Last Updated: 27th May 2021
1. Introduction
BAFTA has always believed in being open about what data we collect from our members and what we do with it. UK data privacy legislation sets out comprehensive requirements for handling the personal data of UK citizens. This includes a number of things we must tell you of when we collect data from you. We have provided all the information you need as simply and clearly as possible through this Privacy Policy using a question-and-answer format.
2. What data will be collected about me?
We collect the following details:
- Your name and email address
- Payment details (although these our not stored by our systems)
- Contact details such as phone number and a postal address where this is necessary
- Details of any special requirements you have in relation to events you are attending such as dietary requirements, allergies or access requirements
- In some cases we may need you to confirm that you are old enough to attend
Some events may require other more specific information e.g. your area of interest or expertise. Where this is required we will provide more information about how we use the data as part of the booking experience.
2.1. Address and Other Contact Details
We collect address and other contact details so that we can send you letters and emails to do with the administration of the events you attend, or have expressed an interest in. We will also use these details to send you surveys relating to events you have booked so that we can understand our audience and gather feedback to improve future events.
2.2. Payment Details
If payment is required then we collect payment details, but these are passed to a third party payment provider and are not stored by any BAFTA systems.
2.3. Your Attendance At Events
Some events will include checking tickets on the door and may store details of which events you have actually attended. If you have booked tickets and then fail to attend this will also be recorded and in some cases we may impose sanctions on users who are consistent no-shows.
When you are making a booking on behalf of someone else, or bringing guests with you, then we may require that you supply the names of your guests in advance. Your name and the names of your guests may be passed on to the venue and security team solely for the purposes of confirming identity on arrival.
2.4. Website Analytics
In common with most other websites we use website analytics software which collects data about how people use our website. However, this is anonymised and cannot be traced back to you. We use this to help make sure our web servers are working well and to see which parts of our websites are most/least popular. This helps us to improve the overall user experience.
3. Why is this data collected?
We record only the information we need to enable us to run and secure the events you have booked and collecting subsequent feedback on these events. By booking a ticket for an event you are entering into an agreement as set out in the terms and conditions displayed on the ticket and during the booking process. Processing your data is necessary for us to provide the service which you have booked.
In other words, this means that the lawful basis for processing your data in this case is Article 6(1)(b) of GDPR: "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"
As far as contacting you after an event for feedback is concerned, we collect this data to understand our audience and improve future events. As such the collection and processing of this data is in BAFTA's legitimate interests and the lawful basis for this processing is Article 6(1)(f) of GDPR: "processing is necessary for the purposes of the legitimate interests pursued by the controller".
4. Who is responsible for my data?
Any data collected about you in relation to any BAFTA events will be kept under BAFTA's control. BAFTA is registered charity (No. 216726) and can be contacted using the following details:
Postal:
The Data Controller
BAFTA
195 Piccadilly
W1J 9LN
Email: [email protected]
5. How long will you keep my data for?
5.1. Payment Data
We will not store your payment data. We use Stripe ( https://stripe.com/ ) to process payments. Stripe will store details of the transaction, but will not store your credit card number.
5.2. All Other Data
All other data we hold about you will be kept for 4 years after the date of your last login to the system. At this point your personal data will be erased from the system and all data about your bookings will be anonymised.
You also have the option of deleting your account on the “settings” page. If you delete your account we will immediately delete your personal data and anonymise all data about your bookings.
6. Where will my data be stored?
Your data will be stored on web servers which are managed and run by Amazon Web Services ( https://aws.amazon.com/ ) in Ireland. For information about the security of your data in the AWS cloud check out these links:
BAFTA staff may also occasionally download attendee lists for specific events to BAFTA’s systems in our HQ in London.
7. Who will have access to my data?
Staff within BAFTA whose duties require it will have access to our events system. This includes staff in the Scotland, Wales and North American branches who also use the system to administer their events.
Some technical tasks, such as configuring and securing our servers, require specialist expertise. We use specialist UK-based contractors to provide these services. These contractors are carefully vetted. All contractors must sign non-disclosure agreements which include a requirement that they keep all BAFTA's data confidential.
Depending on the nature of the event we may need to pass any or all of the following details about you to the event organisers:
- Attendee names
- Dietary requirements
- Allergies
- Access requirements
- Age
- Contact details (email address or phone number)
We will also pass your details to law enforcement agencies if we are required to do so by law.
We will not pass on or sell your details to anyone else.
8. What rights does the UK GDPR give me?
Here is a summary of the main provisions of the UK GDPR which are relevant to the type of data we hold about you:
Access: You have the right to view the data we hold about you and to receive copies of this data in digital format.
Accuracy / rectification: If any of the data we hold about you is incorrect or incomplete then you can provide the correct or complete data and we must update the data we hold.
Erasure: You can request that we erase all the data we hold about you, but this is only available in some situations.
Restriction of processing: In some cases you can ask us to retain your data but not do anything with it.
9. How do I exercise my UK GDPR rights?
If you want to exercise any of your rights in relation to data BAFTA holds about you then please email: [email protected] or write to the Data Controller at the address given above (see "Who is responsible for my data?")
Please provide details in your email/letter of what actions you would like us to take. Depending on the nature of the request and whether or not your request comes from the email address we have on file for you, we may need to verify your identity so that we don't give out information to the wrong person, or delete the wrong person’s information. In most cases it helps if you are able to provide a contact phone number so that we can validate your identity and discuss the request with you.
10. What if I have a complaint?
If you are concerned about how we manage your data, or how we have handled a request to exercise your rights, then please get in touch with us to discuss it. To do this please send an email detailing your concerns to [email protected].
If you are still not satisfied with the response you can take your concern to the Information Commissioner's Office. For details of how to do this please refer to the ICO web site:
