
Who do we share this information with?
We do not share this information with any third parties.
How long do we keep this data?
Contacts are retained until CCA receive requests for removal or have marketing or fundraising materials returned. Mailing list subscribers have the option to unsubscribe from emails at any point or you can email admin@camcommarts.org.uk.
4. STAFF, VOLUNTEERS & TRUSTEES
What information is being collected?
We collect personal data and some personal sensitive data relating to staff, volunteers and trustees.
Who is collecting it?
CCA collects the data directly. Data is collected by uCheck if a DBS check is required.
How is it collected?
It is collected through the recruitment process, on paper, in person, by email and through our DBS service, UCheck.
Why is it being collected?
Personal data is collected for administrative, legal and direct communication purposes.
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
(a) We have a contractual obligation.; (b) We have a legal obligation.; (c) We have a legitimate interest.
How will it be used?
It is used for verification and identification purposes, suitability for selection and administrative purposes. In line with our DBS policy, staff, volunteers and trustees are required to undertake a DBS check using our HR platform, uCheck. Please read about how your inputted data is used by uCheck in their privacy notice here.
Who will it be shared with?
Trustees’ personal data is shared with regulatory bodies; For individuals working directly with Learners it is submitted to a third party DBS check service (uCheck). Staff personnel records are not shared with any external parties.
Retention period
Data is held for 6 years from the end of the final contract period.
5. WEBSITE
The Cambridge Community Arts and Creative Fenland websites collect cookies in order to help the websites run smoothly and to collect visitor data for analytics. You can find out how our website provider, Squarespace, uses cookies here.
Sometimes our website contains links to other websites. We are not responsible for the privacy policies or practices of third-party websites.
YOUR RIGHTS
Under data protection law, you have rights including:
a. Your right of access - You have the right to ask us for copies of your personal information.
b. Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
c. Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
d. Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
e. Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
f. Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at info@camcommarts.org.uk or by writing to: Data Protection Officer, Cambridge Community Arts, 16-18 Arbury Court, Cambridge CB4 2QJ if you wish to make a request.
How do you remove yourself from our system?
All our data is collected and stored manually, therefore, to remove yourself from our systems please contact our Data Controller: Jane Rich info@camcommarts.org.uk with REMOVE ME in the subject area or write to Jane Rich, Data Controller, CCA, 16-18 Arbury Court, Cambridge CB4 2QJ.
How to complain
If you have any concerns about our use of your personal information, you can make a complaint to us at at info@camcommarts.org.uk or by writing to: Data Protection Officer, Cambridge Community Arts, 16-18 Arbury Court, Cambridge CB4 2QJ if you wish to make a request.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk