Oily Cart is committed to being transparent about how we collect and use your data, and to protecting your rights and privacy. This privacy statement tells you what to expect when we collect your personal information. If you have any questions about the ways in which we collect and use your personal information, please contact us at email@example.com.
Processing of data includes obtaining, disclosing, recording, holding, using, erasing or destroying personal information. Oily Cart is registered with the Information Commissioner’s Office (ICO) and works within the framework of and in compliance with relevant legislation, regulations and ICO Guidance.
Lawful bases for processing an individual’s data
- Consent: you have given clear consent for us to process your personal data for a specific purpose.
- Contract: the processing is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
- Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
- Vital interests: the processing is necessary to protect someone’s life.
- Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
- Legitimate interests: the processing is necessary for our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if we are a public authority processing data to perform our official tasks.)
How does Oily Cart protect your data?
We take the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and that it is secured, managed and accessed in accordance with our Data Protection Policy, and our legal responsibilities under privacy and data protection laws. If you would like a copy of our Data Protection Policy, please contact firstname.lastname@example.org.
Sharing Your Data
Only the data required will be processed and for the strict purpose which is specified; access will be restricted according to need and sensitivity.
We will always protect your personal details and will never sell them to, or share them with, other companies for marketing purposes. However, there may be occasions when we need to share your information with a third party; we have made clear where this is the case in the information below.
Some of our suppliers run their operations outside of the EEA. Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to ensure they provide an adequate level of protection in accordance with UK data protection law.
How long does Oily Cart keep data?
We will not retain personal data for longer than is necessary for the purpose it is required, and we’ll ensure it is securely deleted when no longer needed. We will review data to reduce the risk of it becoming inaccurate, out of date or irrelevant. Where necessary, we have given further details about data retention policies in the information below.
What information does Oily Cart collect?
When someone visits www.oilycart.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
You can opt out of being tracked by Google Analytics here: https://tools.google.com/dlpage/gaoptout
Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.
With your consent, we will add you to our mailing lists and contact you to let you know about our shows, tours, training opportunities, events, and the latest news about the company. You may also have told a venue where we perform that you are happy for them to pass your contact information to us to be added to our mailing list.
We will record your name, contact details and either address or location, this is so we can add you to our mailing list, and understand where our audience is from to help us create accessible, inclusive performances that reach a wide audience.
By default we will retain your data in MailChimp for as long as you choose to stay subscribed or such time as we consider your account to be in-active (ie. you are no longer opening or engaging with our emails).
You can update your details or opt-out of our emails at any time using the ‘Unsubscribe’ or ‘Email Preferences’ links found at the bottom of every email we send via MailChimp. If you unsubscribe MailChimp will retain your email address for the purposes of a suppression list to ensure that no further marketing messages can be sent unless you actively choose to opt-in again.
We occasionally save anonymized social media comments or feedback. We use this information for evaluation, marketing and funding purposes, to help demonstrate the impact and reach of our work. This information may be shared with us for on our website and social media channels, in materials promoting our work, at events, in documents such as annual company reports or project evaluation reports, or in funding applications or funding reports.
If you have contacted us via email or the contact form on our website, your email address may be stored in our company contact lists.
Education & training enquiries
If you have contacted us via email, our contact form or social media regarding research, training or advice, your contact details, enquiry and any other details you provide will be stored while we handle your request. Any answers we provide may be stored, and an anonymised record of your request will be included in our quarterly and/or board reports, to help us monitor and respond to requests. Your email address may be stored in our company contact lists or database.
If you have donated money to us via our website, cheque, cash, or services in kind, we will keep a record of your contact details, the details of the gift (amount, date, purpose) and your Gift Aid status. We will keep this information for 7 years, in line with HMRC reporting guidelines.
We do not currently publish this information anywhere, but if we would like to in the future we will contact you.
Feedback and surveys
After our performances and training events, we may want to ask for your feedback to find out what you thought for evaluation purposes and to help us improve what we do. We will ask how you found out about the event, to help us market our work more effectively, and may ask where you have travelled from, so we can understand how far people travel to see our work. We’ll also ask for monitoring information, including ethnicity; this is to help us better understand our audiences, and to ensure we are offering an equally good service to everyone in our communities and reaching as wide an audience as possible. The information we collect on our feedback forms from you, including sensitive personal data, is saved anonymously and securely. Any forms you complete that identify who you are will be permanently deleted.
We may share some of the information for promotional purposes on our website and social media channels, printed marketing materials, at events, with press or with venues that we tour to. We may share the information in documents such as annual company reports, project evaluation reports, or academic evaluation reports, to evaluate and monitor our work. We may also share the information with our funders or in funding applications, to help demonstrate the impact and reach of our work.
If we run an event in partnership with another named organization, your information may need to be shared. Where this is the case, we will make it clear what will happen to your data when we share it and we will not disclose your personal information.
Whenever we share your information, it will always be anonymized and we will not share anything that will identify you.
We use CWC https://countingwhatcounts.co.uk as our Processor to power our Surveys and Participant Communications with you. We have signed a legally-binding agreement with NPO and ACE confirming it will only collect and store information about you according to our instructions, based on how we use their self-serve platform. CWC has taken steps to minimise the amount of personal data it can see or access when processing on our behalf and to make sure its appropriately secured.
Photos & footage
We document our productions and events with photography and footage for marketing and archival purposes. We ask for explicit and informed consent of the individuals, or their parent or guardian if they are under 18 or a vulnerable adult, to take and share images or footage.
These may be shared for promotional purposes on our website and social media channels, printed marketing materials, at events, and with press or venues that we tour to. They may be shared with the Royal Holloway Archives and Special Collections for archival purposes, and with funders to help demonstrate the impact and reach of our work.
A collection of Oily Cart documents, print materials, education resources, images, and footage is stored in Royal Holloway Archives and Special Collections to document the company’s history and to make it available to the public. Royal Holloway and Bedford New College, also known as Royal Holloway, University of London, will act in accordance with GDPR and the Data Protection Act 2018. For more information, please see their Privacy Notice.
Audience Information Grids
We, or venues on our behalf, collect information, including sensitive personal data, about the young people and carers who will be attending performances of our complex needs shows; this is collected from the bookers (for instance, a parent who has booked tickets for them and their child, or a school who has booked a performance for some of their students). The information collected includes the name and age of the young people participating, their access requirements, any medical conditions we need to be aware of, and other information specific to the individual show, such as whether they can eat a certain food they will be offered during the performance. This information is processed to ensure we can make the audience as comfortable as possible during the performance, to tailor the performance to meet their needs and to ensure their safety.
This information is shared with the show’s Company Stage Manager, and the cast (and director if present) of the show.
Creating with the Cart applicants
We collect personal information to process applications to Creating with the Cart, including your name and contact details, and details of your qualifications, skills, experience and employment history. We will share your information with the other facilitators of the summer school who are involved in the application process: Oily Cart’s Communication & Engagement Producer, Artistic Director and Executive Director, and the Postgraduate Programme Director from the summer school’s partner organization, Rose Bruford College.
If you are offered and accept a place, your personal data will be used to facilitate your participation and to communicate information about the summer school. We will also ask for details from, or a scan of, your Disclosure and Barring Service (DBS) check or a form of ID, for example passport or driving license. This is required to work with young people in the summer school’s venue and will be shared with them.
Job applicants, current and former Oily Cart employees
All of the information you provide during the application process will be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.
During the application process, we will ask for the following information:
- Your name, address and contact details, including email address and telephone number;
- Details of your qualifications, skills, experience and employment history;
- Whether or not you have a disability for which the organisation need to make reasonable adjustments during the recruitment process; and
- Information about your entitlement to work in the UK
Your information may be shared internally for the purposes of the recruitment exercise. This includes with members of Oily Cart’s management the administrator involved in the recruitment process, and interviewers involved in the recruitment process.
If your application for employment is unsuccessful, Oily Cart will hold your data on file for 6 months after the end of the relevant recruitment process. If you agree to allow us to keep your personal data on file, we will hold your data on file for a further 6 months for consideration for future employment opportunities. At the end of that period, or once you withdraw your consent, your data is deleted or destroyed. We will not share your data with third parties.
If your application for employment is successful, personal data gathered during the recruitment process will be transferred to your Personnel file and retained during your employment.
We will then share your data with former employers to obtain references for you. We will also ask you for some additional information, including information from a range of ID documents, and your name, date of birth and address history, which we will share with the Disclosure and Barring Service to obtain the necessary background check to allow you to work with children and vulnerable people.
There is additional information that we will collect upon the offer of employment and during your time as an employee:
Oily Cart’s contractual responsibilities include those arising from the contract of employment. The data processed to meet contractual responsibilities includes, but is not limited to:
- Financial information including but not limited to payroll details and terms, bank account, pension scheme details, court orders and payments such as maternity pay and sick pay
- Postal address
- Contact and emergency contact details
Oily Cart’s statutory responsibilities are those imposed on the company by legislation. The data processed to meet statutory responsibilities includes, but is not limited to:
- HMRC data
- National insurance
- Statutory payments like statutory sick pay, statutory maternity pay
- Family leave
- Work permits
- Equal opportunities monitoring
Oily Cart’s management responsibilities are those necessary for the organisational functioning of the company. The data processed to meet management responsibilities includes, but is not limited to:
- Your application form, details of your qualifications, skills, experience and employment history, and references
- Your contract of employment and any amendments to it
- Records relating to your career history, such as training records, appraisals, other performance measures and, where appropriate, disciplinary and grievance records
- Health and safety
- Email and telephone number
- Outcome of criminal record checks and security clearance for certain roles
- Criminal convictions
- In some cases, permits and visas
- You will inevitably be referred to in many company documents and records that are produced by you and your colleagues in the course of carrying out your duties and the activity of the company
- A log of our communications with you by email and telephone
- Correspondence with or about you, for example letters to you about a pay rise or at your request, a letter to your mortgage company confirming your salary
Sensitive personal data
The Data Protection Act 1998 defines ‘sensitive personal data’ as information about racial or ethnic origin, political opinions, religious beliefs or other similar beliefs, trade union membership, physical or mental health, sexual life, and criminal allegations, proceedings or convictions. In certain limited circumstances, the Act permits Oily Cart to collect and process sensitive personal data without requiring the explicit consent of the employee.
- Oily Cart will process data about an employee’s health where it is necessary, for example, to record absence from work due to sickness, reasons for absence and GP reports and notes, to pay statutory sick pay, and to make any necessary arrangements or adjustments to the workplace in the case of disability. This processing will not normally happen without the employee’s knowledge and consent
- Save in exceptional circumstances, Oily Cart will process data about an employee’s racial and ethnic origin, their sexual orientation or their religious beliefs only where they have volunteered such data and only for the purpose of monitoring and upholding the company’s equal opportunities and related provisions.
- Data about an employee’s criminal convictions will be held as necessary
Data will be stored digitally in our Recruitment folder and on other IT systems (such as email and our online database system).
The information will be shared internally so that Oily Cart can comply with its contractual, statutory and management, obligations and responsibilities; what personal data and who it is shared with will depend on, and be limited to, the specific activity, for example the General Manager and Accountant will have access to payroll details to ensure timely reimbursement.
In order to fulfil its statutory responsibilities, Oily Cart is required to transfer an employee’s personal data to third parties, for example, to pension providers and HM Revenue & Customs.
When working directly with, or in an environment with, children or vulnerable people, details from the employee’s Enhanced Disclosure and Barring Service (DBS) check and/or a scan of the Enhanced DBS check required to work in the venue will be shared with the venue (for instance, when touring a show to a school).
With each production, the company will share company contact details (including members of the permanent office staff, and the show’s creative team and performers) in a contact sheet disseminated to everyone involved.
DBS Information and Record will be kept for 2 years after termination of employment. Payroll information, incident report forms relating to staff, employee forms, sickness records, pension records and disciplinary or grievance records will be kept for 6 years after termination of employment. At the end of that period, or once you withdraw your consent, your data is deleted or destroyed. For a comprehensive list of our retention period for employment records, please contact email@example.com.
As a data subject, you have a number of rights which you can exercise in relation to the information we hold about you – if you would like to contact us about any of these, please email firstname.lastname@example.org. You can:
· access and obtain a copy of your data on request;
· require Oily Cart to change incorrect or incomplete data;
· require the company to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing; and
· object to the processing of your data where Oily Cart is relying on its legitimate interests as the legal ground for processing.
Subject Access Request
If you would like to request a copy of the information we hold on file about you (either electronically or in physical form) Oily Cart will, in compliance with the Data Protection Act in relation to subject access requests, respond within one month. Any request will be subject to adequate identity checks before processing. Access requests can be made via email to: email@example.com.
Oily Cart will process all legitimate subject access requests free of charge unless requests made are deemed to be manifestly unfounded or excessive. In such cases, a reasonable and proportionate administrative fee will be applied to the request or, in exceptional cases, a request may be refused.
– Reviewed November 2019