Transparency is one of our core values, and we will always be clear about what information we require from you to run our activity, and how it is used. 

Using personal information allows us to efficiently manage our space calendar with our building partners, manage our ticketed events and donations, and develop a mailing list through which we can share news about what we do and information regarding similar events, productions and notable opportunities that may be relevant to those who engage with us. Any data collection, collation and evaluation is done internally for the purposes of improving our existing booking systems and creating more relevant and meaningful opportunities.

The purpose of this policy is to give you a clear explanation about how we collect and use the information we collect from you directly and from third parties.

We use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:

• What information we may collect about you

• How we may use that information

• In what situations we may disclose your details to third parties

• Our use of cookies

• Information about how we keep your personal information secure and your rights to be able to access it

We may change certain points of this privacy policy as our organisation develops. Should any changes be made that affect your rights or alter existing permissions given through your current engagement, we will notify you through prominent, clear and visible postings on our social media channels and newsletter within a reasonable time frame. 

If you have any queries about this policy, please contact us at hello@andfriends.scot 

_and friends is run by Catriona MacLeod as a registered sole trader, who shares access to company documents and space calendar data with Associate Producer Valerie Andrews and Company Manager Ruth Burgon. Catriona is the designated data controller for the personal information you share with _and friends, and we use third party websites MailChimp, Ko-fi, Google Forms, Calendly and Skiddle to manage mailing lists, donations, meetings and ticket sales respectively. 

We manage our space as part of the Outer Spaces network, and work closely with the building management of Granite House, Stockwell Street, Glasgow who will be referred to throughout this policy as our building partners. We share some of your contact information with our building partners - this is to ensure you are in contact with the appropriate staff on the premises should an emergency arise, and to connect them with you to ensure safe access to the building at the time requested.

You are required to sign a sign in sheet when using the space. This is part of the building's fire evacuation safety plan, and is public.

We are also obliged to share some of your personal information with the Outer Spaces operations team who manage our building in accordance with the terms of our lease agreement. This information includes but is not limited to the nature of your activity in the space, your risk assessment, insurance policy details and number of participants using the space for the duration of your booking. You can view the full Outer Spaces terms and conditions on request. 

We operate in accordance with current data protection legislation.

Should you wish to contact us you can - hello@andfriends.scot 

We collect various types of personal information in a number of ways which are listed below.

For information about how we actively use that data, please refer to the 'marketing' + 'contracts + business interests' sections below.

WHAT YOU GIVE US

We have a mailing list run through MailChimp. To sign up for this, we collect only your name and email address, and this data is stored on their website. It is accessed by Catriona MacLeod using a two-factor authentication password, which is not shared with any other _and friends team member or external party. We do not collect personal addresses or phone numbers, and newsletter recipients reserve the right to unsubscribe at any time. Email addresses are stored on our MailChimp account as Contacts. Should you wish to delete your Contact card from our system, please let us know and it will be permanently deleted from our system. 

When making a booking to use our space, we ask for the name, address, contact email and phone number and PLI policy documents from a Lead Contact who is a representative for the activity, event or group using the space for the duration of their requested booking. We collect this information via forms that are stored on our Cloud account, and we share this information internally only. This information is requested in the interest of visitor wellbeing and efficiency of communication through the duration of the booking. We also ask for the contact details of an Emergency Contact as a further safety measure. This information is also only internally shared. 

Any financial contributions made to _and friends, via Skiddle, Ko-fi or Calendly, are made directly through the aforementioned third party websites. In order to complete any transaction, users input name, address, email and phone number contact information in addition to debit or credit card details, as is standard for third party websites that process payment. Debit or credit card details are not shared with us, and users can opt out of marketing correspondence. We do not contact ticket holders and donors using the information they provide on these site. Information provided and a record of your transaction is stored in our respective online accounts with each of the aforementioned platforms, which are two-factor authentication password protected and access by Catriona MacLeod only. 

When using Calendly to book a 1-2-1 meeting, you will be contacted via the email address provided for the sole purpose of ensuring the meeting is conducted professionally, efficiently and mindfully, and within the time frame requested in order for _and friends to deliver the service paid for. 

Ko-Fi Labs Limited and Skiddle are UK headquartered platforms. Calendly is an international business communications platform and operates remotely. 

INTERACTING WITH US

When you interact with us, whether by phone, e-mail or via other means, for example to request information or make a complaint, we collect information relating to those communications. We use this information to answer any issues or concerns and to provide you with the products, information and services you require from us. Catriona MacLeod is the first point of contact for all correspondence, which is shared only in the interest of responding efficiently and to receive permission from other team members to speak on their behalf.

When you visit our website and receive an email newsletter, we collect information about how you interact with our content. When we send you a mailing we store a record of this, and in the case of emails, we keep a record of which ones you have opened and which links you have clicked on.

When you access our social media channels, limited to Instagram and Facebook, we only receive personal information that you share with us voluntarily and that is compatible with your privacy settings. To find out more about how these social media companies process your personal information, we recommend that you read their individual privacy policies.

UNDER 18S

If you are under 18, please ensure that you obtain your parent/guardian’s consent whenever you provide personal information to us. If you don’t have that consent, you must not provide personal information to us. 

INFORMATION FROM THIRD PARTIES

We do not receive information about you from third parties. We only have access to information provided as part of your aforementioned engagement with MailChimp, Skiddle, Ko-fi and Calendly through our accounts with those platforms.

SPECIAL CATEGORIES OF PERSONAL DATA

Data Protection law recognises that certain categories of personal information are more sensitive such as information pertaining to health, race, religious beliefs and political opinions. We do not collect this type of information. We do not have open and anonymous application processes for professional opportunities, but should we expand our work to invite submissions of this kind, we will likely introduce Equalities Monitoring systems that require this particular kind of information to be shared with us in the interest of fairness and participant wellbeing. We will be transparent about now we use this information should this be the case. We sometimes collect health information about participants in relation to events in our space that require us to be aware of access needs in order to ensure the wellbeing of the participant. 

Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful because they allow a website to distinguish you from other users which helps to provide you with a better experience when you browse that website.

You can choose whether or not to allow the setting of cookies using the privacy settings of your browser. Third party sites, particularly those that process payment, may require you to run Session Cookies to successfully complete any transaction made.

SESSION COOKIES

These cookies are necessary to provide third party online booking and donation services and they enable you to navigate those websites and use their features, such as the shopping basket. Session cookies are created temporarily. Once you close the browser, all session cookies are deleted. This information is not share with us. Read the third party platform privacy policies for further information.

MARKETING/ADVERTISING COOKIES

We do not run adverts on any third party website and therefore do not deliver personalised advertisements and promotional content based on your interests and browsing behaviour.

There are three basis under which we may process your data:

CONTRACTUAL PURPOSES

When you make a purchase from or make a donation to us, you are entering into a contract with us. In order to perform this contract, we need to process and store your data. For example, we may need to contact you by email or telephone in the case of cancellation of a performance, or in the case of problems with your payment.

LEGITIMATE BUSINESS INTERESTS

In certain situations we collect and process your personal data for purposes that are in our legitimate organisational interests. For example, this may include using the nature and frequency of your space booking(s) as evidence of our space's usefulness to our community in a funding application. Should this be the case, we will ask for your consent to be named in such an instance. You reserve the right to remain anonymous, or to be excluded entirely.

WITH YOUR EXPLICIT CONSENT

For any situations where the two above basis are not appropriate, we will instead ask for your explicit consent before using your personal information in that specific situation.

MARKETING COMMUNICATIONS

We aim to communicate with you about the work that we do, our views and beliefs in relation to important local and world events, and news from our community in ways that you find relevant, timely and respectful. We do not tailor the delivery of this information to specific individuals who have engaged with us. We have conveyed our stances on most issues in a transparent and public way, and by choosing to engage with us, we communicate with you as part of our audience as a collective.

Where permitted by law we use our legitimate organisational interest as the legal basis for communications by email. We will provide you with an option to unsubscribe in every email that we send you, or you can alternatively use the contact details set out in this Privacy Policy.

We may also contact you about your space booking by telephone, however we will always get explicit consent from you before doing this. Please bear in mind that this does not apply to telephone calls that we may need to make to you related to enquiries (as above). 

We will never call or contact you in relation to purchases made through third party websites or platforms, and we will never call you in a sales or fundraising capacity.

OTHER MARKETING ACTIVITIES

We conduct analytics to better understand our development as an organisation. We consider the growth and sales rate of our tickets and combine this with other relevant data such as interaction with our website and social media.

We are not a charity and our work is funded through donations and ticket sales. We evaluate the effectiveness of our marketing campaigns for ticketed events through the data provided and make changes to our strategies where required. We also use your data to determine whether certain individuals, companies or organisation may be interested in supporting us. Should we expand our fundraising strategy, we will ensure that we have reasonable knowledge of prospective industry and third sector donors and their activity to minimise the risk of reputational damage to _and friends.

We may conduct analysis of our audience by attendance and other information on our own database to contact individuals who might be interested in supporting our work or attending our events to the extent permitted by applicable data protection laws.

We may contact individuals, companies and organisations about our work using information the relevant parties have freely made available in respect of their business interests.

We carefully balance our legitimate interests against your interests as an individual. You can exercise your rights over your personal information at any time.

In all of the above cases we will always prioritise your rights and interests. You have the right to object to any of this processing at any time. 

THIRD PARTIES

Other than the third party websites, our building partners and the _and friends team names above, we do not share your data with any external third party individual, company or organisation.

Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies). Your personal information may also be processed if it is necessary in the defence of a legal claim. We will not delete personal information if relevant to an investigation or a dispute, it will continue to be stored until those issues are fully resolved.

Your personal data may be shared if it is made anonymous and aggregated, as in such circumstances the information will cease to be personal data.

You have certain rights in relation to your personal information. The availability of these rights and the ways in which you can use them are set out below.

Some of these rights will only apply in certain circumstances.

Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you and certain other information to check that we are processing it lawfully. 

Correction: you are entitled to request that any incomplete or inaccurate personal information that we hold about you is corrected.

Erasure: you are entitled to ask us to delete or remove personal information in certain circumstances where we are able to do so. We are not able to erase your data from ticketing and donation websites. To do so, you will need to contact the third party platform directly. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.

Restriction: you are entitled to ask us to suspend the processing of certain aspects of your personal information, for example, if you want us to establish its accuracy or the reason for processing it.

Objection: We may be entitled to continue processing your information based on our legitimate interests or where this is relevant to legal claims. You also have the right to object where we are processing your personal information for direct marketing purposes.

More information regarding your legal rights in respect of personal information can be found at www.ico.org.uk/for-the-public/. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State in the European Union where you are habitually resident, where we are based, or where an alleged infringement of Data Protection law has taken place. In the UK you can make a complaint to the Information Commissioner’s Office (Tel: 0303 123 1113 or at www.ico.org.uk).

In order to initiate a request with us about your personal information, please send us a description of the information you would like to access or the rights you would like to exercise by emailing us at the address below.

The ways in which we process data may change from time to time and we will always update our Privacy Policy to reflect any changes we make.