Writing East Midlands – Data Protection Policy (UK GDPR Compliant)

1. Introduction

Writing East Midlands is committed to protecting your personal data.

This policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We act as a Data Controller for the personal data we process.

If you have any questions, please contact us at:
Email: info@writingeastmidlands.co.uk
Address: Writing East Midlands CIC, Office 4, The Garage Studios, 41–43 St Mary’s Gate, Nottingham, NG1 1PU.

2. What Personal Data We Collect

We collect and process personal data when you interact with us. This may include:

2.1 Information you provide directly

• Name, address, email, phone number
• Application or submission details
• Workshop/course/event bookings
• Mailing list registration
• Job or freelance applications
• Information relating to the purchase or sale of goods or services
• Demographic information (anonymous)

2.2 Information collected automatically

• Website usage data (via analytics cookies, with consent)
• Survey responses and feedback (anonymous unless stated otherwise)

2.3 Special category data (rare)

Where necessary (e.g., equal opportunities monitoring), we may collect sensitive data.
Providing this is always optional and anonymised wherever possible.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

• Managing bookings for courses, workshops, and events
• Processing submissions and applications
• Managing mailing lists and sending newsletters
• Delivering our programmes, services, and projects
• Processing payments
• Evaluating our impact with a view to improving performance
• Reporting anonymised data to funders
• Recruitment and HR administration
• Ensuring website security and performance

4. Our Legal Bases for Processing

We process personal data using one or more of the following lawful bases:

• Contract – to provide services you have booked or applied for
• Consent – for sending email newsletters and non-essential cookies
• Legal obligation – e.g., financial and HR record-keeping
• Legitimate interests – to manage programmes, evaluate participation, improve services, and ensure organisational functioning
• Public task – where required by Arts Council England reporting conditions (anonymised)

Where we rely on consent, you may withdraw it at any time.

5. How We Store and Protect Your Data

Your information is stored securely using encrypted systems and accessible only to authorised staff.

We use the following secure third-party data processors:

• Good CRM – customer and audience management
• Wufoo and Submittable – application and submission forms
• Mailchimp – mailing list communications
• Google Analytics – website analytics (with cookie consent)

All processors act under written contracts that comply with UK GDPR.

6. International Data Transfers

Some of our service providers (e.g., Mailchimp) store data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK Addendum to the EU Standard Contractual Clauses
• Adequacy regulations
• Other approved UK transfer mechanisms

7. Who We Share Information With

We only share personal data when necessary and never sell your information.

We may share:

• Anonymised demographic data with Arts Council England and other funding bodies as required
• Payment data with secure payment processors
• Data with service providers acting as Data Processors as listed above
• Information where required by law (e.g., HMRC)

We do not share identifiable personal data with third parties for marketing.

8. Cookies and Analytics

We use cookies to operate our website.

Analytics cookies (including Google Analytics) are only activated with your consent.

You may change your cookie preferences at any time through your browser settings.

9. Children’s Data

If you are under 13, please ask a parent or guardian before providing personal information.

We do not knowingly collect personal data from children without appropriate consent.

10. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including:

• Bookings, submissions & applications: up to 3 years
• HR, payroll & financial records: up to 6 years (legal requirement)
• Mailing lists: until you unsubscribe
• Contractual records: for the duration of the contract plus 6 years

When data is no longer required, it is securely deleted or anonymised.

11. Your Data Rights

You have the following rights under UK GDPR:

• Right to access – request a copy of your personal data
• Right to rectification – correct inaccurate or incomplete data
• Right to erasure – request deletion of your data
• Right to restrict processing
• Right to data portability
• Right to object – including to marketing
• Rights related to automated decision-making
• Right to withdraw consent at any time

To exercise your rights, email: info@writingeastmidlands.co.uk

We aim to respond within 3 working days, and always within one month as required by law.

12. Complaints

If you have concerns about how we handle your data, please contact us first.

You also have the right to complain to the Information Commissioner’s Office (ICO):

www.ico.org.uk

13. Updates to This Policy

We may update this policy periodically to reflect operational or legal changes.
The latest version will always be available on our website.