National Centre for Early Music

[Skip navigation]
Navigation Menu

Recruitment Privacy Notice

Privacy Notice - NCEM

The National Centre for Early Music (NCEM) is the trading name of The York Early Music Foundation, a charitable company limited by guarantee, with a registered address of St Margaret's Church, Walmgate, York, YO1 9TL. The York Early Music Foundation's company registration number is 3499629 and registered charity number is 1068331.

This Privacy Notice sets out how NCEM (the Data Controller) collects and uses your personal
data. This Privacy Notice has been written to reflect the changes introduced in May 2018 by both the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA18).

When we refer to "we", "us" "our" or "controller" in this Privacy Notice we mean NCEM.

Our Privacy Notice is structured in a way for you to easily find the specific details of what we do with your personal data, depending on which of our services you are using. We have split the Privacy Notice into 12 parts. Part 1 is all the information we must tell everyone regardless of which one of our services you use. Parts 2 to 12 give specific information on how we use your personal data for each of the services that we offer.

Part 1 - General Information
Part 2 - If you use our box office
Part 3 - If you enter our Young Composers Award
Part 4 - If you enter our International Young Artists Competition
Part 5 - If you hire our venue
Part 6 - If you join one of our membership schemes
Part 7 - If you make a donation to us
Part 8 - If you are one of our sponsors
Part 9 - If you just want to receive our event information and newsletters
Part 10 - If you want to apply for a job with us
Part 11 - If you are one of our volunteers
Part 12 - If you are one of our suppliers or contractors

PART 1 - GENERAL INFORMATION
Our contact details
NCEM is the data controller for the personal data we process about you.
You can contact us regarding the use of your personal data via one of the following ways:
Postal Address: The National Centre for Early Music, St Margaret's Church, Walmgate, York, YO1 9TL
Telephone: 01904 632220
Email: finance@ncem.co.uk

Our Data Protection Officer contact details
We do not have a legal obligation under GDPR to appoint a Data Protection Officer. However, a member of our team does oversee our general compliance with GDPR and DPA18. The various ways you can contact us to discuss any data protection issues or concerns are shown in the "Our contact details" section.

How we get your personal data
We obtain personal data directly from you in one of the following ways:
  • when you enquire about or book an event we are hosting;
  • if you enter an award or competition;
  • when you book our venue for an event you are hosting;
  • if you become a member or make a donation to us;
  • if you apply for a job or join us as a volunteer;
  • when you sign up for our newsletters;
  • if you become one of our sponsors; or
  • if you are one of our suppliers.
The legal basis to process your personal data
When gathering and using your personal data we must have a legal basis to do so - this is a requirement of data protection law.

The legal basis we rely on to process your personal data varies depending on the processing activity undertaken. Generally, we will rely on either consent, contractual obligation or legitimate interests to process your personal data. The full details of the legal basis we rely on to process your personal data are given in Parts 2 to 12 of this privacy notice.

Regardless of which service you use with us, in order for us to comply with one of our legal or regulatory obligations we will rely on the legal basis of "legal obligation" to process your
personal data. For example, we may need to share personal data with regulators such as the Charity Commission or Information Commissioners Office. We also have to retain personal data for accounting purposes and transactions relating to Gift Aid have to be declared to HMRC.

Your rights
Depending on the purpose and legal basis we rely on for processing your personal data, there are various rights available to you. You can:
  • access the personal data we keep about you and be given specific information about the processing. This right always applies regardless of the processing activity we undertake.
  • ask us to rectify personal data we hold about you that you think is inaccurate. This right always applies regardless of the processing activity we undertake.
  • ask us to delete your personal data but only when specific circumstances apply.
  • ask us to restrict the processing of your personal data but only when specific circumstances apply.
  • object to the processing when we have relied on legitimate interest to undertake that processing activity and you believe we have infringed your rights.
  • transfer your personal data from us to another service provider or give it to you. This right only applies to personal data you have given to us and when the processing is based on your consent or contractual basis and the processing is automated.
We do not undertake any solely automated decision making about you with the personal data we process.

To find out more about how to exercise your rights please refer to the guidance on the Information Commissioner's Office website - https://ico.org.uk/your-data-matters

You do not have to pay a fee to us to exercise any of your rights. However, if your request is manifestly unfounded or excessive we may either charge a reasonable fee or refuse the request.
We shall respond to a valid request within one month of receiving it.

If you wish to make a request, please contact us via one of the methods shown in the "Our contact details" section.

How to make a complaint about us to the Information Commissioner's Office
If you are not happy with how we are processing your personal data or you believe we have not dealt with one of your rights correctly you are entitled to make a complaint to the Information Commissioners Office (ICO). The ICO has several ways in which you can get in touch with them, including post, email, and online forms. For full details how to make a complaint please refer to their website - https://ico.org.uk/make-a-complaint

Sharing your information
We do not share, sell or rent your personal data to third parties for them to use for their own marketing purposes.

We do use third party organisations to process personal data on our behalf to enable us to provide our services to you. When we do use data processors we ensure we have appropriate contracts in place with each one that are GDPR compliant. The data processor is not allowed to do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us, unless they are required to do so by law. They will hold it securely and retain it for the period we instruct.

Our data processors include:
  • MS Office 365 - we use Microsoft Office to process and store information which includes personal data, this includes email;
  • Box Office System (hosted by Seat Geek) - used to process sales and tickets for events and to store customer contact details;
  • Artifax Event - we use this system to manage all our events we host;
  • Survey Monkey - we occasionally undertake surveys to help us improve our service;
  • Mailchimp - we store individual's contact details on Mailchimp and send information, e.g. events, newsletters via this platform;
  • Paypal - used to process payment when you make an online monetary donation to us and for entry to our competition
  • IT maintenance and service - our IT contractor has access to our computer network and systems that contain personal data to undertake routine maintenance and deal with IT related problems;
  • Website development and hosting - our website developer hosts our website on our behalf, therefore they are able to access and see personal data captured on our website, including cookies;
  • Wix - used to process online entries to our International Young Artists Competition; and
  • Accountants - we use accountants to undertake our payroll and audit functions, they may see personal data of our customers in the course of the activities they undertake for us).
We may also need to share your personal data with a 3rd party if we are required to do so by law. In such a case our legal basis for sharing your data is necessary for compliance with a legal obligation we are subject to (GDPR Article 6(1)(c)).

Transferring personal data outside of the UK and EU

Mailchimp
We use the marketing platform Mailchimp to store your contact details and other personal data which allows us to undertake our marketing activities. Mailchimp is operated by The Rocket Science Group LLC, who are based in Georgia in the United States of America. All our data on the Mailchimp platform is therefore transferred and stored in the USA. We rely on the following exception in GDPR to undertake the transfer of personal data:
Adequacy decision in place (GDPR Article 45)
Mailchimp is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active
Wix.com
We use Wix.com Ltd for our online application form process for entry into the International Young Artists Competition on our website https://www.yorkcomp.ncem.co.uk/ . Data input onto our online application form may be processed and stored by Wix.com in the United States of America, in Israel and in Europe (including the Ukraine). We rely on the following exception in GDPR to undertake the transfer of personal data:
Adequacy decision in place (GDPR Article 45)
Israel is one of the countries considered by the European Commission to be offering an adequate level of protection for the personal data of EU Member State citizens.
Wix.com is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website -
Survey Monkey
We use Survey Monkey to undertake customer satisfaction surveys or other surveys related to the work we do. Survey Monkey are based in California in the United States of America. Completed surveys may therefore be transferred and stored in the USA. We rely on the following exceptions in GDPR to undertake the transfer of personal data:
Adequacy decision in place (GDPR Article 45)
Survey Monkey is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000Gn7zAAC&status=Active
Standard data protection clauses adopted by the Commission in place (GDPR Article 46(2)(c))
Survey Monkey has a data processor agreement with their customers which includes standard data protection clauses adopted by the Commission. Their latest data processor agreement is dated 16 Aug 2018.
Microsoft Office 365
We use Microsoft Office 365 to process and store most of our information which will include some of your personal data. Microsoft Office 365 is a product supplied by the Microsoft Corporation who are based in Washington in the United States of America. It is possible that the information we process and store in Microsoft Office 365 may be transferred and stored on servers in the USA. We rely on the following exception in GDPR to undertake the transfer of personal data:
Adequacy decision in place (GDPR Article 45)
Microsoft Corporation is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&status=Active
Visitors to our website
In operating our website, www.ncem.co.uk, we use a third-party service, Google Analytics, to collect and process standard internet log information about your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data all of which enables us to improve our services to you. We are not able to identify anyone from this data.

For more information about cookies please read our Cookie Policy .

Children's information
We collect and process personal data relating to children in relation to the following services:
  • Young Composers Award
Links to other websites
Our website may provide links to websites of other organisations. Our Privacy Notice does not cover how those organisations process your personal data when you visit their website. We advise you to read their Privacy Notices.

Changes to our Privacy Notice
We keep our Privacy Notice under review to ensure it remains accurate and up to date. This Privacy Notice was last updated in April 2019.

PART 10 - IF YOU APPLY FOR A JOB WITH US
What personal data do we need?
When you apply for a job with us you will need to provide some or all of the following information as part of the job application process:
  • Full name
  • Postal address
  • Telephone number
  • Mobile number
  • Email address
  • Equal opportunities information (which includes age, disability, gender, religion, sexual orientation, ethnic group, relationship status, caring responsibility) - voluntary
  • Education history
  • Qualifications
  • Employment history
  • Whether you hold a UK work permit
  • References
How do we get your personal data?
We collect information directly from you when you submit your application form and/or CV to us.

We will also collect information about you from your referees as you progress down the recruitment process.

Why do we need your personal data and which legal basis do we rely on for the processing?
We need your personal data to be able to process your application for a job with us, which includes, but is not limited to:
  • assessing your suitability for the role applied for;
  • making a decision on whether your application progresses to the next stage of the recruitment process (sifting and shortlisting);
  • inviting you to interview or tests;
  • making a decision on whether or not to appoint you to the role applied for;
  • obtaining further information in order to carry out pre-employment checks if we make a conditional offer of employment to you; and
  • gathering of information for equal opportunities monitoring
The legal basis we rely on to undertake our recruitment activities includes:
Contractual obligation (GDPR Article 6(1)(b))
The processing of your job application is necessary in order for us to take steps at your request before entering into a possible employment contract with us.

We require certain information from you to enable us to fulfil our employment pre-contractual and contractual obligations. If you are not able to provide all the necessary information we need we may not be able to process your application and consider you for one of our job vacancies.
Legal obligation (GDPR Article 6(1)(c))
We have certain obligations under employment law in relation to recruitment and selection and equal opportunities that we must comply with.

Processing for employment law (GDPR Article 9(2)(b))
Information you provide to us that relates to special category personal data, such as health, religious or ethnic information is necessary for our recruitment and selection purposes as it relates to our obligations in employment law.
Processing to assess working capacity (GDPR Article 9(2)(h))
We have certain obligations to assess your health in relation to your ability to work for us.
Who do we share your personal data with?
Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

Do we use any data processors?
We do not use any data processors for the purpose of recruitment and selection.

How long do we keep your personal data?
All unsuccessful candidate details are kept for 6 months from the end of the recruitment process they relate to.

Successful candidate details are transferred to their employment record and kept for 6 years after employment ends.