Arts Derbyshire seeks to protect personal data and is committed to meeting its legal obligations as detailed in the UK General Data Protection Regulation (“UK GDPR”), Data Protection Act 2018, where applicable, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive). Our privacy policy outlines how and why we use personal data.
The aim of this privacy policy is to ensure that Arts Derbyshire protects the personal data it collects and treats people fairly, honestly and openly.
Arts Derbyshire is the data controller for the personal data described in this policy.
Registered address: 2-3 Friary Street, Derby DE1 1JF
Charity number: 1184423
ICO registration number: ZB866761
Contact: dataprotection@artsderbyshire.org.uk
Arts Derbyshire works with art organisations and artists across the county. Arts Derbyshire exists to provide strategic direction for arts development in Derbyshire, and is a catalyst, enabler and amplifier of best practice arts development that enriches people’s lives across the county. Arts Derbyshire has a website (www.artsderbyshire.org.uk) which publicises details of artists, arts organisations and events; circulates newsletters; and runs workshops, arts events, and programmes of arts activity throughout Derbyshire.
In order to work with our participants (organisations, individual artists, and event participants) and report to our funders, we collect and hold personal data such as, but not limited to: demographic information such as post codes and interests; names; roles and organisations; contact details; email addresses, photographs.
We value your privacy and use a consent banner on our website to gain your consent regarding our use of cookies. You are also able to choose your cookies preferences. We use cookies to enhance your browsing experience, serve personalised ads or content, analyse our traffic and request your consent.
We collect information on the Arts Derbyshire website traffic via Google Ads and Google Analytics. We also use external apps including Eventbrite, TicketSource and Google Forms. These applications and services may transfer data outside of the UK, including to the United States. Where this happens, the provider is required to protect your data using safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, EU-US Data Privacy Framework (including the UK extension), PCI DSS security requirements or an applicable UK adequacy regulation. You can request further details of the specific safeguard used for any provider by contacting dataprotection@artsderbyshire.org.uk.
When you contact us by email or phone we may use details of the contact on our records management system to enable us to help you more efficiently.
We will keep data only for as long as necessary, and this will vary for the data we keep for different functions. We will review our data every two years and remove any data we are no longer actively using or required to store. This will be guided by a retention schedule, kept in the Arts Derbyshire Office Google Drive folder.
All personal data is kept securely. We use password-protected systems, restrict access to personal data to those who need it for their role, and store digital records on secure, access-controlled platforms. If we become aware of a data breach that’s likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and will inform affected individuals directly where there’s a high risk to them.
Photographs may be used on promotional material, in printed media, and on our social media accounts. We obtain explicit permission for any images, audio or film we use through a Recording Consent form.
If you have signed up to receive our e-newsletters, we use your information to send you updates of Arts Derbyshire’s current activities and upcoming events, and those of our members. We may also include fundraising updates, offers, opportunities, jobs and commissions. We will make sure your information is accurate and up to date. You may unsubscribe from our monthly newsletter and mailing list at any time; each newsletter includes an unsubscribe button, or you can email dataprotection@artsderbyshire.org.uk and request to be removed. Newsletters will only be sent where someone has signed up to receive them.
If you have signed up to one of our workshops or events or have participated in one of our projects and given your contact details, we will use this personal information to contact you regarding the project. We will also keep this information for monitoring and reporting purposes. Information used in reports to funders is anonymised.
If you work with Arts Derbyshire as a contractor, freelancer, artist, trustee, or volunteer, we keep your personal information securely for legal, financial, and reporting purposes. Any information shared in reports is anonymised. Personal information is destroyed after 7 years.
We collect the registered users’ information when people sign up for an account with us: If you are a member of Arts Derbyshire, we will keep your contact details and use them to contact you regarding your membership. We take any information provided in your registration and publish it to the website which includes your business / trading name, address, phone number, email address, website address and social media links.
We can request to check your DBS using the online service with your consent if the type and level of criminal record check is required for the role. Section 5.6 (DBS Checks). DBS processing adheres to the UK GDPR Article 10 / Data Protection Act 2018 rules on criminal conviction data.
All information is always kept secure and participants have the right to access this information.
We rely on different lawful bases depending on the type of processing activity. These are:
Special category data
Where we collect special category data (for example, information about ethnicity, disability, or health, typically as part of equal opportunities monitoring), we will only do so where we also have a lawful condition under Article 9 GDPR. This will usually be your explicit consent, or, where relevant, processing necessary for reasons of substantial public interest in line with our published policy document. We will make clear at the point of collection which of these applies.
Arts Derbyshire will never give or sell your contact information to third parties for marketing purposes. Any information we disclose about you, other than for purposes outlined in this privacy policy, will be if required to do so by law.
The varied nature of our projects requires a lot of partnership working; this means we may need to share personal information with other organisations such as health professionals, schools, funders and other charities. We will set up data sharing agreements for large-scale sharing of data for projects where relevant, e.g. with universities which are evaluating our work or Derbyshire County Council with whom we are delivering projects.
In the course of our work we use third party websites (for example, Eventbrite, Twitter, Facebook, Instagram, LinkedIn, SurveyMonkey). We are not responsible for the privacy policies or practices of the third party websites.
We want you to have the best experience possible with Arts Derbyshire and benefit from working with us, feeling confident we are respecting your personal data and processing it in a safe and confidential way. You have the right to withdraw consent to our e-newsletter or use of your image at any time.
You have the right to see the information we keep on you. This is a ‘Subject Access Request’. We ask that you provide your request in writing with proof of identity. The information may take up to a month to collect. If you require this information please email dataprotection@artsderbyshire.org.uk.
If any personal information we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. Please email dataprotection@artsderbyshire.org.uk with details of what needs updating.
You can ask us to delete your personal data where it’s no longer needed for the purpose it was collected, where you withdraw consent, or where you object to our processing and we have no overriding reason to continue. This right doesn’t apply where we’re required to keep information for legal, financial, or reporting obligations (see Section 4).
You can ask us to limit how we use your data — for example, while we investigate a query you’ve raised about its accuracy — without deleting it entirely.
Where we process your data based on your consent and by automated means, you can ask us to provide it to you, or transfer it directly to another organisation, in a structured, commonly used, machine-readable format.
You have the right to object to us processing your data where we rely on legitimate interests (see Section 5.7), including for monitoring and reporting purposes. If you object, we’ll stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims.
To exercise any of the rights above, email dataprotection@artsderbyshire.org.uk. We’ll respond within one month.
You have the right to complain to us if you think we haven’t followed data protection law. You can do this by completing our online complaint form at https://forms.gle/oMJCK7qjAiWCWjGw8, by emailing dataprotection@artsderbyshire.org.uk, or by writing to us at 2-3 Friary Street, Derby DE1 1JF.
For example, you might have a complaint about:
We aim to acknowledge your complaint within 5 working days and provide a response/outcome within 1 calendar month.
Further information on how to make a complaint can be found here: https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/
If we have looked into your complaint and you’re unhappy with our response, you can ask us to provide more details or explain its decision more clearly. Please explain your outstanding issues in a short, clear summary, and allow a reasonable amount of time for us to respond.
You can also complain to the ICO at any time by calling 0303 123 1113 or starting a live chat on their website. Check if you can complain here: https://ico.org.uk/make-a-complaint/data-complaints-complaints/check-if-you-can-complain/
You can see all the information regarding data protection and your rights here: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/
https://www.gov.uk/guidance/data-use-and-access-act-2025-data-protection-and-privacy-changes
https://www.gov.uk/data-protection
This procedure applies to everyone who works for Arts Derbyshire. The terms ‘consultant’ or ‘contractor’ encompasses everyone who works for Arts Derbyshire either paid or voluntary including: trustees; freelance consultants; employed staff and volunteers.
Your experience of working with Arts Derbyshire matters to us and we welcome your feedback which may be instrumental in future reviews of the handbook.
Please email admin@artsderbyshire.org.uk with your comments.
This policy will be reviewed on a bi-annual basis, or as laws are updated.
Adopted: 13 September 2020
Last Review Date: 8 September 2026
Next Review Date: September 2028
Find out what’s on with the Arts Derbyshire newsletter.
Artists, creatives, cultural providers, arts and health specialists – Sign up for one of our professional mailing lists.