Date of production of policy April 2019

GDPR Data Protection and Privacy Policy

At Magic Carpet, we’re committed to protecting and respecting your privacy.
This Policy explains when and why we collect personal information about people, how we use it, the conditions under which we may disclose it to others and how we keep it secure.
We may change this Policy from time to time so please check occasionally to ensure that you’re happy with any changes.
Any questions regarding this Policy and our privacy practices should be sent by email to info@magiccarpet-arts.co.uk or by writing to Magic Carpet, Exeter Phoenix, Gandy Street, Exeter, EX4 3LS Alternatively, you can telephone 01392 422938.

Who are we?

We are Magic Carpet (registered charity (1122778). The registered address is Exeter Phoenix, Gandy Street, Exeter, EX4 3LS.

How do we collect information from you?

We obtain information about you when:

• You, a family member or someone you care for attends a Magic Carpet
  activity.
• You make a donation to Magic Carpet
• You purchase tickets to events or activities.
• You contact us by post, phone or email to make an enquiry.

What type of information is collected from you?

The personal information we collect might include your name, address, email address and telephone number. If you make a donation online or purchase a ticket to an event your card information will not be held by us, it is collected by our third party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions, as explained below.

How is your information used?

We may use your information to:

•  Contact you or your next of kin regarding our activities or health and safety issues or concerns.
• process a donation that you have made;
• process orders that you have submitted;
• to carry out our obligations arising from any contracts entered into by you and us;
• dealing with entries into a competition;
• seek your views or comments on the services we provide;
• notify you of changes to our services;
• send you communications which you have requested and that may be of interest to you. These may include information about campaigns, appeals, other fundraising activities, activities or events.
• process a job application.

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations (for example the collection of Gift Aid). We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us.

Who has access to your information?

We will never sell or rent your information to third parties.
We will never share your information with third parties for marketing purposes.

Third Party Service Providers working on our behalf: In rare circumstances we may pass your information to our third party service providers, agents subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes.
When you are using a secure online donation pages, your donation is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us.

Your choices

You have a choice about whether or not you wish to receive information from us. If you do not want to receive direct marketing communications from us about the work we do our and exciting products and services, then please specify.
We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted. You can change your marketing preferences at any time by contacting us by email; info@magiccarpet-arts.co.uk or telephone on 01392 422938.

How you can access and update your information

The accuracy of your information is important to us. We’re working on ways to make it easier for you to review and correct the information that we hold about you. In the meantime, if you change email address, or any of the other information we hold is inaccurate or out of date, please email us at: info@magiccarpet-arts.co.uk. Alternatively, you can telephone 01392 422938.

You have the right to ask for a copy of the information Magic Carpet hold about you we may charge a nominal fee for information requests) to cover our costs in providing you with details of the information we hold about you. 

Security precautions in place to protect the loss, misuse or alteration of your information 

Non-sensitive details (your email address etc.) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems.

Statements for Documentation

Confidentiality and Data Protection: The information you provide will be used by Magic Carpet to support the services you, a family member or someone you care for accesses from us. No data will be published or shared which can identify an individual.

Consent
Magic Carpet is only required to obtain someone’s consent if there is no other legal basis for processing their personal data. If we are required to obtain consent, we will ensure that the following requirements are met: 

• The consent is freely given. 
• The person giving consent understands fully, what they are consenting to.
• There must be a positive indication of consent (opt-in as opposed to opt-out). 
• The person giving consent must be able to withdraw their consent at any time. 
• Consent should be documented so that it may be referred to in the future, if necessary.

Participants will be asked to sign a separate form to consent to the use of their image on social media and in promotional material.