Data Protection and Privacy Policy

GDPR Specific (January 2019)

The General Data Protection Regulation (GDPR) ensures a balance between an individual’s rights to privacy and the lawful processing of personal data undertaken by organisations in the course of their business. It aims to protect the rights of individuals about whom data is obtained, stored, processed or supplied and requires that organisations take appropriate security measures against unauthorised access, alteration, disclosure or destruction of personal data.  Young Ones Art Box will protect and maintain a balance between data protection rights in accordance with the GDPR. Changes to data protection legislation will be monitored and further amendments may be required to this policy in order to remain compliant with legal obligations.

 

Processing data involves any activity that involves the use of personal data. This includes but is not limited to: obtaining, recording or holding data or carrying out any operation or set of operations on that data such as organisation, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring personal data to third parties.

 

Data Protection Principles - Young Ones Art Box is responsible for and adheres to the principles relating to the processing of personal data as set out in the GDPR. The principles Young Ones Art Box must adhere to are: - (1) Personal data must be processed lawfully, fairly and in a transparent manner; (2) Personal data must be collected only for specified, explicit and legitimate purposes; (3) Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; (4) Personal data must be accurate and, where necessary, kept up to date; (5) Personal data must not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed; and (6) Personal data must be processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage.

 

General

Why do we have a privacy notice?

The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the GDPR). This legislation replaced the previous data privacy law, giving more rights to you as an individual and more obligations to organisations holding your personal data.

 

One of the rights is a right to be informed, which means we must give you detailed information about the way in which we use, share and store your personal information.

 

This new privacy notice came into effect on 25 May 2018.

 

Who are we?

Young Ones Art Box is the data controller (contact 07931 842291 or yo@youngonesartbox.co.uk). This means we decide how your personal data is processed and for what purposes.

 

Whose information does this privacy notice apply to?

This privacy notice applies to information we collect from:

• parents/guardians of children using our venue and taking part in our activity sessions

• people who subscribe to our newsletters;

• visitors to our website;

• job applicants and our current and former employees.

 

What is personal data?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. Examples of personal data we may hold about you include your contact and appointment details.

 

Special category data is a sub-category of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data

 

How do we process your personal data?

We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. We use your personal data for the purposes set out below:.

 

 

Sharing your personal data

Your personal data will be treated as strictly confidential, and will be shared:

•  with named third parties with your explicit consent;

•  with the relevant authority such as the police or a court, if necessary for compliance with a legal obligation to which we are subject e.g. a court order;

•  with your doctor or the police if necessary to protect yours or another person’s life;

•  with the police or a local authority, for the purpose of safeguarding a children or vulnerable adults; or

•  with my insurance company in the event of a complaint or insurance claim being brought against me; or

•  my solicitor in the event of any investigation or legal proceedings being brought against me.

For further details about the situations when information about you might be shared please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/personal-information/sharing-my-info/

 

How long do we keep your personal data?

We keep your personal data for no longer than is reasonably necessary.

 

We will keep your data up-to-date by asking you during treatment sessions if any changes have occurred. Please also let us know in advance if there are any changes to your personal data so that we can ensure we maintain accurate records. Your data will be stored on paper and locked away when not in use. When the time arises to destroy your personal data this will be done via secure paper shredding. In the event Elizabeth Martin falls seriously ill and is unable to continue operating Young Ones Art Box, or dies, responsibility for destroying your personal data will lie with the appointed trustee of the estate. You may request that changes are made to your contact details at any time.

 

Your rights and your personal data

Unless subject to an exemption under the GDPR, you have certain rights with respect to your personal data as set out below.

•  The right to request a copy of your personal data which we hold about you.

•  The right to request that we correct any personal data if it is found to be inaccurate or out of date.

•  The right to request your personal data is erased where it is no longer necessary for us to retain such data.

•  The right to withdraw your consent to the processing at any time. This right does not apply where we are processing information using a lawful purpose other than consent.

•  The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [This right only applies where the processing is based on consent or is necessary for the performance of a contract with you and in either case the we are processing the data by automated means].

•  The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.

•  The right to object to the processing of personal data, (where applicable) [This right only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics].

•  The right to be informed if your data is lost. We shall also inform the Information Commissioner’s Office in accordance with the time limits in the GDPR.

•  The right to lodge a complaint with the Information Commissioner’s Office.

 

For further details about these rights please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

 

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

 

Contact Details

To exercise all relevant rights, queries of complaints please in the first instance contact us at  or call Elizabeth Martin on 07931 842291

 

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

 

 

OFFICE

07931 842291

PRIVACY  POLICY

Young Ones Art Box  registered office : 24 The WayBack, Saffron Walden CB10 2AX

 

©2018 Designed by www.eaststreetcreative.uk   All rights reserved.

 

Yell.com

Data Protection and Privacy Policy

GDPR Specific (January 2019)

The General Data Protection Regulation (GDPR) ensures a balance between an individual’s rights to privacy and the lawful processing of personal data undertaken by organisations in the course of their business. It aims to protect the rights of individuals about whom data is obtained, stored, processed or supplied and requires that organisations take appropriate security measures against unauthorised access, alteration, disclosure or destruction of personal data.  Young Ones Art Box will protect and maintain a balance between data protection rights in accordance with the GDPR. Changes to data protection legislation will be monitored and further amendments may be required to this policy in order to remain compliant with legal obligations.

 

Processing data involves any activity that involves the use of personal data. This includes but is not limited to: obtaining, recording or holding data or carrying out any operation or set of operations on that data such as organisation, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transmitting or transferring personal data to third parties.

 

Data Protection Principles - Young Ones Art Box is responsible for and adheres to the principles relating to the processing of personal data as set out in the GDPR. The principles Young Ones Art Box must adhere to are: - (1) Personal data must be processed lawfully, fairly and in a transparent manner; (2) Personal data must be collected only for specified, explicit and legitimate purposes; (3) Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed; (4) Personal data must be accurate and, where necessary, kept up to date; (5) Personal data must not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed; and (6) Personal data must be processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage.

 

General

Why do we have a privacy notice?

The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the GDPR). This legislation replaced the previous data privacy law, giving more rights to you as an individual and more obligations to organisations holding your personal data.

 

One of the rights is a right to be informed, which means we must give you detailed information about the way in which we use, share and store your personal information.

 

This new privacy notice came into effect on 25 May 2018.

 

Who are we?

Young Ones Art Box is the data controller (contact 07931 842291 or yo@youngonesartbox.co.uk). This means we decide how your personal data is processed and for what purposes.

 

Whose information does this privacy notice apply to?

This privacy notice applies to information we collect from:

• parents/guardians of children using our venue and taking part in our activity sessions

• people who subscribe to our newsletters;

• visitors to our website;

• job applicants and our current and former employees.

 

What is personal data?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. Examples of personal data we may hold about you include your contact and appointment details.

 

Special category data is a sub-category of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purposes of uniquely identifying a natural person, data

 

How do we process your personal data?

We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. We use your personal data for the purposes set out below:.

 

 

Sharing your personal data

Your personal data will be treated as strictly confidential, and will be shared:

•  with named third parties with your explicit consent;

•  with the relevant authority such as the police or a court, if necessary for compliance with a legal obligation to which we are subject e.g. a court order;

•  with your doctor or the police if necessary to protect yours or another person’s life;

•  with the police or a local authority, for the purpose of safeguarding a children or vulnerable adults; or

•  with my insurance company in the event of a complaint or insurance claim being brought against me; or

•  my solicitor in the event of any investigation or legal proceedings being brought against me.

For further details about the situations when information about you might be shared please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/personal-information/sharing-my-info/

 

How long do we keep your personal data?

We keep your personal data for no longer than is reasonably necessary.

 

We will keep your data up-to-date by asking you during treatment sessions if any changes have occurred. Please also let us know in advance if there are any changes to your personal data so that we can ensure we maintain accurate records. Your data will be stored on paper and locked away when not in use. When the time arises to destroy your personal data this will be done via secure paper shredding. In the event Elizabeth Martin falls seriously ill and is unable to continue operating Young Ones Art Box, or dies, responsibility for destroying your personal data will lie with the appointed trustee of the estate. You may request that changes are made to your contact details at any time.

 

Your rights and your personal data

Unless subject to an exemption under the GDPR, you have certain rights with respect to your personal data as set out below.

•  The right to request a copy of your personal data which we hold about you.

•  The right to request that we correct any personal data if it is found to be inaccurate or out of date.

•  The right to request your personal data is erased where it is no longer necessary for us to retain such data.

•  The right to withdraw your consent to the processing at any time. This right does not apply where we are processing information using a lawful purpose other than consent.

•  The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [This right only applies where the processing is based on consent or is necessary for the performance of a contract with you and in either case the we are processing the data by automated means].

•  The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.

•  The right to object to the processing of personal data, (where applicable) [This right only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics].

•  The right to be informed if your data is lost. We shall also inform the Information Commissioner’s Office in accordance with the time limits in the GDPR.

•  The right to lodge a complaint with the Information Commissioner’s Office.

 

For further details about these rights please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

 

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

 

Contact Details

To exercise all relevant rights, queries of complaints please in the first instance contact us at  or call Elizabeth Martin on 07931 842291

 

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.