This privacy statement was last updated on 28/10/2022 and applies to citizens and legal permanent residents of the United Kingdom.
Campaign for the Arts (“CFTA”, “us”, “we”, “our”), a charity registered in England and Wales with number 1079313 and a company registered in England and Wales with number 03853716, is committed to safeguarding your privacy.
At all times we aim to respect any personal information you share with us, or that we receive from other organisations, and keep it safe.
This Privacy Policy (“Policy”) explains how we collect and use your personal information. Please read it carefully.
For the purposes of the information you share with us, CFTA is the data controller.
You do not have to provide us with your personal information. However, you will need to provide some personal information if you would like to:
- join the campaign / become a registered supporter of CFTA;
- sign a petition;
- submit a testimonial;
- answer one of our surveys or questionnaires;
- donate money to us;
- make a purchase from us;
- apply for employment or to volunteer with us;
- contact us by phone, email or post.
We will never sell your personal information.
1. How do we collect personal information?
(a) When you give it to us DIRECTLY
For example, you give us your personal information when you:
- join the campaign / become a registered supporter of CFTA;
- sign a petition;
- submit a testimonial;
- answer one of our surveys or questionnaires;
- donate money to us;
- make a purchase from us;
- apply for employment or to volunteer with us;
- contact us by phone, email or post.
(b) When you give it to us INDIRECTLY
Your information may be shared with us when you follow, like or otherwise interact with us on platforms such as Twitter, Facebook, Instagram, TikTok, YouTube and LinkedIn.
Limited information is shared with us via ‘pixel trackers’, including trackers provided by Brevo to provide us with insights about whether and how you interact with our emails. These help us to refine our communications, and to ensure they are not being incorrectly marked as ‘spam’. If you use an email client that allows it, you can ‘block’ pixel trackers by changing your settings to prevent images being loaded by default.
(c) When you give permission to OTHER ORGANISATIONS to share it or it is AVAILABLE PUBLICLY
Your information may be shared with us by others including independent event organisers, other fundraising entities, sponsors and supporters of our organisation and services.
We may combine information that is shared with us and information available from external, publicly-available sources.
(d) When you visit our WEBSITE
We use cookies to make our website function properly, to make it more secure, to analyse usage and performance, and to provide a better user experience. This Privacy Policy is to be read alongside our Cookies Policy, which explains how and why CFTA uses cookies, as well as our website Terms and Conditions.
CFTA uses the reCAPTCHA service provided by Google. This allows us to verify that a user is a person rather than a machine in order to prevent forms on our website (such as the campaign sign-up form) from being (ab)used by spam bots. When you fill in forms on our website, reCAPTCHA will collect information about your use of the website, including clicks, mouse movements and your IP address, so it can determine that you are a person and not a bot. This information is collected by Google who only provide us with confirmation of authenticity (not your identity). For more information about Google’s use of information gathered through reCAPTCHA, please read their privacy notice here.
2. What personal information do we collect?
We may collect, store and use the following kinds of personal information:
(1) your name and contact details, including address and/or postcode, telephone number, e-mail address, and social media identity. However, we may request other information where it is appropriate and relevant, for example
- details of why you have decided to contact us / join us / support a campaign or petition;
- details of your opinion on a particular issue, campaign or petition;
- details of petitions you have supported, details of topics/areas of interest to you, responses to surveys you have completed;
- your age, to ensure we are handling your data appropriately under data protection legislation. Where appropriate, and you are over 18, we may also use this to better understand our supporters (see section 6 below);
(2) information about your computer and about your visits to and use of this website including your IP address, geographical location, browser type, referral source, length of visit and number of page views;
(3) information about the CFTA services you use (e.g. campaigns you support), services and products of interest to you or any marketing and/or communication preferences you give; and/or
(4) any other information shared with us as per section 1 above.
The law recognises certain types of personal information as sensitive and requiring more protection, including health information, ethnicity and political opinions. This is known as ‘special category’ information. In limited cases, we may collect special category information about you because it is relevant to the particular campaign or survey in which you are participating.
With your explicit consent, we may use certain special category information, such as your ethnicity or political opinions, to understand demographic trends in our supporter base and to help us monitor and address inequalities. For example, we may use this information to determine that certain groups are not being reached by our campaigns, or that our content or priorities need adjusting to ensure relevance.
It may also be necessary for us to process special category information for purposes in the substantial public interest like the prevention or detection of a crime or safeguarding children or adults who are at risk.
If you are applying to us for employment we may carry out checks to ensure your suitability to work with us. In the event that this involves processing information relating to criminal investigations or convictions then we will be relying on the substantial public interest condition relating to the safeguarding of children or adults who are at risk.
3. How and why will we use your personal information?
We use your personal information to:
- enable you to use and/or learn about all of the services we offer;
- send you information about our work, campaigns, organisation(s) and any other information, products or services that we provide (this will not be done without your consent);
- send you supporter surveys (see section 8 below) including for the purpose of understanding our supporters (see section 6 below);
- provide you with the services, products or information you have requested;
- improve your browsing experience by personalising your interaction with our website;
- handle the administration of any donation or other payment you make via credit/debit card, cheque, standing order or BACS transfer;
- collect payments from you and send statements and/or receipts to you;
- handle the administration of your employment and/or volunteering application;
- conduct research into the impact of our work;
- deal with enquiries and complaints made by or about you relating to the website or us in general;
- make campaign / petition submissions to third parties, where you have signed the campaign / petition and the third party is a target of the campaign / petition;
- incorporate your personal information into our promotional activities but only with your consent; and/or
- audit and/or administer our accounts.
4. Signing campaigns / petitions
When you sign any campaign / petition on our website, we ask for some personal information. We will take reasonable steps thereafter to ensure that your personal information remains accurate and up to date. You do not need to set up an account with us to sign a campaign / petition.
Campaigns / petitions indicate your public support for an issue or cause.
If you choose to sign a campaign / petition, we may share limited personal information (your name, postcode and/or your comments on the campaign / petition) as part of a submission to a third party, for example a decision-maker who is the target of the campaign / petition.
5. Submitting testimonials
You may choose to record or upload video, audio or text (a “testimonial”) in support of CFTA and/or a particular campaign / petition.
By voluntarily submitting a testimonial, you grant permission and authorise CFTA to publish, distribute, edit and make use of
- any video or audio recording(s) you submit, including your likeness and voice;
- any written or transcribed statements you submit.
By voluntarily submitting a testimonial, you
- acknowledge that you will not be compensated for any use, and waive any rights to royalties;
- waive the right to inspect or approve of the uses of any printed or electronic copy;
- release CFTA from any and all claims that may arise from any uses, including without limitation to claims of defamation or invasion of privacy, infringement of moral rights, rights of publicity or copyright;
- agree that this authorisation and release shall continue in perpetuity unless you otherwise revoke it in writing.
You always have the right to withdraw your consent to our use of your testimonial(s) by contacting us (see section 18 below).
We may use testimonials in composite or modified forms and in any media. We may share testimonials with third parties relevant to the campaign (such as decision-makers) who will separately be controllers. We may also use testimonials for our own marketing purposes – such as to promote a petition or campaign (which may be different to the one you submitted a testimonial to support), or the activities of CFTA in general.
We use VideoAsk to collect testimonials; a tool created by Typeform, S.L. You can read their privacy policy here.
6. Understanding our supporter base
We refer to anyone who has taken an action with CFTA (e.g. signed a petition, taken a survey, donated, etc) as a ‘supporter’.
In order to better understand our supporters and our supporter base, CFTA may construct segments or groupings of supporters using the personal information you have supplied to us, and/or information that is available publicly. This allows us to improve our interactions with you, ensuring they are more targeted and relevant.
We may share anonymised / aggregated (never personally identifiable) information about these groupings with third parties – for example, to tell a decision-maker that there are a large number of CFTA supporters in their local area.
We rely on our legitimate interests to undertake data processing for these purposes (see section 14 below). If we use your sensitive personal information (see section 2 above) for these purposes, it will only be with your explicit consent.
We may use third parties, such as data analysts, to help us understand our supporters. In this event, we will have contracts which require them to keep any personal information secure.
7. Targeted advertising
We may use some of your personal information to show you targeted advertising, on social media platforms such as Facebook and Instagram or via other third-party advertising that may appear on websites you use.
You can opt-out of targeted advertising by emailing us at hello@campaignforthearts.org. Please note that you may still see advertisements about CFTA since not all of our marketing will be targeted.
You can control what ads you see on Facebook and Instagram via your ad settings on those platforms. Please also see Meta’s data policy.
8. Supporter surveys
From time to time (and in accordance with section 9 below) we may contact you if you are a supporter to invite you to complete surveys.
Your participation in surveys is entirely voluntary and you do not need to provide us with any personal information you do not want to.
We may use personal information provided to us from surveys for the purposes set out in this Policy, including to better understand our supporter base (see section 6 above).
9. Communications, fundraising and marketing
CFTA may contact you about a petition / campaign you have supported, and about other campaigns, petitions and/or activities undertaken by CFTA. We may ask for donations or other support, or invite you to participate in supporter surveys (see section 8 above).
Where you have provided appropriate consent, CFTA may contact you by e-mail or telephone. Email communications from CFTA are facilitated by Brevo and their privacy policy is here.
Where you have provided us with your physical address, CFTA may contact you by post. If you’d like to opt out of ever hearing from us by post, please email hello@campaignforthearts.org.
We may in the future communicate with you via focus groups, which may include online communications with you, and we may use other online messaging platforms such as WhatsApp.
You can choose to stop receiving communications from us at any time by clicking the “unsubscribe” link at the bottom of our emails, or by contacting us using the details in section 18 below.
10. Donations and other payments
Financial transactions carried out on our website are handled through either:
- Stripe, Inc. (“Stripe”) for most one-off donations and card payments. We recommend that you read Stripe’s privacy policy before making any payments to us.
- PayPal if you choose to donate via PayPal. Please see their privacy statement for more information.
- GoCardless if you set up a direct debit. Please see their privacy centre for more information.
We will provide your personal information to payment processors only to the extent necessary to process payments. CFTA does not store your financial details.
11. Children’s data
We do not knowingly process data of any person under the age of 16. If we come to discover, or have reason to believe, that you are 15 and under and we are holding your personal information, we will delete that information within a reasonable period and withhold our services accordingly.
12. Security of and access to your personal information
We aim to ensure that there are appropriate and proportionate technical and organisational measures to protect your personal information from loss, destruction, misuse, alteration, or unauthorised disclosure / access.
Your information is only accessible in CFTA by appropriately trained staff, volunteers and contractors.
We may also use agencies and/or suppliers to process data on our behalf. We may also merge or partner with other organisations and in so doing transfer your personal information to a successor organisation. In both cases, we will take reasonable steps to ensure appropriate measures have been implemented to protect your personal information.
In addition to the disclosures reasonably necessary for the purposes identified elsewhere in this policy, we may disclose your information to regulatory and/or government bodies and/or law enforcement agencies, but only if we need to do so to satisfy a legal obligation.
13. Your rights
If we rely on your consent to use your personal information for a specific purpose, you can withdraw that consent at any time. This includes the right to ask us to stop using your personal information for direct marketing purposes or to be unsubscribed from our email list at any time. You also have the following rights:
- To access your personal information – you can write to us to ask for confirmation of what information we hold on you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we will usually have one month to comply.
- Erasure of your personal information – you can ask us for your personal information to be deleted from our records. In many cases we would propose to suppress further communications with you, rather than delete it.
- To correct your personal information – if you believe our records of your personal information are inaccurate, you have the right to ask for those records to be updated.
- To ask us to restrict our use of your personal information – you have the right to ask for processing of your personal information to be restricted if there is disagreement about its accuracy or legitimate usage.
- To have your data ‘ported’ – to the extent required by applicable laws, where we are processing your personal information (i) under your consent, (ii) to perform a contract with you and (iii) by automated means, you may ask us to provide it to you – or another service provider – in a machine-readable format.
To exercise these rights, please send a description of the personal information in question using the contact details in section 18 below.
We might need to ask for (i) personal identification and/or (ii) further information before we can respond to your request. Please note that some of these rights only apply in limited circumstances.
If you wish to make a complaint about us or the way we have processed your personal information, the contact details of the Information Commissioner’s Office can be found here.
14. Our lawful basis
We are required to have one or more lawful grounds to process your personal information. The following four are most relevant to us:
(1) Consent
We will ask for your consent to use your information to send you electronic communications such as newsletters and marketing and fundraising emails, for targeted advertising and supporter research.
(2) Contractual relationships
Most of our interactions with subscribers and website users are voluntary and not contractual. However, sometimes it will be necessary to use personal information so that we can enter into contractual relationships with people. For example, if you apply for employment or to volunteer with us, or if you purchase something via our online shop.
(3) Legal obligations
Sometimes we will be obliged to process your personal information due to legal obligations which are binding on us. We will only ever do so when necessary.
(4) Legitimate interests
The law allows organisations to use personal information if it is reasonably necessary for legitimate activities, and as long as its use is fair, balanced and does not unduly impact individuals’ rights.
We will rely on this ground to process your personal data when it is not practical or appropriate to ask for consent. Our legitimate interests are as follows:
(A) Achieving our purposes
These include (but are not limited to) promoting any philanthropic or benevolent purpose including without limitation to ensure the advancement of the arts
(B) Governance
- Internal and external audit for financial or regulatory compliance purposes
- Statutory reporting
(C) Publicity and income generation
- Conventional direct marketing and other forms of marketing, publicity or advertising
- Unsolicited commercial or non-commercial messages not sent electronically, including campaigns, newsletters, income generation or charitable fundraising
- Analysis, targeting and segmentation to develop and promote or strategy and improve communication efficiency
- Personalisation used to tailor and enhance your experience of our communications
(D) Operational Management
- Recording and monitoring of applicants for employed and volunteer positions for recruitment purposes
- Physical security, IT and network security
- Processing for historical, scientific or statistical purpose
(E) Purely administrative purposes
- Responding to enquiries
- Delivery of requested products or information
- Communications designed to administer existing services including administration of campaigns and financial transactions
- Thank you communications and receipts
- Maintaining a supporter database and opt-out lists
(F) Financial Management and control
- Processing financial transactions and maintaining financial controls
- Prevention of fraud, misuse of services, or money laundering
- Enforcement of legal claims
- Reporting criminal acts and compliance with law enforcement agencies
When we use your personal information, we will consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair in other ways.
Special category data
In addition to having to have a lawful basis, where we are processing special category data we are also required to meet one of the special conditions as follows:
(1) Legitimate activities
We may process special category data which you provide to us in order to achieve our purposes, where this is allowed under data privacy law.
(2) Explicit Consent
Where we have obtained your consent in order to use your special category data for specified purposes, for example where you provide this type of information when completing a survey.
15. How long we keep your personal information
In general, unless still required in connection with the purpose(s) for which it was collected and/or is processed, we remove your personal information from our records six years after the date it was collected. However, if before that date (i) your personal information is no longer required in connection with such purpose(s), (ii) we are no longer lawfully entitled to process it or (iii) you validly exercise your right of erasure, we will remove it from our records at the relevant time.
If you ask us to stop sending you direct marketing/fundraising/other electronic communications, we will keep your name on our internal suppression list to ensure that you are not contacted again.
Additionally, if you donate by direct debit, your personal information may be retained by the provider we use, GoCarldess, for as long as GoCardless is liable under any compensation award scheme e.g. the Direct Debit Guarantee.
16. Third-party service providers
We use third-party service providers to assist us in delivering our services. Only where necessary, we may share your personal information with those service providers based on our legitimate interests in delivering our services to supporters. This will always be governed by a contract with the relevant service provider which prevents them from using your information in any way which goes beyond our purposes, as stated in this Privacy Policy.
International transfers
We may transfer your personal information to third-party service providers based outside the UK, but only to territories where the level of protection has been deemed to be adequate by way of an ‘Adequacy Decision’ or other international accord, or where we have executed the EU or UK Standard Contractual Clauses with the service provider receiving the information. These Standard Contractual Clauses ensure that the personal information we transfer has an equivalent level of protection to that which is available in the UK.
17. Changes to this policy
We keep this Policy under regular review and will sometimes update it by posting an updated version on our website, to reflect changes in the law or in our practices. We recommend that you check this Policy occasionally to ensure you remain happy with it. Where reasonably possible, we will notify you of significant changes to our privacy policy by email.
18. How to contact us
Please let us know if you have any queries or concerns whatsoever about the way in which your data is being processed.
You can email hello@campaignforthearts.org, or write to us at the following address:
Data Protection
Campaign for the Arts
8 Lee Street
London E8 4DY