Privacy Policy

Chol International Arts
www.wearechol.co.uk

Effective from:

5. Lawful Bases for Processing

1. Purpose

Chol International Arts (“we”, “our”, “us”) is committed to protecting the privacy and security of all personal data we collect and process. This policy explains how we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant privacy laws.

We process personal data in a lawful, fair, and transparent way, ensuring that individuals’ rights are respected at all times.

2. Scope

This policy applies to all Chol staff, freelance artists, volunteers, and anyone involved in collecting and handing data.

3. What Data We Collect

We may collect and process the following categories of personal data:

Participants & Families: name, age, school, contact details, emergency contact information, photographs/videos (with consent), access or health information (only when necessary for safeguarding and inclusion).
Staff & Freelancers: contact details, CVs, contracts, payroll/financial information, references, DBS checks, training records.
Partners & Funders: contact details, role, organisation details, communications.
Supporters & Subscribers: names, email addresses, and communication preferences for newsletters and updates.

4. How We Use Personal Data

We use personal data only for purposes that are necessary and proportionate, including:

Delivering arts projects, workshops, and events.
Safeguarding and protecting children, young people, and vulnerable adults.
Managing staff, freelancers, and volunteers.
Communicating with participants, partners, and supporters.
Evaluating and reporting on our work to funders and stakeholders.
Meeting legal, financial, and regulatory obligations.

5. Lawful Bases for Processing

We process personal data under the following lawful bases:

Consent – for communications, photographs, and optional data.
Contract – to deliver agreements with staff, freelancers, and partners.
Legal Obligation – for safeguarding, employment, tax, and financial records.
Vital Interests – where health or emergency information is required.
Legitimate Interests – for organisational planning, reporting, and fundraising (balanced with individuals’ rights).

6. Data Sharing

We will never sell personal data. We may share data with trusted third parties only when necessary, such as:

Project partners or funders (in anonymised form wherever possible).
IT service providers (e.g., secure cloud storage, email systems).
Regulatory bodies (e.g., HMRC, Charity Commission).

All third parties must comply with UK GDPR and ensure the security of data.

7. Data Retention

We keep personal data only as long as necessary:

Project participation records: up to 3 years after project completion.
Safeguarding and accident reports: 25 years (as legally required).
Employment and financial records: 6 years (as legally required).
Marketing and communications: until consent is withdrawn.

8. Data Security

We take appropriate measures to protect personal data, including:

Password-protected systems and encrypted storage.
Restricted access to sensitive information.
Regular staff training in data protection and safeguarding.
Secure disposal of paper and digital records.

9. Your Rights

Under UK GDPR, individuals have the right to:

Access their personal data.
Request corrections or updates.
Request erasure (“right to be forgotten”).
Restrict or object to processing.
Data portability (where applicable).
Withdraw consent at any time (for consent-based processing).

Requests should be made in writing to info@wearechol.co.uk. We will respond within one month.

10. Complaints

If you have concerns about how we handle your data, please contact us first. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

11. Updates to this Policy

We may update this policy from time to time to reflect changes in law or our practices. The latest version will always be available on our website.