National Centre for Early Music

[Skip navigation]
Navigation Menu

Privacy Notice

Privacy Notice - NCEM

The National Centre for Early Music (NCEM) is the trading name of The York Early Music Foundation, a charitable company limited by guarantee, with a registered address of St Margaret's Church, Walmgate, York, YO1 9TL. The York Early Music Foundation's company registration number is 3499629 and registered charity number is 1068331.

This Privacy Notice sets out how NCEM (the Data Controller) collects and uses your personal
data. This Privacy Notice has been written to reflect the changes introduced in May 2018 by both the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA18).

When we refer to "we", "us" "our" or "controller" in this Privacy Notice we mean NCEM.

Our Privacy Notice is structured in a way for you to easily find the specific details of what we do with your personal data, depending on which of our services you are using. We have split the Privacy Notice into 12 parts. Part 1 is all the information we must tell everyone regardless of which one of our services you use. Parts 2 to 12 give specific information on how we use your personal data for each of the services that we offer.

Part 1 General Information

Part 2 If you use our Box Office
Part 3 If you enter our Young Composers Award
Part 4 If you enter our International Young Artists Competition
Part 5 If you hire our venue
Part 6 If you join one of our membership schemes
Part 7 If you make a donation to us
Part 8 If you are one of our sponsors
Part 9 If you just want to receive our event information and newsletters
Part 10 If you want to apply for a job with us
Part 11 If you are one of our volunteers
Part 12 If you are one of our suppliers or contractors


PART 1 - GENERAL INFORMATION ^ top

Our contact details

NCEM is the data controller for the personal data we process about you.

You can contact us regarding the use of your personal data via one of the following ways:

Postal Address: The National Centre for Early Music, St Margaret's Church, Walmgate, York, YO1 9TL
Telephone: 01904 632220
Email: finance@ncem.co.uk

Our Data Protection Officer contact details


We do not have a legal obligation under GDPR to appoint a Data Protection Officer. However, a member of our team does oversee our general compliance with GDPR and DPA18. The various ways you can contact us to discuss any data protection issues or concerns are shown in the "Our contact details" section.

How we get your personal data

We obtain personal data directly from you in one of the following ways:

• when you enquire about or book an event we are hosting;
• if you enter an award or competition;
• when you book our venue for an event you are hosting;
• if you become a member or make a donation to us;
• if you apply for a job or join us as a volunteer;
• when you sign up for our newsletters;
• if you become one of our sponsors; or
• if you are one of our suppliers.

The legal basis to process your personal data

When gathering and using your personal data we must have a legal basis to do so - this is a requirement of data protection law.

The legal basis we rely on to process your personal data varies depending on the processing activity undertaken. Generally, we will rely on either consent, contractual obligation or legitimate interests to process your personal data. The full details of the legal basis we rely on to process your personal data are given in Parts 2 to 12 of this privacy notice.

Regardless of which service you use with us, in order for us to comply with one of our legal or regulatory obligations we will rely on the legal basis of "legal obligation" to process your personal data. For example, we may need to share personal data with regulators such as the Charity Commission or Information Commissioners Office. We also have to retain personal data for accounting purposes and transactions relating to Gift Aid have to be declared to HMRC.

Your rights

Depending on the purpose and legal basis we rely on for processing your personal data, there are various rights available to you. You can:

• access the personal data we keep about you and be given specific information about the processing. This right always applies regardless of the processing activity we undertake.

• ask us to rectify personal data we hold about you that you think is inaccurate. This right always applies regardless of the processing activity we undertake.

• ask us to delete your personal data but only when specific circumstances apply.

• ask us to restrict the processing of your personal data but only when specific circumstances apply.

• object to the processing when we have relied on legitimate interest to undertake that processing activity and you believe we have infringed your rights.

• transfer your personal data from us to another service provider or give it to you. This right only applies to personal data you have given to us and when the processing is based on your consent or contractual basis and the processing is automated.

We do not undertake any solely automated decision making about you with the personal data we process.

To find out more about how to exercise your rights please refer to the guidance on the Information Commissioner's Office website - https://ico.org.uk/your-data-matters/

You do not have to pay a fee to us to exercise any of your rights. However, if your request is manifestly unfounded or excessive we may either charge a reasonable fee or refuse the request.

We shall respond to a valid request within one month of receiving it.

If you wish to make a request, please contact us via one of the methods shown in the "Our contact details" section.

How to make a complaint about us to the Information Commissioner's Office


If you are not happy with how we are processing your personal data or you believe we have not dealt with one of your rights correctly you are entitled to make a complaint to the Information Commissioners Office (ICO). The ICO has several ways in which you can get in touch with them, including post, email, and online forms. For full details how to make a complaint please refer to their website - https://ico.org.uk/make-a-complaint/

Sharing your information

We do not share, sell or rent your personal data to third parties for them to use for their own marketing purposes.

We do use third party organisations to process personal data on our behalf to enable us to provide our services to you. When we do use data processors we ensure we have appropriate contracts in place with each one that are GDPR compliant. The data processor is not allowed to do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us, unless they are required to do so by law. They will hold it securely and retain it for the period we instruct.

Our data processors include:

• MS Office 365 - we use Microsoft Office to process and store information which includes personal data, this includes email;
• Box Office System (hosted by Seat Geek) - used to process sales and tickets for events and to store customer contact details;
• Artifax Event - we use this system to manage all our events we host;
• Survey Monkey - we occasionally undertake surveys to help us improve our service;
• Mailchimp - we store individual's contact details on Mailchimp and send information, e.g. events, newsletters via this platform;
• Paypal - used to process payment when you make an online monetary donation to us and for entry to our competition
• IT maintenance and service - our IT contractor has access to our computer network and systems that contain personal data to undertake routine maintenance and deal with IT related problems;
• Website development and hosting - our website developer hosts our website on our behalf, therefore they are able to access and see personal data captured on our website, including cookies;
• Wix - used to process online entries to our International Young Artists Competition; and
• Accountants - we use accountants to undertake our payroll and audit functions, they may see personal data of our customers in the course of the activities they undertake for us).

We may also need to share your personal data with a 3rd party if we are required to do so by law. In such a case our legal basis for sharing your data is necessary for compliance with a legal obligation we are subject to (GDPR Article 6(1)(c)).

Transferring personal data outside of the UK and EU

Mailchimp
We use the marketing platform Mailchimp to store your contact details and other personal data which allows us to undertake our marketing activities. Mailchimp is operated by The Rocket Science Group LLC, who are based in Georgia in the United States of America. All our data on the Mailchimp platform is therefore transferred and stored in the USA. We rely on the following exception in GDPR to undertake the transfer of personal data:

Adequacy decision in place (GDPR Article 45)
Mailchimp is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=Active

Wix.com
We use Wix.com Ltd for our online application form process for entry into the International Young Artists Competition on our website https://www.yorkcomp.ncem.co.uk Data input onto our online application form may be processed and stored by Wix.com in the United States of America, in Israel and in Europe (including the Ukraine). We rely on the following exception in GDPR to undertake the transfer of personal data:

Adequacy decision in place (GDPR Article 45)
Israel is one of the countries considered by the European Commission to be offering an adequate level of protection for the personal data of EU Member State citizens.

Wix.com is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website -
https://www.privacyshield.gov/participant?id=a2zt0000000GnbGAAS&status=Active

Survey Monkey
We use Survey Monkey to undertake customer satisfaction surveys or other surveys related to the work we do. Survey Monkey are based in California in the United States of America. Completed surveys may therefore be transferred and stored in the USA. We rely on the following exceptions in GDPR to undertake the transfer of personal data:

Adequacy decision in place (GDPR Article 45)
Survey Monkey is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000Gn7zAAC&status=Active

Standard data protection clauses adopted by the Commission in place (GDPR Article 46(2)(c))
Survey Monkey has a data processor agreement with their customers which includes standard data protection clauses adopted by the Commission. Their latest data processor agreement is dated 16 Aug 2018.

Microsoft Office 365

We use Microsoft Office 365 to process and store most of our information which will include some of your personal data. Microsoft Office 365 is a product supplied by the Microsoft Corporation who are based in Washington in the United States of America. It is possible that the information we process and store in Microsoft Office 365 may be transferred and stored on servers in the USA. We rely on the following exception in GDPR to undertake the transfer of personal data:

Adequacy decision in place (GDPR Article 45)
Microsoft Corporation is registered under the EU-US Privacy Shield Framework. Their certificate can be viewed U.S. Department of Commerce's Privacy Shield website - https://www.privacyshield.gov/participant?id=a2zt0000000KzNaAAK&status=Active

Visitors to our website

In operating our website, www.ncem.co.uk, we use a third-party service, Google
Analytics, to collect and process standard internet log information about your visits to our
website and the resources that you access, including, but not limited to, traffic data, location
data, weblogs and other communication data all of which enables us to improve our services to you. We are not able to identify anyone from this data.

For more information about cookies please read our Cookie Policy

Children's information

We collect and process personal data relating to children in relation to the following services:

• Young Composers Award

Links to other websites

Our website may provide links to websites of other organisations. Our Privacy Notice does not cover how those organisations process your personal data when you visit their website. We advise you to read their Privacy Notices.

Changes to our Privacy Notice

We keep our Privacy Notice under review to ensure it remains accurate and up to date. This Privacy Notice was last updated in April 2019.


PART 2 - IF YOU USE OUR BOX OFFICE   ^ top

See our Box Office privacy notice here



PART 3 - IF YOU ENTER OUR YOUNG COMPOSERS AWARD  ^ top

What personal data do we need?

When you register to enter the Young Composers Award, we will collect the following personal data about you:

• Full name
• Email address
• Age category

When you submit your composition to the Young Composers Award, we will collect additional personal data and information about you, which includes:

• Postal address
• Telephone number
• Age
• Date of birth
• Educational institution
• Title of composition

For children who are 18 years or under who submit a composition, we also collect the name (signature) of your parent or guardian.

How do we get your personal data?

We gather your personal data directly from you when you register to take part and when you submit your composition to the Young Composers Award.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to:

• process your registration to enter the Young Composers Award, which includes sending you reminders of the deadline to submit your score;
• process the score you submit as your entry;
• inform you of whether or not your score has been shortlisted;
• arrange shortlisted candidates' attendance at a workshop and evening performance;
• judge and decide winning scores from the shortlisted candidates;
• arrange attendance at the concert where their winning score will be performed; and
• anything else that specifically relates to processing your personal data for the Young Composers Award.

We also like to:

• inform past winners and finalists of new opportunities (either organised by NCEM or other arts organisations), to publicise your successes and to keep you informed of future Young Composers Awards; and
• inform all registrants of future Young Composers Awards.

The legal bases we rely on are:

Contractual obligation (GDPR Article 6(1)(b))
The data we obtain to process your application and entry to the Young Composers Award are necessary for the performance of a contract which you are subject to. You must always abide by the rules as set out in the terms and conditions for the Award.

We require certain information from you to enable us to fulfil our pre-contractual (registration stage) and contractual obligations (score entry and judging stage). If you are not able to provide all the necessary information we need we may not be able to process your registration and submission to the Young Composers Award.

Legitimate interests (GDPR Article 6(1)(f)
We rely on legitimate interests to send you information about our future Young Composers Awards, to notify winners and finalists of new opportunities (either organised by NCEM or other arts organisations) and to promote the winners' success.

GDPR allows us to rely on legitimate interests for direct marketing purposes.

Additionally, we have undertaken a legitimate interest assessment, which balances our business purpose to undertake direct marketing against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as it would not be an unreasonable expectation for anyone who enters the Young Composers Award to have their personal data processed in this way.

This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003, which govern how a business can undertake electronic direct marketing to consumers.

You always have the opportunity to object to us processing your personal data in this way, both when we first collect your personal data and with every communication we have with you thereafter. You can change your marketing preferences at any time by contacting us via one of the ways shown in the "Our contact details" section.

Who do we share your personal data with?

The Young Composers Award is run in association with BBC Radio 3. As our award partner the BBC sees the personal data of the winner. The BBC does not usually see the personal data of other entrants; however, they do have the right to ask for these details should they require them as part of the award process. The BBC retains the personal data of the winner of the award for 2 years. The BBC is a separate data controller of your personal data for this purpose; for further information on how the BBC process your personal data please read their privacy notice on their website http://www.bbc.co.uk/usingthebbc/privacy/privacy-policy

How long do we keep your personal data?

We keep your personal data for the following periods of time:

• We retain permanently for all registrants your name and year of application.
• We retain permanently the music scores of finalists.
• All application forms and scores of non-finalists are destroyed 6 months after the judging of the award.
• We retain registrants' email addresses for as long as you want to receive news about future Young Composer Awards.

We retain fully anonymised data for our own internal analysis and trend reporting, this data includes geographical data and age-range data.

Do we use any data processors?


Yes. We use the following data processors:

• Mailchimp - used to store your email address and to send you information about future Young Composers Awards
• MS Office 365 - to store data and send emails to and from all registrants of the Young Composers Award.


PART 4 - IF YOU ENTER OUR INTERNATIONAL YOUNG ARTISTS COMPETITION   ^ top

What personal data do we need?

When you apply online to enter the International Young Artists Competition, we will collect the following information from you:

Ensemble nominated lead contact:
• Full name
• Postal address
• Email address
• Mobile number

Each member of the ensemble:

• Full name
• Age
• Date of birth
• Nationality
• Proof of ID (e.g. scan of ID card, passport)

Other information:

• current and/or main teachers
• courses and conservatoires attended
• an unedited audio recording of the ensemble playing in either digital or CD format
• details of your recording
• programme details for both the preliminary and competition recitals
• biography of the ensemble
• letter of recommendation from a prominent personality in musical life
• two recent photographs of the ensemble

How do we get your personal data?

We gather your personal data directly from you when you submit your online application to take part in the International Young Artists Competition. Note - Your application may have been completed by the nominated lead of the ensemble.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to:

• process your online entry in the International Young Artists Competition;
• undertake the initial selection process (based on audio recording submitted);
• inform you of whether or not you have been shortlisted;
• provide feedback to unsuccessful applicants
• invite finalists to the competition and arrange for finalists' attendance at a reception, rehearsals, preliminary recitals and competition day;
• judge and decide a winning ensemble from the finalists; and
• anything else that specifically relates to processing your personal data for the International Young Artists Competition.

We also like to:

• inform past winners and finalists of new opportunities (either organised by NCEM or other arts organisations), to publicise all the finalists' successes and to keep you informed of future International Young Artists Competitions; and
• inform all previous applicants of future International Young Artists Competitions.

The legal bases we rely on are:

Contractual obligation (GDPR Article 6(1)(b))
The data we obtain to process your application and entry to the International Young Artists Competition are necessary for the performance of a contract to which you are subject. You must abide by the rules of the competition at all times.

We require certain information from you to enable us to fulfil our pre-contractual (application stage) and contractual obligations (initial selection stage and finalists stage). If you are not able to provide all the necessary information we need we may not be able to process your application to enter the International Young Artists Competition.

Legitimate interests (GDPR Article 6(1)(f)
We rely on legitimate interests to send you information about our future International Young Artists Competitions, to notify winners and finalists of new opportunities (either organised by NCEM or other arts organisations) and to promote their success.

GDPR allows us to rely on legitimate interests for direct marketing purposes.

Additionally, we have undertaken a legitimate interest assessment, which balances our business purpose to undertake direct marketing against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as it would not be an unreasonable expectation for anyone who enters the International Young Artists Competition to have their personal data processed in this way.

This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003, which govern how a business can undertake electronic direct marketing to consumers.

You always have the opportunity to object to us processing your personal data in this way, both when we first collect your personal data and with every communication we have with you thereafter. You can change your marketing preferences at any time by contacting us via one of the ways shown in the "Our contact details" section.

Who do we share your personal data with?

Your personal data is only used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

We will share the winners' contact details with Linn Records to enable the production of the CD.

BBC Radio 3 record the competition final for editing for future broadcast.

How long do we keep your personal data?

We keep your personal data for the following periods of time:

• We retain permanently for all entrants your name and year of application.
• All application forms and copies of passports/IDs, etc. are destroyed after the final day of the competition.
• We retain entrants' email addresses for as long as you want to receive news about future International Young Artists Competitions

We retain fully anonymised data for our own internal analysis and trend reporting, this data includes geographical data and age-range data.

Do we use any data processors?


Yes. We use the following data processors:

• Wix.com - used to process your online application form to the competition
• Paypal - to process your entry fee to the competition
• Mailchimp - used to store your email address and to send you information about future competitions
• MS Office 365 - to store data and send emails to and from entrants of the competition


PART 5 - IF YOU HIRE OUR VENUE  ^ top

What personal data do we need?

You can hire our venue for conferences or meetings, weddings or parties, corporate functions, and concerts or lectures. Depending on the type of function you are hiring our venue for we will need some or all of the following personal data:

• Contact name of person making booking
• Address of person making booking
• Organisation name and address
• Position of contact person in organisation
• Telephone number of person making booking
• Email address of person making booking
• Lecturers/performers names

We will also need information relating to the booking which includes but is not limited to space required within NCEM venue, type of function, date, time, number of delegates or expected number of guests, accessibility requirements, room layout, additional equipment and services, planned event timings (e.g. guest arrival times, bar open times, food served times, etc), details of event (content, number of performers).

How do we get your personal data?

We get the personal data of the person making the booking directly from the individual when they contact us to make all the arrangements.

We also obtain personal data of an individual who has enquired about our venue via a third-party venue site, such as hitched.com, UKBrides, forbetterforworse.com and for conferences via VisitYorkforMeetings, and other venue directories

If names of lecturers or performers are provided these have been given to us by the person making the booking.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to

• process the booking for hiring our venue;
• liaise with you about the booking to ensure everything runs smoothly at the event; and
• submit and receive payment from you for the booking.

We will also send an invite to brides and grooms who have enquired about our venue in the preceding 6 months to a wedding fair that we hold every year at NCEM.

The legal basis we rely on for providing a venue to hire is:

Contractual obligation (GDPR Article 6(1)(b))
The data we obtain to process your booking to hire our venue is necessary for the performance of a contract to which you are subject to.

We require certain information from you to enable us to fulfil our pre-contractual (request for venue hire details) and contractual obligations (provision of venue and facilities). If you are not able to provide all the necessary information we need we may not be able to process your booking request and you may not be able to hire our venue and facilities.

Legitimate interests (GDPR Article 6(1)(f))
We rely on legitimate interests to contact brides/grooms who have enquired about our venue for their wedding to invite them to our annual wedding fair.

GDPR allows us to rely on legitimate interests for direct marketing purposes.

Additionally, we have undertaken a legitimate interest assessment, which balances our business purpose to undertake this type of direct marketing against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as it would not be an unreasonable expectation for individuals who have made enquiries with us about hiring our venue for a wedding to receive information from us about an event that specifically relates to the reason they want to hire our venue.

This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003, which governs how a business can undertake electronic direct marketing to businesses and consumers.

You always have the opportunity to object to us processing your personal data in this way. You can contact us via one of the ways shown in the "Our contact details" section to inform us that you do not want us to collect and process your personal data for this purpose.

Who do we share your personal data with?

Your personal data is only used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

If we source the catering for you, we only provide your organisation name, numbers and dietary requirements to the caterers. We do not give your personal data or the personal data of attendees/delegates to the caterers.

How long do we keep your personal data?

We keep all information relating to hiring our venue for 6 years from the end of the financial year the event took place.

Do we use any data processors?

Yes, we use the following data processors:

• Artifax Event - to manage our event planning, room bookings and resource scheduling requirements.
• MS Office 365 - to store and process emails and documentation.


PART 6 - IF YOU JOIN ONE OF OUR MEMBERSHIP SCHEMES  ^ top

What personal data do we need?

To become either a Festival Friend or NCEM Patron we need to collect the following personal data about you:

• Full name
• Postal address
• Email address
• Telephone number (landline or mobile)
• Membership scheme you wish to join
• Amount of any additional donation you wish to make
• Payment for the membership scheme you wish to join (cheque, standing order or payment via our Box Office)
• Gift Aid declaration (where applicable)

How do we get your personal data?

We gather your personal data directly from you when you complete and submit your application to join one of our membership schemes.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to:

• process your application to become a Festival Friend or NCEM Patron;
• invite you to events included with your membership package; and
• keep in touch with you throughout the year.

The legal basis we rely on are:

Consent - GDPR Article 6(1)(a)
By submitting your application form to become a member you are consenting to us using your personal data for this purpose. The membership includes some of the following:
• receiving advance copies of our festival brochure and priority booking;
• notification of NCEM events;
• reserved seating; and
• invitations to attend exclusive events.

By joining one of our membership schemes we will send relevant information to you about our events even if you have previously opted out of receiving marketing through the Box Office.

You always have the right to withdraw your consent to being a member, you can do this by contacting us via one of the methods shown in the "Our contact details".

Who do we share your personal data with?

Your personal data is only used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

How long do we keep your personal data?

We retain membership information for 6 years from the end of the financial year to which they relate to.

Do we use any data processors?

Yes. We use the following data processors:

• Box Office System (hosted by Seat Geek) - used to store all details of Festival Friends and NCEM Patrons;
• Mailchimp - used to store the contact details of all Festival Friends and NCEM Patrons, we may contact you, via Mailchimp, to remind you about your renewal or to let you know about events associated with your membership;
• MS Office 365 Email - used to send emails to Festival Friends and NCEM Patrons to remind you about your renewal or to let you know about events associated with your membership;


PART 7 - IF YOU MAKE A DONATION TO US  ^ top

What personal data do we need?

If you make either a one off or regular donation to NCEM we need to collect the following personal data about you:

Donation made via our website (Paypal)
• Name
• Address
• Telephone number
• Email address
• Amount donated
• Gift Aid (where applicable)

Donation made in person, phone or online either by cheque, debit/credit card, bank transfer, or cash (input to our Box Office System)
• Name
• Address (only required for Gift Aid purposes)
• Amount donated
• Debit/Credit details if payment made this way
• Gift Aid (where applicable)

How do we get your personal data?

We gather your personal data directly from you when you make a donation to us.

Why do we need your personal data and which legal basis do we rely on for the processing?


We need your personal data to process and administer your donation to us. This may include contacting you to invite you to a performance or a reception related to the activity you have supported.

The legal basis we rely on are:

Consent - GDPR Article 6(1)(a)
By making a donation to us you consent to us using your personal data for the purpose of us administering the donation and partaking and celebrating the donation.

You always have the right to withdraw your consent for us to use your personal data for this purpose, you can do this by contacting us via one of the methods shown in the "Our contact details".

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

We will share Gift Aid information with HMRC.

How long do we keep your personal data?


We retain donation information and gift aid forms for 6 years from the end of the financial year to which they relate to.

Do we use any data processors?


Yes. We use the following data processors:

• Paypal - used to process online donations
• Box Office System - to store information about donations made


PART 8 - IF YOU ARE ONE OF OUR SPONSORS (TRUSTS AND FOUNDATIONS / CORPORATE PARTNERS)  ^ top

What personal data do we need?

• Your organisation name;
• The name (first and last name) of the person who we are liaising with at your organisation (in some cases this may be several staff members details);
• Organisation postal address;
• Organisation email address;
• Organisation telephone number;
• Organisation mobile number;
• Any other information you feel is relevant for the purposes of the processing.

We do not collect any of the special categories of personal data.

How do we get your personal data?

We will obtain your personal data when we apply for funding from your organisation.

We may also obtain personal data of potential corporate sponsors from business networking events or we may have an existing relationship with you.

Why do we need your personal data and which legal basis do we rely on for the processing?


We need the personal data to allow us to process the funding application we are apply for and to meet any funding conditions or sponsorship agreements that are imposed on us.

The legal basis we rely on are:

Contractual obligation (GDPR Article 6(1)(b))
We will process your personal data to meet any pre-contractual obligations we have with you in relation to our funding application and any contractual obligations we have when the funding is in place.

We may require certain information from you to enable us to fulfil our pre-contractual and contractual obligations. If you are not able to provide all the necessary information we need we may not be able to consider or appoint you as one of our sponsors.

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

How long do we keep your personal data?

We retain information relating to funding and sponsorship for 6 years from when the funding or sponsorship expires.

Do we use any data processors?

• Microsoft Office 365 - to store and process our information


PART 9 - IF YOU JUST WANT TO RECEIVE OUR EVENT INFORMATION & NEWSLETTERS  ^ top

What personal data do we need?

For us to send you information about our events, festivals, and general updates on the work we do, we need the following personal data about you:

• Full name
• Email address
• Postal address

How do we get your personal data?

We obtain your personal data directly from you when you instruct us to add you to our mailing list, this can be done in person at our box office; by phone; by email; or by clicking the subscribe button on our website.

We also obtain personal data indirectly, from publicly available sources, of music teachers/professors, professional composers, heads of schools, etc.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to be able to send you details of our events and updates that you have subscribed to receive.

We need the contact details of music teachers/professors, professional composers, heads of schools, etc. so that we can contact you to promote to your students our Young Composers Award and International Young Artists Competition.

The legal basis we rely on is:

Consent (GDPR Article 6(1)(a)
By submitting your contact details to receive marketing from us you have given your consent for us to use your personal data for this purpose.

You always have the right to withdraw your consent to receive marketing, you can do this by clicking the "unsubscribe" link in the marketing email you receive.

Legitimate interests (GDPR Article 6(1)(f)
We rely on legitimate interests to collect the contact details of music teachers/professors, professional composers, heads of schools and conservatoires, etc. to be able to send you information about our Young Composers Award and International Young Artists Competition so that you can promote these to your students.

GDPR allows us to rely on legitimate interests for direct marketing purposes.

Additionally, we have undertaken a legitimate interest assessment, which balances our business purpose to undertake this type of direct marketing against your right to privacy. The outcome of the balancing test justifies our use of legitimate interests for this purpose as we do not believe it would be an unreasonable expectation for music professionals to receive information about our Young Composers Award and International Young Artists Competition. There is a clear benefit for you and your students to be aware of these prestigious events, for individuals and music ensembles to showcase their compositions and musical talents. A potential risk of us not contacting you is you may never become aware of the events.

This also complies with e-Privacy laws, currently the Privacy & Electronic Communication Regulations 2003, which governs how a business can undertake electronic direct marketing to businesses and consumers.

You always have the opportunity to object to us processing your personal data in this way. You can contact us via one of the ways shown in the "Our contact details" section to inform us that you do not want us to collect and process your personal data for this purpose.

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

How long do we keep your personal data?

We retain your contact details for as long as you want to receive information about our events and the work we do.

Do we use any data processors?

Yes, we use the following data processors:

• Box Office System - to store your contact details and marketing preference
• Mailchimp - used to store your contact details and to send you newsletters or information about future events


PART 10 - IF YOU APPLY FOR A JOB WITH US  ^ top

What personal data do we need?

When you apply for a job with us you will need to provide some or all of the following information as part of the job application process:

• Full name
• Postal address
• Telephone number
• Mobile number
• Email address
• Equal opportunities information (which includes age, disability, gender, religion, sexual orientation, ethnic group, relationship status, caring responsibility) - voluntary
• Education history
• Qualifications
• Employment history
• Whether you hold a UK work permit
• References

How do we get your personal data?

We collect information directly from you when you submit your application form and/or CV to us.

We will also collect information about you from your referees as you progress down the recruitment process.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data to be able to process your application for a job with us, which includes, but is not limited to:

• assessing your suitability for the role applied for;
• making a decision on whether your application progresses to the next stage of the recruitment process (sifting and shortlisting);
• inviting you to interview or tests;
• making a decision on whether or not to appoint you to the role applied for;
• obtaining further information in order to carry out pre-employment checks if we make a conditional offer of employment to you; and
• gathering of information for equal opportunities monitoring

The legal basis we rely on to undertake our recruitment activities includes:

Contractual obligation (GDPR Article 6(1)(b))
The processing of your job application is necessary in order for us to take steps at your request before entering into a possible employment contract with us.

We require certain information from you to enable us to fulfil our employment pre-contractual and contractual obligations. If you are not able to provide all the necessary information we need we may not be able to process your application and consider you for one of our job vacancies.

Legal obligation (GDPR Article 6(1)(c))
We have certain obligations under employment law in relation to recruitment and selection and equal opportunities that we must comply with.

Processing for employment law (GDPR Article 9(2)(b))
Information you provide to us that relates to special category personal data, such as health, religious or ethnic information is necessary for our recruitment and selection purposes as it relates to our obligations in employment law.

Processing to assess working capacity (GDPR Article 9(2)(h))
We have certain obligations to assess your health in relation to your ability to work for us.

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

Do we use any data processors?

We do not use any data processors for the purpose of recruitment and selection.

How long do we keep your personal data?

All unsuccessful candidate details are kept for 6 months from the end of the recruitment process they relate to.

Successful candidate details are transferred to their employment record and kept for 6 years after employment ends.


PART 11 - IF YOU ARE ONE OF OUR VOLUNTEERS  ^ top

What personal data do we need?

If you would like to volunteer and help us with the work we do we will need to collect the following personal data from you before you become a volunteer:

• Full Name
• Home address
• Contact details (such as telephone, mobile, email address)
• Date of birth
• Emergency contact details
• Health issues we may need to be aware of
• Personal evacuation emergency plan details
• Any other personal data you give to us that you feel is relevant for us to know

How do we get your personal data?

We gather your personal data directly from you when you complete our volunteer record form.

Why do we need your personal data and which legal basis do we rely on for the processing?

We need your personal data so that we can assign volunteer duties to you so you can contribute to the activities of NCEM.

Our legal basis for the processing is:

Consent - GDPR Article 6(1)(a)
By volunteering with us you are consenting to us processing your personal data for this purpose.

You always have the right to withdraw your consent to being a volunteer and can decide at any time that you no longer wish to be a volunteer for our charity. Should you wish to stop being a volunteer please notify our Operations and Events Manager.

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

How long do we keep your personal data?

We keep volunteer records for 6 years from when our relationship with you ends.

Do we use any data processors?

Yes, we use the following data processors:

• Artifax Event - to store contact details
• Microsoft Office 365 - to store and process our information


PART 12 - IF YOU ARE ONE OF OUR SUPPLIERS OR CONTRACTORS  ^ top

What personal data do we need?

For us to pay you for the service or goods you have provided to us we need to collect and use a small amount of information about you and your business, this is also likely to include some information about the individuals who work at your business. The information we are likely to need is:

• Your business name;
• The name (first and last name) of the person who we are liaising with at your business (in some cases this may be several staff members details);
• Business postal address;
• Business email address;
• Business telephone number;
• Business mobile number;
• Bank details to enable payment to be made;
• Names, address and dates of birth of contract staff and artists/musicians who deliver education projects on our behalf; and
• Any other information you feel is relevant for the purposes of the processing.

We do not collect any of the special categories of personal data.

How do we get your personal data?

We obtain your data directly when we start to use your services or have purchased goods from you. We gather the relevant information from you to enable us to process payment to you for those services and goods.

We also obtain some data, such as your business name and contact details, indirectly from publicly available sources or recommendations from 3rd parties to enable us to contact you to enquire about the services and goods you provide prior to us making a purchase.

Why we need your personal data and the legal basis we rely on for the processing

We need your personal data to either enquire about the services or goods you provide that we may be interested in purchasing or to make a purchase. We then use your personal data to pay for those goods and services when you invoice us or to raise any queries about the payment.

We also need to undertake DBS checks for contract staff and artists/musicians who we use for education projects. We will use your name, address and date of birth to check your status on the DBS system. We only retain the DBS number and date of checking.

The legal basis we rely on are:

Contractual obligation (GDPR Article 6(1)(b))
The services or goods you have provided to us are done so under contract or with a view to entering into a contract (i.e. we have asked you for a quote for the goods or to undertake the service for us).

We require certain information from you to enable us to fulfil our part of the pre-contractual and contractual obligations, e.g. we need to have certain information to make the purchase and to process payment. If you are not able to provide all the necessary information for us to do this, we will not be able to purchase the goods or services you provide or be able to make payment once purchased.

Legal obligation (GDPR Article 6(1)(c))
We have a legal obligation to pay for any services or goods we have purchased.

Who do we share your personal data with?

Your personal data is used by internal employees and contract staff for the purposes as set out in "why we need your personal data".

Our Accountant will see personal data relating to suppliers and any payments we make.

Invoices may be shared with our grant funders as evidence of expenditure.

How long do we keep your personal data?

We keep all financial data (which includes supplier information) for 6 years from end of the financial year it relates to.