Privacy Policy for Event Participants

What information do we hold about you and why?

Booking an event

When you book an event with us, either online or directly with a property, we will collect the following information about you:

• Your name – to process your booking and contact you regarding it
• Your address – to process your booking and, if applicable, send event tickets
• Your email address – to contact you regarding your booking and send event tickets
• Your contact telephone number – to contact you regarding your booking

It is necessary to process this information to fulfil our event terms and conditions to you. Our legal grounds in relation to this processing is contract, in that the processing is necessary for the provision of the service (entry to the event).

In addition to the data categories identified above, if you are booking an event via our online events platform, your payment details may also be processed. This is managed by the events platform who are PCI DSS compliant. For further details, please see their security guidance.

If we use your personal information to tailor our communications to you, for example by letting you know about similar upcoming events, we will only do so because you have told us you would like to receive these communications. Our legal grounds in relation to this processing is your consent and you have the right to withdraw your consent at any time.

Feedback surveys

When you attend an event, we may invite you to complete a feedback survey.

Completion of surveys will be entirely optional, and we will tell you every time what the purpose of the survey is and how we will process your data.

Our legal grounds for this processing are our legitimate interests so we can understand how we are performing and where we can improve.

CCTV (Closed Circuit Television)

We operate CCTV/video surveillance cameras at some of our properties. CCTV is used for maintaining the security of property and premises; for preventing and investigating crime; and for detecting, apprehending and prosecuting offenders.

If CCTV is in operation, appropriate signage will be in place and the operating procedures will be regularly audited by the property manager to ensure compliance with relevant standards and legislation.

Where we host a CCTV system for which another organisation is responsible, there will be an agreement in place to cover:

• agreed responsibilities for compliance with data protection law
• named contacts responsible for the operation of the CCTV system in each organisation
• a procedure for handling requests for access to CCTV footage

Photography and filming

If we plan to take photographs or film individuals or small groups at an event you have booked, we will ask for your consent to take and use these images, before doing so. You have a right to withdraw your consent at any time, but you should note that it might be difficult to remove images if they have been published.

If we plan to take photographs or film large events, we will inform you that photography or filming is due to take place at the point of booking and will ensure there is clear signage on the day. If you would prefer not to be included in any images, or do not want your image to be published, please contact us and we will find ways to manage this carefully on the day.

Who will have access to your data and who will we share it with?

Access to your personal data will be restricted to Trust employees and partners (as listed below) on a need-to-know basis only. Access will be provided for the purposes of supporting you as an event participant, contacting you regarding the event and making sure we keep you informed about the things important to you.

Access to CCTV images is restricted to authorised members of staff for the purposes of ensuring the equipment is in good working order and images are being recorded accurately. Where necessary or required, CCTV images may also be shared with CCTV service providers, security organisations, and individuals or organisations making an enquiry under the appropriate sections of the Data Protection Act 2018. We will only provide access when we consider there to be a lawful basis for doing so and we have documented this.

We will never sell your data to third parties.

We will only ever share your information with third parties in relation to supporting your relationship with us. To make your interactions with us as efficient as possible we will share your information with:

• Our online events booking host – for the purposes of processing your booking
• Our electronic newsletter provider – for the purposes of delivering our newsletter and gathering statistics around email opening and clicks to help us monitor and improve content

Where these third parties are acting as data controllers, they are required to handle your personal data in accordance with all applicable data protection laws. For further information about how they do this, please refer to their privacy policies.

Where the third parties are acting as data processors, processing personal data on behalf of the Trust, we have contracts in place with these third parties which require them to process your personal data on our instructions only. They will not process your personal data for any other purpose and they will retain it securely.

In some cases, your data will be processed outside of the UK. Where this is the case, we will ensure that there are adequate safeguards in place (for example, the use of Standard Contractual Clauses) for the protection of your personal data.

How long will we keep your personal data?

• Information held on your booking record (including contact details and event attended): 6 years from date of the last booking
• CCTV images: one calendar month, unless a crime or incident has been reported and the images are to be retained in line with the investigation. Also, if we receive a request for access to CCTV images, a copy of the images provided will be retained for 2 years.
• Photographs/video footage: permanently unless you ask us to delete your information