The purpose of this Data Protection and Privacy Policy is to give you a clear explanation about how the National Children’s Orchestras of Great Britain (“we”, “our”, “us” or “the Charity”) collect and use the information we collect from you.
It is separate to NCO’s Website Terms.
This policy was last updated on 13th December 2023
Who we are
The National Children’s Orchestras of Great Britain is a registered charity. Our registered charity number in England and Wales is 803026 and we are also registered as a company in England and Wales under the name The National Children’s Orchestras of Great Britain, Company registration number 2471385.
Scope
Your data is important to you and so it is important to us. We are committed to protecting your personal information, being transparent about what information we hold about you and to using any personal data that we hold responsibly, conscientiously, and respectfully.
Using personal information allows us to develop a better understanding of all of our stakeholders – from the children who are our members and their families, to the children who apply to audition for our programmes, those who work for and with us or apply to do so, those who donate to our charity or support us in other ways (or those who might look to in the future) and for the wider individuals and communities who visit our websites and social media platforms. In turn we provide all of our stakeholders with timely information relevant to their relationship with us.
We use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:
- What personal information (data) we may collect about you
- How we may use that information, including the legal basis
- Who we share your information with
- How we maintain your information and how long we keep it
- Information about how we keep your personal information secure
- Your rights to accessing your information
NCO is registered with the Information Commissioner’s Office as required by the Data Protection Act 1988. NCO is also compliant with the General Data Protection Regulation 2018 (GDPR).
What personal information (data) do we collect about you?
We collect various types of information and in a number of ways:
Information you give us
You provide us with information when you use one of our secure forms (hosted by our Customer Relationship Management (CRM) system, Beacon or occasionally Microsoft Forms) to make an application to audition for NCO or to take part in a non-auditioned activity, to join as a member following an offer of a place, to make a donation or sign up to be a regular supporter or to apply for a job, work placement or voluntary position with NCO. We’ll store personal information you give us such as your name, email address, postal address and telephone number. We will also store a record of your applications/memberships, purchases and donations.
Information about your interactions with us
When you visit our website, we collect information about how you interact with our content. When we send you a mailing, we store a record of this, and in the case of many of the emails we send, we will keep a record of which ones you have been sent, have opened and which links you have clicked on.
Information that is publicly available
We may (excluding for recruitment processes) research and collect information that is in the public domain from online media sites or newspaper articles, social media sites (such as LinkedIn or Facebook) and Companies House listings.
Sensitive personal data
Data Protection law recognises that certain categories of personal information are more sensitive such as ethnicity, age and gender. We only collect this type of information about our customers, employees, prospective employees or volunteers when there is a clear reason for doing so. We may ask you for this kind of information through a survey to gain a better picture of who is applying to work with us or through an application to audition for NCO, as you join us as a Member or when you become a Friend, Patron or other Donor of NCO. We use this data for our development and for our reporting to funders. You are not obliged to answer any questions about protected characteristics.
What Legal basis do we use to process your personal information?
There are four bases under which we may process your information:
Contract purposes
When you make an application to audition for NCO programmes or apply to take part in another NCO activity, pay for your child’s membership once they have been offered a place following audition, accept employment with us, or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your data.
Legitimate business interests
In certain situations, we collect and process your personal information for purposes that are in our legitimate organisational interests. However, we only do this if there is no overriding prejudice to you by using your personal information in this way. We describe below (after point 4.) situations where we may use this basis for processing.
With your explicit consent
For any situations where the two bases above are not appropriate, we will instead ask for your explicit consent before using your personal information in that specific situation.
Legal Obligation
There may be situations where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies).
How we use your personal information
We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful. To do this we use information that we have stored about you, such as the orchestra your child is in or the email preferences you have given us in terms of interest in updates and supporting NCO or updates on annual auditions.
We use our legitimate organisational interest as the legal basis for communications by post and email. In the case of postal mailings, you may unsubscribe from receiving these at any time using the contact details at the end of this policy.
In the case of emails:
- we will communicate with you on a contractual basis for applications to audition for NCO or take part in a non-auditioned NCO activity to fulfil a Membership you have signed up for and/or
- where you have given express ‘opt-in’ consent to receive emails outside any contract you hold with us, e.g. in the case of e-newsletter updates and opportunities to support NCO, we will provide you with an option to update your preferences or unsubscribe in every non-contract email that we subsequently send you. You can alternatively unsubscribe via the contact details at the end of this policy.
We may also contact you about our work by telephone. However, we will always give you the opportunity to opt out before doing so, as well as cross-referencing with the Telephone Preference Service. Please bear in mind that this does not apply to telephone calls that we may need to make to you related to your transactions and memberships (see contract processing information below).
In addition to the communications laid out above, we also process personal information in the following ways that are within our legitimate organisational interests:
- We may analyse data we hold about you to ensure that the content and timing of communications that we send you are as relevant to you as possible.
- We may analyse data we hold about you in order to identify and prevent fraud.
- As per our Website Terms, in order to improve our website we may analyse information about how you use it and the content that you interact with.
- We may use profiling techniques or undertake screening with third party marketing and insight companies to provide us with information about you that will help us to communicate in a relevant way with you, in particular when we are approaching you about potential philanthropic support. Such information is compiled using publicly available data about you and your purchase and donation history with us. All such information is kept securely.
If you are working in the arts or related industries, including the press industry, we may be in touch with you via email to let you know about upcoming launches, special events, concerts and opportunities for work.
In all of the above cases we will always keep your rights and interest at the forefront to ensure they are not overridden by our own interests. You have the right to object to any of this processing at any time. If you wish to do this, please use the contact details at the end of this policy. Please bear in mind that if you object this may affect our ability to carry out tasks that are for your benefit.
Some specific examples of instances where we use contract as a legal bases for contacting you are:
- To contact you by email or telephone to provide you with details about upcoming orchestral activities for your child where they are a member of our orchestral programmes, to gather health information about your child in order to safeguard them at NCO activities they are part of, to administrate payment of fees or applications for financial support.
- If you make a donation to National Children’s Orchestras including signing up as a Friend or Patron, making a general donation or arranging to leave a legacy to NCO, we will contact you with more information about your membership/donation including event invitations and newsletter updates about the work you have supported. This could be in the form of an email, postal mailing, text message or phone call.
- When you choose to apply for a job post or work placement (permanent, freelance or voluntary), we will process your data in order to complete the application process, communicate with you about your application and if appropriate, the ongoing role/project.
Some specific examples of instances where we ask for explicit consent are:
- To receive our regular e-newsletter which updates on NCO, concerts and events and opportunities to support our charity.
- To receive updates on future auditions via our auditions mailing list.
- When your child moves on from NCO, we will ask you if you would like to be contacted in the future as an Alumni Parent (in the case that your child is 16 or under) or will ask them if they would like to be contacted as an Alumni (in the case that your child is over 16).
- When your child becomes a Member of NCO, we ask for your consent for them to feature in photographs and film.
Who do we share your personal information with?
The members of our team who view, process and maintain your data do so in order to carry out the processes described in this policy, with an awareness of the details of this policy and our accompanying Internal GDPR processes policy. You can see our process in the case of a breach, at the beginning of this policy.
We never sell your data.
There are certain circumstances under which we may disclose your personal information to third parties to allow us to conduct our operations including:
- To our own service providers who process data on our behalf and on our instructions. For example, our Customer Relationship Management (CRM) provider, Beacon, and our website developers/hosts, Interactive Schools (for www.nco.org.uk), and Outlandish (for our private Member Website) and to mailing houses that process direct mailings for us. We also share names, dietary requirements and photos (for ID purposes) to staff in residential venues. We require that these third parties comply strictly with our instructions and with data protection laws, for example around security of personal data.
- Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies).
- We may share your information with marketing and insight companies to process your data in order to help us communicate with possible supporters, as outlined in the ‘How we use your information section’ above. Where we do so, we require the third party to destroy all data following use and to comply with data protection laws and data security.
- Where you have consented to Gift Aid on a donation we will share appropriate information with HMRC in order to reclaim the Gift Aid.
Your debit and credit card information
If you use your credit or debit card to pay NCO for membership fees or merchandise/photos or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).
Our payment and donation forms, even where they are embedded in our website nco.org.uk, are hosted and processed securely through our Customer Relationship Management (CRM) provider, Beacon, who act as NCO’s Data Processor. NCO, through Beacon, uses several data sub-processors related to payments which are Stripe, GoCardless and Paypal. You can read more about the security of your data in ‘Security of your Personal Information’ further down this policy.
Maintaining your personal information
We store your personal information securely and how long we maintain and keep that information depends on your relationship with us:
- For parents/carers of children submitting an audition application to be part of an NCO programme:
Re General applications and Membership
When a parent/carer applies for an audition to one of NCO’s orchestral programmes, they do so on behalf of a child/children in their care, who are usually between the age of 8 and 14. Information gathered through our secure Beacon forms will include personal details, ranging from sensitive information such as your child’s full name and date of birth, your (the parent/carer) contact details, which school the child attends, household income and less personal information such as the instruments the child plays and other musical activities they take part in.
All of this information is stored on NCO’s CRM system, Beacon, for the duration of the application/expression of interest process for each activity and is downloaded to NCO’s database based on Sharepoint, NCO’s cloud-based server. If the child is unsuccessful in their audition for a place in NCO, we will hold personal information for 24 months.
If the child is successful, during their subsequent membership, NCO will use personal information to administrate participation including making sure parents/carers are informed of all activity details.
When you make a payment for your child’s membership, it will be processed through a secure payment form, hosted by our CRM data processor, Beacon. For more information, see ‘Your Debit and Credit Card information’ above. We do not ask you to supply bank account details.
Before NCO residentials or orchestral weekends, we will also ask parents/carers for health and wellbeing information relating to their child to ensure they can be cared for appropriately whilst engaged in NCO activities. This information will only be shared with personnel who are engaging with the child. It will be deleted 9 months after the end of the membership year in which they participated.
Personal information from parents/carers or in relation to their children will normally be retained for the duration of their child’s eligibility for membership of NCO programmes (this is usually until they are aged 15).
Towards the end of your child’s eligibility for NCO membership, we will ask parents/carers if they are happy for NCO to retain their contact details to keep them in touch with NCO in the future.
Beyond that point we will retain basic information on children who have been NCO members, including name, instrument and dates of membership, in order for us to build a long term picture of how the membership has developed and to recall membership status when we see young musicians making public achievements.
Photography and Recordings
When a child joins as a member of NCO’s programmes, we will ask parents/carers to supply a photograph of the child for ID purposes at activity. This photo will be deleted 9 months after the end of the membership year in which they participated. We will also ask a member’s parent/carer for consent to take photos/record films of children during activity, including:
• for use in NCO promotional materials and communications campaigns including e-newsletters, website and social media channels.
• made by media companies for broadcast/other transmission including promotional purposes.
• made with NCO partnership organisations for collaborative projects e.g. NCO’s involvement with ABRSM’s Composer Mentoring programme or as Classic FM’s Children’s Orchestra.
In consideration of the safeguarding of the children in NCO membership and to comply with the requirements of concert venues, no photography or recording of any kind is permitted at NCO concerts except for official photography or recording specifically authorised by NCO. NCO may sell official photography of children in NCO membership to parents/carers/families after activity has taken place. NCO may also record public concerts and make online recordings/files/DVDs available for purchase. NCO may store and retain any images or recordings it creates. All images and recordings made by NCO will be owned by the charity. Images such as photographs and film taken at activities and concerts for marketing purposes will be retained beyond the period of the child’s involvement with NCO but parents/carers can withdraw their permission for their use by contacting NCO.
Re Financial Support Applications
When you make an application to NCO for financial support, you share financial information with us through our Application for Financial Support form (hosted by our CRM Data Processor, Beacon). This information might include information on your income, savings, property ownership, benefits received and more. This information as well as proof to support it, is requested by NCO in order for us to make decisions around whether we are able to offer you financial support. This information is kept on file for six years as an HMRC legal requirement. You can read more about Beacon’s security features in the ‘Security of your personal information’ section further down this policy.
- For permanent/fixed term employed staff, freelance staff or voluntary/placement students working with NCO
When you make an application to join our team on a permanent, fixed term or freelance basis, or apply for a voluntary and/or work placement, you will complete a secure Application Form via our CRM system, Beacon and an optional Equal Opportunities Form, via Beacon or Microsoft Forms. Job application information will be stored securely for 6 months following the close of application date. For successful applicants, job application information will be held in restricted personnel files for 6 years after leaving employment with NCO. Anonymised information gathered through the Equal Opportunities Form e.g. gender, ethnicity etc. of applicants will be retained beyond this.
Prior to starting employment or a placement with NCO, as part of the referencing process and in line with our Safeguarding Policy, you will be required to provide details of an existing DBS or to agree to NCO requesting a DBS for you. If you are not employed following this reference, NCO will retain the certificate’s date of issue, the name, address and date of birth of the subject, the type of certificate requested, the position for which you requested the check, the certificate’s unique reference number and the details of the recruitment decision; for 6 months. If you are employed, the DBS information will become part of your personnel file and will be kept for 6 years following the end of your employment with NCO.
When you are employed by NCO as a permanent or fixed term member of the administrative team, you will be asked to complete an Employee Starter Form. You will provide personal and contact details, a copy of your passport; P45 and a valid work permit/visa (if applicable). This is to perform our duty to conduct right to work in the UK checks. You will also disclose your bank account details in order to be paid. As an HMRC legal requirement, payroll related information is kept on file for three years following the end of the final tax year in which you are employed by NCO and passport/work visa and permits are kept on file for the duration of your employment, plus three years.
When you are employed as a freelancer to work at NCO’s orchestral activities, you will be asked to supply NCO with an invoice for your work and travel expenses following completion of the activity. You will provide personal and contact details, as well as bank account details in order to be paid. This information is kept on file for six years as an HMRC legal requirement.
- NCO donors and regular supporters
When you sign up as a supporter or make any general donation to NCO, you will provide us with basic information, including your name, postal address and additional contact details at your discretion. The details you provide will be held by NCO so that we can administer your membership/donation, deliver your membership benefits and contact you with information about NCO for the duration of your support. If you decide you would no longer like to support NCO, we will not contact you but we will retain key identifiable donor details (name, address, past gifts) so that we can match with any future support you may wish to give.
- For those signed up to NCO email lists
Those who subscribe to the NCO e-newsletter, the NCO Auditions Mailing list, the NCO Alumni Mailing list or other consent based mailing lists we may create in the future, will receive regular emails sent to their nominated email address.
The e-newsletter will contain recent news, information on upcoming events, job vacancies and occasional recommendations. We may also include invitations to join fundraising campaigns, information on how to leave a gift in your will to NCO or highlight opportunities for you to join us as a regular donor on the Supporter Scheme.
Emails to those signed up to our Auditions Mailing list will contain information on upcoming opportunities to audition for our programmes.
The contact information provided in your opt-in form for these email lists will not be shared with, sold, rented or leased to any third parties. Your email address and personal data will be held on secure servers in the US operated by Mailchimp, our email marketing service provider, on behalf of NCO. We will also store your details within NCO’s secure database, provided by Beacon. We will only ask you to provide your first and last name and email address in order to receive emails as part of these lists, though we may hold other information on you e.g. if you or your child have taken part in our programmes or if you have made a donation to us. We ask for your name so that we are able to personalise the mailing. You can unsubscribe automatically at any time by clicking the ‘unsubscribe’ button at the bottom of the email.
- For those responding to an offer of free tickets to an NCO Concert or expressing interest to take part in a non-auditioned NCO activity
If you are responding to an offer of free tickets to an NCO Concert, you may complete a Microsoft Form or Google Form with key personal information including your name and email address. These will be passed securely to the Box Office where the Concert is taking place for the purpose of booking your free tickets. Your personal information will only be retained by NCO if you give your consent in that form to join our regular e-newsletter list, where it will be kept indefinitely unless you unsubscribe.
If you are expressing interest/making an application to take part in a non-auditioned NCO activity, you may complete a Microsoft Form or a Beacon form with key personal information including your name and email address. These will be used by the NCO team to process your application and to communicate with you about the opportunity and the activity.
Safeguarding
Where there are concerns about the safety or welfare of a child or young person, those concerns will be shared with key decision makers along with relevant personal information about the person at risk. There is no legislation that prohibits the sharing of confidential and personal information where there are concerns about the safety or welfare of a child or young person, or where a criminal act may be, or may have been committed. Necessary written notes to document disclosures, events or reports of a safeguarding nature will be stored securely and converted to password protected digital notes as soon as possible and saved on NCO’s Sharepoint before the written notes are destroyed. Safeguarding records will be kept until NCO is confident that the information is held accurately with the authorative agency responsible for taking further safeguarding action e.g. social services or the police and for 25 years from the child’s date of birth.
If a concern is raised about an NCO staff member or volunteer that relates to behaviour that has harmed, or may have harmed a child or young person, possibly committed a criminal offence against a child or young person or behaved in a way that indicates he/she is unsuitable to work with children and young people, a comprehensive summary will be stored in the person’s confidential personnel file on NCO’s Sharepoint and a copy should be given to the individual if appropriate. Such information will be retained on file, including for people who leave the organisation, at least until the person reaches normal retirement age, or for ten years if that is longer.
Security of your personal information
Security of your data is important to us. We have in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will specify that any third parties we use for processing your personal information do the same.
As described previously, we use a Customer Relationship Management (CRM) system, Beacon, to process your personal data including when you make an application or take out a membership with NCO, make a donation or when you agree to work with us. Some of these processes include financial transactions. Beacon acts as a Data Processor in these cases, and more, for NCO. All of this processor data stays in the UK and you can read more about the hosting and storage of that data on Beacon’s website. Beacon employs extensive security measures for securing Personal Data as NCO’s Data Processor. For an up-to-date list of the publicly available security measures employed by the Provider, see Beacon’s website.
Personnel data is also stored on our IT systems which are tightly managed including a secure NCO local wi-fi.
You may have log in details, as part of your child’s membership to our private log-in only Member Website. Your child’s name and your parent/carer email address will be shared with our website provider, Outlandish, in order to create and maintain your account. The Member Website contains information relating to your child’s membership including the music they will play, schedules, information for activity and orchestra lists containing the names of the children in the orchestra and links to events. The Member Website is hosted by Outlandish. The site and its data is hosted on Amazon Web Services (AWS) servers in Ireland. Outlandish keep the software regularly updated in order to maintain website security. You play an important role in keeping this website secure. You should not share your username, password, or other security information for your National Children's Orchestras account with anyone. If we receive instructions using your user name and password, we will consider that you have authorised the instructions.
For our public-facing website, www.nco.org.uk, please see our Website Terms for details of website and social media security.
You can read more about security functions for Google Forms or Microsoft Forms if you have completed a secure form for one of the reasons mentioned elsewhere in this policy.
Your rights to your personal information
You have a right to request a copy of the personal information that we hold about you and/or your child and to have any inaccuracies in this data corrected. Please use the contact details at the end of this policy if you would like to exercise this right. Any objections you make to any processing of your data will be stored against your record on our system so that we can comply with your requests.
We ask you to let NCO know if any of your contact details change, if there are any inaccuracies in them or if you no longer want to receive information or services from NCO.
Contact details and further information
If you have any queries about this policy, in the first instance, please contact us at National Children’s Orchestras by emailing [email protected]
This includes if you would like to object to any processing of your personal information that we carry out for our legitimate organisational interests. We will do our utmost to resolve any queries or issues with you.
The National Children’s Orchestras of Great Britain, Unit 2.3, Streamline, 436-441 Paintworks, Arnos Vale, Bristol, BS4 3AS [email protected]
You also have the right to contact the Information Commissions Office (ICO) if you have any questions about Data Protection. You can contact them using their help line 0303 123 1113 or at www.ico.org.uk.
Changes to this policy
We may change this Privacy Policy from time to time and will post changes on the NCO website. If we make any changes to this Policy that materially impacts previously collected information about you, we will obtain your prior express consent.
