Our contact details
Name: data protection lead
Email: info@kirkstallarttrail.co.uk
Website: kirkstallarttrail.co.uk
To make a request or raise a concern, use the data protection enquiry form.
What personal information we collect and why
We currently collect and process the following information:
- basic personal identifiers, contacts and characteristics – for example, name and contact details, or photographs
- financial identifiers – for example, payments to artists or volunteers or payment received by Kirkstall Art Trail
- special categories of data – health data, only for specific purposes and where it is ‘necessary’, for example, disclosing a disability
We do not collect other ‘special categories of data’ (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data where used for identification purposes, a person’s sex life, or their sexual orientation), nor ‘criminal offences data’ (personal data relating to criminal convictions and offences or related security measures).
Your data protection rights
Under UK data protection law, we must have a ‘lawful basis’ for collecting and using your personal information. There is a list of possible lawful bases in the UK General Data Protection Regulation (UK GDPR). You can find out more about lawful bases on the ICO’s website.
The lawful basis we rely on may affect your data protection rights, which are set out in brief below.
- Access – you have the right to ask for copies of your personal information. You can request other information, such as details about where personal information is obtained from and who it’s shared with. There are some exemptions, which means you may not receive all the information requested.
- Rectification – you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Erasure – you have the right to ask us to delete your personal information.
- Restriction of processing – you have the right to ask us to limit how we can use your personal information.
- Object to processing – you have the right to object to the processing of your personal data.
- Data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Withdraw consent – when we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, use the data protection enquiry form.
Our lawful bases for the collection and use of your data
Under the UK GDPR, we rely on lawful bases for processing this information. You can withdraw consent at any time.
(a) Consent. You have given us permission to use your information for a specific purpose. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time using the data protection enquiry form.
You give consent when you:
- subscribe to our mailing list
- share your photos with us, for example for the postcard gallery
- agree to be credited by name on our website or social media
- tell us about access needs or a disability, so we can make adjustments for you
- agree to us quoting your feedback, with or without your name
We use Sender to send our newsletter. Sender records whether newsletters are opened and which links are selected, which helps us improve them.
We only use health and access information for the purpose you gave it for, and delete it once participation ends.
(b) Contractual obligation. We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
You could enter a contract with us as an artist, poet, Fashion Show designer, competition entrant, volunteer, or venue host.
(c) Legal obligation. We need to use your information to meet our legal duties. This includes:
- responding to data protection requests
- keeping financial records for six years, as required for charity accounts, including an accurate record of donations and payments to artists for our annual accounts and reporting
(d) Legitimate interest. We use your information where it is necessary for our legitimate interests as a community organisation, and where this does not override your rights.
Donations
We collect and keep your name, email address, and phone number when you donate, to support Kirkstall Art Trail’s financial transparency and good governance. This includes:
- maintaining clear, auditable financial records in line with UK fundraising and community governance standards
- supporting transparency in income sources, and helping guard against financial crime
- contacting you about your donation, if we need to
This information is used only for these administrative and governance purposes. It is never used to send you marketing or newsletters unless you opt in using the separate mailing list sign-up form.
Event photography and filming
We take photographs and film at our events to promote Kirkstall Art Trail, report to our funders, and keep a record of our work. General photography and filming of venues and visitors is covered by our event photography and filming notice, displayed at each venue.
You can ask not to be photographed or filmed on the day, or ask us to delete images or footage of you at any time, using the data protection enquiry form.
Where a child under 16 or an adult at risk is the specific subject of a photograph or video, we ask for consent first. We also ask for consent before filming or publishing an interview.
We may use AI tools to help write text descriptions of images for our website, so that people using screen readers can access them.
Contact form enquiries
When you contact us using the ‘contact us’ form, we use your name, email address, and message to reply to your enquiry. We only use this information to respond to you. It is never used to send you marketing or newsletters unless you opt in using the separate mailing list sign-up form.
Workshop sign-ups
When you sign up for a workshop, for example at the Bunting Festival, we use your name and contact details to arrange your place and let you know about any changes to the workshop.
Evaluation
We use applications, including unsuccessful ones, and feedback survey responses to evaluate and improve the Art Trail, and to report to our funders.
Where we get the personal information
Most of the information we hold comes directly from you, for example when you submit a form through our website, submit an application through CuratorSpace, or contact us through social media, WhatsApp, email, or phone.
We don’t routinely delete content posted to our social media channels. You can ask us to remove content about you at any time.
If you contact us through social media or WhatsApp, the platform also processes your information. We suggest you also read the privacy information of that platform. We use:
- Facebook, see the Meta privacy policy
- Instagram, see the Instagram privacy policy
- WhatsApp, see the WhatsApp privacy policy
We also get information from:
- photographs and videos taken at our events, and photos that visitors share with us
- other people, for example someone recommending a volunteer or an artist naming a collaborator
- publicly available sources, for example contact details on a venue’s website
We do not collect personal information directly from children. When we work with schools, we photograph children’s artwork but not the children. Children may appear in general photography and filming at our events, as described in our event photography and filming notice.
How long we retain your information
We review the information we hold every year and delete anything past its retention date.
How we store your personal information
We store information using the following services:
- our website, hosted by Fasthosts, including form entries stored in the website database
- Friendly Captcha, GDPR-compliant bot protection, is used to protect the website from spam, and runs only with consent
- email, hosted by Fasthosts, and Outlook.com for finance email
- Google Drive, for documents and photographs, with access restricted to the management committee
- Gmail, for Fashion Show organising
- Sender, a secure third-party website, is used to send out newsletters
- CuratorSpace, a secure third-party website, is used for artists to apply for the Art Trail
- Microsoft Forms, for feedback surveys
- Square, to process donations
- WhatsApp, to organise venues, artists, the Fashion Show, and volunteers
- Facebook and Instagram, for publishing and messages
- Canva, to design graphics such as postcards and edit videos, which may include photographs and footage of people
- Claude, an AI tool made by Anthropic, for drafting, administration, and writing text descriptions of images. We have turned off the setting that allows Anthropic to use our chats to train its AI models
Square collects your name, email address, and phone number when you donate. Square is a data controller, responsible for the personal information it processes.
Our website uses an SSL certificate, so information sent through our forms is encrypted. All accounts are protected with strong passwords, and access is limited to the people who need it.
Information stored outside the UK
Some of the services we use store information outside the UK, including in the US. Where this happens, we use services covered by UK adequacy regulations, or with other safeguards required by UK data protection law.
Who we share your information with
We share information only where we need to run the Art Trail, or where the law requires it.
We share:
- artists’ and hosts’ names, email addresses, and mobile numbers with each other, and with artist support volunteers, to organise venues
- artists’ names, and any website, social media, or online shop details they give us, on their artist profile on the venue page
- venue addresses in the public venue directory and access guides on venue pages. We do not publish hosts’ names
- event photographs and photos you share with us, with Leeds City Council, the press, and our funders, for promotion and reporting
- financial information with Leeds City Council, when we claim grant funding
- information with the Charity Commission, where required
- quotes from feedback, where you agreed, in reports to our funders and on our website
Anyone we share contact details with for the Art Trail is asked to use them only for that purpose.
We do not sell your information.
How to update information we may hold
To update personal information (for example, an email address), or to ask for inaccurate information to be corrected, use the data protection enquiry form. See also ‘right to rectification’ above.
How to complain
To make a complaint about how personal information has been used, use the data protection enquiry form.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF.
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Monitoring and review
This policy is reviewed annually, when relevant law changes, or when an organisational change affects how personal data is handled.
The policy was last reviewed on 18 August 2026