Privacy Notice 2027

1. Who this notice covers

This notice covers entrants, performers, children, parents and guardians, teachers, group contacts, volunteers, trustees, adjudicators, accompanists, trophy holders, supporters, mailing-list subscribers, website visitors and people who contact or complain to the Festival.

2. Information we collect

• Identity and contact details, including name, address, email address and telephone number.
• Entry information, including age or date of birth, school year where needed, class, group, instrument, performance title, author or composer and availability.
• Parent, guardian, teacher, group and emergency-contact details.
• Payment and transaction information. Full card details are handled by payment providers and are not retained by the Festival.
• Adjustment, access, welfare or health information where necessary to support participation or respond to an emergency.
• Photography and publicity preferences, official images, results, awards and trophy records.
• Volunteer, trustee and contractor information, including references, role information, training and appropriate DBS-check administration records.
• Correspondence, complaints, safeguarding reports, accident records and data-protection requests.
• Website information, including IP address, browser and device information, cookie choices, CookieYes consent records and consented Google Analytics data.

Most information is provided directly by the person concerned or by the adult making an entry. The Festival may also receive information from a parent or guardian, teacher, group organiser, volunteer referee, Festival service provider, statutory agency or another person raising a concern.

3. Children's information

The Festival knowingly processes children's information because many performers are under 18. An entry for a child must be submitted by a parent, guardian, teacher or authorised adult. Where a teacher or organisation enters a child, it must have authority to provide the information and must make this notice available to the parent or guardian.

Children's information is used only for Festival administration, age eligibility, scheduling, safeguarding, legal compliance, reasonable adjustments, programmes, results and authorised publicity. A child must not create or submit an entry directly.

4. Why we use information and our lawful bases

5. Programmes, results and publicity

• The public programme may include the performer's name, group name, class or age band and performance title. A school is not identified unless it is the entered group name.
• Results may be published on the Festival website, Facebook page or in local media. Publication is occasional and proportionate.
• An entrant may request that their name is withheld for a genuine safeguarding reason. The Festival will consider the request before publication wherever practicable.
• Official photography is optional. Consent is obtained at entry and checked before photographs are taken. Consent can be withdrawn for future use, although the Festival may not be able to recall material already lawfully printed or published.

6. Who receives information

• RunMyFestival, operated by Mushram Ltd, is the Festival's current online entry platform for the 2027 Festival. It handles online account information under its own privacy notice and processes Festival entry information through the service.
• Play and Perform is the Festival's former entry platform. It is not the intended route for 2027 entries, but limited earlier entry records may remain there temporarily for administration, queries and deletion in line with the retention periods below.
• PayPal and SumUp for payments and transaction administration.
• Kualo for website hosting, Google for email and Google Analytics, CookieYes for cookie-preference management and consent records, Apple iCloud for restricted document storage, and Mailchimp for the opt-in mailing list.
• Meta where results, news or consented images are published on Facebook.
• Brailsford Printers for programme production. The supplied programme file must be deleted after printing is completed.
• Adjudicators and official accompanists. Adjudicators receive programme information. Accompanists receive the performer name, class number and performance item.
• An appointed photographer or videographer, acting under Festival instructions and the recorded consent preferences.
• BIFF, rights holders, insurers, professional advisers, venues, local authorities, safeguarding agencies, police or regulators where necessary.

The Festival controls how entry information is used for Festival purposes. RunMyFestival and Play and Perform also publish their own privacy information about the data they collect and their respective responsibilities. Entrants should read the relevant platform notice as well as this notice.

Some providers may process information outside the UK. Where this occurs, the Festival relies on the provider's lawful transfer arrangements, such as adequacy regulations or approved contractual safeguards, and considers the information and settings used.

7. How long we keep information

• Routine entry and contact records: 24 months after the relevant Festival.
• Earlier entry records held in Play and Perform: deleted when no longer needed and, in any event, within the same 24-month period unless another listed exception applies.
• Financial and accounting records: six years after the end of the relevant accounting period.
• Uncollected adjudicator remark sheets: one month after the Festival. Submitted adjudication material and backing tracks are deleted when no longer operationally required, normally within one month.
• Trophy-holder contact details: until the trophy is returned and any issue resolved, normally by the conclusion of the following Festival.
• Historical programmes, winners' names, awards and results: retained permanently as a proportionate Festival archive, without routine contact details and subject to safeguarding objections.
• Official photographs: selected archive and publicity images are retained until consent is withdrawn or continued use is no longer appropriate. Rejected or unused images are deleted within 12 months.
• Safeguarding, complaint, accident, volunteer, DBS-administration and breach records follow the Festival's internal retention schedule and may be held for longer.
• Mailing-list information: until consent is withdrawn or the address has been inactive for 24 months, after which consent will be refreshed or the record deleted.
• CookieYes consent records: normally up to 12 months after the choice is recorded or renewed, unless a record is needed longer to demonstrate compliance or deal with a complaint.
• Google Analytics event-level information: no more than 14 months. Aggregate reports that no longer identify a visitor may be kept for longer.

8. Security

Access is limited to the Chair and relevant Section Co-ordinators according to need. The Festival uses access controls, strong passwords, two-factor authentication where available, device security, restricted folders and secure sharing. Access is removed when a role ends. Safeguarding records are separated from routine entry records.

Festival records currently stored through a personal Apple iCloud account are treated as Festival-controlled records. They must be held in a separate restricted location, protected by account and device security, excluded from family sharing, backed up appropriately and transferred or deleted when the responsible officer changes.

CookieYes is used to prevent non-essential website technologies from operating before a visitor makes a choice. Google Analytics is disabled unless the visitor accepts analytics cookies. Visitors may later change or withdraw their choice through the website's cookie-preference control.

9. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, or withdraw consent. Send requests to contactus@donvalleyfestival.org.uk. The Festival may need proof of identity and may refuse or limit a request where the law permits.

If you are dissatisfied, raise the concern with the Festival first so it can investigate. You also have the right to complain to the Information Commissioner's Office.

10. Data breaches

Anyone working for the Festival must report a suspected loss, misdirection, unauthorised access or disclosure immediately to the Chair. The Festival will contain and record the incident, assess risk, notify the ICO within 72 hours where legally required and notify affected people without undue delay where the risk is high.

11. Contact and review

The Committee reviews this notice annually and when services, suppliers, law or Festival practice change.