Privacy Policy

Personal data we collect

We collect and process a range of personal data, that is, information about an identifiable individual. We only collect data that is necessary to provide you with the services requested, to keep you informed and to carry out our business. There are occasions where you can limit the information you provide to us, but please bear in mind this may limit the service or level of personalisation we can offer.

What is Personal Data?

Personal data means any information which could be used to, directly or indirectly, identify you – such as your name, email address, an online identifier, telephone number, postal address, IP address or one or more other factors including physical, economic, cultural or social identity.

What is processing? 

Processing means performing an action with your personal data. This could be saving your information as part of you getting in contact with us via our website, purchasing something, registering for an event, subscribing to our newsletter list, or applying for a job or trustee position. Processing also relates to us sending you emails, actioning a subject access request response, and updating or deleting your data in line with your personal data rights.

What is a Data Controller?

A Data Controller is an organisation, public authority, agency, other body or legal person that is responsible for and determines the purposes and means for processing the personal data they collect. A Data Controller can pass your personal data to a Data Processor who would carry out the processing of your personal data on their behalf, for example, to send you an email. Andro and Eve is a data controller.

What is a Data Processor?

A Data Processor is an organisation, public authority, agency, other body or legal person that processes your personal data on behalf of a Data Controller. Andro and Eve may use, for example, the services of another company to send email communications to you on our behalf. In order to do this, we would need to provide the third-party organisation with some of your personal data in order for them to fulfil their obligations.

Information we collect directly from you

We collect certain information directly from you. This may be via our website (for example data that you provide by filling in forms on our websites, including data provided at the time of requesting our newsletters, buying from our shop or tickets to an event), when you enter a competition, when you make a request or query, whether by email, or via our website. You may provide some of this data to us when attending one of our events, to one of our staff, or or by completing forms or surveys.

Examples of the types of personal data we may collect from you are as follows:

• contact details (for example, name, telephone number, email)
• demographic information (for example, date of birth or nationality)
• information relating to other members of your party and/or participants at any event
• your credit card details or other details that may be required to process a purchase on our shop or a donation; either a one-off or a regular donation. 
• your preferences, interests and previous activities with Andro and Eve, such as; events you have attended, donations you have made, purchases from our online shop and tickets purchased for our events.
• your views, opinions, questions and comments
• records of your correspondence with us
• details of your visits to our website and the resources you access
• data entered on our websites on our contact forms

Information we collect from third parties about you

Some of the information we hold about you may be provided to us via third-party sources (i.e. from someone who is not part of Andro and Eve). For example:

• You may post reviews or other content relating to Andro and Eve via third-party social media platforms and channels, such as Facebook, Google or Instagram
• We are sometimes required to undertake checks on the sources of funds for large donations and other contributions from supporters. t This may include information obtained from third parties such as Companies House

We recommend that you check the privacy policy/ notice and statements of any third parties that you provide information to, as we are not responsible for the way in which they use, share or make available your personal data.

Information collected by us automatically about you

As you interact with our website, we may automatically collect analytics data about your equipment, browsing actions and patterns, to provide you with the best experience and help you to make use of certain functionality such as online shopping. We collect this data by using cookies, server logs and other similar technologies. 

You can set your browser to refuse all or some browser cookies or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our website may become inaccessible or not function properly.

What are Cookies?

When browsing our website www.androandeve.com anonymous data is collected by cookies. A cookie is a small piece of data that is sent from Andro and Eve’s web server to your browser. It is stored on your hard drive. A cookie cannot read data off your hard disk other than the cookie itself, files created by other websites, and will not damage your system. You can reset your browser to refuse cookies or alert you when a cookie is being sent. Andro and Eve does not use cookies to identify you.

In order to improve our website, we may analyse information about how you use it and the content you interact with. We use Google Analytics to do this but this data is anonymous.

Google Analytics processes information about:

• The pages you visit on our website
• How long you spend on each webpage
• How you got to the site
• What you click on while you’re visiting the site.

We make sure you cannot be directly identified by Google Analytics data. We do this by using Google Analytics’ IP address anonymisation feature and by removing any other personal data from the titles or URLs of the pages you visit. We will not combine analytics information with other data sets in a way that would directly identify who you are. 

Children’s personal data

Our services are not designed for, or intentionally targeted at, children 13 years of age or younger. We do not intentionally collect children’s personal data (anyone under 13 years old) without ensuring we have explicit consent from the parent or guardian. The exception to this is safeguarding disclosures where we may collect data, including special category data (see below), on children or vulnerable adults without their explicit consent or that of a parent/guardian, due to the nature of the information.

If you believe a person under 13 years old has provided us with their personal data, other than for safeguarding reasons, or have any concerns regarding this aspect of our notice, please contact hello@androandeve.com

Special category data

Special category personal data is that which is considered more sensitive, for example, revealing your political or religious beliefs or concerning your health or ethnicity.

This type of information is sometimes necessary to ensure you can enjoy Andro and Eve’s events. For example, we may need information regarding accessibility requirements or dietary requirements so that you are able to access and enjoy our workshops and events. It is part of Andro and Eve’s Equity and Inclusivity policy to provide as similar an experience as possible to all visitors and individuals, regardless of any disability.

If you respond to one of our audience surveys we may ask you to complete optional questions relating to special category data such as ethnicity in order to meet our equality monitoring obligations and to understand and improve the diversity of our audiences. This data is anonymised and cannot be used to identify individuals.

We will only collect and process special category data about a child or vulnerable adult where we meet the necessary requirements to do so under data protection law which includes processing for the vital interests of the child/ vulnerable adult, in the context of legal claims, for reasons of substantial public interest and in the context of health or social care.

Our legal basis for processing your data

The legal basis for processing personal data in relation to site security is our legitimate interests, and the legitimate interests of our users, in ensuring the security and integrity of Andro and Eve. The legal basis for processing data collected with Google Analytics is your consent.

The legal basis for processing all other personal data is that it’s necessary to perform our duties as a Company Limited by Guarantee and in the exercise of our functions as an arts organisation and employer.

Why we use your personal data

The law requires us to ensure we have a lawful basis for processing your personal data. We only use your personal data when we believe it is lawful to do so.

Sometimes, we may ask you to consent to our collection and use of your personal data for certain purposes. Where this is the case, you can change your mind and withdraw your consent at any time by emailing us at hello@androandeve.com

Otherwise, we process your personal data usually because it is necessary for one of the following lawful reasons:

• the performance of a contract that you enter in to with us

For example, if you purchase an item from our online shop, tickets to an event or workshop then we must deliver our obligations under the contract we have with you as a result, and your personal data will often be required in order for us to do this.

• our legitimate interests or those of a third party

For example, we believe it is in our interest as a queer arts organisation providing accessible opportunities for all kinds of people to access queer culture to keep certain people who have attended our events informed of ongoing and future activities and opportunities with Andro and Eve.

• compliance with a legal obligation

For example, the law requires us to retain certain information about donations and transactions for tax and audit purposes.

• for your vital interests

For example, safeguarding disclosures relating to children or vulnerable adults, or in relation to certain events where you may be requested to provide emergency contact details or similar information.

In relation to any marketing or promotional messages from us, you can always opt out of receiving these. If you no longer wish to receive email communications from Andro and Eve you can unsubscribe by clicking ‘unsubscribe’ from the link in any of the emails you receive from us. 

How we use your personal data

We use your personal data for:

• Providing and delivering our services, goods or information you have requested from us.
• administering donations and our relationships with supporters including processing any payments.
• Gathering feedback.
• Managing activities related to any events or projects.
• Fulfilling and responding to requests from you, or made on your behalf.
• Analysis of our audiences, participants and supporters to help us improve our understanding of our audiences and ensure that our programme, projects, marketing activities and individual engagement are as relevant, effective and appropriately targeted as possible.
• Communications with you including newsletters, marketing and promotional messages or surveys providing information relating to offers, events, opportunities, new services or new activities of Andro and Eve. 
• Running competitions and dealing with competition entries and results
• For our internal operational and management purposes including record keeping, staff recruitment and management
• Ensuring content from our websites is presented to you in the most effective manner for you and for your computer

Do you have to provide personal data?

If we need to collect personal data by law, or under the terms of a contract we have with you, and you choose not to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to deliver an item to you, or to sell you a ticket to an exhibition). In this case, we may be unable to process a transaction and/or may have to cancel something you have requested from us – but, we will notify you if this is the case at the time.

Data Sharing

Where appropriate, your personal data may be accessed by and shared with all parts of Andro and Eve as an organisation. We will never sell your data.

A number of third-party service providers are engaged by Andro and Eve to assist in the provision of our services, our operations and the running and maintenance of our systems. For example, when you make a payment to us this is likely to be processed via secure third-party payment process providers, and many of our systems are maintained and supported by external specialist providers.

When we use third-party service providers, we disclose only the personal data that is necessary to deliver the service. 

We do not share your personal data with others unless we are employing the services of a Data Processor in order to fulfil Andro and Eve’s business activities and, in some cases, your data may be transferred outside of the European Economic Area (‘EEA’). Listed below are the Data Processors we use together with links to their privacy policies:

• For our newsletter we use Mailchimp. View their Privacy Statement
• For event and workshop bookings we use Eventbrite. View their Privacy Policy
• For online workshops or talks we use Zoom. View their Privacy Policy.

Your data is held securely in MailChimp and Eventbrite platforms in compliance with GDPR rules. These third-party sites have been properly checked for their compliance with privacy laws.

Sometimes we may ask for your permission to share your details with others. For example, if you attend a workshop or course, we may ask if delegates are happy for us to share their contact details with other delegates. We do not share details unless consent has been given. 

Data security and retention

Keeping your personal data secure is very important to us and as such, we have implemented 

appropriate security measures and procedures in place to protect your personal data from unauthorised access, disclosure, alteration and destruction. 

We limit access to your personal data to those employees, agents, contractors and other third-parties who have a business need to know. They will only process your personal data on our instructions (which, in the case of our employees and contractors, are set out in our policies) and they are subject to a duty of confidentiality.

We regularly review and update our procedures to deal with any suspected personal data breaches. In the event of any suspected personal data breach we will notify the individuals affected and the applicable data protection regulators, where legally required to do so.

International data transfers

Personal data may be transferred outside of the UK to other third-party service providers incidentally in the course of our activities. We will take steps to ensure that adequate protection is provided for information transferred overseas as required under data protection legislation.

Data collected by Google Analytics and Mailchimp may be transferred outside the EEA for processing. This will be reviewed annually in line with Andro and Eve’s organisational policies review.

Data retention

We aim to keep personal data only for as long as is necessary to fulfil the purposes for which the data was collected. 

By law, we have to keep certain basic information about our customers and supporters and their transactions with us for specified periods of time. If you would like further information on this please email hello@androandeve.com

Opting out of marketing

You can ask us to stop sending you newsletters and marketing messages at any time by:

• following the opt out (unsubscribe) link on any marketing message sent to you
• if you make a regular donation by contacting us at hello@androandeve.com

We will implement your request as promptly as possible, but it can take up to 21 days to remove you from our mailing list, so you may still receive marketing communications during this time.

Where you opt out of receiving these newsletters and/or marketing messages, we keep a record of this so that we don’t contact you again. We may also need to retain and use your personal data for other purposes (such as making bookings and other financial transactions).

Your data protection rights

You have a number of legal rights in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which, if applicable, will be shared with you at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation that makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use, or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time of your request.

These don’t apply in all circumstances, as there are also legal exemptions which may apply, depending on why we have collected the data, and the legal basis on which we are holding the data. We will be happy to explain if you have questions about this.

You can contact us at hello@androandeve.com if you wish to:

• make a formal request for information we hold about you
• make changes to the data we hold about you
• opt out of being contacted for marketing purposes (you can also opt out of our marketing messages by using the unsubscribe link that appears on each of them)
• request us to erase the data we hold about you
• ask questions or raise concerns about this privacy notice.

Contact

Data Protection requests and enquiries

Please email hello@androandeve.com with any data protection requests or enquiries, including requests to exercise your data protection rights (such as access, erasure or objection to processing).

Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK Data Protection Authority (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO so please contact hello@androandeve.com first.

Changes to this privacy notice

This privacy notice was last updated on 11 December 2023.

We may change or update this notice from time to time so please check this page occasionally to ensure that you’re happy with any changes.