Edinburgh Art Festival takes the privacy of all its visitors and users very seriously. We are committed to protecting your personal information and being transparent about what information we hold about you.
Edinburgh Art Festival is a charity funded by Creative Scotland and the City of Edinburgh Council as well as a range of other statutory bodies, trusts & foundations and corporate sponsors. We are a registered charity (SC038360) as well as a company limited by guarantee (SC314596)
We operate and are registered as Edinburgh Art Festival in accordance with current data protection legislation.
The information we collect
Information you give us
When you sign up to our online mailing list, we store personal information such as your full name and email address.
When you make a purchase on our website, make a donation via JustGiving or buy tickets for an event, we store information such as your name, email address, postal address, telephone number and card details. We also keep a record of your purchases or donations.
Information about your interactions with us
When we send you an e-newsletter we store a record of this, and keep a note of which ones you have opened as well as which links you have clicked on.
Information from third parties
We occasionally receive information about you from third parties. For example, the Festival may commission audience research by external audience research agencies. Any data collected via our audience research agency is done so with your explicit consent, and held confidentially by Edinburgh Art Festival and the agency in question. Your data will never be shared individually, but may form part of an aggregate report e.g. the percentage of audiences visiting from a postcode.
Sensitive personal data
Data protection law recognises that certain categories of personal information are more sensitive, such as information about health, race, religion and political opinions. We do not collect this information about our audiences unless there is a clear reason for doing so, for instance, we may store necessary health information provided by participants in our learning and engagement programme for health and safety reasons.
If you have any questions or concerns about the information we hold about you, you can also email us at email@example.com.
There are two bases under which we may process your data:
When you make a purchase from us or make a donation to us, you are entering into a contract with us. In order to perform this contract, we need to process and store your data. For example, we may need to contact you by email or telephone in the case of cancellation event, delays with a product order or in the case of problems with your payment.
Legitimate business interests
In certain situations, we collect and process your personal information for purposes that are in our legitimate organisational interests. However, we only do this if there is no overriding prejudice to you by using your information in this way. We describe below all situations where we may use this basis for processing.
When requested (e.g. when you sign up to our mailing list), we will use your personal information to inform you about forthcoming Festival events, news and offers which may be of interest to you. To do this we may use data that we have stored about you relating to events you have booked for in the past, or any preferences you may have directly told us about.
We will only contact you via email if you have subscribed to our mailing list, either via the sign-up form on our website or by opting in when making a purchase. You can unsubscribe at any time by using the ‘unsubscribe’ link in our e-newsletters, or by contacting us directly on firstname.lastname@example.org. In general, we do not send information by post, and will only do so if you have explicitly asked to be contacted in this way, for instance, you may contact us and request a hard copy of the Festival guide to be posted out to you.
We will not contact you via telephone for marketing purposes, but may have to contact you via telephone if we need to speak to you regarding problems with a purchase you have made or changes to an event you are attending.
Other processing activities
In addition to marketing communications, we may also process personal information in the following ways, all of which are within our legitimate organisational interests:
We may analyse data we hold about you to ensure that the content and timing of our communications that we send you are as relevant and appropriate to you as possible.
In order to improve our website, we may analyse information about how you use it and the content you interact with.
We might use profiling techniques to provide us with information about you that will help us to communicate in a relevant way with you, in particular when we are approaching you about potential philanthropic support. Such information is only compiled using information about you that is already in the public domain.
In all of the above cases, we keep your rights and interests at the forefront. You have the right to object to any of this processing at any time. If you wish to do this, please contact us via email@example.com.
There are occasional circumstances under which we may disclose your information to third parties. These are as follows:
To our service providers who process data on our behalf and on our instructions (for instance third party ticketing sites such as EventBrite, E-newsletter mailout services such as Mailchimp and donations management services such as JustGiving). In these cases we require that these third parties comply with data protection laws, particularly around the security of personal data.
When we are duty bound to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies).
Cookies are used to identify you when you visit a website to build a demographic profile.
A cookie is a small piece of information sent to by a web server to a web browser, which enables the server to collect information back from the browser. They are frequently used on websites and you can choose if and how a cookie will be accepted by configuring your preferences and options in your browser.
Your debit and credit card information
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard. None of our staff members are able to see your full card number, and we will never store your 3 or 4-digit security code.
Maintaining your personal information
We will store your personal information until such time as you advise us you no longer wish it to be held, for instance by unsubscribing from our mailing list.
Any objections you make to any processing of your data under the terms described above will be stored against your record on our system to ensure we can comply with your requests.
We will put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible.
If you have any questions or concerns about the way in which we handle your personal information, please contact Edinburgh Art Festival, Institut Français d’Écosse, West Parliament Square, Edinburgh, EH1 1RF or e-mail firstname.lastname@example.org.