Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller's possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the "GDPR") which are effective from 25 May 2018.
The York Mystery Plays Supporters Trust (YMPST) is the data controller. This means the Trust decides how your personal data is processed and for what purposes.
YMPST complies with its obligations under the "GDPR" by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
To respond when an individual or group contacts YMPST.
Processing is carried out by a not-for-profit body and the processing relates to members or former members and those who have contact with YMPST in connection with the purposes detailed above.
Your personal data will be treated as strictly confidential save where we are legally required to disclose information (e.g. HMRC for Gift Aid claims; to the police for the purpose of crime prevention; to the NHS to protect individuals at risk). We will never sell or rent your data to third parties. We will only share your data with third parties with your explicit consent.
When we use your data because of the legitimate interest of keeping you informed of news, events and activities your information will be retained for as long as you are either a member of the Trust or have asked to be included in our circulation list. If you have made a donation to us under Gift Aid we will keep a record of this in line with HMRC requirements.
YMPST will use photographs, videos and other media formats to publicise the activities of YMPST and for no other purpose. If a person or persons used in the material asks for it to be destroyed that will be done. In general, the material will not be held for longer than necessary however some material may be collected as part of the historical record and archives of the Mystery Plays in which case they may be held for an indefinite period.
Before photographing or filming children or vulnerable adults, their parent/guardian must be informed, and their written permission obtained. They will be told what the material will be used for and if the images are to be used on the web or on social media. Until the written permission of their parent/guardian is obtained photographs and videos of children and vulnerable adults will not be taken.
Adults and young people will be asked to consent to being photographed or filmed. If they do not consent they will not be photographed or filmed.
The only instance that would involve YMPST sending your personal information outside of the EAA is to add to our Mailchimp account. Mailchimp is software that provides easy options for sending emails. Mailchimp uses multiple data centres in the USA.
Mailchimp have certified their compliance with the EU-US/Swiss-US Privacy Shield Frameworks. This is a framework that sets privacy standards for data sent between the US and EU countries. It makes sure those standards are similar to what is used within the EEA.
To exercise all relevant rights, queries or complaints please in the first instance contact YMPST at the De Grey Rooms, St Leonards Place, York YO17HD or by email at membership@ympst.co.uk or by telephone 01904638173.
You can contact the Information Commissioners Office on 0303 123 1113, via their email contact form or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.