Manx Operatic Society Privacy Notice
dated 1st October 2020
The Manx Operatic Society is committed to protecting and respecting your privacy.
This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
For the purposes of the General Data Protection Regulation and Data Protection Act 2018 in respect of the personal data of the users of our website, our members, volunteers, contractors and business contacts, we act as a data controller.
Information we may collect from you, how we get it and why we require it
We may collect and process some or all of the following types of data about you:
- Commitment forms are issued when auditioning for our shows and requests personal details, confirmation of your commitments during our rehearsals and information regarding your theatre experiences. The audition panel will use this information during the audition process to assist their selection and also to contact you following casting. The personal details required include your name, address, email address and telephone numbers. This personal information is covered under ‘Legitimate Interest’ under Article 6(f), GDPR. The forms are held by our Secretary and copies are given to the Assistant Director for use during the rehearsal planning. Once the current show has closed all Commitment forms are destroyed by shredding. There is an opt-in ‘Consent’ for you to agree for us to keep your personal detail so we can continue to contact you regarding future auditions, shows and social events (Article 6(a), GDPR). If you wish to withdraw your consent at any point then you can inform our Secretary. This information will not be shared with any other person or business unless it is in the ‘vital interest’ of the individual in a case of emergency (Article 9, GDPR).
- Membership forms are issued to cast members and social members each year following casting of the show. The form details the types of membership available and the fees. The personal details required include your name, address, telephone numbers, email address, date of birth and age. This personal information is covered under ‘Legitimate Interest’ under Article 6(f), GDPR and is required for the administration and legal requirements of our membership. There is an opt-in ‘Consent’ for use of your photograph to be used in our social media outlets, our website and any PR or advertising and an opt-in ‘Consent’ for you to agree for us to keep your personal detail so we can continue to contact you regarding future auditions, shows and social events (Article 6(a), GDPR).The completed Membership forms will be held securely by our Secretary until the following Annual General Meeting when the annual membership ceases. The forms will then be reviewed and where an individual has given consent for the society to keep their personal details, the form will be held securely by our Secretary until consent is within drawn by the individual. All forms where consent has not been given will be destroyed by shredding. If you wish to withdraw your consent at any point, you can inform our Secretary and your form will be destroyed by shredding. This information will not be shared with any other person or business unless it is in the ‘vital interest’ of the member in a case of emergency (Article 9, GDPR) or necessary for licenses from the Department of Education.
- Medical Conditions/Medication forms can be completed by members on a voluntary basis and can be obtained by request from our Secretary. The purpose of this form is to inform the Executive Committee, Assistant Direct or and First Aider of any medical conditions which members feel they need to advise in case of emergency. These forms are signed by the member and are covered by consent under Article 6, GDPR and will be treated as special category data under Article 9, GDPR. The forms will be held securely by our Secretary until the current show closes and then the forms will be destroyed by shredding. The information will be treated as sensitive and will not be shared with any other person unless it is in the ‘vital interest’ of the member or they have given the ‘explicit consent’ under Article 9, GDPR.
- Photography of members can only be used on our social media outlets, website and for any PR or advertising once we have the ‘consent’ of the individual (Article 6(a) GDPR). However, it should be noted that photography is an integral part of the production and advertising of our shows and not consenting may require the Executive Committee to dismiss you from the production. If you wish to withdraw your consent and erase photography you can inform our Secretary, however, the erasure will only apply to any individual photographs as production photography of the cast, crew and rehearsals remain the property of Manx Operatic Society and are covered under the Copy Rights within our licenses.
- Information that you provide by filling in contact forms on our website (www.mos.im). Contact form submission information is stored for a limited time in a log before being completely discarded, automatically. Our site does not collect any web data from visitors and cookies are only stored on logged on Admin Users, therefore there is no requirement for any cookies to be used.
- If you or a business contact the society by post, email or telephone, we may keep a record of that correspondence for future reference. This includes general correspondence, show specific correspondence, information or documents with historical or of specific value to the society, meeting minutes, invoices and general book-keeping documents, emails to or between the Executive Committee and any other committee/society business. The recording of this information falls under Article 5(2), GDPR; adequate, relevant and limited to what is necessary and for no longer than is necessary. Information will not be shared with any other person or business, however, please note that members can request via the Secretary to see a copy of the minutes. The copy shown will be redacted of all personal data or reference to individuals will be pseudonymised. The member will not be allowed to take or keep a copy of the minutes.
How we store your personal data and security
All forms, correspondence and general administration is kept in a secured cabinet within the Manx Operatic Society rehearsal halls of which only the Secretary, Treasurer and Chairman has access. Some administration is also held securely at the Secretary’s and Treasurer’s private homes and all electronic versions are kept on the Secretary’s and Treasurer’s laptop which is password protected and has appropriate cyber security. Both the Secretary and the Treasurer hold a USB drive which is also password protected.
Any paper forms are kept for up to 1 year and other correspondence and administration may be kept for up to 10 years where necessary. Accounts, bank statements, invoices and general book-keeping documents will be kept for 7 years securely by our Treasurer in line with Company law. Paper documents are discarded using a shredder and individual photographs are disposed of in the general waste. Electronic data is permanently deleted via the general deletion function within the laptops operating system.
‘Subject Access Requests’ can be sent to our Secretary and will be dealt with by our Data Protection Officer. Requests for objection, withdrawal of consent or erasure of data can also be sent to our Secretary. However, it should be noted that the erasure of personal data i.e. names and email address, will not apply to records of meeting minutes or emails to or between the Executive Committee as agreed with the Information Commissioners office, Isle of Man.
Our website is protected by up to date cyber security provided by our website provider and administrator. Any hackers attempting to hack our site are blocked for a period of time by banning their IP address (no information is shared with anyone) and once the ban is lifted the IP is discarded.
Your data protection rights
Under data protection law, you have rights including:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
- You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
- Please contact our Secretary if you wish to make a request.
How to complain
You can also complain to the ICO if you are unhappy with how we have used your data.
Information Commissioner Office
First Floor, Prospect House, Prospect Hill, Douglas, Isle of Man, IM1 1ET