Who are we?
Cantilena Festival on Islay is a private limited company and is also a registered charity. Under the Data protection laws we are data controllers and as such are obliged to confirm to you our responsibilities when processing your personal data.
How do we collect personal data from you?
If you are an existing supporter or funder or about to become one, all of your personal data has been given to us directly by you.
What type of personal data is collected?
The personal data may include your name, any other names you have used, gender, nationality, address, email address, passport details, National Insurance number, date of birth and bank account details.
How is your personal data used and processed?
We may process your personal data:-
- to maintain email subscriber and Patron databases in our computer system;
- to maintain paper filing systems in our office;
- to complete Revenue Scotland forms necessary to deal with your actions as a supporter and/or funder we have been instructed to provide which may be digital forms accessed on a third party’s e-portal;
- to receive funds from you;
- to exercise our legal rights.
- We will not use your personal data for marketing purposes.
Lawful basis for processing
We need to have a lawful basis for processing your personal data. We have more than one lawful basis for processing your personal data and these are:-
- Necessary for receiving support and/or funds from you
It is necessary for us to process your personal data in order to liaise with you and to receive support and/or funds from you.
- Necessary for complying with legal obligations
It is necessary for complying with legal obligations in order to liaise with you and to receive support and/or funds from you.
How your personal data is stored and the length of time we shall retain your personal data
Your personal data is stored electronically and/or as hard copies. Electronic storage is on our computer files and our email services. Our email services are cloud hosted by Cloudmail and Mailchimp and our Patron services are hosted by GoCardless and Typeform. Their data storage may be outside the EU. Hard copies are kept on paper correspondence and document files stored in our office.
Generally, we shall retain personal data for so long as you remain a supporter and/or funder or for a period of 5 years after you no longer have an interest in our activities whichever is the longer. Even after that period of time if financial documents have been lodged with us and are required for indefinite safekeeping these shall be stored in our hard copy filing system (and may be stored digitally too) until such time as these are no longer required by law, or you confirm in writing to us that you want the documents returned to you or destroyed (provided we are not obliged by law to continue to retain them).
We as Data Controllers have service agreements in place with all of our third party service providers who process personal data on our behalf as Data Processors and they are bound to comply with data protection legislation.
The right to lodge a complaint
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have not dealt correctly with your personal data. The contact details of the ICO’s UK office can be found on their website https://ico.org.uk/global/contact-us/ and the contact number is 0303 123 1113. The contact details for the ICO’s Scotland office are:
The Information Commissioner's Office - Scotland
45 Melville Street
Telephone: 0303 123 1115
Request for access to your personal data
You have the right to obtain access to the personal data we hold free of charge (unless the request is manifestly unfounded or excessive or repetitive in which case we reserve the right to charge a reasonable fee for providing the information). If you request access to your personal data we must provide this within one month of such a request unless there is complexity or a number of requests in which case we may seek to extend this period of one month to three months.
Right to rectification of personal data
You have the right to have personal data rectified if it is inaccurate or incomplete.
How we keep your personal data secure
All personal data collected by us is stored on a password-protected computer backed up by a secure server and if stored in a paper or hard copy filing system, stored securely in our office or if off-site stored securely with our third party service providers. We have service agreements in place with all of our third party service providers, and they are bound to comply with data protection legislation.