Fair Processing and Privacy Notice

Data Controller – St Ives School of Painting (SSP)

Contact Details regarding Data Protection Enquiries:

Alison Sharkey, Director. Telephone: 01736 797180.

Email:info@schoolofpainting.co.uk

 

St Ives School of Painting’s Commitment To Your Privacy

St Ives School of Painting’s (SSP) respects your privacy and your desire to understand how we handle and use your information. This Policy explains how we collect, use and store your information. Using your information in a way that you are comfortable with and keeping your information secure is an integral part of the quality experience we aim to provide. SSP will ensure we meet all information protection and customer legislation standards when handling any of your personal information.

 

Your privacy is important to us which is why we want to inform you on our updated Privacy Notice. To give you a more transparent and clear information on how we process your personal data, we have divided the Privacy Notice into different chapters. Depending on if you are an enquirer, SSP member or if you have enrolled on a course, different parts of the notice will apply to you. In each chapter, we describe in more detail what personal data we have about you and how we use it. We have also increased the information on your rights, for example how to get access to your data and how you can request to terminate the usage of your data.

 

Who is the controller of your personal data?

The company, St Ives School of Painting (“SSP”), is the controller of the personal data you submit to us and responsible for your personal data under applicable data protection law.

 

St Ives School of Painting and the St Ives Art School are working names of St Ives School of Art,

registered office is at:

Porthmeor Studios,

Back Road West,

St Ives,

Cornwall,

TR26 1NG

 

company no 7871063 registered in England, a company limited by guarantee

registered charity no 1146825

 

Where do we store your data?

We store the data that we collect from you within the European Economic Area (“EEA”) but may also be transferred to and processed in a country outside of the EEA. Any such transfer of your personal data will be carried out in compliance with applicable laws.

 

For transfers outside the EEA, SSP will use Standard Contractual Clauses and Shields as safeguards for countries without adequacy decisions from the European Commission.

 

Who can access your data?

We never pass on, sell or swap your data for marketing purposes to third parties.

 

We are working towards ensuring a contract is in place with all our third party processers so we know that they are compliant with GDPR and or US Privacy Shield.  We only forward data to third parties to provide you with our services, to collect, process, export and store personal data. You will find categories of third parties under every specific process below.

What is the legal ground for processing?

For every specific process of personal data we collect from you, we will inform you whether the provision of personal data is statutory or required to enter a contract and whether it is an obligation to provide the personal data and possible consequences if you choose not to.

 

Updates to our Privacy Notice:

We keep this notice under regular review. This privacy notice was last updated on 21 May 2018.

 

We may need to update our Privacy Notice. The latest version of the Privacy Notice is always available on our website. We will communicate any material changes to the Privacy Notice, for example the purpose of why we use your personal data, the identity of the Controller or your rights.

 

Chapters

 

  1. ENROLLED STUDENTS 
  2. ENQUIRERS
  3. SSP MEMBERS
  4. DIRECT MARKETING
  5. FUNDRAISING, DONATIONS AND LEGACY PLEDGES
  6. CUSTOMER SERVICE
  7. COMPETITIONS
  8. SURVEY RESPONDERS
  9. WEBSITE VISITORS
  10. SOCIAL MEDIA USERS
  11. FULFILLMENT OF LEGAL OBLIGATIONS
  12. YOUR RIGHTS

 

 

 

 

 

 

ENROLLED STUDENTS

Why do we use your personal data?

We will use your personal data to manage your purchase of our courses at SSP or in the event of any problems with your booking. We will do this by processing your orders so that we can confirm your booking and send you information about the course via emails and by post.  We keep this securely on our customer database.

 

We will use your personal data to manage your payments as well as make note of any special access requirements.

 

We will also use your data to handle complaints.

 

What types of personal data do we process?

We will process following categories of personal data

 

* contact information such as name, address, e-mail address and telephone number

* payment information and payment history

* booking information

* how you heard about us

* special requirements

 

Who has access to your personal data?

We forward your personal data to third parties to provide you with the services mentioned above. This includes our email platforms and our customer relationship management (CRM) system to send your order confirmation and communications. We use payment service providers for your payment. We store transaction information on our CRM system as well as cloud based file storage for bookkeeping purposes.

 

What is the legal ground to process your personal data?

The processing of your personal data is necessary for SSP to fulfil the service of managing your booking which is a contract.

 

How long do we save your data?

We will keep your data for as long as you are an active customer. We define active as engaging with us in the last five years. This can be through making a booking, an enquiry or opening a marketing email. After this time, we will anonymise your data and retain only what we need for monitoring of how courses have performed and bookkeeping purposes.


ENQUIRERS

Why do we use your personal data?

We will use your personal data to send you marketing offers, information surveys and invitations through e-mails, phone calls and postal mail.

 

To optimise your experience of SSP we will provide you with relevant information, recommended products, send you reminders of courses you have requested to be on a waiting list for and send you personalised offers. All these great services are based on information you have submitted to us.

 

What types of personal data do we process?

We will process following categories of personal data

 

* contact information such as e-mail address, telephone number and postal code

* if you want updates on specific courses or tutors

* how you heard about us

 

Who has access to your personal data?

We forward your personal data to third parties to provide you with the services mentioned above. This includes our email platforms and our customer relationship management (CRM) system to send and store communications.

 

We never pass on, sell or swap your data for marketing purposes to third parties.

 

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you agree to direct marketing.

 

If you are enquiring via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter and if you say yes, we will tick a box against your personal details on our database to show you have consented to receiving marketing information.  If you make the enquiry via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will store your personal details on the legal basis that you have given your consent for us to send you marketing information.  We will not process your data for any other purpose.

 

If you complete one of our ‘Keep in Touch’ cards on site, after a course or an online request to go on our mailing list we ask you for your name, address, postcode and email address.  This enables you to advise us whether you would like an annual brochure posted to your home address plus there is a separate option to consent to receiving the e-newsletter/special offers or information about new courses.  We will enter information into our CRM system.

 

 

Your right to withdraw your consent:

You have the right to withdraw your consent for the processing of your personal data at any time for direct marketing.

 

When you do so, SSP won’t be able to send you any further direct marketing offers or information based on your consent.

 

You can opt out from direct marketing by the following means:

 

* following the instruction in each marketing post

 

* emailing info@schoolofpainting.co.uk

 

How long do we save your data?

We will keep your data for direct marketing until you withdraw your consent.

 

For e-mail marketing we will consider you an inactive customer if you haven’t opened an e-mail within the last year. We will stop digital marketing after this time. If you are inactive for five years we will stop sending you postal marketing and we will delete your personal data only retaining anonymised information needed for bookkeeping and monitoring purposes.


SSP MEMBERS

Why do we use your personal data?

We will use your personal data to create and manage your membership and to give you a personalised and relevant experience. We will use it to check you are entitled to receive life drawing discounts as an enrolled member.

 

We will use it to alert you to emergency information regarding life drawing sessions such as last-minute cancellations or venue change.

 

If you have not opted-out of direct marketing we will use your personal data to send you marketing offers, information surveys and invitations through e-mails, text messages, phone calls and mail. We will also use your personal data for invitations for events and competitions and SSP Member discounts and additional services.

 

 

What types of personal data do we collect?

We will process the following categories of personal data that you submit to us when you sign up for SSP Membership

 

* identification data such as e-mail address

* contact information such as name, postal code, e-mail address

* membership ID

* telephone number (if you choose to provide it to us)

* address (if you choose to provide it to us)

 

 

We will process the following categories of personal data if you make a booking

 

* order history

* payment history

 

Who has access to your personal data?

We forward your personal data to third parties to provide you with the services mentioned above. This includes our email platforms and our customer relationship management (CRM) system to send your order confirmation and communications. We use payment service providers for your payment. We store transaction information on our CRM system as well as cloud based file storage for bookkeeping purposes.

 

Our tutors will have access to list of active members to enable them to process drop in bookings.

 

What is the legal ground to process your personal data?

The processing of your personal data is necessary to fulfil the service of the SSP membership which is a contract.

 

Collecting your personal data when creating and managing you SSP membership is required to fulfil our commitments according to the membership agreement.

 

If you don’t submit your personal data we won’t be able to provide you with services of the SSP membership i.e. a membership card that gives you a life drawing discount and emergency updates regarding interruptions to life drawing sessions.

 

How long do we keep your data?

 

You have the right to terminate your membership at any time. If you choose to do so your membership will cease to exist.

 

We will keep your data for up to five years after you have had an active membership. Then it will be anonymised so we are able to track growth or reduction of membership over the years and for bookkeeping purposes. We will delete your data if there has been no further activity on your account. You can request your personal data to be deleted at any time after membership has been terminated.

 

We will keep your personal data if there are any legal requirements and if there is an open dispute.

 

Your right to object to direct marketing:

You have the right to opt out of direct marketing, including profiling analysis. If you object to direct marketing we will cease to process your personal data for that purpose and will cease to send out marketing material based on your SSP membership.


DIRECT MARKETING

Why do we use your personal data?

We will use your personal data to send you marketing offers, information surveys and invitations through e-mails, phone calls and postal mail.

 

To optimise your experience of SSP we will provide you with relevant information, recommended products, send you reminders of courses you have requested to be on a waiting list for and send you personalised offers. All these great services are based on your previous purchases, and information you have submitted to us.

 

What types of personal data do we process?

We will process following categories of personal data

 

* contact information such as e-mail address, telephone number and postal code

* if you want updates on specific courses or tutors

 

If you are a previous student or SSP member we will also process your personal data submitted in relation to the account and membership such as

 

* name

* address

* booking history

 

Who has access to your personal data?

To provide you with the service mentioned above some data will be forwarded to third parties, such as email providers and technical suppliers for distribution of physical and digital direct marketing. Data is stored on our cloud based Customer Management System (CRM).

 

We never pass on, sell or swap your data for marketing purposes to third parties.

 

What is the legal ground to process your personal data?

The processing of your personal data is based on consent.

 

To enable us to tailor our contact to your needs we ask at the time of booking whether you would like to receive our digital newsletter and annual paper newsletter.  If you make your booking via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter. If you say yes, we will tick a box against your personal details on our CRM to show you have consented to receiving marketing information.  If you make the booking via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will adjust your personal details to record your marketing preferences.  We will not process your data for any other purpose.

 

 

Your right to withdraw your consent:

You have the right to withdraw your consent to direct marketing, including profiling analysis made for direct marketing purposes. If you object to direct marketing we will cease to process your personal data for that purpose and will cease to send out marketing material.

 

You can opt out from direct marketing by the following means:

 

* following the instruction in each marketing post

 

* emailing info@schoolofpainting.co.uk

 

How long do we save your data?

We will keep your data for direct marketing until you withdraw your consent.

 

For e-mail marketing we will consider you an inactive customer if you haven’t opened an e-mail within the last year. We will stop sending you digital marketing after this point.

 

If you unsubscribe we will need to retain your data on unsubscribe lists to make sure we don’t contact you again.

 

For postal marketing we will consider you an inactive customer if you haven’t been active within the last five years. We understand activity to be a booking, email or phone enquiry or the opening of marketing emails. We will stop sending you digital marketing after this point.

We will delete your personal data after this time period only retaining anonymised information necessary for bookkeeping and monitoring purposes.


 FUNDRAISING, DONATIONS AND LEGACY PLEDGES

Why do we use your personal data?

Successful and rewarding fundraising depends on developing good relationships with donors. Creating and maintaining an up-to-date profile on a donor helps us to build and maintain those good relationships. It also allows us to contact you in the most appropriate way and promote fundraising and event opportunities that we believe you will be most interested in.

 

Where we have your permission to direct market to you, we may invite you to support our work by making a donation, buying a raffle ticket, getting involved in fundraising activities or leaving a gift in your will.

 

Occasionally, we may invite some supporters to attend special events to find out more about the ways in which donations and gifts in wills can make a difference to specific projects and to our cause. We’ll also send you updates on the impact that you make by supporting us in this way, unless you tell us not to.

 

What types of personal data do we process?

We do not collect sensitive personal information about our supporters unless there is a clear and valid reason for doing so.

We will process following categories of personal data

 

* contact information such as e-mail address, telephone number and postal code

* how you heard about us

 

If you have donated

* name

* address

* amount of donation and purpose

* whether it has been gift aided

* whether you are a UK tax payer so that we can claim gift aid

 

If you’ve told us that you’re planning to, or thinking about, leaving us a gift in your will

* record of your intention

* purpose of gift

* if we have a conversation or interaction with you (or with someone who contacts us in relation to your will, for example your solicitor), we’ll note these interactions throughout your relationship with us, as this helps to ensure your gift is directed as you wanted.

 

How much of this information we collect depends on the type of relationship you have and the information we build in the course of your relationship with us.

 

Who has access to your personal data?

To provide you with the service mentioned above some data will be forwarded to third parties, such as email providers and technical suppliers for distribution of physical and digital direct marketing. Data is stored on our cloud based Customer Management System (CRM).

 

We never pass on, sell or swap your data for marketing purposes to third parties.

 

What is the legal ground to process your personal data?

The processing of your personal data relating to donation is necessary for SSP to fulfil the service of managing your donation.

 

If you say that you would like to hear from us, you will be added to our email subscriber list and will receive regular updates and fundraising asks. You can change your preferences on these updates at any time.

 

Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them. We follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who’ve made, or are likely to make, a significant donation to SSP.

 

As part of this process we’ll carry out research using publicly available information and professional resources. If this applies to you, we’ll remind you about the process when you make your donation.

 

 

How long do we save your data?

We need to keep the details of financial transactions for 7 years after the financial year of a donors last gift, in the event of a tax or banking enquiry. We will only contact you to thank you. If you say that you would like to hear from us, you will be added to our email subscriber list and will receive regular updates and fundraising asks. You can change your preferences on these updates at any time.

 

You can opt out from direct fundraising marketing by the following means:

 

* following the instruction in each marketing post

 

* emailing info@schoolofpainting.co.uk

 

 

 


CUSTOMER SERVICE

 

Why do we use your personal data?

We will use your personal data to manage your queries through e-mail, telephone and through social media.

 

We may also contact you if there is a problem with your booking.

 

What types of personal data do we process?

We will process any data you provide to us, including the following categories

 

* contact information such as name, address, e-mail address and telephone number

* payment information and payment history

* order information

* account or member number

* all correspondence in the matter

 

Who has access to your personal data?

To provide you with the service mentioned above some data will be forwarded to third parties, such as email providers. Data is stored on our cloud based Customer Management System (CRM).

 

We never pass on, sell or swap your data for marketing purposes to third parties.

 

What is the legal ground to process your personal data?

The processing of your personal data is based on SSP’s legitimate interest.

 

How long do we keep your data?

We will keep your data as long as you are an active customer or enquirer. We define active as engaging with us in the last five years. After this time we will store anonymised data necessary for bookkeeping and monitoring purposes.

We will save complaints data for 2 years. After that it will be anonymised to be used to monitor overall performance of the School on feedback from customers.

 

Your right to object to processing based on legitimate interest:

You have the right to object to the processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate a legitimate ground for the process which overrides your interest and rights or due to legal claims.


COMPETITION

 

Why do we use your personal data?

We will process your data when you enter our competitions. SSP will use your personal data to contact contestants regarding the competition, before and after an event, to identity contestants, to contact winners, deliver and follow up on prize deliveries.

 

What types of personal data do we process?

We will process following categories of personal data

 

* contact information such as name, address, e-mail address and telephone number

* information submitted in the contest

 

Who has access to your personal data?

If we run a competition in partnership with another supplier e.g. accommodation provider we will share the personal data of the winner so they can receive their prize. We forward your personal data to third parties to provide you with the services mentioned above. This includes our email platforms and our customer relationship management (CRM) system to send and store communications.

 

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you choose to enter a competition.

 

To enable us to tailor our contact to your needs we ask at the time of entering the competition whether you would like to receive our digital newsletter and annual paper newsletter.  If you make your entry via the telephone or in person, we will ask you whether you wish to receive digital marketing or the paper newsletter. If you say yes, we will tick a box against your personal details on our database to show you have consented to receiving marketing information.  If you make the entry via the website, we will offer you a box to tick to opt-in to receiving marketing information.  If you answered yes, we will adjust your personal details to record your marketing preferences.  We will not process your data for any other purpose.

 

Your right to withdraw your consent:

You have the right to object to direct marketing, including profiling analysis made for direct marketing purposes. This will not stop you entering the competition. You can withdraw your consent at any time and we will cease to send out marketing material.

 

You can opt out from direct marketing by the following means:

 

* following the instruction in each marketing post

 

* emailing info@schoolofpainting.co.uk

 

How long do we save your data?

We will keep your personal data for as long as we need to close the competition and notify the winner. We aim for this to be within 60 days of the competition ending.

 


SURVEY RESPONDERS

Why do we use your personal data?

We contact all students who have been on our courses to ask for their feedback on the course they have been on. We also send surveys out to people who have consented to direct marketing to gather information on new projects and fundraising.

 

What types of personal data do we process?

We will process the following categories of personal data

 

* contact information such as name, address, e-mail address and telephone number (if provided)

* feedback submitted in the survey

 

Who has access to your personal data?

To provide you with the service mentioned above some data will be forwarded to third parties, such as email providers and online survey platforms. Data is also stored on our cloud based Customer Management System (CRM).

 

We never pass on, sell or swap your data for marketing purposes to third parties.

 

 

Following a survey we will only contact you if you have provide your name and expressed consent. We will only use your feedback for our own promotional purposes if you have expressed consent.

 

What is the legal ground to process your personal data?

The processing of your personal data is based on your consent when you choose to fill in the survey.

 

How long do we save your data?

We will keep your personal data associated with the survey for as long as it is useful for developing and monitoring the quality of our courses. The data gathered is anonymised. We will not connect your feedback with anything that would identify you as an individual unless you have consented to provide your name and email as part of the survey.

 


WEBSITE USERS

 

Cookies

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.
For further information visit www.aboutcookies.org or www.allaboutcookies.org
You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.

 

Why do we use your personal data?

 

We will use data to evaluate, develop and improve our services, products and systems for all our customers. For this purpose we will not analyse your data on an individual level, all processing will be done on pseudonymised data. This includes analysis to make our services more user-friendly, such as modifying the user interface to simplify the flow of information or to highlight features that are commonly used by our customers in our digital channels and to improve IT systems in order to increase the security for our visitors and customers in general.

 

We use Google Analytics (GA) to track site user interaction. We have GA code installed on our site which creates one or more text files on your computer (called a “cookie”). The cookies contain an ID number which is used to uniquely identify your browser and track each site you visit that has GA enabled.

 

We use this data to determine the number of people using our site and to better understand how they find and use our web pages. With this information we can continually improve the information that we provide on our site and the processes for actions such as contacting us and donating. We can also use it to increase the number of new people finding our site.

 

Who has access to your personal data?

As we cannot access any of your personal data for your Google Analytics or Doubleclick profile data, we are not the Data Controller. You would need to contact Google directly for this information.

 

What is the legal ground to process your personal data?

If you already have GA cookies, they will be updated with the latest information about your visit to the site.

 

You have the right to object to this tracking and to stop it happening.

 

How do I prevent being tracked by Google Analytics?

 

If you are uncomfortable with this tracking, you can take the following actions:

 

– Use a tracking-blocker, such as Privacy Badger

 

– Clear cookies after every browsing session

 

– Install the Google Analytics opt-out extension

 


SOCIAL MEDIA

 

Why do we use your personal data?

You may come across SSP naturally on Facebook through your own networks, or you may see an ad from us. We target ads at audiences that look like they have an interest in making art. We do this to inform, educate and engage new potential students.

 

Who has access to your personal data?

Facebook and Instagram are valuable tools for us to communicate and share with our community, which is why we use the platforms. These are however commercial companies. We want to remind our users that formation that shared on timelines, on our page or in private messages may be used or sold by them for commercial purposes. We have no control over this.

 

Social networking sites such as Facebook, Instagram and Twitter may send cookies that help them to show adverts from businesses and advertisers in your social media feed, but only if your privacy settings within your social media account allows them to do so.

Since we do not have any control over your social media privacy settings, we are unable to control these cookies.

You can find out how social media providers collect and use your information, and how to manage your privacy settings by reading their privacy and cookie policies., for example by visiting:

https://www.facebook.com/policies/cookies/

https://www.instagram.com/legal/cookies/

https://twitter.com/en/privacy

 


FULFILLMENT OF LEGAL OBLIGATIONS

 

Why do we use your personal data?

We will use your personal data to comply with obligations in laws, court rulings and decisions from authorities.

 

This includes using your personal data to collect and verify accounting data to comply with our book-keeping rules.

 

What types of personal data do we process?

We will process following categories of personal data

*customer number

*order number

*name

*postal address

*transaction amount

*transaction date

 

Who has access to your personal data?

 

We will share your personal data with IT companies that provide book-keeping system solutions.

 

What is the legal ground to process your personal data?

The processing of your personal data is necessary for SSP to fulfil its legal obligation.

 

How long do we save your data?

We will save your data in compliance with the book-keeping rules in the UK.

 


YOUR RIGHTS

As an individual whose personal data is processed by SSP you have the following rights:

 

Right to access:

You have the right to request information about the personal data we hold on you at any time. You can contact SSP and we will provide you with your personal data via e-mail.

 

Right to portability:

Whenever SSP processes your personal data, by automated means based on your consent or based on an agreement, you have the right to get a copy of your data transferred to you or to another party. This only includes the personal data you have submitted to us.

 

Right to rectification:

You have the right to request rectification of your personal data if the information is incorrect, including the right to have incomplete personal data completed.

 

Right to erasure:

You have the right to erase any personal data processed by SSP at any time except for the following situations:

 

*you have an ongoing matter with Customer Service

*you have an open booking which you have not completed yet

*you have an unsettled debt with SSP, regardless of the payment method

*if you are suspected or have misused our services within the last four years

*if you have made any purchase, we will keep your personal data in connection to your transaction for book-keeping purposes

 

Your right to object to processing based on legitimate interest:

You have the right to object to processing of your personal data that is based on SSP’s legitimate interest. SSP will not continue to process the personal data unless we can demonstrate legitimate grounds for the process which overrides your interest and rights or due to legal claims.

 

Your right to withdraw your consent to direct marketing:

You have the right to withdraw your consent to direct marketing, including profiling analysis made for direct marketing purposes.

 

You can opt out from direct marketing by the following means:

 

* following the instruction in each marketing email or email info@schoolofpainting.co.uk with ‘opt out’ in the subject matter.

 

 

Right to restriction:

You have the right to request that SSP restricts the process of your personal data under the following circumstances:

 

* if you object to a processing based on SSP’s legitimate interest, SSP shall restrict all processing of such data pending the verification of the legitimate interest.

* if you have claim that your personal data is incorrect, SSP must restrict all processing of such data pending the verification of the accuracy of the personal data.

* if the processing is unlawful you can oppose the erasure of personal data and instead request the restriction of the use of your personal data instead.

* if SSP no longer needs the personal data but it is required by you to defend legal claims.

 

How can you exercise your rights?

We take data protection very seriously and therefore we have dedicated staff member to handle your requests in relation to your rights stated above. You can reach them at info@schoolofpainting.co.uk and address to the Compliance Officer.

Compliance Officer:

We have appointed a Compliance Officer to ensure that we continuously process your personal data in an open, accurate and legal manner. You can contact our Compliance Officer at info@schoolofpainting.co.uk

 

Right to complain with a supervisory authority:

If you consider SSP to have processed your personal data in an incorrect way you can contact us. You also have the right to raise a complaint to a supervisory authority. You can read more about these rights here – https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/