Privacy Policy

Why do we use your personal data?

SSP keeps personal data about children to whom we provide services and we use this data to:

• Support children and monitor their progress;
• Provide appropriate support and pastoral care; and
• Monitor the quality of our provision of services to young people

What types of personal data do we process?

We will process following categories of personal data

• Name
• home address
• parent/guardian contact details
• health information for emergencies
• feedback and evaluation data
• transaction amount
• transaction date

Who has access to your personal data?

Where required SSP may share data with third parties, but only where it is necessary to:

• comply with a legal obligation;
• for the protection or detection of crime; or to
• allow a partner organisation to act on behalf of SSP

We keep data locked and secure. Access internally is only given to staff and tutors who are need access for safeguarding and delivery.

What is the legal ground to process your personal data?

The processing of your personal data is necessary for SSP to fulfil the service of managing your enrolment which is a contract.

How long will we save your data?

We will keep children’s personal data associated with feedback and evaluation for as long as it is useful for developing and monitoring the quality of our provision. The data gathered is anonymised after the end of the programme or activity. We will not connect your feedback with anything that would identify you as an individual.

We will keep your data for as long as you are an active customer. We define active as engaging with us in the last five years. This can be through making a booking, an enquiry or opening a marketing email. After this time, we will anonymise your data and retain only what we need for monitoring of how courses have performed and bookkeeping purposes.

Why do we use your personal data?

We will process your data when you enter our competitions. SSP will use your personal data to contact contestants regarding the competition, before and after an event, to identity contestants, to contact winners, deliver and follow up on prize deliveries.

What types of personal data do we process?

We will process following categories of personal data:

• contact information such as name, address, e-mail address and telephone number
• information submitted in the contest

Who has access to your personal data?

If we run a competition in partnership with another supplier e.g. accommodation provider we will share the personal data of the winner so they can receive their prize. We forward your personal data to third parties to provide you with the services mentioned above. This includes our email platforms and our customer relationship management (CRM) system to send and store communications.

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you choose to enter a competition.

To enable us to tailor our contact to your needs we ask at the time of entering the competition whether you would like to receive our digital newsletter and annual paper newsletter.  If you make your entry via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter. If you say yes, we will tick a box against your personal details on our database to show you have consented to receiving marketing information.  If you make the entry via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will adjust your personal details to record your marketing preferences.  We will not process your data for any other purpose.

Your right to withdraw your consent:

You have the right to object to direct marketing, including profiling analysis made for direct marketing purposes. This will not stop you entering the competition. You can withdraw your consent at any time and we will cease to send out marketing material.

You can opt out from direct marketing by the following means:

• following the instruction in each marketing post
• emailing [email protected]

How long do we save your data?

We will keep your personal data for as long as we need to close the competition and notify the winner. We aim for this to be within 60 days of the competition ending.

Why do we use your personal data?

We will use your personal data to send you marketing offers, information surveys and invitations through e-mails, phone calls and postal mail.

To optimise your experience of SSP and based on the information that you have provided to us, we will provide you with relevant information, recommended products, send you reminders of courses you have requested to be on a waiting list for and send you personalised offers.

What types of personal data do we process?

We will process following categories of personal data

• contact information such as e-mail address, telephone number and postal code
• if you want updates on specific courses or tutors

If you are a previous student or SSP member we will also process your personal data submitted in relation to the account and membership such as

• name
• address
• booking history

What is the legal ground to process your personal data?

The processing of your personal data is based on consent.

To enable us to tailor our contact to your needs we ask at the time of booking, membership payment or enquiry whether you would like to receive our digital newsletter and annual paper newsletter.  If you do this via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter.  If you make the booking or enquiry via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will adjust your personal details to record your marketing preferences.  We will not process your data for any other purpose.

Your right to withdraw your consent:

You have the right to withdraw your consent to direct marketing, including profiling analysis made for direct marketing purposes. If you object to direct marketing we will cease to process your personal data for that purpose and will cease to send out marketing material.

You can opt out from direct marketing by the following means:

• following the instruction in each marketing post
• emailing [email protected]

How long do we save your data?

We will keep your data for direct marketing until you withdraw your consent.

If you haven’t opened an e-mail within the last year we will stop sending you digital marketing. If there has been no other activity on your account i.e. no bookings or enquiries, for five years we will stop sending you our annual postal marketing. After five years of inactivity we will delete your personal data only retaining anonymised information needed for bookkeeping and monitoring purposes. If you unsubscribe we will need to retain your data on unsubscribe lists to make sure we don’t contact you again.

Why do we use your personal data?

We will use your personal data to send you marketing offers, information surveys and invitations through e-mails, phone calls and postal mail.

To optimise your experience of SSP and based on the information that you have provided to us, we will provide you with relevant information, recommended products, send you reminders of courses you have requested to be on a waiting list for and send you personalised offers.

What types of personal data do we process?

We will process following categories of personal data

• contact information such as e-mail address, telephone number and postal code
• if you want updates on specific courses or tutors
• how you heard about us
• records of phone and email correspondence

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you agree to direct marketing.

If you are enquiring via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter.  If you make the enquiry via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will store your personal details on the legal basis that you have given your consent for us to send you marketing information.  We will not process your data for any other purpose.

If you complete one of our ‘Keep in Touch’ cards on site, after a course or an online request to go on our mailing list we ask you for your name, address, postcode and email address.  This enables you to advise us whether you would like an annual brochure posted to your home address plus there is a separate option to consent to receiving the e-newsletter/special offers or information about new courses.  We will enter this information into our CRM system.

The processing of any complaint or feedback is based on SSP’s legitimate interest

How long do we save your data?

We will keep your data for as long as you are an active customer. We define active as engaging with us in the last five years. This can be through making a booking, an enquiry or opening a marketing email. After this time, we will anonymise your data and retain only what we need for monitoring of how courses have performed and bookkeeping purposes. We will save complaints data for 2 years. After that it will be anonymised to be used to monitor overall performance of the School on feedback from customers.

Your right to object to processing based on legitimate interest:

You have the right to object to the processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.

Your right to withdraw your consent:

You have the right to withdraw your consent from the processing of your personal data at any time for direct marketing.

When you do so, SSP won’t send you any further direct marketing offers or information based on your consent.

You can opt out from direct marketing by the following means:

• following the instruction in each marketing post
• emailing [email protected]

How long do we save your data?

We will keep your data for direct marketing until you withdraw your consent.

If you haven’t opened an e-mail within the last year we will stop sending you digital marketing. If there has been no other activity on your account i.e. no bookings or enquiries, for five years we will stop sending you our annual postal marketing. After five years of inactivity we will delete your personal data only retaining anonymised information needed for bookkeeping and monitoring purposes.

Why do we use your personal data?

We will use your personal data to manage your purchase of our courses at SSP. We will do this by processing your orders so that we can confirm your booking and send you information about the course via emails and by post.  We keep this securely on our customer database.

We will use your personal data to manage your payments and inform you of changes in course arrangements. No credit or debit card information is held by the School.  

We will use your personal data to comply with health, safety and equality legislation to ensure we provide a safe working environment and equal access to services.  

We will use your personal data to create a student account in your name, in our private domain of an external web app. This app is where we host our online course content in the format of a collaborative virtual bulletin board. Having an account enables you to access private information, interact with your tutor and fellow students and share files securely. 

We will also use your data to handle complaints.

What types of personal data do we process?

We will process the following categories of personal data

• contact information such as name, address, e-mail address and telephone number
• payment information and payment history
• booking information
• how you heard about us
• special requirements and health
• records of phone and email correspondence

Who has access to your personal data?

We share your personal data with authorised staff working at the school using IT cloud based applications which are secure.

We share your name and booking history with our tutors in our private domain of an external web app and no other personal data. 

We never pass on, sell or swap your data for marketing purposes to third parties. 

Note: If you choose to give your contact details to tutors, you are giving it to them in their personal capacity and not to St Ives School of Painting (as we already hold this information). You are giving it to them in their capacity as an artist not as a representative of SSP. The tutor then becomes the data controller

What is the legal ground to process your personal data?

The processing of your personal data is necessary for the adequate performance of the contract between you and us and to allow us to comply with our legal obligations. 

The processing of your personal data in our private domain of an external web app is based on SSP’s legitimate interest in being able to provide and improve the service.   

The processing of any complaint or feedback is based on SSP’s legitimate interest in responding to the complaint and being able to provide and improve the service.   

How long do we save your data?

We will keep your data for as long as you are an active customer. We define active as engaging with us in the last five years. This can be through making a booking, an enquiry or opening a marketing email. After this time, we will anonymise your data and retain only what we need for monitoring of how courses have performed and bookkeeping purposes. We will save complaints data for 2 years. After that it will be anonymised to be used to monitor overall performance of the School on feedback from customers.

Your right to object to processing based on legitimate interest:

You have the right to object to the processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.

Why do we use your personal data?

We will use your personal data to comply with obligations in laws, court rulings and decisions from authorities.

This includes using your personal data to collect and verify accounting data to comply with our book-keeping rules.

What types of personal data do we process?

We will process following categories of personal data

*customer number

*order number

*name

*postal address

*transaction amount

*transaction date

Who has access to your personal data?

We will share your personal data with IT companies that provide book-keeping system solutions.

What is the legal ground to process your personal data?

The processing of your personal data is necessary for SSP to fulfil its legal obligation.

How long do we save your data?

We will save your data in compliance with the book-keeping rules in the UK.

Why do we use your personal data?

Successful and rewarding fundraising depends on developing good relationships with donors. Creating and maintaining an up-to-date profile on a donor helps us to build and maintain those good relationships. It also allows us to contact you in the most appropriate way and promote fundraising and event opportunities that we believe you will be most interested in.

Where we have your permission to direct market to you, we may invite you to support our work by making a donation, buying a raffle ticket, getting involved in fundraising activities or leaving a gift in your will.

Occasionally, we may invite some supporters to attend special events to find out more about the ways in which donations and gifts in wills can make a difference to specific projects and to our cause. We’ll also send you updates on the impact that you make by supporting us in this way, unless you tell us not to.

What types of personal data do we process?

We do not collect sensitive personal information about our supporters unless there is a clear and valid reason for doing so.

We will process following categories of personal data

• contact information such as e-mail address, telephone number and postal code
• how you heard about us

If you have donated

• name
• address
• amount of donation and purpose
• whether it has been gift aided
• whether you are a UK tax payer so that we can claim gift aid

If you’ve told us that you’re planning to, or thinking about, leaving us a gift in your will

• record of your intention
• purpose of gift
• if we have a conversation or interaction with you (or with someone who contacts us in relation to your will, for example your solicitor), we’ll note these interactions throughout your relationship with us, as this helps to ensure your gift is directed as you wanted.

How much of this information we collect depends on the type of relationship you have and the information we build in the course of your relationship with us.

What is the legal ground to process your personal data?

The processing of your personal data relating to donation is necessary for SSP to fulfil the service of managing your donation.

If you say that you would like to hear from us, you will be added to our email subscriber list and will receive regular updates and fundraising asks. You can change your preferences on these updates at any time.

Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them. We follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who’ve made, or are likely to make, a significant donation to SSP.

As part of this process we’ll carry out research using publicly available information and professional resources. If this applies to you, we’ll remind you about the process when you make your donation.

How long do we save your data?

We need to keep the details of financial transactions for 7 years after the financial year of a donors last gift, in the event of a tax or banking enquiry. We will only contact you to thank you. If you say that you would like to hear from us, you will be added to our email subscriber list and will receive regular updates and fundraising asks. You can change your preferences on these updates at any time.

You can opt out from direct fundraising marketing by the following means:

• following the instruction in each marketing post
• emailing [email protected]

Why do we use your personal data?

We use images of students, tutors and staff in a range of materials to promote St Ives School of Painting (SSP) This includes (but is not limited to) advertisements and other publicity materials such as leaflets, brochures and posters, direct mail, books, newspapers, magazine articles, video and publications for the Internet and learning resources. We will take our own images of business activities we run using our own equipment and also work with external photographers and filmmakers.

In order to deliver our small group, interactive online courses (currently taught via Zoom) we record the online sessions which include students and tutors. This enables participating students to access these recordings for the period of time specified on booking.

We will do filming and photography in public spaces for use in promotional material or whilst recording an outside course broadcast and there is no intention to film anyone other than staff and tutors.  However, due to the location there may be occasions where members of the public might accidentally be caught during the filming or photograph.  Please see paragraph under “What types of personal data we process” below on how we try to ensure this does not happen and steps that will be taken if it does.  

What types of personal data do we process?

We will process the following categories of personal data (images of students, tutors and staff) as:

digital photographs

video recordings

audio recordings

**For outside photographs, broadcasts and filming, where we will be in a public or gallery space, location warning notices will be put in place and all reasonable efforts will be made to gain approval from the subject of any image of an identifiable person.

While efforts will be made to make individuals unidentifiable in the final footage so that faces are blurred, the warning signs will advise members of the public to avoid the area of filming so as not to be caught on camera.  The notices also advise that if a member of the public think they have been filmed and do not consent to it to contact the school on [email protected] so that arrangements can be made to delete the data if possible.

Who has access to your personal data?

We store images and video temporarily in digital cameras which are then downloaded to our cloud based systems. The images are deleted from digital cameras after being downloaded. When working with outside professionals they will hold images for as long as necessary to complete a project and then delete the data. A contract is in place with these outside professionals to comply with data protection legal requirements.

Depending on the use of the image it could be put in the public domain such as website, social media and print, but consent will be obtained before this is done.

Recordings from online classes are confidential and are only accessed by participating students and staff.

What is the legal ground to process your personal data?

In face to face courses we ask students to sign an Image and Media Permission Form to give consent to the use of their image for the purposes set out above on why we use your personal data. The processing of this is under consent. There may be circumstances where the difficulty in withdrawing an image will mean SSP will hold the data under legitimate interest. An example of this would be on printed materials such as a brochure of flyer that has already been produced. You have the right to object to the processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.

For video recordings of our online courses where you are included due to participation on screen, we will process this data under contract. As a condition of taking part in the course you agree for the recording to be made accessible to participating students for the duration of the course and for the agreed period of time afterwards. If you leave the course, you cannot withdraw your consent to the recordings being accessible to fellow students for the agreed time. After this period the School may retain recordings for the purposes for staff training. We will then hold the data under legitimate interest.

The taking of photographs and filming in public and gallery spaces and at events, will be processed under our legitimate interests (and your interests and fundamental rights do not override those interests). Location warning notices will be put in place and all reasonable efforts will be made to avoid filming members of the public.  If this does happen please see paragraph under “What types of personal data we process” to be advised on how we try to ensure this does not happen and steps that will be taken if it does.  

How long do we save your data?

SSP will keep all the images and video recordings and use them for such period as it considers appropriate, and will move them into its secure image archive held in the cloud for posterity once they are no longer appropriate for the modern image library.

For recordings of online courses images and video recordings will be made accessible to participating students on that course for the agreed period and then will either be retained for staff training or deleted.

Why do we use your personal data?

We will collect and process personal data relating to job applicants. We collect this data for the recruitment exercise.

We need to process data to decide whether you meet the minimum requirements to be shortlisted for a role and whether your application meets the requirements to invite you to an interview. If we decide to call you for an interview, we will use the information you provide us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references and carry out appropriate checks.

We also need to process data to ensure that it is complying with our legal obligations e.g. to check a successful applicant’s eligibility to work in the UK or DBS checks if applicable.

Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.

St Ives School of Painting (SSP) is an equal opportunities employer.  In order to monitor the effectiveness of our advertising and recruitment to ensure they are open to all sections of the community, we have designed a diversity questionnaire with the intention of having a separate, confidential record of your name, where you obtained information about the vacancy you applied for and information about the protected characteristics within the Equality Act 2010.

The information contained in this questionnaire will be treated as confidential and will be used for monitoring purposes. It will not be seen by the recruitment team during the selection process.

The diversity information you provide will enable SSP to monitor the effectiveness of our Equal Opportunities Policy and meet our legal obligations under the Equality Act 2010.  Effective monitoring is an important tool for measuring performance and progress towards equality and diversity goals and in ensuring a truly inclusive working environment. This information is only used for research and statistical analysis.

Diversity information is defined by the Data Protection legislation as “sensitive”.  It is not mandatory to supply “sensitive” information, but should you do so it will not affect your application in any way.

The information you give will be held on both manual and electronic systems by SSP.

If you are appointed, we will also use the information you provided on disability to ensure that we are meeting our obligations under the Equality Act 2010 to make reasonable adjustment to the work place so that a disabled person is not at any substantial disadvantage compared to a non-disabled person.

Any other disclosures will only be made if we are required to do so by any court order or similar process, or as required by law.

How do we protect your data?

We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.

Where we engage third parties to process personal data on our behalf, we do so based on written instructions and are under a duty of confidentiality and obliged to implement appropriate technical and organisational measures to ensure the security of data.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Your information will be shared internally for the purposes of the recruitment exercise on a ‘need to know’ basis, including with members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with the vacancy in order to comply with its legal obligations and enter into a contract with you.

There are two instances where will share your data. Firstly if your application for employment is successful and we make you an offer of employment we will then share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records and professional registration checks. We will require those third parties to keep your personal data confidential and secure. Third parties are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions. Secondly, we will share anonymised equality and diversity monitoring data with a funder if required.

We will not transfer your data outside the European Economic Area.

What types of personal data do we collect?

We collect, store and use a range of information about you, in connection with your application for work with us. This includes:

• The information you have provided in any curriculum vitae and covering letter.
• The information you have provided on our application form, including your name, address and contact details, including email address and telephone number.
• Details of your qualifications, skills, experience and employment history.
• Information about your entitlement to work in the UK.
• Any information that you provide us during an interview, including interview notes and the records of any tests or assessments.
• Information providing you with the outcome of an interview selection process, including correspondence and any feedback given.

We may also collect, store and use the following ‘special categories’ of more sensitive personal information:

• Equal opportunities monitoring information about your ethnic origin, sexual orientation, health, religion or belief, marital status, gender reassignment and age.
• Information about your health, including any medical condition, health and sickness records.
• Whether or not you have a disability for which the we need to make reasonable adjustments during the recruitment process.
• Information about criminal convictions and offences.

We collect this information in a variety of ways. For example, data might be contained in application forms or CVs, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment, including online tests.

We will also collect personal data about you from third parties, such as recruitment agencies, references supplied by former employers, information from employment background check providers and information from criminal records checks. We will seek information from third parties once a job offer to you has been made

Data will be stored securely in files, and electronically accessed only by authorised HR staff.

What is the legal ground to process your personal data?

We need to process your data to enter into an employment contract with you.

We also have a legitimate interest in processing personal data during the recruitment process and for keeping records of the process.

How long do we keep your data?

If your application is unsuccessful your personal data will remain in the recruitment management system for 12 months after the end of the relevant recruitment process. At the end of that period or sooner if you withdraw your consent and we have relied on that consent for lawful processing of your data, your data will be deleted or destroyed.

Panel notes relating to the selection process that are held outside of the recruitment management system will be destroyed 12 months after completion of the end of the relevant recruitment process.

In exceptional cases your data may be kept for longer than the 12 months stated in this section if we decide that it is in our legitimate interests to retain your data for longer, in order to investigate or defend allegations relating to the fairness of the recruitment process and in the event of a legal claim, for example that we have discriminated against candidates on prohibited grounds.

If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your personnel file and retained during your employment.

Why do we use your personal data?

You may come across SSP on Facebook through your own networks, or you may see an ad from us. We target ads at audiences that look like they have an interest in making art. We do this to inform, educate and engage new potential students.

Who has access to your personal data?

Facebook and Instagram are valuable tools for us to communicate and share with our community, which is why we use the platforms. These are however commercial companies. We want to remind our users that formation that shared on timelines, on our page or in private messages may be used or sold by them for commercial purposes. We have no control over this.

Social networking sites such as Facebook, Instagram and Twitter may send cookies that help them to show adverts from businesses and advertisers in your social media feed, but only if your privacy settings within your social media account allows them to do so.

Since we do not have any control over your social media privacy settings, we are unable to control these cookies.

You can find out how social media providers collect and use your information, and how to manage your privacy settings by reading their privacy and cookie policies., for example by visiting:

• facebook.com/policies/cookies/
• instagram.com/legal/cookies/
• twitter.com/en/privacy

Why do we use your personal data?

We will use your personal data to create and manage your membership and to give you a personalised and relevant experience. We will use it to check you are entitled to receive life drawing discounts as an enrolled member.

We will use it to alert you to urgent information regarding life drawing sessions such as last-minute cancellations or venue change.

If you have not opted-out of direct marketing we will use your personal data to send you marketing offers, information surveys and invitations through e-mails, text messages, phone calls and mail. We will also use your personal data for invitations for events and competitions and SSP Member discounts and additional services.

What types of personal data do we collect?

We will process the following categories of personal data that you submit to us when you sign up for SSP Membership

• identification data such as e-mail address
• contact information such as name, postal code, e-mail address
• membership ID
• telephone number (if you choose to provide it to us)
• address (if you choose to provide it to us)
• records of phone and email correspondence

We will process the following categories of personal data if you make a booking

• order history
• payment history

What is the legal ground to process your personal data?

The processing of your personal data is necessary to fulfil the service of the SSP membership which is a contract.

Collecting your personal data when creating and managing your SSP membership is required to fulfil our commitments according to the membership agreement.

If you don’t submit your personal data we won’t be able to provide you with services of the SSP membership i.e. a membership card that gives you a life drawing discount and emergency updates regarding interruptions to life drawing sessions.

The processing of any complaint or feedback is based on SSP’s legitimate interest

How long do we save your data?

We will keep your data for as long as you are an active customer. We define active as engaging with us in the last five years. This can be through making a booking, an enquiry or opening a marketing email. After this time, we will anonymise your data and retain only what we need for monitoring of how courses have performed and bookkeeping purposes. We will save complaints data for 2 years. After that it will be anonymised to be used to monitor overall performance of the School on feedback from customers.

Your right to object to processing based on legitimate interest:

You have the right to object to the processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.

How long do we keep your data?

You have the right to terminate your membership at any time. If you choose to do so your membership will cease to exist.

We will keep your data for up to five years after you have had an active membership. Then it will be anonymised so we are able to track growth or reduction of membership over the years and for bookkeeping purposes. We will delete your data if there has been no further activity on your account. You can request your personal data to be deleted at any time after membership has been terminated.

We will keep your personal data if there are any legal requirements and if there is an open dispute.

Why do we use your personal data?

We contact all students who have been on our courses to ask for their feedback on the course they have been on. We also send surveys out to people who have consented to direct marketing to gather information on new projects and fundraising.

What types of personal data do we process?

We will process the following categories of personal data

• contact information such as name, address, e-mail address and telephone number (if provided)
• feedback submitted in the survey

Following a survey we will only contact you if you have provide your name and expressed consent. We will only use your feedback for our own promotional purposes if you have expressed consent.

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you choose to fill in the survey.

How long do we save your data?

We will keep your personal data associated with the survey for as long as it is useful for developing and monitoring the quality of our courses. The data gathered is anonymised. We will not connect your feedback with anything that would identify you as an individual unless you have consented to provide your name and email as part of the survey.

Why do we use your personal data?

We will use data to evaluate, develop and improve our services, products and systems for all our customers. For this purpose we will not analyse your data on an individual level, all processing will be done on pseudonymised data. This includes analysis to make our services more user-friendly, such as modifying the user interface to simplify the flow of information or to highlight features that are commonly used by our customers in our digital channels and to improve IT systems in order to increase the security for our visitors and customers in general.

We use Google Analytics (GA) to track site user interaction. We have GA code installed on our site which creates one or more text files on your computer (called a “cookie”). The cookies contain an ID number which is used to uniquely identify your browser and track each site you visit that has GA enabled.

We use this data to determine the number of people using our site and to better understand how they find and use our web pages. With this information we can continually improve the information that we provide on our site and the processes for actions such as contacting us and donating. We can also use it to increase the number of new people finding our site.

For further information visit www.aboutcookies.org or www.allaboutcookies.org
You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.

Who has access to your personal data?

As we cannot access any of your personal data for your Google Analytics or Doubleclick profile data, we are not the Data Controller. You would need to contact Google directly for this information.

What is the legal ground to process your personal data?

If you already have GA cookies, they will be updated with the latest information about your visit to the site.

You have the right to object to this tracking and to stop it happening.

How do I prevent being tracked by Google Analytics?

If you are uncomfortable with this tracking, you can take the following actions:

• Use a tracking-blocker, such as Privacy Badger
• Clear cookies after every browsing session
• Install the Google Analytics opt-out extension

As an individual whose personal data is processed by SSP you have the following rights:

Right to access:

You have the right to request information about the personal data we hold on you at any time. You can contact SSP by emailing [email protected] or download this form, which explains the procedure, what information we need from you and how you can make the request.

Right to portability:

Whenever SSP processes your personal data, by automated means based on your consent or based on an agreement, you have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us.

Right to rectification:

You have the right to request rectification of your personal data if the information is incorrect, including the right to have incomplete personal data completed.

Right to erasure:

You have the right to erase any personal data processed by SSP at any time except for the following situations:

• you have an ongoing matter with Customer Service
• you have an open booking which you have not completed yet
• you have an unsettled debt with SSP, regardless of the payment method
• if you are suspected or have misused our services within the last four years
• if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes

Your right to object to processing based on legitimate interest:

You have the right to object to processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate legitimate grounds for the process which overrides your interest and rights or due to legal claims.

Your right to withdraw your consent to direct marketing:

You have the right to withdraw your consent to direct marketing, including profiling analysis made for direct marketing purposes.

You can opt out from direct marketing by the following means:

• following the instruction in each marketing email or email [email protected] with ‘opt out’ in the subject matter.

Right to restriction:

You have the right to request that SSP restricts the process of your personal data under the following circumstances:

• if you object to a processing based on SSP’s legitimate interest, SSP shall restrict all processing of such data pending the verification of the legitimate interest.
• if you have claim that your personal data is incorrect, SSP must restrict all processing of such data pending the verification of the accuracy of the personal data.
• if the processing is unlawful you can oppose the erasure of personal data and instead request the restriction of the use of your personal data instead.
• if SSP no longer needs the personal data but it is required by you to defend legal claims.

How can you exercise your rights?

We take data protection very seriously and therefore we have dedicated staff member to handle your requests in relation to your rights stated above. You can reach them at [email protected]

Compliance Officer:

We have appointed a Compliance Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Compliance Officer Janet Wynne at [email protected]

Right to complain with a supervisory authority:

If you consider SSP to have processed your personal data in an incorrect way you can contact us. You also have the right to raise a complaint to a supervisory authority. You can read more about these rights here – https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/