Privacy Policy
1. Introduction
Deptford X is committed to protecting your personal information. We also want to maintain the trust and confidence of every one of our audience members and supporters, as well as each visitor who uses the Deptford X website (www.deptfordx.org).
Our Privacy Policy gives you detailed information on when and why we collect your personal information, how we use it and how we keep it secure.
Aside from helping us deliver an excellent festival and events, the information you share with us means you’ll receive a more personalised and rewarding experience e.g. information about exhibitions, events, opportunities and new works that may interest you.
Registering for the Deptford X newsletter has many benefits, not least the opportunity to receive information about our work and manage your personal information. You can register with us at any time on our website – www.deptfordx.org.
Deptford X is a UK registered charity (Charity Number 1087490). Deptford X is the data controller of your personal information.
Contact details for Deptford X:
Deptford X
Lewisham Arthouse
140 Lewisham Way
London
SE14 6PD
If you have questions regarding your information or its use, please contact our Data Protection Manager by email: admin@deptfordx.org.
Although it is not compulsory to provide all of the information listed below, should you choose not to, then Deptford X may not be able to provide you with the full range of services that we have to offer.
2. How We Collect Your Personal Information
We collect your information when you decide to interact with us. This could include when you sign up to receive emails from us or when you attend an event or purchase an item through our online shop.
We also look at how our audiences use our websites, so that we can offer the best possible experience whether you’re finding out about opening times or just trying to find out more about our latest exhibitions.
We collect information in a number of ways when you:
• Make a donation
• Buy merchandise or editions from us
• Complete an online survey or audience data survey from our front of house reception
• Contact us by post
• Attend an event
• Sign up to our mailing list
• Apply to one of our opportunities (Fringe, studio, workshops)
• Visit our website: we use google analytics to help make the experience of using our website better. We do not store cookies.
3. The Types of Information We Collect
We only collect the information that’s necessary to carry out our business, provide the particular service you’ve requested and to keep you informed. There are occasions when you can choose not to give us certain information, but this for example, may limit the level of personalisation we offer e.g. you may not get to hear about an event you would have loved to have attended.
The type of information we collect depends on where and when it is gathered, see previous section 2. We may collect:
• Prefix and name
• Gender
• Ethnicity
• Email address
• Postcode
• Date of Birth
• Contact phone number(s)
• Payment card details. Please note, we will not hold payment information for any longer than it takes to process your transaction.
• Delivery address(s)
• Billing address
If you are a student volunteer we may also collect:
• Name of college/university
• Area of college/university
• Course name
• Course faculty
• Course level
• Course end date
• Name of tutor
When visiting our website we may collect the following information:
• Automatically populated IP address: a public IP address is a unique number which allows a computer, group of computers or other internet connected device to browse the internet. The log file records the time and date of your visit, the pages that were requested, the referring website (if provided) and your internet browser version. This information is collected to help diagnose and manage the website, to audit the geographical make-up of users, and to establish how they have arrived at the website.
• Cookies: we do not store cookies.
Information we obtain independently from you:
• Your information may be shared with us by independent organisations, for example other arts organisations that Deptford X has worked with. These independent organisations will only do so when it is required to complete a contract and/or when you have indicated your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process and safeguard your data.
Third Party Organisations
We may combine information you have given to us with this additional information available from external sources. This will only be done when you give permission to the relevant third party organisations to share the data they hold on you, or if the data is already publicly available.
Data Hygiene
From time to time we may screen our database and cleanse our files for inaccurate data. We may also update inaccurate data if the information is available.
Social Media
Depending on your settings or the privacy policies for social media and messaging services like Facebook, Instagram, Vimeo, YouTube or X, you may give us permission to access information from those accounts or services.
Information available publicly
We may include information found in places such as Companies House and information that has been published in articles/ newspapers.
4. Why We Collect Your Personal Information and How We Use It
The information we hold on you will be used in a number of ways. Here are the main ones: to provide a service you have requested, offer you a personalised experience and understand our audience’s needs better, inform you of events or updates you’ve asked for or contact you if we need to obtain or provide additional information (e.g. change of event time).
Specifically, we use your information we collect in the following ways:
To carry out our business and to provide a service or carry out a contract with you:
• To fulfil ticket, merchandise, or donation requests.
• Process payments. Please note that Deptford X does not store any Debit/Credit Card or other payment information once the transaction has been completed.
• Provide the best possible customer services and to help us with internal administration.
• Contact you with important information relating to your event booking or purchase, such as confirming your order, reminding you of an upcoming event you’ve booked for or letting you know about start times or building works that may affect your visit.
Where we have your consent:
• Send you updates via email about what’s on, offers and news or about supporting us.
• Email you about a specific topic you’ve requested to hear more on such as opportunities, our artists or other projects.
Where we have justifiable reason (including legal obligation and legitimate interest):
• Learn about your interests and preferences so that we can contact you with information that is relevant to you.
• Help us target our marketing communications and adverts so that they’re more relevant to you.
• Use your pseudonymised details to show you advertising on such Social Media platforms as Facebook and Instagram or via other third party advertising that may appear on other websites you use. The information shared with these platforms is pseudonymised to protect your personal data.
• For classifying our audience into groups or segments, using publicly available information. These segments help us to understand our audience better and ensure we’re sending relevant messages to each group.
• Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective.
• Undertake consumer research: we may contact you to ask you to participate in consumer research either via an online or telephone survey or in person. You are under no obligation to participate in research and, should you provide any further information, Deptford X will inform you how any further information will be used.
• Analyse and continually improve the services we offer including our artistic output, our website, open call opportunities and our other products.
• To keep our database accurate and relevant.
• Detect and reduce fraud and credit risk.
For a small number of our audience, where we want to better understand people’s engagement with Deptford X and their potential interest in supporting us further:
Before contacting a small number of individuals we may seek additional information from Deptford X’s connections, director, board of trustee and shareholder information. This helps us understand the background of the people who may choose to support us and helps us to make requests for gifts to those who may be able and willing to give. Contact will only be made on a one to one where we have justifiable reason (including legitimate interest).
5. How We Handle Your Information and Other Organisations
Deptford X will never share, sell, rent or trade your personal information to any third parties for marketing purposes without your prior consent.
Some of our service providers may have access to your data in order to perform services on our behalf – payment processing is a good example of this. We make sure anyone who provides a service for Deptford X enters into an agreement with us and meets our standards for data security. They will not use your data for anything other than the clearly defined purpose relating to the service that they are providing.
We may share your details with:
• Service providers who work on behalf of Deptford X, who we have entered a contract with them or you, for example payment processing, printers, marketing agencies, database services, website hosting or email delivery service.
• Service providers and storage services:
◦ MailChimp, who help us to segment and understand our audience by providing additional information so that we can send the most relevant and targeted communications possible. We use MailChimp to store our recipient lists – all data is stored on a secure server in the USA for the purposes of email newsletter distribution. Under the terms of their Privacy Policy, they endeavour not to, under any circumstances, contact people on our lists, market to people on our lists, sell our lists, or share our lists with any other party, except as required by law or, regarding contacting, except in response to a complaint or other communication directly from an individual on one of our lists. If you would prefer that your data is not stored in this manner, you have the right to opt out from further communications at any point.
◦ Dropbox, who we may use to store applications for our open calls. Dropbox is used as a secure service to collect application until the deadline is closed for that open call. All information is then downloaded to the Deptford X internal secure server and is monitored under our HR and recruitment policies. For further information, please contact the Data Protection Manager using the contact details outlined in this notice. Under the terms of the Dropbox Privacy Policy, they participate in and comply with the EU-U.S. Privacy Shield Framework. All dropbox accounts are password protected.
◦ Google, who we use to run our email servers and some of our working document storage. We use google forms to collect open call submissions but will keep this information for only as long as it is relevant. All google accounts are password protected. You can find out more about their privacy here: https://privacy.google.com/businesses/compliance/#?modal_active=none
◦ Eventbrite, who we use from time to time to allow users to register for tickets to our events. Under the terms of the Eventbrite Privacy Policy, they participate in and comply with the EU-U.S. Privacy Shield Framework. Information is not stored on the eventbrite database. Where the user has opted-in to the Deptford X mailing list, we will use this information as detailed in section 2 above.
◦ Third party advertisers (such as Facebook or Google) to help us identify customers similar to our audience or to serve relevant adverts to you on third party websites. The information shared with these advertisers is pseudonymised to protect your personal data.
◦ Where required to do so (for example, if required to do so by the ‘know your donor’ principles under charity law or a court order), or when requested by the police or a regulatory or government authority investigating illegal activities.
Deptford X is not responsible for the privacy notices and practices of other websites even if accessed using links from www.deptfordx.org and recommends that you check the policy of each website you visit and contact its owner or Data Protection Manager if you have any concerns or questions.
Despite all our precautions, no data transmission over the internet is 100% secure. So, we cannot guarantee the security of any information which you disclose to us and so wish to draw your attention to the fact that you do so at your own risk.
6. How We Protect Your Data
Deptford X is committed to protecting the personal information you entrust to us. We adopt robust and appropriate technologies and policies, so the information we have about you is protected from unauthorised access and improper use e.g. our own network is protected.
As part of the services offered to you through the Deptford X website, the personal information you provide may be transferred to countries outside the European Economic Area (EEA). By way of example, this may happen if any of the computer servers used to host the website are located in a country outside of the EEA. If Deptford X transfers your personal information outside of the EEA in this way, we will take steps to ensure that your privacy rights continue to be protected as outlined in this privacy notice.
Deptford X may transfer your data to the USA to organisations such as Facebook, Instagram, or Google. The USA has weaker data protection laws than that of the EEA and therefore we will ensure that only organisations who are a part of the EU privacy shield initiative will handle your personal information. More details on this certification can be found at www.privacyshield.gov/welcome
We will keep your information only for as long as is reasonably necessary for the purposes set out in this privacy notice and to fulfil our legal obligations. We will not keep more information than we need. The retention period will vary according to the purpose, for example if purchasing a ticket only, we will typically keep your data for up to ten years from the date of your last transaction whereas if you have pledged a legacy to Deptford X, we will hold your details until notified by your executors. For further information about how long we will keep your information, please contact the Data Protection Manager using the contact details outlined in this notice.
If you ask us to stop sending direct marketing communications to you, we will keep the minimum amount of information (e.g. name, address or email address) to ensure we adhere with such requests.
7. Your Choices
You should find it easy to access and amend the personal information that we hold on you, or request that we stop contacting you. It’s your data and we want to make sure you feel in control of it.
If you have subscribed to our mailing list, you can amend your personal details and email contact preferences at any time. Simply click on the link at the bottom of our emails or on our website.
Or, if you prefer, you can contact us by emailing or writing using our contact details below.
Every email we send to you will include details on how to change your communications preferences or unsubscribe from future communications.
You can also request full details of personal information we hold about you under the Data Protection Act 1998, or after 25 May 2018, The General Data Protection Regulation, by contacting the Data Protection Manager. Please send a description of the information you would like to see, together with proof of your identity to admin@deptfordx.org.
At any time you have the right to ask Deptford X to amend or stop how it uses your personal information including for marketing purposes. You can do this by clicking on the mailing list button on our website, or by contacting us by email or in writing using our contact details below.
You have the right to get information held about you by us corrected. If you have any concern about the accuracy of your personal data, please let us know using the below contact details.
If you would like us to remove the personal information we hold about you, please contact us using the below contact details.
You have the right to lodge a complaint with the supervisory authority, The Information Commissioner’s Office – www.ico.org.uk
By email: admin@deptfordx.org
By post: Data Protection Manager, Deptford X, Lewisham Arthouse, 140 Lewisham Way, London, SE14 6PD
8. Updates or Changes to the Privacy Policy and Further Information
This notice was updated on 28 August 2024. It may be updated to take into account changes at Deptford X or for example to reflect changes to regulation or legislation.
Updates to this policy will be posted on this page – please check back from time to time. We may also inform you of any changes where we hold an appropriate email address for you.
When your data is provided to us by another person (for example a recommendation) or a publicly accessible sources (such as Google) we will tell you where we obtained the information within a month of getting it.
Further information on data protection regulations and laws can be found here:
Data Protection: https://ico.org.uk/for-the-public