Data Protection Policy

TUNBRIDGE WELLS ARTS FESTIVAL

GENERAL DATA PROTECTION REGULATIONS (GDPR)
PRIVACY NOTICE

This Policy was last updated on 9th September 2026

Chair: Celia Barstow
Vice Chairman: Debbie Mumford
Hon. Secretary: Fiona Ross
Hon. Treasurer (Acting): Fiona Ross
Safeguarding Officer: Celia Barstow 5 Milestone Court, Chantlers Hill,
Paddock Wood, Tonbridge TN12 6QT

PRELIMINARY STATEMENT: In order to operate, Tunbridge Wells Arts Festival (the Festival) needs to gather, store and use certain types of information about individuals.
These individuals can include:
• Staff - Committee members, other voluntary staff, professional musicians engaged as adjudicators and accompanists, and
• Supporters - 'Friends' of the Festival, performers, parents of child performers, music teachers, sponsors, advertisers, and other people the Festival has a relationship with or regularly needs to contact.
This Privacy Notice explains how data is collected, stored and used in order to meet the Festival’s data protection standards and comply the General Data Protection Regulations (GDPR) which came into effect on 25 May 2018.

The Notice protects the rights of our staff and supporters, complies with Data Protection law and protects the Festival from the risks of a data breach.

Applicability of Privacy Notice
The Notice applies to everyone handling data on behalf of the Festival, for example Committee Members and other voluntary staff. It applies to all data held by the Festival relating to individuals, including names, email addresses, postal addresses, phone numbers and any other personal information held (for example: dates of birth of child performers, and payments for class fees, Friends subscriptions, etc.)

Data Controller
The Data Controller for the Festival is Celia Barstow, Chair. The Data Controller, together with the committee, is responsible for why data is collected and how it will be used. Any questions relating to the collection or use of data should be directed to the Data Controller.

DATA PROTECTION PRINCIPLES
1. We fairly and lawfully process personal data
The Festival will only collect data where lawful and where it is necessary for the legitimate purposes of the organisation. The Festival's valid lawful bases for processing personal data are 'Consent' and 'Legal obligation', as set out in Article 6 of the GDPR.
• The name and contact details of committee members, other voluntary staff, professional musicians engaged as adjudicators and accompanists will be collected when they take up a position and will be used to contact them regarding administration related to their role, and also regarding festival activities.
• Further information, including personal financial information and criminal records information may also be collected in specific circumstances where lawful and necessary (in order to carry out a DBS check).
• An individual’s name and contact details will be collected when they submit an entry for a festival. This will be used to contact them about their entry and to allow them entry to the festival.
• An individual’s name, contact details and other details may be collected at any time, with their consent, in order for Tunbridge Wells Arts Festival to communicate with them about festivals and related activities, and/or for Direct Marketing. See ‘Direct Marketing’ below.

2. We only collect and use personal data for specified and lawful purposes.
When collecting data, the Festival will always explain to the subject why the data is required and what it will be used for.
We will never use personal data for any purpose other than that stated or that can be considered reasonably to be related to it. For example, except for providing the local authority (Kent County Council) with details lawfully required by virtue of the Child Performance Licensing Regulations, we will never pass on personal data to third parties without the explicit consent of the subject.

3. We ensure any data collected is relevant and not excessive
The Festival will not collect or store more data that the minimum information required for its intended purpose.

4. We ensure data is accurate and up-to-date
The Festival will ask staff and supporters to check and update their data on an annual basis. Any individual will be able to update their data at any time by contacting the Data Controller.

5. We ensure data is not kept longer than necessary
Save for any legal requirement placed upon it, the Festival will keep data on individuals for no longer than 12 months after our involvement with them has ceased.

6. We process data in accordance with individuals’ rights
The following requests can be made in writing to the Data Controller. Staff and supporters can:
• request to see any data stored about them. Any such request will be actioned within 14 days of the request being made.
• request that any inaccurate data held on them is updated. Any such request will be actioned within 14 days of the request being made.
• request the cessation of receiving any marketing communications. Any such request will be actioned within 14 days of the request being made.
• object to: any storage or use of their data that might cause them substantial distress or damage, and any automated decisions made based on their data. Any such objection will be considered by the committee, and a decision communicated within 30 days of the request being made.

7. We keep personal data secure.
The Festival will ensure that data held by us is kept secure.
• Electronically-held data will be held within a password-protected and secure environment.
• Passwords for electronic data files will be re-set each time an individual with data access leaves their role/position.
• Physically-held data will be stored in a locked receptacle.
• Keys for locks securing physical data files should be collected by the Data Controller from any individual with access if they leave their role/ position. The codes on combination locks should be changed each time an individual with data access leaves their role/position.
• Access to data will only be given to relevant staff and supporters where it is clearly necessary for the running of the organisation. The Data Controller will decide in what situations this is applicable and will keep a master list of who has access to data.

CONTACT BETWEEN STAFF MEMBERS
We only share staff members’ data with other staff members with the subject’s prior consent. As an organisation comprising volunteers, the Festival encourages communication between volunteer staff.
To facilitate this, volunteer staff can request the personal contact data of other staff in writing via the Data Controller. These details will be given, as long as they are for the purposes of contacting the subject (e.g. an email address or phone number) and the subject consents to their data being shared with other staff in this way.

DIRECT MARKETING
The Festival will regularly collect data from consenting supporters for marketing purposes. This includes contacting them to promote festivals, related concerts, updating them about news, fundraising and other festival activities.
Whenever data is collected for this purpose, we will provide:
• A clear and specific explanation of what the data will be used for.
• A method for users to show their active consent to receive these communications.
• Data collected will only ever be used in the way described and consented to.

POLICY REVIEW
The Festival Committee will review this Policy on a regular basis, and at least once a year, improving and enhancing it as necessary.

A copy of this Policy will be accessible to all participants throughout the Festival.