Data Protection Policy

Data Protection is an issue Bath Academy of Musical Theatre (BAMT) takes very seriously. Beyond compliance, we aim to observe best practice to protect and reassure our various contacts and students. In short, we commit to procedures that protect sensitive data at all times with secure cloud-based record-keeping, and files that are regularly reviewed, updated and, if necessary, deleted. Our Data Protection Policy refers to our commitment to treat information about students, stakeholders and other interested parties with the utmost care and confidentiality. Through this policy, we will ensure that we gather, store and handle data fairly, transparently and with respect towards individual rights. It is presented to all staff and is available to students and stakeholders upon request.

SCOPE

This policy refers to all parties (employees, job candidates, students, stakeholders etc.) who provide any amount of information to us. Employees of our company must follow this policy. Contractors, consultants, partners and any other external entity are also covered. Generally, our policy refers to anyone we collaborate with or who acts on our behalf and may need occasional access to data.

GENERAL

As part of our operations, we need to obtain and process information. This information includes any offline or online data that makes a person identifiable such as names, addresses, digital footprints, photographs etc. Our company collects this information in a transparent way and only with the full cooperation and knowledge of interested parties. Once this information is available to us, the rules below apply. Our data will be:

  • Accurate and kept up-to-date

  • Collected fairly and for lawful purposes only

  • Processed by the company within its legal and moral boundaries

  • Protected against any unauthorized or illegal access by internal or external parties

  • Made available only to individuals with a legitimate reason to see and use it

  • Within a reasonable timescale, accessible to individuals to whom the data relates

  • Largely kept electronically and paper files will be held securely

Our data will not be:

  • Communicated informally

  • Stored for more than a specified amount of time or longer than it is needed

  • Transferred to organisations, states or countries that do not have adequate data protection policies

  • Distributed to any party other than the ones agreed upon by the data’s owner (exempting legitimate requests from law enforcement authorities)

In addition to ways of handling the data the company has direct obligations towards people to whom the Data belongs. We will:

  • Be transparent so people know which of their data is collected

  • Provide information to people about how we’ll process their data

  • Be clear about who has access to their information

  • Have provisions in cases of lost, corrupted or compromised data

  • Allow people to request that we modify, erase, reduce or correct data contained in our databases

DATA WE KEEP

BAMT currently keeps data for the following purposes:

  • Communications with all stakeholders including students and consultants

  • Marketing and general trading purposes

  • To ensure good governance of the business and to comply with legal requirements

  • Personnel, checking references and monitoring equal opportunities, and emergency contact details

Data subjects include:

  • Staff members

  • Students who have trained and studied with BAMT

  • Contacts from the local area who work with young people with an interest in performing arts

The kinds of details we keep are:

  • Contact and other personal details

  • Personnel information such as application details, training and personal development information

Some information is made available to the following bodies:

  • People whose data the company holds

  • HMRC, Companies House and other government and legal authorities

  • Staff and managers who need to see information to undertake their duties for BAMT

  • The company’s accountant and, when appropriate, legal advisors

ACTIONS

To exercise Data Protection we will:

  • Restrict and monitor access to sensitive data

  • Develop transparent data collection procedures

  • Build secure networks to protect online data from cyberattacks

  • Establish clear procedures for reporting privacy breaches or data misuse

  • Include contract clauses or communicate statements on how we handle data

  • Establish data protection practices (document shredding, secure locks, data encryption, frequent backups, access authorization etc.)

  • Publicise our data protection provisions our website

Disciplinary Consequences

All principles described in this policy must be strictly followed. A breach of data protection guidelines will invoke disciplinary and possibly legal action.

GDPR

BAMT has taken steps to become compliant with the new General Data Protection Regulations enforced in May 2018. Our data processing is compliant with the lawful basis of ‘Consent’. As the law specifies, we “can show that an individual has performed a clear affirmative action to allow [us][ to process their personal data for a specific purpose”. As of May 2018 all of our electronic communications request affirmative action in order to continue receiving contact from BAMT. Following the implementation date of GDPR of 25th May 2018, we have removed personal contact details for people who have not provided consent from our databases.

Where we have identified a contact who’s work supports our own, we may contact the individual at their business address in line with legitimate business interest directive as outlined by the ICO. Via our digital marketing platform (Mailchimp) all of our contacts have the right to access, rectify, restrict and erase their data. Contacts also have the right to object to any communication via clearly indicated contact methods with BAMT's staff. BAMT ensures that contacts can exercise the right to be in informed about the use of their data via clearly labelled disclaimers at the point providing personal data. Any individual whose data we hold but whose data is not held in a mailing list, may exercise any of their rights above, by contacting BAMT directly through clearly signposted methods on www.ba-mt.co.uk, on our literature and on social media channels.