Privacy Policy (updated 24 May 2019)

1. Who we are
Pavilion is a company limited by guarantee (no.01692928) and a charity (Registration no.513682).

2. Purpose of this Notice
This Notice explains how we will collect and use your personal data. We are the data controller for personal data that we process about you. Throughout this Notice, “we”, “our” and “us” refers to Pavilion, “you” and “your” refers to those expressing an interest in Pavilion’s activities, including audiences, participants and collaborators, together with those who later become a collaborator with Pavilion.

3. Change in the law
Until 24 May 2018 we shall process your personal data in accordance with the Data Protection Act 1998 (or DPA for short). From 25 May 2018, we shall process your personal data in accordance with the General Data Protection Regulations (GDPR). This Notice complies with requirements under both DPA and GDPR.

4. Changes to this Notice
Prior to the implementation of GDPR, we are likely to make changes to this Notice. We shall inform you of any changes to this Notice. Notification will be through the appropriate medium of communication e.g., where our main contact with you is by email, we will email you. Updates to our Privacy Policy will be made here.

5. Anything you are not clear about
If there is anything you are unclear about, please contact info@pavilion.org.uk and we will be happy to answer any queries you may have concerning this Notice or the way in which we process your personal data.

6. Where does Pavilion get your personal data from?
We obtain personal data about you from the following sources:
a) From you when you register onto our events, sign up to our mailing list, apply to our programmes of work, make a donation to us or contact us directly.
b) When you use our website.
c) From previous interactions with us where you have shared your personal data for the purposes of collaboration, research and benefaction.

7. What type of information is collected from you?
The personal information that we may collect from you could include:
• Name and title.
• Contact information including email address.
• Demographic information such as the town or city you live in, your age bracket.
• Information about what pages have been accessed on our website.
• Preferences of the type of information you would like to receive from us.
• Payment details if we have processed debit or credit card payments from you or have been supplied bank details.

8. Cookies
Google Analytics:
We use Google Analytics to collect information about visitor behaviour on our website. Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. This Analytics data is collected via a JavaScript tag in the pages of our site and is not tied to personally identifiable information. We therefore do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are.

Third Party Cookies:
These are cookies set on your machine by external websites whose services are used by Pavilion, including social media platforms like Twitter and Instagram. You should be aware that these sites are likely to be collecting information about what you are doing on the internet, including on this website.

Links to other websites:
From time to time, we may provide links to other websites from our website. Our privacy policy is limited to our own organisation and website.

9. Categories of personal data being processed
We will collect and process personal data about you for the purposes described below.
We will not collect “sensitive personal data” as described under the DPA and “special categories of data” as described under the GDPR. Such “sensitive personal data” or “special categories of data” includes: information about your racial or ethnic origin, gender, sexuality, religious beliefs or other beliefs, physical or mental health and criminal history.

10. The purposes for which we process your personal data
In general terms, we process your personal data in order to administrate your engagement with Pavilion. This includes invitations to attend events and exhibitions, and notifications of opportunities to work collaboratively with Pavilion, including volunteer opportunities.

We may also use it as follows:
• To contact you with information you have specified you are interested in.
• For internal record keeping.
• For statistical reporting.
• For sector research purposes.
• To process an order or donation that you have made.
• To carry out our obligations with you in respect of a contract entered into by you and us.

11. The legal basis for processing your personal data.
Article 6(1)(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose. E.g. joining Pavilion’s mailing list. Should you later wish to be removed from the Pavilion mailing list please use the unsubscribe link in any email that you receive. Alternatively, please contact info@pavilion.org.uk and we will remove you from our contact list or change your mailing preferences accordingly.
Article 6 (1)(b) Contract: the processing is necessary for a contract we have with the individual. E.g. the processing is necessary to fulfil a contractual commitment between us and you relating to the delivery of a project you are participating in.
Article 6 (1)(c) Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations). E.g. processing personal data to comply with Pavilion’s legal obligation to HMRC.
Article 6 (1)(d) Vital interests: the processing is necessary to protect someone’s life. Sometimes in extreme circumstances Pavilion will have to release information to protect your interests. E.g. in medical emergencies.
Article 6 (1)(f) Legitimate interest: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. E.g. contacting a journalist with Pavilion press information that they would expect to receive in their professional role (business to business activity).
It is recognised that some of the above grounds will overlap and that Pavilion could rely on multiple grounds justifying its lawful processing.