Privacy Policy
Zest Theatre is a registered charity creating theatre and cultural experiences that amplify young people’s voices. Our work places young people at the heart of bold, joyful experiences in public spaces across the country.
This policy explains how we collect, use, store and protect personal information across our work, including participation, performances, bookings, fundraising, communications, recruitment and the management of our organisation.
We handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended.
1. Who we are and how to contact us
Zest Theatre is a company limited by guarantee registered in England and Wales, company number 07747048, and registered charity number 1144299.
Zest Theatre is the data controller for the personal information covered by this policy. This means we decide why and how that information is used.
If you have questions about your information, want to exercise your data protection rights or wish to make a complaint, contact us:
Email: hello@zesttheatre.com
Telephone: 01522 569590
Post: Zest Theatre, Barbican Creative Hub, 11 St Mary’s Street, Lincoln, LN5 7EQ
2. What information we collect and where it comes from
The information we collect depends on how you engage with Zest. It may include:
Your name, contact details, age or age range, and organisation or professional role.
Enquiries, correspondence, bookings and agreements.
Information needed to administer payments, donations and fundraising.
Participation details, emergency contacts, access requirements and relevant health information.
Applications, employment history, qualifications, references and other recruitment or appointment information.
Equality monitoring information, feedback and evaluation responses.
Photographs, film, audio recordings and creative contributions that identify you.
Information about your use of our website and engagement with our communications.
We collect information through conversations, correspondence, paper forms and online forms. Information may be exported to our organisational files and stored using services such as Dropbox and GDrive.
We usually receive information directly from you. We may also receive it from parents or carers, schools, project partners, referees and other people involved in delivering our work or managing recruitment.
Where relevant, we may obtain information from public professional sources or official registers, such as an organisation’s website, Companies House or registers used to check trustee eligibility. We use publicly available information only where we have a lawful and relevant reason to do so.
We collect only information needed for the stated purpose. Where appropriate, we explain which information is required, which is optional and what happens if required information is not provided.
If we receive your information from another source, we provide the required privacy information within the applicable legal timeframe, unless an exemption applies.
3. Why we use information and our lawful bases
We use personal information to:
Organise and deliver performances, projects and participation opportunities.
Manage bookings and relationships with schools, venues, festivals, commissioners and partners.
Make our activities accessible and respond to access requirements.
Support safeguarding and the safety of people involved in our work.
Recruit, appoint and manage staff, freelancers, volunteers, trustees and other contributors.
Administer donations, payments, accounts and fundraising.
Understand who our work reaches, evaluate its quality and report to funders.
Communicate news, opportunities and fundraising information.
Document and publicise our work.
Respond to enquiries, complaints and legal matters.
Meet our responsibilities as an employer, a company, and a charity.
We identify a lawful basis for each use of personal information. Depending on the circumstances, this may be:
Contract
Where using information is necessary to fulfil a contract with you, or to take steps you request before entering into one. This may apply to bookings, employment or freelance engagements. Where you act on behalf of another organisation, we will normally rely on legitimate interests to manage your contact details.
Legitimate interests
Where using information is necessary for a legitimate purpose, such as organising our activities, managing professional relationships, conducting recruitment, evaluating our work or administering the charity. We consider whether that use is necessary and whether your rights and interests override it.
Legal obligation
Where we need to use information to meet a legal requirement, such as applicable employment, tax, accounting or charity reporting duties.
Consent
Where we ask you to agree to a particular use, such as subscribing to optional communications or certain uses of photographs and recordings. You can withdraw consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Vital interests
In exceptional circumstances, where information is needed to protect someone’s life and the relevant legal conditions are met.
Where a form, project or activity involves a particular use of information, we may provide a shorter, specific privacy explanation alongside this policy.
4. Sensitive information and information about young people
Some information receives additional protection under data protection law. This includes information about health, disability, racial or ethnic origin, religious beliefs and sexual orientation.
We may need this information to arrange access support, enable safe participation, monitor equality, carry out relevant recruitment activities or meet safeguarding responsibilities.
Before using it, we identify both an ordinary lawful basis and an additional condition permitting the use of special category information. Depending on the purpose and circumstances, that additional condition may relate to explicit consent, employment obligations, substantial public interest, legal claims or another applicable legal condition.
We explain why sensitive information is requested and limit access to people who need it for that purpose. Information about criminal convictions or offences is subject to separate legal requirements and is collected and used only where lawfully justified.
We take particular care with children’s and young people’s information. We aim to explain its use in language they can understand and collect only what is appropriate for the activity.
Information may be provided by a young person themselves or by a parent, carer, school or partner. Where we rely on consent, we consider the young person’s ability to understand the decision and obtain consent from someone with parental responsibility where required.
Permission to take part in an activity is separate from the lawful basis for using personal information.
5. Recruitment
We collect and use information when recruiting employees, freelancers, volunteers, trustees, trainees, placement students and other contributors.
Depending on the opportunity, this may include:
Contact details, applications, CVs and supporting statements.
Relevant skills, qualifications, experience and interests.
Interview, audition or assessment responses, notes and scores.
References and correspondence.
Access requirements and equality information.
Information needed for relevant identity, eligibility, trustee disqualification or safeguarding checks.
We use this information to administer the process, assess suitability, communicate with applicants, arrange access support, conduct appropriate checks and make appointment decisions.
Our lawful bases may include legitimate interests in conducting fair and effective recruitment, steps requested before entering into a contract where applicable, and relevant legal obligations. Sensitive information requires an additional legal condition, as explained in section 4.
Applications may be reviewed by authorised trustees, staff, selected young people and external interview or assessment panel members. We limit the information each person can access to what they need for their role and require it to be handled confidentially.
Where we collect equality monitoring information, we explain its purpose and whether it is separate from selection. If information about background or lived experience is requested to inform assessment for a particular role, we explain that purpose rather than describing it solely as monitoring.
Unsuccessful applications and associated assessment records are normally kept for six months after applicants are notified of the final outcome. We then securely delete or anonymise them. Relevant records may be retained longer where necessary to deal with a complaint, dispute, legal claim or legal obligation. Detailed vetting information may be deleted sooner when it is no longer needed.
For successful applicants, necessary information becomes part of the relevant employment, engagement, volunteer or trustee records. Further privacy and retention information is provided during appointment or onboarding.
If we would like to retain an application for future opportunities, we seek a separate, optional agreement and specify the retention period. Applying does not subscribe you to marketing communications.
6. Who can access information and who we share it with
We do not sell personal information.
Access is restricted to people who need information to carry out their responsibilities. These may include authorised staff, trustees, freelancers and other contributors, including the recruitment participants described above.
Where necessary and lawful, we may share relevant information with:
Providers of forms, file storage, email, IT, payment and other organisational services.
Schools, venues, festivals and project partners involved in delivering agreed activities.
Professional advisers, accountants, auditors and insurers.
Funders and regulators where appropriate.
Safeguarding agencies, emergency services, police or other authorities.
We use anonymous or aggregated information for evaluation and reporting wherever possible. If identifiable information needs to be shared, we establish a lawful basis and provide appropriate privacy information unless a legal exemption applies.
Where a supplier processes information on our behalf, we put appropriate contractual arrangements in place. Some organisations receiving information act as independent controllers and have their own privacy notices.
7. How we store and protect information
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.
These include controlling access, maintaining confidentiality and securely disposing of information when it is no longer needed.
Our service providers may store information, or allow access to it, outside the UK. Where this constitutes a restricted international transfer, we ensure an appropriate legal transfer mechanism and any required safeguards are in place.
You can contact us for details of the transfer arrangements relevant to your information and how to obtain information about the safeguards used.
8. How long we keep information
We keep personal information only for as long as needed for its purpose, taking account of legal obligations, safeguarding responsibilities and the handling of complaints or claims.
Different records about the same person may have different retention periods.
Schools
Routine school contact records are kept for a maximum of three years. We check and update contact information as appropriate.
Theatres, venues and festivals
Routine professional contact records are kept for a maximum of five years. We check and update contact information as appropriate.
Participants and audiences
Routine project participation records are kept for a maximum of three years after the relevant activity ends. Health and access information is reviewed and removed sooner where it is no longer needed.
Recruitment
Unsuccessful applications and associated assessment records are normally kept for six months, as explained in section 5.
Marketing
We retain subscription information while there is a valid basis for sending communications and review it periodically. If you unsubscribe, we may retain a minimal record of your preference to prevent further unwanted marketing.
Other organisational records
Financial, contractual, employment, trustee, safeguarding, incident, complaints and legal records follow retention arrangements appropriate to their purpose and any applicable legal requirements. We provide more specific information where relevant.
Photographs and recordings may have different retention periods depending on their agreed use. We explain these arrangements when collecting or arranging the material.
We securely delete or anonymise information when it is no longer required.
9. Marketing, cookies and online activity
We use email and other communications to share news, events, opportunities and fundraising information where permitted by data protection and electronic communications law.
You can stop marketing communications at any time by using an unsubscribe link or emailing hello@zesttheatre.com.
We may still send necessary messages about an application, booking, agreement or activity you are involved in.
We may keep records of communications sent and use technologies that indicate delivery, opening or engagement. Where consent is legally required for tracking, we obtain it.
Our website may use cookies and similar technologies to support its operation, understand its use and support relevant advertising. We obtain consent where required and provide information about available choices.
We use social media to share our work and respond to messages or comments. Social media platforms also process information under their own privacy policies.
Further information about website cookies and advertising pixels is available in our Cookie Policy.
10. Your rights and how to complain
Depending on the circumstances, you may have the right to:
Be informed about how we use your personal information.
Access your personal information.
Have inaccurate information corrected.
Request deletion of information.
Request restrictions on its use.
Receive certain information in a portable format.
Object to particular uses.
Withdraw consent where we rely on it.
Receive applicable safeguards relating to significant decisions based solely on automated processing.
These rights are subject to legal conditions and exemptions. You have an absolute right to object to the use of your information for direct marketing, including associated profiling.
Contact hello@zesttheatre.com to exercise your rights. You do not need to use a particular form or legal terminology. We may need proportionate information to confirm your identity.
We normally respond without undue delay and within one month, subject to any lawful extension or adjustment. Requests are normally free of charge.
Complaints
Anyone can complain about our handling of their personal information, including applicants, employees, freelancers, volunteers, trustees, audiences, participants and young people.
You can complain verbally or in writing using the contact details in section 1. You do not have to put a data protection complaint in writing or attempt informal resolution first. Your right to complain applies alongside any grievance procedure.
We acknowledge data protection complaints within five days and, in all cases, within the legal maximum of 30 days. We investigate without undue delay, keep you informed and explain the outcome.
We aim to provide a substantive response within 28 working days. If more time is needed, we explain why and keep you updated. Separate legal deadlines apply to requests to exercise your data protection rights.
Our wider Complaints Policy explains our approach to handling concerns. Its provisions do not restrict the data protection rights explained here.
You can also complain to the Information Commissioner’s Office. You do not have to complete our complaints procedure before contacting the ICO.
We review this policy when our activities or legal requirements change.
