Privacy Policy Privacy Policy The terms “NDCW” “NDCWales” “National Dance Company Wales” or “us” or “we” refer to National Dance Company Wales. We are a company limited by guarantee registered in England and Wales under company number 01672419 whose registered office is at The Dance House, Pierhead Street, Cardiff Bay, Cardiff, CF10 4PH. The term “you” refers to the individual accessing and/or submitting Information to the Website. We are committed to protecting and respecting the privacy of your personal information: we want to maintain the trust and confidence of our audiences and supporters as well as our online visitors through our NDCWales website at www.ndcwales.co.uk/en, and any subdomain or any such related website and/or mobile application for such website (the “Website”) and social media pages. We, as the Data Controller, can be contacted via our Data Protection Adviser, Kelly Twydale (Operations Director) via email data@ndcwales.co.uk or call 02920635600. This Privacy Policy gives you detailed information on when and why we collect your personal information, how we use it and how we keep it secure. As Data Controller we are responsible for, and control the processing of, your Personal Data in accordance with applicable Privacy and Data Protection Requirements. “Personal Data” has a legal definition but, in brief, it refers to information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. Such information must be protected in accordance with applicable Privacy and Data Protection Requirements (this is defined at the end of this Policy). We use Personal Data to ensure that we contact you with relevant information that you want to hear about, such as our performance information at the Dance House, the home to NDCWales, or NDCWales on tour; activities that we run for you to get a deeper engagement with dance; ways to support us and the sector; as well as using information to improve our service and develop the dance sector. Registering your personal details with NDCWales has many benefits, including being able to manage your personal information and the information you receive from us about performances and activities. In certain circumstances (see below), we may ask you to indicate your consent to the way we use your personal information (as is set out in this Policy) when you first submit such personal information to or through our Website, for example, when you opt in to receive information from us at any time on our registration page, as well as updating your preferences. Why do we collect personal information? We collect personal information depending on the service we are offering to you; this could be as an audience member; or a participant, or if you deal with us on behalf of your business. We also collect information about people who are visiting our Website or social media pages. Where you are an audience member of our show or our Website We gather Personal Data about you to ensure that we can provide you with a service that meets your needs and to inform you of events or updates you’ve asked for or to contact you if we need to obtain or provide additional information. Provide the best possible audience and customer experience and to help us with internal administration. Fulfil merchandise, donation and membership requests. Process payments. Please note that the Dance House/NDCWales does not store any Credit Card or other payment information once the transaction has been completed. Purchase through Paypal and Just Giving Some of NDCWales and Dance House activities and merchandise is sold through PayPal. PayPal will hold the Personal Data you have provided them with. They will also provide us with this information to enable us to deliver the purchase. Please see their privacy policy for more information on how they handle your Personal Data. NDCWales also uses Just Giving to take donations. Only the Personal Data that you want NDCWales to receive is shared from Just Giving, otherwise you are known as anonymous donation. Please see their privacy policy for more information on how they handle your Personal Data. Improve our marketing and communications so the information you receive is relevant to you. We will learn about you, your interests and preferences so we can improve communications in the future. Help us understand our audiences, their motivations and behaviour, we will group audiences into segments, using booking and publicly available information. These segments help us to understand our audience better and ensure we’re sending appropriate communications to you. Measure and review how our audiences respond to a variety of marketing activity to ensure our communications is relevant and effective. Undertake audience research: we may contact you to ask you to participate in audience research online, or telephone survey or in person. You are under no obligation to participate in this research. If you do provide any further information to Dance House/NDCWales we will inform you how the research will be used. Analyse and continually improve the services we offer including our artistic output, our Website and our other products. Analyse how we deliver the artistic programme, website and other marketing outputs so we can improve the service for audiences. Ensure we keep our database accurate and up to date. Contact you with important information relating to your booking or purchase, such as confirming your order, reminding you of an upcoming performance you’ve booked for or letting you know about important information that may affect your visit. Provide you with updates about similar shows and courses that you might be interested in. On the grounds that it enables us to fulfil our service and deliver our contract with you, we process the data because it is necessary for the legitimate interests we pursue as a national dance company. This is subject to you raising an objection under your rights below requiring us to check that our interest in the processing is not overridden by the resulting risk to your rights and freedoms If you have agreed for us to do so, we may: Send you updates via email about our productions; activities on tour and at the Dance House, news or about supporting us. You can update your personal preferences at any point and choose not to hear from us, but this may prevent us from sending you correspondence in future. Where you are a participant Please see the previous section for audience members, as we collect the same data that we do for audience members and use it in the same way and on the same grounds. In addition, if you are participating in one of our dance programmes (such as Dance for Parkinson’s, Dance Days, Summer Course, workshops and Dance to Health, for example) we may ask you to provide additional information about your health and wellbeing. Health Data We process this data on the legal basis that it is necessary for the performance of the contract between us. By ensuring that we are aware of any requirements you may need during the sessions, this helps us deliver and support your needs and to communicate those to medical professionals in the case of emergency. In accordance with the applicable Privacy and Data Protection Requirements, we will only process this data if you have given your explicit consent for us to process it for this purpose. we will only use this information for the course specified. once you have finished the course, or let us know you are no longer attending, we will destroy this information together with your other information. If you are unsuccessful if getting on the course, your applications and Personal Data will be destroyed. this information is only shared with the teacher / chaperone delivering the session. we will only use emergency contact information in an emergency the health form is only stored in the original hard copy and kept securely until the end of the course. NDCWales will not keep any record of that health and medical form and it will be destroyed. if an accident did happen during a session the Accident Record Form will keep a record of the accident along with the participants name, contact details and accident details. This is then logged as part of the legal procedures of the organisation. Participants under the age of 16 want to take part in one of our dance courses, we will only process that child’s Personal Data for a purpose and legal basis set out above, but also, we will ask the holder of parental responsibility to consent to such processing on behalf of the child. Children and minors have the same rights as adults to know what data we hold, to update their data, object to processing data and the right to be forgotten (among others). Please visit Your Rights section. Retention Policy We have touched on how long we keep certain information already, but we have some further detail about our retention policies here, as the retention period will vary according to the purpose for which your data is processed. We will keep your information only for the purposes set out above: for the time that the processing is necessary for the performance of the contract between us. For example, the duration of the course that you are participating in, or until you after the show you have booked to see; we will only keep your special category data from the moment you book the course, until the course comes to an end, or you let us know that you will no longer be participating. As discussed previously, when you stop attending the course, for whatever reason, we will destroy the health form you completed. Please keep in mind that, in the unfortunate event that you are involved in an accident during the course or while visiting us as an audience member, for example, your Personal Data may be reported in our accident log book, which we are required to keep as part of our legal and regulatory obligations; or 7 years or until consent is withdrawn (whichever is sooner), where the legal basis is express consent. If required, we will be entitled to hold Information for longer periods in order to comply with our legal or regulatory obligations, for example, accident record forms, as discussed previously. If you would like further information on our CRM System, Tessitura and the Consortium please click here. How we collect your personal information We collect your personal information when you interact with us. This could include, where you: purchase any courses or other goods (excluding tickets) at the Dance House; have been to see National Dance Company Wales on tour at a partner venue; sign up to receive the NDCWales /Dance House newsletter emails from us or provide us with feedback to an event, join as a Lift member (NDCWales’ supporters membership scheme). make a donation buy classes or merchandise such as t-shirts from our online shop have contacted us by email, phone, post or in person register for special interest lists e.g. visited a touring venue; surveys and competitions visit our website: we use cookies to help make the experience of using our website better and to personalise the service you receive from us. This will mean that the website will remember your previous visits and track the pages on our website that you visit. We also look at how our audience engages with our marketing including our Website and social media, so that we can offer the best possible experience even where you are just trying to find out more about our latest productions. For more information please see our Cookie Policy. What happens to your data when you buy tickets to one of our productions In 2007 the Welsh Millennium created a Consortium (defined below) that makes it possible for other arts organisations to benefit from the same ticketing system we use, namely “Tessitura”. We offer a collegiate approach to the use of Tessitura with consortium partners, sharing a system for mutual benefit rather than a more traditional corporate relationship. The organisations in our Consortium are currently: Welsh National Opera BBC National Orchestra of Wales National Dance Company Wales National Theatre Wales Liverpool Everyman and Playhouse Whilst all ‘organisation specific’ data is locked down to the appropriate organisation (i.e. transactional information, payment data, customer interactions, ticket history etc.), there is a general tab on a customer’s record which is shared amongst Consortium partners. This means that by purchasing tickets through Tessitura each consortium member can view the following information: Name, Address, Phone Number, E-mail Address. However, under no circumstance are they allowed to make use of this information unless you have specifically given them permission to do so. If you would like further information on our CRM System, Tessitura and the Consortium please click here. Third-party links This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy every website you visit. What information do we collect? We only collect personal information that’s necessary for us to deliver our service and personal information that you have agreed to provide us to keep you informed. This Personal Data includes: personal information including first and last name, date of birth, photograph and/or likeness; contact information including current residential address, primary email address and/or primary phone number; card payment information, including your card details, name on your account and your billing address; certain information relating to your health and wellbeing (i.e. the Health Data we mentioned earlier); technical information including IP address (for more information on this, please see below), operating system, browser type and related information regarding the device you used to visit the Website, the length of your visit and your interactions with the Website; information obtained through our correspondence and monitoring; and details of any enquiries made by you through the Website, in person, or over the phone together with details relating to subsequent correspondence (if applicable). Data from venues/arts organisations independently from you: Your information may be shared with us by other arts organizations such as venues which we have performed at. You should check their Privacy Policy when you provide your information to understand fully how they will process and safeguard your data. Social Media You are in control of your personal setting on social media. We will only contact you if you wish to receive messages from us depending on your permission to access information from those accounts or services. If you make use of our Website through a social media provider, we may access information about you via that social media provider in accordance with their policies. When using social media and you have chosen to include it in your social media account, we may access information such as your name, profile picture, gender, birthday, email address, town or county and any other information you have chosen to make available. We may also access information from social media providers about your use of an application that we run on their website. Support and Fundraising We know some of our existing audiences are interested in supporting the company further and we would like to understand who those audience members might be. So long as we have specific consent to do so, we may contact audience members if you have been to see NDCWales at a higher frequency over a 3-year period, or who have been to NDCWales’ fundraising events or supported the company in the past. Business Personal Data Why do we collect personal information? NDCWales works with a variety of people and organisations to enable it to operate. We work with a variety of artists, freelancers, trustees, different types of organisations and third-party service providers, and sometimes about those who have hired the facilities at the Dance House. As part of our working processes we will need to capture and process sometimes Personal Data if a separate business field is not available, and you have provided us with that information as part of a contract. To enable us to fulfil our service and deliver our contract with you we collect data, so we can: contact you regarding your contract and business agreement with us. process payments through our finance systems. If you have agreed to work with us under legitimate reasons, we will: contact you regarding NDCWales and delivery of service only contact you by the permissions you have supplied If in the future you want to cease communications, you have option to opt out or the right to be forgotten – See your Rights (below) How we collect this personal information? We collect your personal information if you share this information with us part of a contract or an agreed delivery of service by NDCWales and the Dance House or for our legitimate interests as a Dance Company. We work with organisations and individuals some of whom provide NDCWales with Personal Data as part of a business agreement such as name, contact telephone number, email, address and bank details. What information do we collect? We only collect personal information that’s necessary for us to deliver our service. If business fields are not provided, Personal Data may include name, address, email, telephone number and bank account details. You can update your personal preferences or let us know at any point if you choose not to hear from us, but this may mean you will not receive necessary correspondence from us that allows us to perform the contract with you. Our Grounds for Processing your Personal Data: The grounds we hold and process your Personal Data are as follows: Ensure that NDCWales can provide communication and service to those using the company, such as tour venues, schools or the Dance House facilities. Detect and reduce fraud and credit risk we will retain data with a financial connection for up to 7 years. How we manage your data Any Personal Data held by National Dance Company Wales and the Dance House will not be shared with any third party without your consent for marketing purposes. However, we may disclose your information (including Personal Data): to other companies within our group of companies (which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006); to our business partners, service providers or third-party contractors to enable them to undertake services for us and/or on our behalf for example Sage International - Tracking all payments to staff, freelancers and organisations through Sage. Lloyds Bank - Processing payments PayPal/ eBay to pay for good or a service directly. HMRC – to process information connecting to TAX and National Insurance Third party organisations which supply a marketing support service such as box office system Tessitura, freelancers, mailing houses, website hosting providers or email delivery service. Audience Insight and the Audience Agency who help us analyse audience behaviour to improve our service to you. to any prospective buyer or seller (and their representatives) in the event that we sell or buy any business or assets; if we are under orders or a duty to disclose or share Personal Data to comply with any legal obligation, including (but not limited to) any request or order form law enforcement agencies and/or HMRC in connection with any investigation for the purposes of fraud protection and credit risk reduction; and if we are under a duty to disclose or share Personal Data to comply with any legal obligation, including (but not limited to) any request or order from law enforcement agencies and/or HMRC in connection with any investigation to help prevent unlawful activity; and to other third parties if you have specifically consented to us doing so. All third-party service providers have gone through a Third-Party Assessment by National Dance Company Wales to ensure it meets the Data Protection Guidelines Regulations. We may disclose aggregated, anonymous information (i.e. information from which you cannot be personally identified), or insights based on such anonymous information, to selected third parties, including (without limitation) analytics and search engine providers to assist us in the improvement and optimisation of the Website. In such circumstances we do not disclose any information which can identify you personally. How we protect and store your data National Dance Company Wales and the Dance House takes managing Personal Data seriously and has adopted robust and appropriate technologies and policies, so the information we have about you is protected. More details The Personal Data that National Dance Company Wales/ Dance House collects from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us as one of our third-party suppliers. These staff may be employed to deliver the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your Personal Data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted. You would have created a password if you purchased tickets through Wales Millennium Centre website and you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Marketing and opting out Where you are dealing with us on behalf of a limited company or LLP, for business purposes, then we may contact you by email to your corporate email address about similar or related products that we offer. If you prefer not to receive any direct marketing communications from us, or you no longer wish to receive them, you can opt out at any time. Where you have previously ordered products or services from us we may contact you by telephone and email and post about similar or related products, services, promotions and special offers that may be of interest to you. We will inform you (during the sale process) if we intend to use your data for such purposes and give you the opportunity to opt-out of receiving such information from us. In addition, and if you have given permission, we may also contact you by telephone and email about our other products, services, promotions and special offers that may be of interest to you. We will inform you (before collecting your data) and seek your permission if we intend to use your data for such additional marketing purposes. If you prefer not to receive any direct marketing communications from us, or you no longer wish to receive them, you can opt out at any time. If you have given permission, we may contact you by mail, telephone and email to provide information about products, services, promotions, special offers and other information we think may be of interest to you. We will inform you (before collecting your data) if we intend to use your data for such purposes. If you would rather not receive such marketing information from us, or you no longer wish to receive it, you can opt out at any time. If you have given permission, we may share your Personal Data with carefully selected third party organisations and business partners and they may contact you directly (unless you have asked them not to do so) by mail, telephone and email about products, services, promotions and special offers that may be of interest to you. We will inform you (before collecting your data) and seek your permission if we intend to disclose your data to third parties for such purposes. If you prefer not to receive direct marketing communications from our business partners, or you no longer wish to receive them, you can opt out at any time (see below). You have the right at any time to ask us, or any third party, to stop processing your information for direct marketing purposes. If you wish to exercise this right, you should contact us by sending an email to data@ndcwales.co.uk contact the relevant third party using their given contact details, giving us or them enough information to identify you and deal with your request. Alternatively, you can follow the unsubscribe instructions in emails you receive from us or them. Information about other individuals If you give us information on behalf of a third party, you confirm that the third party has appointed you to act on his/her/their behalf and has agreed that you can: give consent on his/her/their behalf to the processing of his/her/their Information; receive on his/her/their behalf any data protection notices; and give consent to the transfer of his/her/their Information abroad (if applicable). Your rights If you are an individual, this section sets out your legal rights in respect of any of your Personal Data that we are holding and/or processing. If you wish to exercise any of your legal rights, you should put your request in writing to us (using our contact details below) giving us enough information to identify you and respond to your request You have the right to: Request access to information about Personal Data that we may hold and/or process about you, including: whether we are holding and/or processing your Personal Data; the extent of the Personal Data we are holding; and the purposes and extent of the processing. Have any inaccurate information we hold about you be corrected and/or updated. If any of the Information that you have provided changes, or if you become aware of any inaccuracies in such Information, please let us know in writing giving us enough information deal with the change or correction. In certain circumstances to request that we delete all Personal Data we hold about you (the ‘right of erasure’). Please note that this right of erasure is not available in all circumstances, for example where we need to retain the Personal Data for legal compliance purposes. If this is the case, we will let you know. In certain circumstances to request that we restrict the processing of your Personal Data, for example where the Personal Data is inaccurate or where you have objected to the processing. To request a copy of the Personal Data we hold about you and to have it provided in a structured format suitable for you to be able to transfer it to a different data controller (the ‘right to data portability’). Please note that the right to data portability is only available in some circumstances, for example where the processing is carried out by automated means. If you request the right to data portability and it is not available to you, we will let you know. In certain circumstances to object to the processing of your Personal Data. If so, we shall stop processing your Personal Data unless we can demonstrate sufficient and compelling legitimate grounds for continuing the processing which override your own interests. If, because of your circumstances, you do not have the right to object to such processing then we will let you know. In in certain circumstances not to be subject to a decision based solely on automated processing, for example where a computer algorithm (rather than a person) makes decisions which affect your contractual rights. Please note that this right is not available in all circumstances. If you request this right and it is not available to you, we will let you know. To object to direct marketing, for which see above. Complaints If you have any concerns about how we collect or process your information then you have the right to lodge a complaint with a supervisory authority, which for the UK is the UK Information Commissioner’s Office (“ICO”). Complaints can be submitted to the ICO through the ICO helpline by calling 0303 123 1113. Further information about reporting concerns to the ICO is available at https://ico.org.uk/concerns/. IP Addresses and Cookies We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration and to help us monitor our engagement and delivery to you. An IP address is a unique number which allows a computer, group of computers or another internet connected device to browse the internet. The log file records the time and date of your visit, the pages that were requested, the referring website (if provided) and your internet browser version. Using Google Analytics, we use this information to help understand audiences online; where they are from; what pages they are most interested in; how did they find out the information and how we could improve our engagement. This is statistical data about our users' browsing actions and does not identify any individual. Please read NDCWales/ Dance House Cookies Policy for more information Contact Details By email: data@ndcwales.co.uk By phone: 029 2063 5600 By post: Dance House Pierhead Street Cardiff Bay CF10 4PH Use of CCTV We monitor and record images using closed circuit television at our home the Dance House and at the Wales Millennium Centre box office. We do this for the purposes of crime prevention and public safety. Changes to our Privacy Policy This policy was updated on 12 June 2018 in line with the new General Data Protection Regulations. Any changes we may make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to data@ndcwales.co.uk For more information on the Data Protection Act, you can call (UK) 01625 545 700 or visit the Information Commissioner's website at www.informationcommissioner.gov.uk DEFINITIONS References in this Policy to: “Privacy and Data Protection Requirements” means: the Data Protection Act 1998 (until repealed) (“DPA”), the Data Protection Directive (95/46/EC) (until repealed) and, from 25 May 2018, the General Data Protection Regulation 2016/679 (“GDPR”) or any equivalent provision which may replace the GDPR following the formal political separation of the United Kingdom from the European Union; the Regulation of Investigatory Powers Act 2000; the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699); the Electronic Communications Data Protection Directive (2002/58/EC); the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003); and all applicable laws and regulations which may be in force from time to time relating to the processing of Personal Data and privacy, including where applicable the guidance and codes of practice issued by the Information Commissioner or any other supervisory authority, and the equivalent of any of the foregoing in any relevant jurisdiction; and “Personal Data”, “Data Controller” and “Data Processor” and “processing” shall have the meanings given to them in the DPA or, from 25 May 2018, the GDPR. Policy updated on 12 June 2018 Cookies policy What is a cookie? A cookie is an online file which is stored on your internet browser or the hard drive of your computer. Cookies contain information that is transferred to your computer's hard drive from our website. A cookie allows us to monitor and deliver a better more personalised online service. Some of the cookies we use are essential for the site to operate. A cookie cannot give NDCWales access to your computer or to information beyond what you provide us. Why do we use Cookies? We use cookies to monitor our audience’s behaviour online to ensure we deliver the best service; engage with the most useful and best content for them, and to understand our audiences more to provide the best form of communication and messaging. If you have any questions about this information, please contact the Data Protection Officer by emailing data@ndcwales.co.uk The below table shows the types of cookies which are frequently used by websites today, together with their purpose: The following table sets out which cookies NDCWales uses, their purpose and how intrusive they may be considered. Third-party cookies Advertising Cookies We sometimes use online cookies for targeted online advertising based on audiences who have visited our website, social media channel pages or have determined their interests and demographic through Google. Google uses the third-party DoubleClick cookie to collect data and serve ads that are relevant to you on the websites of its partners. The cookie does not contain any personally-identifiable information and we do not merge it with any personally-identifiable information collected through the website. Users may opt out of the use of the DoubleClick cookie for interest-based advertising by visiting Ads Settings. The features used are: Remarketing with Google Analytics, Google Display Network Impression Reporting and Google Analytics Demographics and Interest Reporting. We use also Google Analytics' 3rd-party audience data such as age and interests to better understand your online behaviour, and we work with companies that collect information about your activity to make sure we only talk to you about things you’re interested in. How you can manage Cookies settings Cookies can not identify you and we can not see any Personal Data on your computer. However, if you wish to change your setting and disable cookies you can do through your browser settings. By changing your setting this will affect your personal preferences to the website. All browsers are different – for more information on cookies in general, visit the following external links: www.aboutcookies.org www.youronlinechoices.eu Below are the more common internet browsers, and how to change your Cookies settings: Cookie Policy updated 3 May 2018