Data Protection Policy

Vital Xposure holds discreet information on all of its employees, volunteers and contributors. This may include information that allow to identify the individual, which is defined as ‘personal data’ under the law.

The Policy sets out our procedures for collection, storage and use of personal data

Personal data is defined by the Information Commissioners Office (“the ICO”) as data that relates to a living individual who can be identified

• from that data, or
• from that data and other information in the possession of (or likely to come into the possession of) the data controller e.g: expressions of opinion about an individual.
• from codified records that do not identify individuals by name but, for example, bear unique reference numbers that can be used to identify the individuals concerned.

Special categories of personal data means information that could be used in a discriminatory way, so needs to be treated with greater care than other personal data, i.e: information about:

• race or ethnic origin
• political opinions,
• religious beliefs or other beliefs of a similar nature,
• trade union membership
• physical or mental health or condition,
• sexual life,
• commission or alleged commission by the data subject of any offence, or
• any proceedings for any offence committed or alleged to have been committed by the data subject, the disposal of such proceedings or the sentence of any court in such proceedings.

When we collect and process personal data we will ensure the individual (‘data subject’ under the law) has given us their consent beforehand and that they are aware of their right to withdraw their consent. The law defines consent as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’

We will seek consent in one of the following ways:

• in writing
• by asking individuals to tick a box
• verbally, followed by a written record and affirmation of the consent by the individual (‘data subject’)
• through acceptance of the proposed processing of personal data, such as accepting cookies when visiting our website

In processing personal data we will:

• not contact individuals for direct marketing purposes by email, the internet, phone, fax or any new electronic systems that may be introduced without prior consent. Business to business communications to generic addresses such as “admin@” “info@” do not require consent.
• provide opt-out opportunities in every e-newsletter mailing to ensure compliance and accuracy of the data we hold
• make it clear that we use cookies on our website to collect details of visitors to our website and gives them an opportunity to refuse their operation.

When do we collect data?

1. Recruitment

Vital Xposure advertises paid and voluntary roles and places to participation programmes via online channels and a detailed information pack for each role and place is hosted on our website.

We ask potential applicants to submit specific information, such as a CV and a cover letter, or fill out an application form which is available in both online and word formats. In the application form we ask for contact details to allow us to get in touch with the applicant and notify them of the outcome of their application.

We ask potential applicants to complete and submit a separate Equality and Diversity Monitoring form. This is made available to download as a document from our website, so that it can  be filled out and submitted along with other application documents, or included as a distinct section at the end of an online application form. In either formats of the form, there is clear information notifying the applicant that the Equality and Diversity Monitoring form:

• is used for statistics and diversity data monitoring
• is voluntary to complete
• will be kept separate to the recruitment process (shortlisting, interviewing and job or role offer).

After the shortlisting process, unsuccessful candidates will receive a letter to inform them about the outcome of the application. This letter is usually sent to the email address they have provided us with. In the letter we will offer the applicant the options to:

• have their personal data stored on our system for more than 12 months, should they wish to be considered for another role. If they give us their consent in writing, we will confirm receipt and record the date and method consent is given.
• continue to receive communications from Vital Xposure by registering to our e-newsletter mailing list; a link to sign up to our mailing list is also provided and, once clicked, it clearly shows that we use Mailchimp for our e-newsletter list (link and icon), which is a GDPR compliant online marketing tool.

We will also notify them that:

• Vital Xposure will never sell, trade or rent personal data to third parties
• their application documents will be destroyed after 12 months if unsuccessful
• they have the right to ask us further information on the data we hold for them (the process is defined by law as ‘data subject request’)

2. Employee records:

The employee contract will reflect the fact that it is necessary for Vital Xposure to hold and sometimes disclose certain personal data about employees,  such as payroll and pension auto-enrolment.

• Any data the company holds about the employees will only be held for so long as the Employee works for Vital Xposure. Following termination of employment Vital Xposure will only keep records as deemed necessary to comply with its legal obligations and in line with minimum statutory retention periods (See the Company’s Data Retention Schedule).
• The Employee has the right to inspect data that we hold about them and, if necessary, update that data. Normally inspection of files can be within 10 working days of a request.
• If the Employee’s personal information changes at any time, they should inform the Executive Director or the General Manager as soon as possible to ensure that the information remains accurate.

3. Volunteers records:

The law does not provide clear guidelines for the retention of volunteer records. Vital Xposure will adhere to the following principles when collecting and processing volunteer data:

• we will only collect data that is relevant to the volunteer role
• we will process all volunteer data fairly and lawfully
• we will not keep any data for longer than required
• we will not sell, trade or rent their personal data to third parties
• we will ensure volunteers are aware of their rights to access the data we hold for them
• we will only collect and process volunteer personal data if we have their explicit consent

The volunteer data that we may need to collect will be based on the ‘need to know’ basis:

• Contact details, as provided by the individual
• Details of experience, skills and preferences used to assess suitability for a role (recorded on application form or gained through interview)
• Equality and Diversity Monitoring data, for statistics and diversity monitoring purposes
• Information relating to DBS checks
• References
• Supervision notes

Some of this information is regarded as “sensitive data” under the law and will be processed accordingly.

4. Audiences records:

We ask audiences to provide feedback on a Vital Xposure production or show they are attending. The feedback is collected for:

• artistic purposes: to evaluate our learning about the audience experience and measure the impact of our work. and
• statistical purposes: to evaluate the reach of our work and understand the profile of our audiences.

If audiences book their ticket or confirm attendance via Vital Xposure, we ask for their feedback via a paper form or an online survey. We ensure that;

• we only ask questions relevant to the purpose (see above)
• we include our contact details on the form
• we tell audiences completion of the form is voluntary and anonymous

As a touring company, we normally rely on each venue’s booking system and do not have direct access to audiences. We endeavour to enter into data-sharing agreements with partnering venues to collect data and information on:

• total ticket sales and attendance, including breakdown of tickets sold and concessions / comps offered
• audiences profile and postcode breakdown
• comments and qualitative feedback

The agreements also allow the partnering venue to include an option to direct their customers to a marketing link  where individuals can choose to register to our mailing list.

Data Retention Schedule

The Data Protection Act 2018 does not dictate how long an organisation should keep personal data for, however the guiding principle is that ‘personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes’.

Vital Xposure maintains a schedule to indicate the kind of personal data retained and the maximum period it will be retained for. If there is no need to keep personal data that long, then it will be disposed of securely. There are certain categories of data which may be anonymised after the retention timescale and still processed; these categories are clearly defined in the schedule.

The Data Retention Schedule can be provided upon request.

Data protection officer

Vital Xposure is not required to have a designated Data Protection Officer under the GDPR, however, the General Manager is responsible for ensuring Data Protection Compliance, in collaboration with the Executive Director.