Data Protection and GDPR

Charity Registration Number: 294979
Policy Effective Date: July 2026
Next Review Date: July 2027
Data Protection Lead: Chair of trustees

Introduction and Purpose

As a registered charity, Havering Singers (the “Society”) needs to collect and use certain types of information about the individuals who interact with us. These include current, past and prospective choir members, audience members, donors, soloists, the musical director, accompanists and trustees.

This policy ensures that the Society complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It outlines how we collect, handle and store personal data legally, fairly and securely.

Data Protection Principles

The Society is committed to processing data in accordance with the six core principles of GDPR. Personal data must be:

1. Processed lawfully, fairly and transparently.
2. Collected for specified, explicit and legitimate purposes (Purpose Limitation).
3. Adequate, relevant and limited to what is necessary (Data Minimisation).
4. Accurate and, where necessary, kept up to date (Accuracy).
5. Kept in a form which permits identification for no longer than is necessary (Storage Limitation).
6. Processed in a manner that ensures appropriate security (Integrity and Confidentiality).

Policy Review Framework and Version Control

To demonstrate compliance with the GDPR Accountability Principle, this policy must be systematically maintained and updated. Reviews fall under two categories.

Scheduled regular reviews

• Annual frequency: This policy will undergo a comprehensive review by the Committee at least once every 12 months to ensure operational accuracy, update named personnel and verify that data retention timelines are being actively executed.

Triggered event reviews

This policy must be reviewed and updated outside the standard annual schedule without undue delay if any of the following occur:

• Changes in data processing: If the Society changes how it handles data, or introduces a new purpose for processing, such as launching a new ticket-selling vendor or publishing audience photography online.
• Technological shifts: The adoption of new software, databases or cloud storage solutions, such as transitioning material onto shared cloud systems like Google Drive or Dropbox.
• Regulatory updates: Structural changes to data protection legislation, revised guidance issued by the Information Commissioner’s Office (ICO), or new legal requirements.
• Following a data breach: If the Society experiences a data breach or a “near-miss”, security protocols and policy definitions must be reassessed immediately.

Document audit trail

The Types of Data We Collect

To run the Choral Society effectively, we hold different categories of personal data:

Lawful Bases for Processing Data

We only process personal data where we have a valid lawful basis to do so:

• Contractual necessity or pre-contractual steps: To manage choir memberships, process ticket sales, fulfil agreements with hired staff and soloists, or review prospective credentials prior to booking.
• Legitimate interests: For the day-to-day administration of the choir, such as organising concert logistics, printing programmes and marketing upcoming events.
• Consent: For sending emails regarding future concerts. This consent can be withdrawn at any time.
• Legal obligation: To process Gift Aid claims with HMRC, maintain charity accounts or fulfil statutory obligations regarding independent contractors.

Recruitment and Booking of Professional Musicians

When the Society recruits or books professional artistic roles, such as a Musical Director, Accompanist or Guest Soloist, we collect specific personal data to assess suitability, conduct auditions or interviews and finalise agreements.

Recruitment of the Musical Director and Accompanist

• Data collected: Curriculum vitae (CVs), cover letters, contact details, professional references and notes made by the audition panel, trustees and choir during interviews and trial rehearsals.
• Storage and access: Access to applicant files is strictly restricted to the designated hiring panel. Electronic files must be stored in a dedicated, secure folder on a password-protected device or cloud drive.
• Retention period: Application materials and panel notes for unsuccessful candidates will be permanently deleted or securely shredded six months after the post has been filled, allowing for any process queries or runner-up offers.

Hiring and Engagement of Concert Soloists

The Society engages independent guest soloists for public concerts, either booked directly or through professional agents.

• Information gathered: For the purposes of contracting and concert delivery, the Society collects names, contact details, financial invoicing details, performance biographies and publicity headshots.
• Consent for publicity: By submitting promotional photographs and biographies for use in concert programmes, flyers, websites and social media marketing, the soloist or their agent provides consent for public distribution.
• Special category data: If a soloist shares specific medical, health or dietary requirements, such as for concert-day catering or venue accessibility, this data is processed strictly to ensure their safety and comfort. It is restricted to relevant committee organisers and deleted immediately following the concert event.
• Publicity materials: Biographies and headshots will be removed from active promotional use after the concert, though they may remain archived in historical digital concert programmes for record-keeping purposes.
• Unbooked enquiry records: If a soloist or agent submits an enquiry or quote for a concert but is not booked, their contact information and performance details will be deleted within 12 months unless they consent to remain on an artistic roster for future consideration.

Data Storage and Management for Hired Professionals and Soloists

Once a Musical Director, Accompanist or Soloist is formally contracted, their data is handled under strict security protocols appropriate for financial and personnel records.

Secure storage of personnel and contractor data

• Contractual and financial records: Signed contracts, letters of agreement, invoices and bank details provided for fee payments must be stored securely.
• Digital files: These must be held on password-protected laptops or PCs, with access restricted solely to the Chair, Secretary and Treasurer.
• Physical papers: These must be stored in a secure filing cabinet by a designated trustee or designated committee member.
• Data minimisation: The Society will only hold the necessary contact, professional and financial information required to fulfil the contract and process payments.

Ongoing retention

• Active or regular contractors: Data is kept securely for the entire duration of the Musical Director’s or Accompanist’s tenure with the Society.
• Post-tenure and post-event retention: Following the conclusion of a soloist’s engagement or the resignation of a contracted person such as the Musical Director, core financial records and contracts will be retained for six years following the end of the financial year they relate to, in order to comply with HMRC and UK accounting regulations. Non-financial personal data, such as private phone numbers or personal email threads, will be deleted within 12 months of their departure.

Practical Procedures for General Data Handling

Data storage and security

• Digital data: Electronic files containing personal details, such as membership spreadsheets, must be stored securely on password-protected devices or secure cloud storage with access restricted to authorised committee members.
• Physical data: Paper records, such as physical Gift Aid forms and paper membership applications, must be kept in a secure, locked filing cabinet or box by the designated committee member.
• Email communication: When emailing the entire choir, an audience mailing list or multiple soloist agents, committee members must use the BCC (Blind Carbon Copy) field to prevent exposing individuals’ email addresses.

Data sharing

• The Society will never sell or share personal data with third-party marketing companies.
• Data will only be shared with third parties when strictly necessary to deliver our services, such as using platforms for concert tickets or HMRC for Gift Aid.

Individual Rights under GDPR

All individuals whose data is held by the Society, including contracted staff, soloists and job applicants, have the right to look at, correct, limit or request the complete deletion of the personal information we hold about them, subject to statutory legal holding requirements, such as financial records required by HMRC.

Data Breach Procedures

A data breach is any unauthorised access, alteration, loss or destruction of personal data, such as losing a laptop containing the member database or accidentally sending a soloist’s contract containing bank details to the wrong email recipient.

In the event of a breach, the Data Protection Lead will take immediate steps to contain it. If the breach is likely to result in a risk to individuals’ rights and freedoms, the Society will notify the Information Commissioner’s Office (ICO) within 72 hours.