Donate

Privacy policy

Who we are

Kirkstall Art Trail is the data controller for the purposes of the Data Protection Act 2018 and other regulations, including the UK General Data Protection Regulation, which means it determines what your data is used for and why it is collected. The purpose of this privacy policy is to tell you what information we collect about you, how we use that information, and how long we retain it. 

To make a request or raise a concern, use the data protection enquiry form. You can also email info@kirkstallarttrail.co.uk.

What personal information we collect and why

We currently collect and process the following information:

  • basic personal identifiers, contacts and characteristics – for example, name and contact details, or photographs
  • financial identifiers – for example, payments to artists or volunteers or payment received by Kirkstall Art Trail
  • special categories of data – health data, only for specific purposes and where it is ‘necessary’, for example, disclosing a disability

We do not collect other ‘special categories of data’ (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data where used for identification purposes, a person’s sex life, or their sexual orientation), nor ‘criminal offences data’ (personal data relating to criminal convictions and offences or related security measures).

Your data protection rights

Under UK data protection law, we must have a ‘lawful basis’ for collecting and using your personal information. There is a list of possible lawful bases in the UK General Data Protection Regulation (UK GDPR). You can find out more about lawful bases on the ICO’s website.

The lawful basis we rely on may affect your data protection rights, which are set out in brief below.

  • Access – you have the right to ask for copies of your personal information. You can request other information, such as details about where personal information is obtained from and who it’s shared with. There are some exemptions, which means you may not receive all the information requested.
  • Rectification – you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
  • Erasure – you have the right to ask us to delete your personal information.
  • Restriction of processing – you have the right to ask us to limit how we can use your personal information.
  • Object to processing – you have the right to object to the processing of your personal data.
  • Data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Withdraw consent – when we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, use the data protection enquiry form. You can also email info@kirkstallarttrail.co.uk.

Our lawful bases for the collection and use of your data

Under the UK GDPR, we rely on lawful bases for processing this information. You can withdraw consent at any time.

(a) Consent. You have given us permission to use your information for a specific purpose. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time using the data protection enquiry form.

You give consent when you:

  • subscribe to our mailing list
  • share your photos with us, for example for the postcard gallery
  • share your own Advent window image for the Advent map
  • agree to be credited by name on our website or social media
  • take part in an interview for our website or social media
  • tell us about access needs or a disability, so we can make adjustments for you
  • agree to us quoting your feedback, with or without your name

We use Sender to send our newsletter. Sender records whether newsletters are opened and which links are selected, which helps us improve them.

We only use health and access information for the purpose you gave it for, and delete it once participation ends.

(b) Contractual obligation. We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

You could enter a contract with us as an artist, poet, Fashion Show designer, competition entrant, volunteer, or venue host.

(c) Legal obligation. We need to use your information to meet our legal duties. This includes:

  • responding to data protection requests
  • keeping financial records for six years, as required for charity accounts, including an accurate record of donations and payments to artists for our annual accounts and reporting

(d) Legitimate interest. We use your information where it is necessary for our legitimate interests as a community organisation, and where this does not override your rights.

Event photography and filming

We take photographs and film at our events to promote Kirkstall Art Trail, report to our funders, and keep a record of our work. General photography and filming of venues and visitors is covered by our event photography and filming notice, displayed at each venue.

You can ask not to be photographed or filmed on the day, or ask us to delete images or footage of you at any time, using the data protection enquiry form. You can also email info@kirkstallarttrail.co.uk.

Where a child under 16 or an adult at risk is the specific subject of a photograph or video, we ask for consent first. We also ask for consent before filming or publishing an interview.

We may use AI tools to help write text descriptions of images for our website, so that people using screen readers can access them.

Donations

We collect and keep your name, email address, and phone number when you donate, to support Kirkstall Art Trail’s financial transparency and good governance. This includes:

  • maintaining clear, auditable financial records in line with UK fundraising and community governance standards
  • supporting transparency in income sources, and helping guard against financial crime
  • contacting you about your donation, if we need to

This information is used only for these administrative and governance purposes. It is never used to send you marketing or newsletters unless you opt in using the separate mailing list sign-up form.

Event emails to people taking part in the Art Trail

We use an email service (Sender) to send information to people who have applied or signed up to take part in the Art Trail, such as artists and venue hosts. The service shows us who has opened these emails. We use this only to follow up by phone or another route if important information has not reached you, for example if it goes to your spam folder. We do not use it for marketing, and it does not affect your newsletter choices.

Evaluation

We use applications, including unsuccessful ones, and feedback survey responses to evaluate and improve the Art Trail, and to report to our funders.

Contact form enquiries

When you contact us using the ‘contact us’ form, we use your name, email address, and message to reply to your enquiry. We only use this information to respond to you. It is never used to send you marketing or newsletters unless you opt in using the separate mailing list sign-up form.

Workshop sign-ups

When you sign up for a workshop we use your name and contact details to arrange your place and let you know about any changes to the workshop.

Historic Art Trail maps

We keep printed maps from past Art Trails on the ‘gallery – maps’ page on our website, and on our social media, as a record of the Art Trail and to promote art in our community.

Advent Trail windows

When you share a photo of your window, we keep it in the archive of past Advent Trail maps to promote art in our community.

Where we get the personal information

Most of the information we hold comes directly from you, for example when you submit a form through our website, submit an application through CuratorSpace, or contact us through social media, WhatsApp, email, or phone.

We don’t routinely delete content posted to our social media channels. You can ask us to remove content about you at any time.

If you contact us through social media or WhatsApp, the platform also processes your information. We suggest you also read the privacy information of that platform. We use:

We also get information from:

  • photographs and videos taken at our events, and photos that visitors share with us
  • other people, for example someone recommending a volunteer or an artist naming a collaborator
  • publicly available sources, for example contact details on a venue’s website

We do not collect personal information directly from children. When we work with schools, we photograph children’s artwork but not the children. Children may appear in general photography and filming at our events, as described in our event photography and filming notice.

How long we retain your information

Mailing list details

Until you withdraw consent. When you unsubscribe, we keep your email address on a suppression list so we do not contact you again, and delete it [retention period TBC]. Trail participant emails are kept for two years after the event.

Photos you share with us, with your name and contact details

Until you withdraw consent

Your name, if you agreed to be credited on the website or social media

Until you ask us to remove it

Written interviews published on our website

Kept in our news archive, unless you ask us to remove them

Video interviews published on social media

Kept on our social media, unless you ask us to remove them

Records of consent for interviews

For as long as the interview is published

Quotes from feedback, where you agreed, and the record of your agreement

For as long as we publish the quote, unless you ask us to remove it

Health and disability information, for example access information

Until participation ends, unless you ask us to delete it sooner

Applications from artists, poets, Fashion Show designers, competition entrants, and volunteers

Up to two years after the event, unless you ask us to delete them sooner

Art Trail participant emails

We keep your email address for two years after the event, the same as your application. You can ask us to remove your details sooner.

Register of interest from potential hosts

Until you decide whether to host. If you decide not to host, we delete your details

Host details

For as long as you are willing to host with us, including years you do not take part. We check each year when we start recruiting venues. If you tell us you can no longer take part, we delete your details

Artist profiles on venue pages (includes Fashion Show participants)

Published until the next year’s venue pages replace them, within a year of the event; the previous year’s pages are then deleted. You can ask us to remove your profile sooner

Venue page access guide

Published until the next year’s venue pages replace them, within a year of the event; the previous year’s pages are then deleted. You can ask us to remove your venue details sooner

Venue directory entries

Published until the next year’s directory replaces them, within a year of the event; the previous year’s page is then deleted. You can ask us to remove your venue entry sooner

Map markers and pop-ups – venues, artists, and poets

Published until the next year’s markers replace them, within a year of the event; the previous year’s markers are then deleted. You can ask us to remove your map marker sooner

Historic Art Trail maps

Printed maps from past Art Trails are kept on the ‘gallery – maps’ page on our website and on our social media, as a record of the Art Trail. You can ask us to remove your venue or artist details from a map, or remove a map, at any time.

Advent window markers

Kept on the Advent Trail map until you ask us to remove your marker. Markers then remain in the archive of past maps on the Advent Trail page.

Records of data protection requests

[Period TBC]

Financial records, including payments to artists and donations

Six years, as required for charity accounts

Contact form enquiries

General enquiries are kept one year after we have replied

Workshop sign-up details

Up to two years after the workshop, unless you ask us to delete them sooner

Feedback survey responses

Two years after the event

Event photographs and films

Kept as part of our event archive. You can ask us to delete images of you at any time

Raw video footage

[Period TBC]

Images shared with AI tools to help write text descriptions

Deleted once the descriptions are written. Mistral states deleted conversations are removed from its systems “typically after a short grace period,” with limited retention for monitoring and legal purposes

We review the information we hold every year and delete anything past its retention date.

How we store your personal information

We store information using the following services:

  • our website, hosted by Fasthosts, including form entries stored in the website database
  • email, hosted by Fasthosts, and Outlook.com for finance email
  • WhatsApp, to organise venues, artists, the Fashion Show, and volunteers
  • CuratorSpace, a secure third-party website, is used for artists to apply for the Art Trail
  • Square, to process donations
  • Google Drive, for documents and photographs, with access restricted to the management committee
  • Canva, to design graphics such as postcards and edit videos, which may include photographs and footage of people
  • Gmail, for Fashion Show organising
  • Sender, a secure third-party website, is used to send our newsletter and emails to people taking part in the Trail (for example artists, venues, and volunteers).
  • Facebook and Instagram, for publishing and messages
  • Microsoft Forms, for feedback surveys
  • Friendly Captcha, GDPR-compliant bot protection, is used to protect the website from spam, and runs only with consent
  • Vibe, an AI tool made by Mistral, for drafting, administration, and writing text descriptions of images. We have turned off the setting that allows Mistral to use our chats to train its AI models

Square collects your name, email address, and phone number when you donate. Square is a data controller, responsible for the personal information it processes.

Our website uses an SSL certificate, so information sent through our forms is encrypted. All accounts are protected with strong passwords, and access is limited to the people who need it.

Information stored outside the UK

Some of the services we use store information outside the UK, including in the US. Where this happens, we use services covered by UK adequacy regulations, or with other safeguards required by UK data protection law.

Who we share your information with

We share information only where we need to run the Art Trail, or where the law requires it.

We share:

  • artists’ and hosts’ names, email addresses, and mobile numbers with each other, and with artist support volunteers, to organise venues
  • artists’ names, and any website, social media, or online shop details they give us, on their artist profile on the venue page
  • venue addresses in the public venue directory and access guides on venue pages. We do not publish hosts’ names
  • event photographs and photos you share with us, with Leeds City Council, the press, and our funders, for promotion and reporting
  • financial information with Leeds City Council, when we claim grant funding
  • information with the Charity Commission, where required
  • quotes from feedback, where you agreed, in reports to our funders and on our website

Anyone we share contact details with for the Art Trail is asked to use them only for that purpose.

We do not sell your information.

How to update information we may hold

To update personal information (for example, an email address), or to ask for inaccurate information to be corrected, use the data protection enquiry form. See also ‘right to rectification’ above.

How to complain

To make a complaint about how personal information has been used, use the data protection enquiry form.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:   

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF.

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Monitoring and review

This policy is reviewed annually, when relevant law changes, or when an organisational change affects how personal data is handled.

The policy was last reviewed on 18 August 2026