Privacy Policy - Festival 2022 LTD

PRIVACY POLICY – FESTIVAL 2022 LTD

WHO WE ARE

Festival 2022 Limited is registered in England and Wales (company number 12581221) at the registered office address of One Brindley Place, Brindley Place, Birmingham, England, B1 2JB (“Festival 2022 Ltd”/”we”/”us”).

Festival 2022 Ltd is a wholly owned subsidiary of the Birmingham Organising Committee for the 2022 Commonwealth Games Ltd, registered in England and Wales (company number 11120160) at the office address of One Brindley Place, Brindley Place, Birmingham, England, B1 2JB (the “OC”).

Festival 2022 Ltd and the OC together form a group (the “Company Group”/”Parties”) in which the OC is the sole member of Festival 2022 Ltd, and the Parties work together for the purpose of curating, managing and promoting a nationwide festival of creativity and innovation in 2022 (the “Festival”).

The Festival is delivered in partnership across the four nations of the United Kingdom, led by us, working with Visit Scotland and Creative Wales our (“Strategic Delivery Bodies”) and funded by UK Government with the Scottish Government, Welsh Government and Northern Ireland Executive (“Funders”).

HOW TO CONTACT US

If you have any questions about Festival 2022 Ltd.’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Write to us at:

Data Protection Officer, Festival 2022 Ltd

One Brindley Place, Brindley Place, Birmingham, B1 2JB.

Email us at: dp@festival2022.uk

You may also request a copy of this privacy policy in another format.

ABOUT THIS POLICY

Festival 2022 Ltd takes its responsibility to look after your personal information very seriously. This privacy policy will explain how as the lead organisation for the Festival, we use the personal data we collect from you when you submit information to us via http://www.festival2022.uk (the “Festival Website”), apply to be part of the Festival, or work with us to deliver the Festival. This may be through our R&D Project or any other mechanism via which you become involved.

We have a separate notice for any information which we collect via cookies, web logs, Google Analytics and security or performance software. For further information about these please read our cookies notice.

THIRD PARTY LINKS/SITES

The Festival Website contains links to websites operated by third parties (including social media sites). Please note that our privacy policy applies to the personal information that we collect through the Festival Website and our social media sites only and we cannot be responsible for personal information that third parties may collect, store and use through their websites. You should carefully read the privacy policy of each website you visit.

WHAT DATA DO WE COLLECT AND WHY?

We will collect and process personal information submitted to us by you (or a third party who is acting on your behalf) via the Festival Website, our third-party tools or by post, when you:

  • Register your interest in the Festival and/or the R&D Project
  • Request, sign up or contact us for information on the Festival and/or R&D Project
  • Prepare and submit your application for the R&D Project
  • Submit a complaint to us or provide feedback to us
  • Sign up to our contact list
  • Contact us via email for any purpose
  • Use or view the Festival Website via your browser’s cookies

Depending on the nature of your contact, we collect:

  • Your name, telephone number, email address and / or other contact data
  • Your business address
  • Country of residence and postcode (if UK)
  • Your image data if we record any meetings with you
  • Your IP address
  • Information about your organisation and the industry sector you work in.
  • When you ask us to provide you with information about the Festival, us, or the R&D Project, we process your information where it is necessary for legitimate interests and when we consider that your interests and fundamental rights do not override our interests; or for the purposes of providing information to you prior to your entering into a contract with us.
  • When we process your information during the registration, application or selection process for the Festival or our R&D Project, we will do so to determine your relationship with the Festival, where it is necessary for our legitimate interests and when we consider that your interests and fundamental rights do not override our interests.
  • We also rely on the basis of explicit consent, via use of a ‘tick box’ to send you marketing information about the Festival and to share your data with the Company Group and Strategic Delivery Bodies in order that they may send you marketing information about the public events in 2022 associated with the Festival.
  • When we respond to freedom of information and data subject requests, the legal basis for processing your personal data is that it is necessary to comply with a legal obligation placed on us as the data controller.
  • When we respond to complaints or general enquiries you may have about us or the Festival, we process your personal data for the performance of a task carried out in the public interest.
  • There may also be instances where we need to process your personal data when it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We would rely on this basis when we are required to communicate with you further in response to any enquiries or contact you have made with us, and where such communication is not covered by the lawful bases described above.

If you have consented to receive marketing information from us, we will use your personal information, with this explicit consent, to provide specific email communications related to the Festival or public events in 2022 associated with the Festival.

HOW DO WE STORE AND SHARE YOUR DATA?

We use a third-party tool named Flexigrant as the platform to host the application on which you, or a third party who is acting on your behalf, will input your data. More information about Flexigrant can be found on their website at: https://www.flexigrant.com/privacy-policy/

We use a third-party tool named Salesforce to store personal data collected during the registration, application and selection process; and to manage the sending of marketing and communications material. More information about Salesforce can be found on their website at: https://www.salesforce.com/company/privacy/

Our thirty-party tools are accessible via the Festival Website http://www.festival2022.uk. We use a third-party organisation called Supercool to host and maintain the Festival Website and store personal data collected via the Festival Website. More information about Supercool can be found on their website at: https://www.supercooldesign.co.uk/

If you have contacted us by post at our Birmingham address or via email, then our staff will use your personal data in order to respond to your enquiry.

Information you submit to us in your application to be part of the R&D Project of the Festival will be shared by us with people and organisations involved in delivering, administrating or working on the Festival. This includes the Strategic Delivery Bodies, our Funders and any external advisors, producers or contractors engaged by Us or a Strategic Delivery Body to deliver the Festival. Throughout, your data will be shared with the Strategic Delivery Bodies and other parties where applicable under a data sharing agreement where there is a lawful ground to do so to further the delivery of the Festival.

If you have consented to receive marketing information from us and our Strategic Delivery Bodies, we and/or our Strategic Delivery Bodies will also use your personal information to provide specific email communications related to delivery of the Festival across the four nations of the United Kingdom.

Except as specified in this privacy policy, we will not share your personal information with a third party unless you have given explicit consent to do so. We will never sell your personal data to third parties or any other organisations.

HOW IS OUR PROCESSING OF YOUR INFORMATION LAWFUL?

The law requires us to determine which of six defined bases we use to process different categories of your personal information, and to notify you of the basis for each category. The key bases we rely on are set out below:

We continue to process your information on the consent basis until you withdraw your consent, or it can be reasonably assumed that your consent no longer exists.

PROTECTING YOUR DATA

We employ comprehensive and appropriate security measures in order to protect your personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and any other unlawful forms of processing. We aim to ensure that the level of security and the measures adopted to protect your personal data are appropriate for the risks presented by the nature and use of your personal data. Our security measures include organisational security (passwords and access controls, staff training, information security and data protection policies), physical security (secure data centres, building security) and IT security (firewalls, encryption).

Although we will always treat the information you send us with the strictest confidence, we cannot guarantee the security of the Internet. No transmission over the Internet can ever be guaranteed secure and it is possible, though very unlikely, that someone other than ourselves could access and read information sent to us in this way. If you feel concerned about this, please use another form of contact, e.g. post.

HOW LONG WILL WE KEEP YOUR INFORMATION?

If you make a simple request for information about us or the Festival, we will retain your personal data for no longer than six months. This will enable us to answer your enquiry and to deal with any further enquiries or complaints you may have relating to your initial enquiry. After six months your personal data will be deleted securely.

In all other cases, Festival 2022 Ltd will retain your personal data until the end of March 2023, or until you expressly withdraw your consent for us to process your personal data. We will then ensure your personal data is deleted securely.

WHAT ARE YOUR DATA PROTECTION RIGHTS?

Festival 2022 Ltd would like to make sure you are fully aware of all your data protection rights. Every person whose data we process is entitled to the following:

  • The right to access – You have the right to request from us copies of your personal data. We may charge you a small fee for this service.
  • The right to rectification – You have the right to request that we correct any information you believe is inaccurate. You also have the right to request that we complete the information you believe is incomplete.
  • The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
  • The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
  • The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
  • The right to data portability – You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
  • The right to withdraw consent - You may withdraw your consent at any time by contacting us (please see the ‘How to Contact Us’ section of this privacy policy below). There will also be a link in each marketing email you receive where you can select ‘unsubscribe’ in order to withdraw your consent or in order to change your consents.

If you make a request, we have one month to respond to you. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In such a case we will notify you and keep you updated. If you would like to exercise any of these rights, please contact us at our email: dp@festival2022.uk.

CHANGES TO THIS PRIVACY POLICY

We regularly review and, where necessary, update our privacy information. If we plan to use personal information for a new purpose, we will update our privacy information and will communicate the changes to you. This privacy policy is effective from and was last updated on 1 September 2020.