Wells Operatic Society Limited – Data Protection Policy

Last updated: September 2025

Wells Operatic Society Limited ("we", "our", "us"), trading as Wells Little Theatre, is committed to protecting personal information. This policy explains how we collect, use, store, and share data across all aspects of the Society's work.

Charity number: 276308
Company number: 01377655 (company limited by guarantee)
Registered address: The Little Theatre, Chamberlain Street, Wells, BA5 2PS
Contact email: box.office@wellslittletheatre.com

We are the data controller for the information we hold. Trustees are collectively responsible for ensuring that all data is processed in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1               Scope of this Policy

This policy covers all personal data processed by the Society, including:

  • Members, patrons, life members, and volunteers.
  • Trustees and committee members.
  • Audience members and ticket holders.
  • Donors and sponsors.
  • Young performers and safeguarding records.
  • Professional advisors, suppliers, and contractors

2               What Information We Collect

We may collect:

  • Contact details – name, address, email, phone.
  • Membership/volunteer details – emergency contacts, experience, skills.
  • Ticketing information – bookings via Yapsody (ticketing), Stripe (online payments), and Zettle (in-person payments).
  • Marketing preferences – when you sign up for newsletters.
  • Donation and sponsorship records – including Gift Aid declarations.
  • Trustee/committee records – statutory details required by the Charity Commission and Companies House.

3               Special Category and Sensitive Data

We may also collect and process:

·       Health and accessibility information (to support participation and make adjustments) – lawful basis: explicit consent or substantial public interest.

·       Safeguarding information (DBS results, safeguarding records, incident reports) – lawful basis: legal obligation and substantial public interest.

·       Children's data (young performers, emergency contacts) – lawful basis: parental/guardian consent and legal obligation for safeguarding.

All such data is subject to enhanced security, restricted access, and limited retention.

4               How We Collect Data

·       Through ticket bookings online, by phone, or in person.

·       Via membership and volunteer applications.

·       Through donations, sponsorships, or Gift Aid forms.

·       When joining as a trustee, officer, or committee member.

·       Via safeguarding procedures.

·       When you contact us directly.

·       Via photography and filming at performances and events (with appropriate consent).

·       Through emergency situations (if we need to process data for health and safety reasons).

·       From references (when recruiting volunteers for positions requiring enhanced checks).

5               How We Use Data

We use data to:

  • Process ticket bookings and manage audiences.
  • Administer membership, patron, and life member schemes.
  • Manage volunteers and support trustees.
  • Promote productions and send communications (with consent).
  • Record donations, claim Gift Aid, and maintain financial records.
  • Ensure safeguarding and health & safety compliance.
  • Comply with legal, charity, and company requirements.

We do not sell personal data.

6               Lawful Bases for Processing

We process personal data under:

  • Performance of contract (ticketing, membership).
  • Consent (marketing, young performers).
  • Legal obligation (safeguarding, accounting, statutory filings).
  • Legitimate interests (running the theatre, maintaining community engagement, reporting to members, donors, and regulators).
  • Vital interests – in emergency situations to protect health and safety.
  • Explicit consent – for special category data where other lawful bases don't apply.

7               Sharing Data

We share data with trusted partners only where necessary, including:

  • Yapsody – ticketing platform.
  • Stripe – online payments.
  • Zettle – in-person payments.
  • Email provider – newsletters and communications.
  • Accountants, solicitors, insurers – professional services.
  • Regulators – Charity Commission, Companies House, HMRC (Gift Aid), safeguarding authorities.

8               Complete List of Data Processors

We work with the following trusted partners who may process your personal data on our behalf:

Ticketing and Payments

  • Yapsody – online ticket sales and booking management platform
  • Stripe – secure online payment processing for ticket sales
  • Zettle – card payment processing for on-premises ticket sales and merchandise
  • Lloyds Bank – banking services for direct transactions

Communications and Marketing

  • [Email platform, e.g. MailChimp] – newsletter and marketing communications (if used)
  • [Website host, e.g. WordPress.com] – website hosting and maintenance

Administrative Services

  • [Accounting software, e.g. Xero] – financial record keeping (if used)
  • [Cloud storage, e.g. Google Workspace] – document storage and collaboration (if used)

Professional Advisors

  • Accountants, solicitors, and other professional advisors (bound by professional confidentiality)
  • Insurance providers (for claims processing and risk assessment)

All processors are required to implement appropriate technical and organisational measures to protect your data and use it only for the purposes we specify.

Where data is transferred outside the UK (e.g. Yapsody, Stripe), we ensure adequate safeguards such as UK adequacy decisions or Standard Contractual Clauses. You can request details of these safeguards by contacting our Data Protection Lead.

9               Automated Decision Making

We do not use automated decision-making or profiling that would significantly affect you. All decisions about membership, volunteering opportunities, or other matters involve human review.

10            Data Retention

Standard Retention Periods:

  • Ticketing records – 7 years (legal/accounting).
  • Membership/volunteer records – for the duration of involvement + 3 years.
  • Trustee/committee records – 7 years after leaving (statutory).
  • Gift Aid/donation records – 7 years (charity accounting).
  • Safeguarding records – in line with statutory guidance (Working Together to Safeguard Children).
  • Life membership records – retained indefinitely to honour commitments.
  • Historical archives – selected materials may be kept permanently for heritage and research purposes (with appropriate safeguards).

11            Data Security

  • Electronic systems protected by passwords and encryption.
  • Restricted access for authorised trustees/volunteers only.
  • Paper records stored securely.
  • Regular backups and virus protection.
  • Enhanced safeguards for sensitive/special category data.

12            Data Breaches

In the unlikely event of a data breach affecting your personal information:

  • We will assess the risk and, where required, report it to the ICO within 72 hours
  • If the breach poses a high risk to your rights and freedoms, we will notify affected individuals without undue delay
  • We maintain an incident response plan to minimise any potential impact

13            Your Rights

Individuals have the right to:

  • Access the personal data we hold.
  • Request corrections, updates, or deletions.
  • Withdraw consent at any time (for marketing or participation).
  • Request restriction or object to processing.
  • Request portability of data.
  • Lodge objections to direct marketing (you can opt out at any time using unsubscribe links or contacting us directly).
  • Request information about automated decision-making (though we don't currently use this).
  • Complain to the ICO (www.ico.org.uk, 0303 123 1113).

Requests should be sent to the Data Protection Lead (see Section 12).

14            Data Protection Contacts

Data Protection Lead: [insert trustee/volunteer name]
Email: [insert contact email]
Post: Data Protection Lead, Wells Little Theatre, Chamberlain Street, Wells, BA5 2PS

Safeguarding Lead: [insert contact for safeguarding queries]

15            Photography, Video, and Audio Recording

During our productions and events, we may take photographs or recordings for:

  • Marketing and promotional purposes
  • Social media content
  • Historical archives
  • Legal basis: Legitimate interests (promotion of charitable activities) or explicit consent

Your choices:

  • We will seek consent for any photography/recording where individuals are clearly identifiable
  • You may opt out of photography at any time by speaking to front-of-house staff
  • Images of children require explicit parental/guardian consent

16            Volunteer and Member Data Protection Responsibilities

All trustees, volunteers, and members who handle personal data must:

  • Follow this Privacy Policy and our Data Protection Guidelines
  • Keep personal information secure and confidential
  • Report any suspected data breaches immediately to the Data Protection Lead
  • Complete data protection awareness training where appropriate

Unauthorised disclosure of personal information may result in disciplinary action and potential removal from volunteer roles or membership.

17            Charity-Specific Use of Data

As a registered charity and company limited by guarantee, we may be legally required to share:

  • Trustee and officer details with the Charity Commission and Companies House.
  • Data for serious incident reporting to the Charity Commission.
  • Information for annual returns and regulatory filings.

18            Policy Review and Updates

This policy is reviewed annually by the Board of Trustees and updated as necessary to reflect:

  • Changes in data protection law
  • New technologies or service providers
  • Feedback from members, volunteers, and regulators
  • Charity Commission guidance updates

Policy approval: This policy was approved by the Board of Trustees on 02/09/2025 and is due for review on 02/09/2026

Material changes will be communicated to members, volunteers, and active supporters via email and our website.