ALDERSHOT & FARNBOROUGH FESTIVAL OF MUSIC AND ART
GDPR PRIVACY NOTICE – PIANO SECTION
[This is the document to be given to persons who are providing the data to explain why it is being collected]
Introduction. New EU regulations known as the General Data Protection Regulation (GDPR) will come into force on 25th May 2018. The GDPR places significant additional responsibilities, over and above those defined in the Data Protection Act 1998, on those who collect and process personal data to ensure that providers of personal data understand the lawful basis for the collection and processing of their data. The document which explains this basis is known as a ‘Privacy Notice’. The present document constitutes the Aldershot & Farnborough Festival Privacy Notice.
What personal data does the Festival need to collect? For each competitor in the Piano Section, the Festival collects name, date of birth, address, phone and mobile contact, school attended, grade achieved, teacher’s name and contact details. Payment details are offered as BACS transfer or cheque but not recorded electronically. Details of Trophies awarded are kept in a Festival note book and not recorded electronically.
Who is collecting the data? The data will be collected by the Festival organisers.
How is the data collected? Data is mainly collected by means of paper entry forms, although some entries are sent electronically by e-mail.
Why does the Festival need to collect this data? Self-evidently, the Festival must know the names of competitors in order to organise the event and place the competitor in the correct class.
How will the data be used? Data is mainly collected by means of paper entry forms, although some entries are sent electronically by e-mail.
With whom will the data be shared? Details will be shared between committee members when putting together the programme, and placed on a spreadsheet. None of the data will be placed online, stored in the Cloud or shared with any outside agency or organisation. None of the data will be sold to or shared with any other organisation. The Festival does not receive commercial sponsorship.
Does anyone else associated with the Festival collect data? No.
What will be the effect of sharing data? No data is shared.
Is the intended use likely to cause individuals to object or complain? No.
Can I see my data or ask for it to be deleted? You have the right to see your personal data, and to ask for it to be deleted. If your data is deleted it may not be possible for you to perform in the Festival. A request to view your data is known as a ‘subject access request’. The Festival is legally obliged to respond to your request within 30 days. Subject access requests should be made in writing via the Secretary to the Data Access Controller.
How long will my data be kept? Paper entry forms will normally be kept for approximately one year (after the following year’s Festival) and then destroyed either by shredding or burning. Data from 1964 onwards is held in handwritten note books and preserves the historic record of the Festival.
How secure is my data? Electronic data is held in a password-protected database and a backup copy maintained. None of the data is accessible online or stored in the Cloud. Paper documents (e.g entry forms) are kept under lock and key in a private dwelling with normal domestic security measures in place; the Festival will take reasonable measures to ensure that the paper data is not lost or stolen or viewed by unauthorised persons, but does not guarantee to store it under lock and key. E-mail communications are not subject to special encryption measures. The GDPR mandates procedures which must be followed for reporting a breach or suspected breach of data security, and these will be followed by the Festival if such a breach occurs.
How will the new measures affect the entry process in future years? You will need to tick a lot more boxes in future to make it clear that you understand data collection issues and have ‘opted in’. A requirement of the GDPR is that providers of personal data must positively ‘opt in’ to having their data collected; it is no longer permissible to assume that ‘silence gives consent’.
Piano Section Organisers
Aldershot & Farnborough Festival of Music & Art