.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
You Will Be is Trademarked | Website designed by Jorvik Web Dev
You Will Be C.I.C.
Last updated: [DATE]
You Will Be C.I.C. is a Community Interest Company registered in England and Wales, based in Malton and working across Ryedale and North Yorkshire.
We are the data controller for the personal data described in this policy.
Company number: [COMPANY NUMBER]
Registered office: [REGISTERED ADDRESS]
Contact email: [EMAIL]
ICO registration number: [ICO NUMBER, if registered]
If you have questions about this policy or how we handle your data, please contact us at [EMAIL].
This policy explains what personal data we collect, why we collect it, what we do with it and what rights you have. It applies to our website, our events and projects, and our wider community work.
Depending on how you interact with us, we may collect:
Contact and enquiry data — name, email address, phone number, and the content of your message when you contact us or sign up to hear from us.
Artist and participant data — name, contact details, studio or practice address, images of your work, biography, website and social media links, and any other information you provide when applying to take part in Ryedale Open Studios, the Malton Sculpture Trail, Unearthed or other projects.
Business and partner data — name, role, organisation, contact details for local businesses, venues, stakeholders and collaborators.
Consultation and feedback data — responses to public consultations, surveys and feedback forms. Where these include demographic information, this is usually collected anonymously or with your consent.
Event data — booking details, attendance information, and any accessibility or dietary requirements you tell us about.
Volunteer data — name, contact details, availability, emergency contact, and any information relevant to the role.
Photography and film — images and footage captured at our events and projects.
Technical data — IP address, browser type, device information, and how you use our website. See our [Cookie Policy] for detail.
Some information is treated as more sensitive under data protection law, for example health information (such as accessibility requirements) or demographic data collected for equality monitoring.
Where we collect this, we do so with your explicit consent, or because it is necessary to provide reasonable adjustments, or for equality monitoring purposes carried out in the substantial public interest. We keep this data to a minimum and restrict who can access it.
[DECISION NEEDED] If you collect equality monitoring data for funders (likely, given YNYCA funding), confirm whether this is anonymous. If it is genuinely anonymous, it falls outside GDPR entirely and can be described as such. If it is linked to a named person, the "substantial public interest" condition requires an appropriate policy document under Schedule 1 of the Data Protection Act 2018 — worth checking with your funder what they actually require.
Some of our work involves schools, families and young people.
Where we engage with children under 13, we obtain consent from a parent or guardian. Where we work through schools, the school is usually responsible for obtaining consent, and we work to the school's own safeguarding and data protection arrangements.
We do not collect more information about children than we need, and we do not use it for marketing.
[DECISION NEEDED] If you have a separate safeguarding or child protection policy, reference it here. Funders and schools will look for this.
What we doWhyLawful basisRespond to your enquiryTo answer your questionLegitimate interests — responding to people who contact usProcess artist applicationsTo assess and administer participationContract, or steps taken at your request before entering a contractAdminister events and bookingsTo run the event you have bookedContractSend newsletters and updatesTo keep you informed about our work ConsentWork with businesses and partnersTo deliver collaborative projectsLegitimate interests — running our activitiesManage volunteersTo organise and support volunteeringLegitimate interests, and contract where applicablePublic consultationTo design projects around community needLegitimate interests — consulting the community we serveReport to funders To meet our funding obligationsLegal obligation, or legitimate interestsPhotography and film at eventsTo document and promote our workLegitimate interests, or consent where an individual is identifiable and the focus of the image Website analyticsTo understand and improve our siteConsentAccounting and statutory recordsTo meet our legal duties as a CICLegal obligation
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights. You can ask us for details of that assessment.
We photograph and film our events to document our work, report to funders and promote future activity.
Where an image is a general crowd or wide shot, we rely on legitimate interests. Where an individual is identifiable and the clear focus of an image, we ask for consent, and we ask for consent for images of children.
We signpost photography at events. If you do not want to be photographed, please tell a member of the team, or contact us afterwards at [EMAIL] and we will remove the image from our own channels where we reasonably can.
Note: once an image is published to social media or included in a funder's report, removal isn't always fully within your control. This wording reflects that honestly rather than promising more than you can deliver.
If you sign up to hear from us, we will send you updates about our projects and events.
You can unsubscribe at any time using the link in any email, or by contacting us at [EMAIL]. We will act on your request promptly.
We do not sell your data or share it with third parties for their own marketing.
We do not sell your personal data. We may share it with:
Service providers who help us operate, such as our website host, email and newsletter platform, booking or ticketing platform, and cloud storage provider. These act on our instructions under a written contract.
Funders, including York & North Yorkshire Combined Authority, where we are required to report on our activity. This is usually aggregated or anonymised. Where individual data is required, we will tell you.
Partner organisations where you have applied to a jointly delivered project, and only with your knowledge.
Professional advisers such as our accountants or legal advisers, where necessary.
Authorities, where we are required to disclose information by law, or where disclosure is necessary to protect someone from harm.
[DECISION NEEDED] List your actual processors by name. The ICO expects specificity, and people reasonably want to know if their data sits in Mailchimp, Eventbrite, Google Workspace and so on. Add the real list before publishing.
Some of our service providers may store or process data outside the UK.
Where that happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations covering the destination country, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
[DECISION NEEDED] If all your providers are UK or EU based, you can simplify or remove this section. Most CICs using US-based tools like Mailchimp or Google will need to keep it.
We keep personal data only for as long as we need it.
DataRetentionEnquiries[2 years] from last contact Newsletter subscribersUntil you unsubscribe, then [1 year] to honour your requestArtist and participant recordsDuration of the project plus [6 years]Unsuccessful applications[1 year] from decision Event bookings[2 years] after the eventVolunteer recordsDuration of volunteering plus [2 years] Consultation responses[3 years], usually anonymised sooner Photography and filmIndefinitely as part of our archive, unless you ask us to remove an image Funder reporting recordsAs required by the funding agreement, typically [7 years]Financial and statutory records6 years plus the current financial year
When data is no longer needed, we delete it or anonymise it securely.
[DECISION NEEDED] The bracketed periods are reasonable defaults, not answers. Check your funding agreements — YNYCA and similar funders often set minimum retention periods that override what you'd otherwise choose. The "indefinitely" on photography is defensible for an archive but only if you say so plainly, which this does.
We take appropriate technical and organisational measures to protect personal data, including access controls, secure storage and limiting access to those who need it.
No system is completely secure, but we take our responsibilities seriously and review our arrangements regularly.
Under UK data protection law you have the right to:
To exercise any of these rights, contact us at [EMAIL]. We will respond within one month. There is no charge, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
We may need to verify your identity before we act on a request.
If you are unhappy with how we have handled your data, please tell us first at [EMAIL] so we have the chance to put it right.
You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
We may update this policy from time to time. The date at the top shows when it was last revised. Where changes are significant, we will tell you directly if we can.
For anything relating to this policy, or to exercise your rights, contact [EMAIL] or write to us at [REGISTERED ADDRESS].