Atelier Armonico

The event organiser, Atelier Armonico, has the legal responsibility to tell ticket buyers and event attendees how their personal information will be collected and used. You can find their Privacy Policy below or contact them to request it.

1. Introduction and Purpose

Atelier Armonico is committed to protecting the privacy and personal data of all individuals whose information we hold or process. This includes the participants in our community arts programmes, our freelance artists and contractors, our funders and professional contacts, and anyone else with whom we interact in the course of our work.

This policy sets out how Atelier Armonico collects, uses, stores, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all trustees, staff, freelancers and contractors acting on behalf of the organisation.

ICO registration

Organisations that process personal data as a data controller are generally required to register with the Information Commissioner's Office (ICO) and pay an annual data protection fee, unless an exemption applies. As a newly registered charity, Atelier Armonico will assess its own position under the current ICO registration requirements and, if registration is required, will complete it before processing personal data in its capacity as a charity. The outcome of this assessment and the organisation's registration status will be recorded and reviewed annually, and whenever there is a material change in the nature or scale of the organisation's data processing activities.

2. Data Protection Principles

Atelier Armonico will ensure that all personal data is:

Processed lawfully, fairly, and transparently
Collected for specified, explicit, and legitimate purposes, and not used in ways incompatible with those purposes
Adequate, relevant, and limited to what is necessary for the purposes for which it is collected
Accurate and, where necessary, kept up to date
Kept for no longer than is necessary for the purposes for which it is held
Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage

3. Lawful Basis for Processing

Under UK GDPR Article 6, the organisation must identify a lawful basis for each category of personal data it processes. The lawful bases most relevant to Atelier Armonico's activities are:

Consent (Article 6(1)(a)): where the individual has given clear consent for the organisation to process their personal data for a specific purpose, used for the use of photographs, video and audio recordings for promotional or publicity purposes
Contract (Article 6(1)(b)): where processing is necessary for the performance of a contract with the individual, used for financial and contractual information relating to freelance artists and contractors
Legal obligation (Article 6(1)(c)): where processing is necessary to comply with a legal obligation, used for financial records required by HMRC
Legitimate interests (Article 6(1)(f)): where processing is necessary for the organisation's legitimate interests, provided those interests are not overridden by the individual's rights and interests, used for participant contact details, attendance records, and professional contact information

Where the organisation relies on legitimate interests as its lawful basis, it will carry out and document a legitimate interests assessment to confirm that its interests are not overridden by the rights of the data subjects concerned.

4. Special Category Personal Data

Special category personal data includes information about a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation. This category of data is subject to additional protections under UK GDPR Article 9 and requires both an Article 6 lawful basis and an applicable Article 9 condition.

Atelier Armonico does not routinely collect special category personal data. However, the following situations may give rise to the processing of such data in the course of the organisation's work:

Information about participants' health, disability or communication needs, where provided voluntarily in order to ensure appropriate support
Information about participants' ethnic or cultural background, where collected for monitoring and evaluation purposes required by funders
Information about participants' religion or philosophical beliefs, where relevant to the design or delivery of a programme

Where special category data is processed, the organisation will:

Identify both an Article 6 lawful basis and an applicable Article 9 condition before processing begins
In most cases, rely on explicit consent (Article 9(2)(a)) as the Article 9 condition, obtained through a clear and specific consent process separate from any general consent form
Alternatively, where processing is carried out for the purpose of managing the charity's activities in the substantial public interest, rely on Article 9(2)(g) and Schedule 1, Part 2 of the Data Protection Act 2018, as applicable
Collect only the minimum special category data necessary for the stated purpose
Store special category data separately and with enhanced security measures
Not share special category data with third parties without explicit consent, unless required to do so by law or in connection with a safeguarding referral

The Data Protection Lead is responsible for ensuring that the lawful basis and Article 9 condition for any processing of special category data are documented before processing commences.

5. Criminal Offence and DBS Information

Information about criminal convictions, cautions, and the results of DBS (Disclosure and Barring Service) checks is subject to additional restrictions under UK GDPR and the Data Protection Act 2018. This category of data may only be processed under the control of official authority, or where authorised by law.

In the context of safer recruitment, Atelier Armonico may receive DBS certificates and self-disclosure information from candidates and existing workers. The following rules apply to such information:

DBS certificates will not be photocopied or retained. A record will be kept of the date of the check, the level and type of check, the certificate reference number, and the recruitment decision made. Where there is a genuine dispute about the results of a check, a copy may be retained for no longer than six months
Self-disclosure forms will be stored securely and separately from other recruitment records, accessible only to the Data Protection Lead and, where necessary, the trustee lead for safeguarding
Criminal offence information will only be shared with those who need to know it for the purpose of making a recruitment decision, and will not be included in general personnel files
Criminal offence information obtained through the recruitment process will not be used for any purpose other than assessing the suitability of the individual for the role in question

For further detail on the handling of DBS information in the recruitment context, see Atelier Armonico's Safer Recruitment Policy.

6. What Data We Collect and Why

Workshop participants and community programme participants

We collect and hold the following information about individuals who take part in our community arts projects:

Name and contact details (telephone number and/or email address)
Attendance records
Feedback and evaluation responses
In some cases, images or recordings (photographs, video, or audio) for documentation, evaluation, or promotional purposes, always with explicit prior consent (see Section 9)

We collect this information in order to deliver our programmes effectively, to maintain contact with participants, to meet our monitoring and evaluation obligations to funders, and to document and promote our work. Our lawful basis for processing this data is legitimate interests (Article 6(1)(f)); where consent is required, in particular for the use of images and recordings, we additionally rely on consent (Article 6(1)(a)).

We are mindful that some of our community participants may be in vulnerable circumstances, including people seeking asylum and survivors of domestic abuse. We take particular care to collect only the minimum data necessary, to store it securely, and never to share it in ways that could put individuals at risk. We do not collect information about immigration status, legal proceedings, health conditions, or other sensitive matters unless this is strictly necessary, an appropriate lawful basis and Article 9 condition have been identified, and explicit consent has been obtained.

Freelance artists and contractors

We collect and hold the following information about individuals engaged to work with us:

Name, contact details, and address
Bank details for payment purposes
Tax and National Insurance information where required
Contracts, invoices, and correspondence

We collect this information in order to manage our contractual and financial obligations. Our lawful basis for processing this data is the performance of a contract (Article 6(1)(b)) and, for financial records, compliance with a legal obligation (Article 6(1)(c)).

Funders and professional contacts

We hold contact details and correspondence relating to funders, partner organisations, and professional contacts. This information is used for the purposes of managing relationships, reporting obligations, and professional communication. Our lawful basis is legitimate interests (Article 6(1)(f)).

Safer recruitment information

In the context of recruitment, we collect application forms, references, identity documents, and DBS information. This data is processed for the purpose of assessing candidates' suitability for roles, with our lawful basis being legitimate interests (Article 6(1)(f)) and, where applicable, compliance with legal obligations (Article 6(1)(c)). DBS and criminal offence data is processed in accordance with Section 5 above.

7. Privacy Notices

Individuals whose personal data we collect have the right to be informed about how their data will be used at the time it is collected, or as soon as practicable thereafter. Atelier Armonico meets this obligation through privacy notices provided at the point of data collection.

The organisation will provide a privacy notice to:

Workshop and community programme participants, at or before the start of their engagement with our programmes
Freelance artists and contractors, at the point of engagement
Candidates for roles, at the start of the recruitment process
Funders and professional contacts, through our website privacy notice or on first contact where appropriate

Each privacy notice will set out, in plain language:

The identity of the data controller and the Data Protection Lead
What personal data is being collected and why
The lawful basis for processing (and, where applicable, the Article 9 condition for special category data)
How long the data will be retained
Who the data may be shared with
The individual's rights under UK GDPR and how to exercise them
How to raise a complaint with the ICO

The Data Protection Lead is responsible for ensuring that privacy notices are prepared, kept up to date, and made available to the relevant individuals. Where participants may have limited English, the organisation will take reasonable steps to make privacy notices accessible, including through translation or the use of an interpreter.

8. Consent

Where we rely on consent as our lawful basis for processing personal data, in particular for the use of photographs, video, or audio recordings of participants for promotional or publicity purposes, we will:

Ask for consent clearly and in plain language, ensuring individuals understand what they are agreeing to
Not make participation in our activities conditional on consent to be photographed or recorded
Obtain consent through a specific, separate consent form rather than as part of a general terms or conditions document
Keep a record of when, how, and for what purpose consent was given
Make it easy for individuals to withdraw consent at any time, and act promptly on any withdrawal

Where participants may have limited English, we will take reasonable steps to ensure that consent forms and explanations are provided in a language they understand, or that an appropriate interpreter is available.

Consent is not the appropriate lawful basis for processing data that is necessary for the delivery of our programmes. Where we process participant contact details and attendance records on the basis of legitimate interests, we do not require separate consent for that processing, but we will inform participants of it through our privacy notice.

9. Images and Recordings

Atelier Armonico sometimes documents its work through photographs, video, or audio recordings, which may be used for evaluation reports, funding applications, social media, press coverage, or other promotional purposes. Our approach to images and recordings is governed by both our data protection obligations and our safeguarding policies.

The organisation's position is that photographs and recordings of identifiable individuals are taken and used only with their explicit, informed, and specific consent. Consent is required whether or not an image shows a participant's face, and is obtained through a dedicated consent form before any image or recording is taken for promotional or publicity use.

Consent forms will clearly describe the specific purposes for which images or recordings may be used; consent given for one purpose (such as a funder report) does not automatically extend to other uses (such as social media)
Individuals may withdraw consent at any time, after which the organisation will not use new images of them and will remove existing images where reasonably practicable
Consent for images or recordings of children and young people must be obtained from the person with parental responsibility, as well as, where appropriate, from the young person themselves
Only the adult themselves may give consent for images or recordings of adults at risk: consent cannot be given on their behalf by a family member, carer, or support worker

Given the nature of Atelier Armonico's community work, particular care must be taken with images of participants who are seeking asylum, survivors of domestic abuse, or otherwise in circumstances where identification could cause harm. The potential consequences of identification for such individuals may be severe. Where any doubt exists about whether an image could identify or expose a participant, that image will not be used without specific further consent.

Where photographs or recordings are taken at a public performance or event for general documentary purposes - for example, images of the stage, the setting, or an audience as a whole - individual consent is not required for individuals who appear incidentally, provided that the intention to photograph or film the event has been communicated in advance. This exception does not extend to deliberate or prominent photography of identifiable individuals, and does not apply to community participants who attend as audience members, who remain subject to the full consent requirements above.

10. How We Store Personal Data

Personal data is stored in password-protected spreadsheets and email accounts held by the CEO and the Creative Producer, with access limited to those who need it in order to carry out their role
Devices used to access personal data must be password-protected
Personal data must not be stored on personal devices without appropriate security measures in place
Physical documents containing personal data (such as signed consent forms or DBS records) must be stored securely and not left accessible to unauthorised persons
Personal data must not be shared via unsecured channels (such as unencrypted email) or with individuals who have no legitimate need to see it
Special category data and criminal offence data will be stored separately and with enhanced access controls

11. How Long We Keep Personal Data

Contact details and attendance records for community participants will be retained for a maximum of two years after their last engagement with the organisation, unless they have asked to be removed sooner
Images and recordings will be retained only for as long as they are in active use and covered by valid consent, and deleted when no longer needed or when consent is withdrawn
Financial records relating to contractors, including bank details and invoices, will be retained for seven years in line with HMRC requirements
Funder correspondence and grant-related records will be retained for a minimum of seven years or in line with the terms of the relevant funding agreement
Safer recruitment records for successful candidates will be retained for the duration of the engagement and for a further period in accordance with legal requirements; see the Safer Recruitment Policy for detail
Safeguarding records will be retained for a minimum of seven years; see the Safeguarding Policies for detail
When data is no longer required, it will be securely deleted or destroyed

The Data Protection Lead is responsible for ensuring that retention periods are applied consistently and that data is deleted or destroyed when the relevant period has expired.

12. Third-Party Data Processors

A data processor is any organisation or individual that processes personal data on behalf of Atelier Armonico, under the organisation's instructions. Examples include cloud storage providers, email platforms, payroll services, and external evaluators who may process participant data on behalf of the organisation.

Where the organisation uses third-party data processors, it will:

Carry out appropriate due diligence to ensure the processor provides sufficient guarantees about their data protection practices
Enter into a written data processing agreement with the processor before sharing any personal data, in accordance with UK GDPR Article 28
Ensure that the data processing agreement sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller
Only share the minimum personal data necessary for the processor to carry out the agreed purpose
Review data processing agreements periodically and when the processing arrangement changes

The Data Protection Lead is responsible for identifying where third-party processors are used, ensuring that appropriate agreements are in place, and maintaining a record of processing activities that includes details of processors.

13. Sharing Personal Data

Atelier Armonico will not share personal data with third parties except in the following circumstances:

Where we are required to do so by law, including in connection with safeguarding referrals to statutory agencies
Where we share data with funders or partner organisations as part of our contractual or reporting obligations, in which case we will only share the minimum data necessary, will ensure that recipients handle it appropriately, and will have a data processing agreement in place where the recipient processes data on our behalf
Where an individual has given explicit consent for their data to be shared

We do not sell, rent, or otherwise transfer personal data to third parties for commercial purposes.

14. International Data Transfers

Atelier Armonico's operations are primarily based in the United Kingdom. However, the organisation may on occasion transfer personal data to recipients outside the UK, for example, in connection with international co-productions, partnerships with overseas organisations, or the use of cloud-based services hosted outside the UK.

Where personal data is transferred outside the UK, the organisation will ensure that an appropriate safeguard is in place, as required by UK GDPR Chapter V. This may include:

A UK adequacy decision confirming that the receiving country provides an adequate level of protection
Standard contractual clauses approved by the ICO
Binding corporate rules, or another mechanism recognised under UK data protection law

The Data Protection Lead is responsible for identifying where international transfers occur, assessing whether an appropriate safeguard is in place, and documenting the basis for any such transfer. Where no appropriate safeguard exists, the transfer will not proceed without specific advice from a qualified data protection professional.

15. Data Protection Impact Assessments

A Data Protection Impact Assessment (DPIA) is required before carrying out processing that is likely to result in a high risk to the rights and freedoms of individuals. Examples of processing that may require a DPIA include:

Systematic processing of special category data on a large scale
Systematic monitoring of individuals, for example, audio or video recording of participants across multiple sessions
Processing data about particularly vulnerable individuals, including people seeking asylum or survivors of abuse, in new or untested ways
Processing that involves sharing data with new categories of recipients or transferring data internationally for the first time

Where the organisation proposes to undertake a new type of processing activity that may create a high risk to individuals, the Data Protection Lead will carry out a DPIA before the processing begins. The DPIA will identify the risks, assess their likelihood and severity, and identify measures to mitigate them. Where a DPIA identifies a high residual risk that cannot be mitigated, the organisation will consult the ICO before proceeding.

A DPIA is not required for all new processing activities, only those that are likely to result in high risk. The Data Protection Lead is responsible for assessing whether a DPIA is required for any new or materially changed processing activity.

16. Individual Rights

Under UK GDPR, individuals have the following rights in relation to their personal data held by Atelier Armonico:

The right to be informed about how their data is used, addressed through privacy notices (Section 7)
The right of access to the data we hold about them (subject access request)
The right to have inaccurate data corrected
The right to have their data erased in certain circumstances ('right to be forgotten')
The right to object to processing based on legitimate interests
The right to restrict processing in certain circumstances
The right to data portability in certain circumstances
Rights in relation to automated decision-making and profiling (not currently applicable to Atelier Armonico's processing activities)

Any individual wishing to exercise any of these rights should contact the Data Protection Lead at the address below. The organisation will respond to all valid requests within one calendar month. Where a request is complex or where the organisation receives a large number of requests, this period may be extended by a further two months, in which case the individual will be informed of the extension and the reasons for it.

The organisation will not charge a fee for handling subject access requests in ordinary circumstances. Where requests are manifestly unfounded or excessive, the organisation may charge a reasonable fee or refuse to comply, and will inform the individual of this decision.

17. Data Breaches

A personal data breach is any incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes, for example, sending personal data to the wrong recipient, losing a device on which personal data is stored, or a data system being accessed by an unauthorised individual.

Reporting a breach internally

Anyone who becomes aware of a suspected or actual personal data breach must report it to the Data Protection Lead immediately
The Data Protection Lead will assess the nature, severity, and likely consequences of the breach as quickly as possible and will document the assessment

Reporting to the ICO

If a breach is likely to result in a risk to the rights and freedoms of individuals, it must be reported to the ICO within 72 hours of the organisation becoming aware of it
If the breach is likely to result in a high risk to individuals, those individuals must also be notified directly without undue delay
The Data Protection Lead is responsible for making these notifications and for keeping a record of all breaches, including those that do not meet the reporting threshold

Particular considerations

Given the nature of Atelier Armonico's community work, any breach involving data relating to people seeking asylum, survivors of domestic abuse, or other participants in vulnerable circumstances will be treated as a matter of the highest priority regardless of its apparent scale. The potential impact on the safety and wellbeing of individuals will be the primary consideration in assessing and responding to any such breach.

18. Responsibilities

The Data Protection Lead (Artistic Director and CEO) is responsible for ensuring that this policy is implemented and followed, for handling data subject requests and breach notifications, for maintaining a record of the organisation's processing activities, and for ensuring that privacy notices, data processing agreements, and DPIAs are in place where required
All trustees, staff, freelancers and contractors are responsible for handling personal data in accordance with this policy and for reporting any concerns or suspected breaches to the Data Protection Lead promptly
The board of trustees is responsible for reviewing and approving this policy and for ensuring that the organisation meets its data protection obligations, including its ICO registration position

19. Contact

For any queries about this policy, or to exercise your rights in relation to personal data held by Atelier Armonico, please contact:

Davide Maria Levi, Artistic Director and CEO

Atelier Armonico

d.levi@atelierarmonico.com

If you are not satisfied with how the organisation has handled your personal data, you have the right to make a complaint to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

20. Policy Review

This policy will be reviewed by the board of trustees at least annually, or sooner in the event of a significant change in the organisation's activities, data processing practices, ICO registration status, or the applicable legal framework. Any amendments must be approved by the board and recorded in the board minutes.