BESTIVAL GENERAL PRIVACY
Date of last revision 18 May 2018 v1.0
Bestival is committed to protecting your privacy and the confidentiality of any personal data which you provide to us.
The choice of how much information you provide to Bestival is yours and of course if you want to use Bestival’s platforms, receive Bestival news, or attend Bestival events, Bestival will require certain information from you in order to provide the platforms or conduct the events. In order to ensure we adhere to data protection legislation we will only ask for the relevant personal data required to offer you services.
The Data Controller for Bestival Ltd is based in London, UK:
3 Loughborough Street
Telephone: 020 3327 4810
Our Data Controller is:
Robert Gorham, Director, who can be contacted at email@example.com
How we collect your personal data
We want to make sure you receive the communications that are most relevant to you, be it through visiting our website or receiving emails, post, phone calls, text, through push notifications on our app, or in person.
We collect your personal data in the following ways:
When you directly interact with us – this could be if you ask about our work; when you sign up to receive emails; purchase Bestival tickets or merchandise; apply for a job or when you provide your data over the phone, by email, via the website or app, via physical mail, or in person e.g. at Bestival events.
When you interact with us through any of our partners, for example, Ticketline, and have provided your consent for your contact details to be shared with us.
When you interact with us through other third parties – this could be if you enter a competition through a third party website and provide your consent for your personal information to be shared with us.
From other information that is publicly available – in order to tailor our communications, we may collect information about you from publicly available sources, such as social media platforms and web search engines such as Google. We may use third parties who collect publicly accessible data as a service to do this ensuring that they are adhering to data protection law requirements in their collection processes before any such data is shared.
Further detail about how we collect your personal data is provided below in relation to the purposes for processing your personal data.
Our purposes for processing personal data
The following sets out all of the purposes of processing of personal data Bestival undertakes, setting out how we process your personal data to achieve the purpose:
To keep you informed about Bestival events, news and offers about Bestival, and our Bestival related events.
We will ask for your email address to provide this information to you. You will be required to ‘opt-in’ to receive emails from us and can unsubscribe at any time by clicking the ‘unsubscribe’ link at the bottom of emails, or by sending an email to firstname.lastname@example.org.
To advertise our work through digital ads
We use digital agencies to advertise Bestival through digital ads which is achieved using email addresses and cookies (please see below for further information about cookies).
If we send your details to Facebook for this purpose they will be hashed before they are sent, and Facebook only briefly uses the data for matching purposes then deletes it
If you wish to opt out of having your details provided to Facebook or other social media platforms for the purpose of targeted advertising, please contact us at email@example.com
Personal data provided to Bestival by partners
We work closely with partners such as our primary ticket agent Ticketline, and other ticket agents, to ensure our customers are provided with any information related to Bestival events. For any Bestival events we reserve the right to lawfully use legitimate interest right to contact all ticket holders, via data provided to us by our ticketing partners, prior to the event with information directly related to the running of the event. We will endeavour to ensure our partners gain your consent before any contact details are made available to Bestival for marketing purposes.
Personal Data processed for employment purposes
We process personal data for employment purposes in line with data protection legislation and employment law obligations. We require personal data when processing candidates’ applications to Bestival. For employees of Bestival we require personal data and emergency contact personal data which is kept securely and only accessible by HR staff. Direct Line Managers of staff who hold some relevant employment information about their team members or about applicants for employment are directed to take reasonable steps to ensure this personal data is held securely. For tax purposes we are legally required to keep all employment data for 7 years after which we will ensure all personal data is removed from our paper and electronic systems.
We process health data for sickness absence purposes ensuring that appropriate security controls are in place for this processing of ‘special categories’ of personal data, as defined by the General Data Protection Regulation 2018.
We retain personal data related to professional memberships to ensure required accreditations are maintained.
We use external providers for our payroll processing and pension scheme for employees. We have appropriate contracts in place to ensure the security and confidentiality of any personal data provided for these purposes.
The following sets out the technical and organisation security measures employed by Bestival to ensure your personal data is kept confidential and secure by Bestival and our partner organisations / third party suppliers
Lawful basis for processing
For most processing of personal data we will be asking for your consent, however, some processing will be based on legitimate interests or for the purposes of entering into a contract e.g. where we require certain personal data in order to provide a service you choose to use. We would only rely on the lawful basis of legitimate interests where we are assured that we would not be using your data in a way you would not expect taking into account your rights and interests.
Disclosure of Personal Information:
We may disclose your personal information to our suppliers or other external third parties for outsourcing some of the functions and services relating to the purposes for which your personal information may be processed by Bestival, for storage and otherwise to enhance our services. When we contract external services providers, we may provide them with your personal information, but only to the extent required for them to fulfil that contract, or where you would reasonably expect Bestival to disclose it to a third party for a particular purpose.
We will not sell your personal information to other parties.
Security & storage of your information:
Bestival takes reasonable steps to ensure the security of all information it collects, including that the information is protected from misuse and loss and from unauthorised access, modification or disclosure. For example, your personal information may be stored and maintained in a secure cloud-based environment, which can be accessed only by authorised personnel. Some of these services are hosted by third parties located in Europe, Australia and the United States. However, as no data transmission over the internet or information stored on servers accessible through the internet can be guaranteed to be fully secure, we cannot ensure or warrant the security of any information you send to us or receive from us online.
It may sometimes be necessary to transfer personal data overseas, in particular to Australia and the Unites States. When this is needed information may be transferred to countries or territories around the world. Any transfers made will be in full compliance with all aspects of the General Data Protection Regulation and associated legislation. Wherever your data is transferred, it may be accessed by the courts, regulatory bodies, and law enforcement and national security authorities, according to the laws in the relevant jurisdiction.
Retaining your personal data
We will retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, audit or reporting requirements. We may also retain your personal data for a reasonable period afterwards to allow us to respond to any follow up enquiries or complaints.
Your rights in relation to personal information:
Your rights in relation to how organisations process your personal data have been significantly enhanced under the new General Data Protection Regulation 2018. The following sets out how Bestival will ensure we meet all of these increased rights.
1. The right to be informed
2. The right of access
You may request access to your personal information collected by Bestival. Please send an email to firstname.lastname@example.org and we will endeavour to respond as soon as possible and in any event within one calendar month of receiving your request. There may be some legal or regulatory reason why access is denied or amendment refused. If this is so, we will tell you why.
3. The right to rectification
If you believe any of your personal information held by Bestival is not accurate, complete or up-to-date, Bestival will take reasonable steps to correct the information. You can make a request for rectification verbally or in writing. To request that your personal information be corrected or updated, please send an email to email@example.com. We will respond to your request within one calendar month.
4. The right to erasure
Also known as ‘the right to be forgotten’, you can now request for your personal data processed and held by us to be erased, unless there is another legal requirement for us to continue to process that data, in which case this will be explained to you in response to your request. You can request for us to erase your data either verbally or in writing. We will respond to your request within one calendar month.
5. The right to restrict processing
Similar to your right to request erasure of your personal data, you can request we restrict processing where you have issues with the content of the information we hold or with how we have processed your data. In these cases we would only apply the restriction for a certain period of time while we consider your request for doing so. You can request us to restrict processing either verbally or in writing. We will respond to your request within one calendar month
6. The right to data portability
Where technically feasible we will endeavour to provide you with a copy of your personal data in a format that can easily be transferred to another organisation. We will respond to your request within one calendar month. Please note this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
7. The right to object
You have the right to object to us using your data for marketing purposes or where the processing is based on legitimate interests.
8. Rights in relation to automated decision making and profiling
Bestival does not process any personal data for automated decision making or for profiling as defined by the Regulation.
Please contact us at firstname.lastname@example.org to exercise any of your rights as above.
If you have a complaint about the handling of your personal information, please write to the address provided above or send an email to email@example.com.
If you are still not satisfied with the outcome of your complaint, you may write to the Information Commissioner’s Office at the following address:
Information Commissioner’s Office
You can also contact the Information Commissioner’s Office via their “online form here”https://ico.org.uk/global/contact-us/email/.
Website Advertising and Analytics:
A pixel is a small amount of code on a web page or in an email notification which is used by organisations to learn how users are interacting with certain web content to help us improve our services and personalize your experience. Pixels use you online identifiers to do this along with an anonymised version of your social media site ID. We cannot see any personal data of individual users, but the collected data are saved and processed by social media sites.
Links to other websites
Bestival is not responsible for the privacy practices or content of any other website or service that is linked to our Website, or for the privacy practices of any third party social media or other service providers that you can access through our Website. We encourage you to read the privacy policies of those websites or service providers, including, but not limited to, our ticket agent partners, which may require you to provide additional personal information.
The IP Address (Internet Protocol Address) is a unique address that computing devices such as personal computers, tablets, and smartphones use to identify itself and communicate with other devices in the IP network.
Bestival uses IP addresses to ensure our users are directed to the correct version of our website dependant on the territory you are accessing our website from. We also use web log information provided through the IP address to understand any issues users may experiences while using our website to ensure a seamless service for our users.
What are cookies?
Cookies are small text files that are stored in your computer’s memory and hard drive when you visit certain web pages. They are used to enable websites to function or to provide information to the owners of a website.
Analytical purposes: We use analytical cookies that allow us to recognise, measure and track visitors to our Websites. This helps us to improve and develop the way our Websites work, for example, by determining whether site visitors can find information easily, or by identifying the aspects of our Websites that are of the most interest to them. For these purposes, we may store the following:
the name of the domain from which you accessed the internet
the date and time you accessed our Websites
the advert or internet address of the website from which you linked directly to our Websites
the pages you accessed while visiting our Websites
the device from which you accessed our Websites
the location from which you accessed our Websites
In addition, we use a third party service providers, to provide certain analytics services to us in connection with the operation of the Websites, including (without limitation) the collection and tracking of the data and information listed above. We may disclose visitor data, including personally identifiable information, to enable those third party service providers to provide such services. Such data may be sent to those third party service providers and their local overseas suppliers, where the standard of data protection may be lower than the country in which you reside.
Usage preferences: Some of the cookies on our Websites are activated when visitors to our sites make a choice about their usage of the site. Our Websites then ‘remember’ the settings preferences of the user concerned. This allows us to tailor aspects of our sites to the individual user.
Functional purposes: Functional purpose cookies store information that is needed by our applications to process and operate. For example, where requests within an application involve multiple stages, cookies are used to store the information from each stage temporarily, in order to facilitate completion of the overall request.
Your cookie preferences
To make full use of our Websites, your computer or mobile device will need to accept cookies, as our sites will not function properly without them. In addition, cookies are required in order to provide you with personalised features on our websites.
Third party cookies
Amending cookie preferences
Our website uses Google Analytics who provide reports on website traffic data to help us understand usage and to ensure we continue to improve your experience when using our website.
You can amend your preferences or opt-out of Google Analytics here