Data Privacy Policy
Who we are
Delight Charity (registered charity number 1159567) is the data controller for the personal data described in this Data Privacy Policy. Delight is an arts-based learning charity working in primary schools across Surrey and Croydon.
Data controller: Delight Charity
Responsible person: Jessica Clarke, Head of Creative Learning
Address: 9B Station Avenue, Caterham Surrey, CR3 6LB
Phone: 01883 818300
Email: jess@delightcharity.org.uk
Charity number: 1159567
ICO reference: ZA914545
You have the right to raise concerns with the Information Commissioner’s Office (ICO) at ico.org.uk/concerns or by calling 0303 123 1113.
What personal data we collect
Delight is the named controller of data. We currently collect and process the following information:
For schools and school staff:
- Name, email address, telephone number, year group
- Details from teacher tracking
- From interviews or focus groups conducted as part of programme-level evaluations: name, email address, telephone number, year group and engagement data
For pupils:
- From Pupil Premium tracking surveys: name or initials where given, gender, year group, SEN needs, ability level, profile of the pupil and engagement data
- From interviews or focus groups conducted as part of programme-level evaluations: name, age, key stage, and engagement data
- Photographs and film where agreed with the school
For grant givers:
- Company name, contact name, email address, telephone number, postal address
- Contract terms
For Arts Partners and suppliers:
- Company name, contact name, email address, telephone number, postal address, bank account details
For volunteers:
- Names, email address, telephone number, postal address, next of kin name and telephone number
For mailing list supporters:
- First and last names
- Email addresses
- Record of communication activities
For internal staff:
- Name, telephone number, postal address, bank account details, NI number, copy of passport
Through our website:
- Contact form submissions: name, email address and message content
- Newsletter sign-ups: name and email address
- Analytics data: pages visited, time on site, device type and approximate location (via Google Analytics — anonymised, no individual is identified)
- Cookie data: see Section 7 below
What personal data we collect and why we hold it
The personal information we collect is provided for the following reasons:
- Data given directly by schools in order to create impact data and evaluation on Delight creative programmes
- Data given directly by schools relating to the administration required to deliver programmes in schools
- Names, email address , and postal address opt in in order to communicate Delight news via newsletters, impact reports, thank you/Christmas cards
- Data held by cookies on our website
- Data given by internal staff for HR purposes
We use the information that you have given us in order to:
- Create impact data and evaluation on Delight arts programmes
- Other handling of data relating to the administration required to deliver programmes in schools
- Send Delight newsletters, impact reports, thank you/Christmas cards
- Manage the user experience on our website
- Manage HR processes
Lawful basis for processing
Under UK GDPR, we rely on the following lawful bases:
- Consent (Article 6(1)(a)) — for mailing list communications, photography and film, and website contact form submissions. You can withdraw consent at any time by contacting us at on the contact details listed above.
- Legitimate interests (Article 6(1)(f)) — for programme administration, school relationship management, impact evaluation, and website analytics
- Legal obligation (Article 6(1)(c)) — for financial record-keeping and employment law compliance
- Contract (Article 6(1)(b)) — for managing relationships with arts partners, suppliers and grant givers
Who we share your data with
We do not sell personal data. We may share data in the following circumstances:
- Service providers who process data on our behalf — including Dropbox (cloud storage), Xero (finance), LearnDash (learning management), MailChimp (newsletters), and Google Analytics (website analytics)
- Law enforcement or regulatory bodies where required by law
- External auditors and tax authorities in relation to financial records (via Xero)
- Partner schools — programme evaluation and impact data is shared with the school from which pupil data originated
We do not share data with advertising partners or use data for targeted advertising.
International Transfers
Some of our service providers store data outside the United Kingdom. Where this is the case, we ensure appropriate safeguards are in place:
- Dropbox — data may be stored in US or EU data centres. Dropbox provides Standard Contractual Clauses as a safeguard for any transfer outside the UK
- Xero — data is hosted on servers in the United States. Xero relies on Standard Contractual Clauses to safeguard this transfer
- MailChimp — data is hosted in the United States. MailChimp is certified under the UK-US Data Privacy Framework (UK Extension), which is the primary safeguard. Standard Contractual Clauses with a UK Addendum apply as a fallback
- LearnDash — hosted on Delight’s own WordPress installation in the United Kingdom; no international transfer applies
- Google Analytics — data may be processed in the United States. We use anonymised analytics data only; no individual is identified
Cookies
We use essential cookies to make our website work, and analytics cookies to understand how visitors use it. Analytics cookies are only set with your consent — you can accept or decline these using the banner on our website.
We do not use advertising cookies or share your data with advertising partners.
Essential cookies: Required for the website to function. Set Automatically. Cannot be declined.
Analytics cookies: Google Analytics – collects anonymised data on pages visited, time on site, and device type. Set only with consent.
Children's data
Delight works with children as part of its programmes. Children’s personal data is processed only through partner schools, and only with appropriate consent obtained by the school. Our website is not directed at children, and we do not knowingly collect personal data directly from children through our website.
Where we hold SEN or disability information relating to children, this is used solely to support inclusive and appropriate programme delivery. It is treated as special category data and subject to enhanced protection.
How long we keep your data
- Delight
Partner schools and teachers: 7 years from end of relationship, then deleted. Data retained while relationship is active.
Children’s data: 7 years from collection, then deleted. Photographs and film retained indefinitely in our media library unless removal is requested.
Grant givers: 7 years from end of relationship if they decline ongoing communication, then deleted.
Arts partners and suppliers: 7 years from end of relationship if they decline ongoing communication, then deleted.
Volunteers: 3 years from end of relationship if they decline ongoing communication, then deleted.
Mailing list: Retained while subscribed. Deleted if consent is withdrawn or not given.
Internal staff: Duration of employment plus 3 years after termination, then deleted.
Website enquiries: 12 months from receipt, then deleted.
Website analytics: 26 months (Google Analytics default retention period).
Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include:
- Secure, password-protected cloud storage via Dropbox
- Role-based access controls — staff only access data relevant to their role
- Two-factor authentication on core systems
- Regular software updates and security monitoring
- Secure deletion of data at the end of retention periods
In the event of a personal data breach that poses a risk to individuals’ rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
Your data protection rights
Under UK GDPR you have the following rights:
- Right of access — you can ask us for copies of your personal data
- Right to rectification — you can ask us to correct inaccurate or incomplete data
- Right to erasure — you can ask us to delete your data in certain circumstances
- Right to restriction of processing — you can ask us to restrict how we use your data in certain circumstances
- Right to object to processing — you can object to processing based on legitimate interests
- Right to data portability — you can ask us to transfer your data to another organisation in certain circumstances
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal
- Right to lodge a complaint — you have the right to complain to the ICO at ico.org.uk/concerns
We will respond to all requests within one month. There is no charge for making a request. To exercise any of these rights, please contact us at the contact details above.
Contact Us
If you have any questions about this policy or how we handle your data, please contact:
Name: Jessica Clarke, Responsible Person
Email: jess@delightcharity.org.uk
Phone: 01883 818300
Address: Delight, 9B Station Avenue, Caterham, Surrey, CR3 6LB
If you are not satisfied with our response, you have the right to complain to the ICO:
ICO website: ico.org.uk/concerns
ICO helpline: 0303 123 1113
ICO address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
You can download a PDF version of the Privacy Policy here.