Our contact details
Name: Data Protection Officer
E-mail: info@kirkstallarttrail.co.uk
Website: kirkstallarttrail.co.uk
To make a request or raise a concern, use the data protection enquiry form.
What personal information we collect and why
We currently collect and process the following information:
- basic personal identifiers, contacts and characteristics – for example, name and contact details, or photographs
- financial identifiers – for example, payments to artists or volunteers or payment received by Kirkstall Art Trail
- special categories of data – health data, only for specific purposes and where it is ‘necessary’, for example, disclosing a disability
We do not collect other ‘special categories of data’ (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data where used for identification purposes, a person’s sex life, or their sexual orientation), nor ‘criminal offences data’ (personal data relating to criminal convictions and offences or related security measures).
Your data protection rights
Under UK data protection law, we must have a ‘lawful basis’ for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
The lawful basis we rely on may affect your data protection rights, which are set out in brief below.
- Access – you have the right to ask for copies of your personal information. You can request other information, such as details about where personal information is obtained from and who it’s shared with. There are some exemptions, which means you may not receive all the information requested.
- Rectification – you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Erasure – you have the right to ask us to delete your personal information.
- Restriction of processing – you have the right to ask us to limit how we can use your personal information.
- Object to processing – you have the right to object to the processing of your personal data.
- Data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Withdraw consent – when we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, use the data protection enquiry form.
Our lawful bases for the collection and use of your data
Under the UK General Data Protection Regulation (UK GDPR), we rely on lawful bases for processing this information. You can withdraw consent at any time.
(a) Consent. We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time and can do this using the data protection enquiry form.
You give consent when:
- subscribing to the mailing list, to receive the newsletter
- filling out the contact us or data protection enquiry form
- using your name and/or photograph on the website and social media
- signing up for an activity
(b) Contractual obligation. We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
You could enter a contract with us as an artist, volunteer, or venue host.
(c) Legitimate interest. We collect and retain your name, email address, and phone number during the donation process, to support Kirkstall Art Trail’s financial transparency and good governance as a community organisation. This includes:
- maintaining clear, auditable financial records in line with UK fundraising and community governance standards
- supporting transparency in income sources, helping guard against financial crime
- providing an accurate audit trail of incoming funds for annual accounts and reporting
This information is used only for these administrative and governance purposes. It is never used to send you marketing or newsletters unless you independently opt in via the separate mailing list sign-up form.
Where we get the personal information
Your personal information is supplied directly from you.
How long we retain your information
Personal identifiers and contact information are kept for up to two years following the end of any participation, to allow for charitable evaluations, unless earlier disposal is requested.
If you have consented to be credited on the website, for example, the postcard galleries, or a news post, we will retain your name unless you ask for its removal.
Health and disability data (access information) is deleted once participation ends, unless earlier disposal is requested.
If you have signed up to the mailing list, this information is kept until consent is withdrawn, at which point it is securely deleted from our database. Unsubscribing through the newsletter, sent via Sender, also removes your details from that database.
Data held is reviewed annually, and anything past its retention date is destroyed.
How we store your personal information
Information is securely stored.
- The website is secure, with an SSL certificate.
- Form entries are stored locally on the website database.
- Friendly Captcha, GDPR-compliant bot protection, is used to protect the website from spam, and runs only with consent.
- Sender, a secure third-party website, is used to send out newsletters.
- CuratorSpace, a secure third-party website, is used for artists to apply for the Art Trail.
- Outlook, a secure email client, is used for email.
- Google Drive is used to store some data, encrypted in transit and at rest. Access is restricted to the management committee.
- Square is used to process donations, automatically collecting name, email, and phone number. Payments are PCI-compliant and encrypted, and Square acts as a data controller responsible for the personal data it processes.
All accounts are protected with a strong password, and strict data management protocols are in place.
How to update information we may hold
To update personal information (for example, an email address), or to ask for inaccurate information to be corrected, use the data protection enquiry form. See also ‘right to rectification’ above.
How to complain
To make a complaint about how personal information has been used, use the Data protection enquiry form.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF.
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Monitoring and review
This policy is reviewed annually, when relevant law changes, or when an organisational change affects how personal data is handled.
Review
The policy was last reviewed on 18 August 2026