General Data Protection Regulation Statement and Policy – Privacy Policy

Blue Ocean Waves is committed to protecting the privacy of our beneficiaries and supporters and to upholding the highest standards of care with regard to any personal data in our possession.

The UK’s first Data Protection Act was passed in 1984 and the second Act was passed in 1998, coming into force on 1 March 2000. The General Data Protection Regulation (GDPR) was passed in 2016 and came into force after a two-year preparation period on 25 May 2018. GDPR originated in the European Parliament but will be fully absorbed into UK law regardless of the UK’s exit from the European Union. The regulation will apply across all EU member states including the Republic of Ireland, where it replaces the Acts of 1988 and 2003.

We generally hold very little personal data – only that which we need to carry out our work – and we do not engage in any direct marketing programmes such as telephone fundraising or donation fundraising campaigns. We do not share personal data with third party organisations apart from trusted partners who are GDPR compliant such as our funding partners who support, monitor, and evaluate our work.

Why we hold and process personal data

Our work requires us to collect certain data from those participating in and supporting our activities and events. We do this in order to:

• Monitor and evaluate our programmes, enabling us to continually improve them to better meet participants’ needs
• Provide impact reports to funders and potential funders, without whom we could not resource the programmes
• Help us plan future programmes, sessions, events & other related activities.
• Keep a record of funding provided and actions taken by our supporters and our communications with them
• Send our supporters information about our activities and events where we have their consent or are otherwise allowed to
• Keep people safe during our activities and events
• Comply with legal obligations
• Manage our organisation
• Ensure we do not send unwanted information to participants, supporters or anyone who has informed us they do not wish to be contacted

These reasons are underpinned by a “legal basis” under GDPR.

Explaining the legal bases, we rely on

The law on data protection sets out a number of different reasons for organisations to collect and process your personal data: When collecting your personal data, we will always make clear to you which data is necessary for a particular purpose.

Blue Ocean Waves relies on the following legal bases in our marketing activities:

Consent

Wherever possible, we will ask for your consent to send you marketing information. We will do this through a clear statement of what you will receive and allow you to select only those channels that you wish to hear from us by.

For example, if you register for a music, dance, drama or art programme, you will be asked whether you would like us to keep in touch about other Blue Ocean Waves’ activities and events. You will also be asked which channel(s) of communication you would like us to use.

Legitimate Interest

In specific situations, we process your data to pursue our legitimate interests in ways which might reasonably be expected, and which do not materially impact your rights, freedom, or interests. Blue Ocean Waves’ use of legitimate interest includes the following:

• Sending direct marketing information by email, to keep our participants and supporters updated on Blue Ocean Waves’ activities and events. We will only do this where we have reason to believe that this information will be of interest. We make it easy for you to opt out of receiving such information.
• If you have opted into Blue Ocean Waves’ emails or text messages, we may link to your account on social media site such as Twitter, Facebook, and Instagram to serve you Blue Ocean Waves’ content.
• We review your previous participation in, or support of Blue Ocean Waves to offer relevant information in the future.
• To help identify businesses and organisations who may wish to support Blue Ocean Waves, we send emails or make phone calls to individuals where relevant to their job, for instance people working in the arts, and disability sector.

For activities other than marketing, we may rely on different legal bases:

Legal Compliance

If the law requires us to, we may need to collect and process your data.

Consent

We may ask for your consent for data.For example, where you engage with any of our service programme and can give you a clear choice about what information you need to provide.

Legitimate Interest

In many situations we need data in order to carry out a task. For example, if you register for a music, dance, drama or art activity or event.

Public Interest

In limited situations we may use data in the public interest. It is likely to be in the public interest to collect data to prevent crime or dishonesty, ensure that we are fair in our practices by carrying out equality and diversity monitoring, or safeguard the wellbeing of people with whom we work. When and why, we will send you personalised marketing communications

Blue Ocean Waves will only contact you for marketing purposes – for example keep you up to date on our work, or let you know of ways in which you can participate or support that work – where we have your consent, or we are otherwise allowed to do so.

We will make it easy for you to tell us if you would like to receive marketing communications from us and hear more about our work and the ways in which you would like to receive this information (such as email, SMS and phone). We will not send you marketing material if you tell us that you do not wish to receive it.

Where you give us your consent to send marketing information, we will wherever possible let you know how long this consent will last. Unless we have grounds for believing that a longer period is reasonable and have explained this to you, we will understand your consent to last for 36 months. After this time, for us to continue to update you, we will need your refreshed consent. You can update or withdraw your consent at any time, for individual channels of communication, or for all channels.

Other circumstances in which you may receive marketing information “Legitimate Interest”

We may send you marketing communications by direct mail where you are a regular participant or supporter, and we have evidence that you do not object to receiving marketing material and you have not informed us you wish to opt-out of receiving marketing communication from us.

“Soft opt in”

This allows organisations to send marketing communications by email and SMS to individuals who have previously received similar services, provided they were given the opportunity to opt out at the time of registering for the initial service. How and when we collect information about you Blue Ocean Waves may collect your personal data in the following circumstances:

When you give it to us DIRECTLY

You may give us your personal data directly when you sign up for one of our activities or events, volunteer with us, or when you communicate with us.

When you give it to us INDIRECTLY

You may give us your information indirectly when you sign up to events with third parties that are funding or supporting us to deliver an event or activity. These independent third parties will pass your data to Blue Ocean Waves where you have given your consent, or it is a necessary part of providing the event or activity. Sometimes your personal data is collected by an organisation working on our behalf but as they are acting on our behalf, we are the “data controller” and responsible for the security and proper processing of that data

When you access Blue Ocean Waves’ Social Media We might also obtain your personal data through your use of social media such as WhatsApp, Facebook, Twitter, Instagram or LinkedIn, depending on your settings or the privacy policies of these social media and messaging services.

When the information is publicly available We might also obtain personal data about individuals who may be interested in participating in or supporting organisations like Blue Ocean Waves. In this scenario, Blue Ocean Waves’ may seek to find out more about these individuals, their interests and motivations for supporting us through publicly available information. This information may include newspaper or other media coverage, open postings on social media sites such as Facebook and data from Companies House. Blue Ocean Waves will not retain publicly available data relating to such individuals without their consent.

We may also gather information if your activities relate to our work – for instance, if you are a public figure such as a Member of Parliament or represent an organisation which we work with we may gather information about you to make decisions – for instance, whether we engage with you to seek your support for our work.

Blue Ocean Waves’ use of cookies

Cookies are used to enable us to improve services for you through, for example measuring how many people are using each page of the website and for how long so that we can try to improve the quality of our website.

When you visit our website, we will collect data from your computer or other device such as a smart phone or tablet through the use of “cookies”. Cookies are created by your web browser when you visit our website. Every time you go back to the Blue Ocean Waves’ website, your browser will send the cookie file back to the website’s server. They improve your experience of using our website, for example, by remembering your preference settings so that you are presented with information likely to be most relevant to you, and by measuring your use of the website to enable us to continuously improve our website to ensure that it meets your needs. Cookies can also be used to show you relevant Blue Ocean Waves’ content on social media services such as Facebook – these are known as “retargeting'” or “advertising” cookies.

If you wish to restrict or block the cookies which are set by the Blue Ocean Waves’ website, or indeed any other website, you can do this through your browser settings.

The Help function within your browser should tell you how. Alternatively, you may wish to visit www.aboutcookies.org which contains comprehensive information on how to do this on a wide variety of browsers. You will also find details on how to delete cookies from your computer as well as more general information about cookies. For information on how to do this on the browser of your mobile phone you will need to refer to your handset manual.

If you visit our website as an anonymous visitor (e.g. you switch off cookies), Blue Ocean Waves may still collect certain information from your browser, such as the IP address (an IP address is a number that can uniquely identify a computer or other internet device). Blue Ocean Waves’ website contains hyperlinks to websites owned and operated by other organisations. These third-party websites have their own privacy policies, including policies on their use of cookies, and we urge you to review them. They will govern the use of personal information you submit, or which is collected by cookies whilst visiting these websites. We cannot accept any responsibility or liability for the privacy practices of such third-party websites and your use of such websites is at your own risk. Please be aware that restricting cookies may impact on the functionality of the Blue Ocean Waves’ website.

Google Analytics

Blue Ocean Waves’ uses Google Analytics, a web analytics service provided by Google, Inc. Google Analytics sets a cookie in order to evaluate your use of the website and compile reports for us on activity on the site.

Google stores the information collected by the cookie on servers in the United States of America. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. By using the Blue Ocean Waves’ website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

What information might Blue Ocean Waves’ collect about you?

We only collect personal data relevant to the type of interaction you have with Blue Ocean Waves.

Whatever your interaction with us this information will be minimal and linked to the purpose for which we need it.

For example, when you contact Blue Ocean Waves to register for an activity or event, or sign up to Blue Ocean Waves’ online content or you telephone, email, write to or text Blue Ocean Waves, or engage with Blue Ocean Waves via social media channels, we may receive and retain personal information.

In these cases, we are likely to process details such as your name, email address, postal address, telephone, or mobile number.

If you participate in an activity or event we may (with your permission) take your Photograph or video, or interview you.

If you participate in market research, we may ask you questions regarding your experience with us, or other survey questions relating to your experience.

If you are a volunteer, we may collect information such as correspondence with you, the activities, and events you attend, details of your background or how we would like to work with you.

Where we gather information about you which is publicly available – for instance as a funder – this may include your name, contact details, views, and interests.

Sensitive Personal Data

We only collect “sensitive personal data”, e.g. health status, where there is a clear and specific reason for doing so, such as participation in an event or activity, attending our classes or volunteering or working with Blue Ocean Waves. We may also collect data for equality monitoring.

We collect this data where we need it to ensure that we provide appropriate facilities or support to enable you to participate in the activity or event or carry out your role, and where required to collect such data as a condition of third-party funding, such as publicly funded grants.

Rarely, we may collect this data for the prevention of crime or dishonesty, to safeguard those with whom we work, or for another reason which is in the public interest. Where we do this, we will do it carefully and in accordance with applicable laws.

All sensitive personal data is stored safety on a database, to which only a limited number of relevant staff have access. It is deleted when no longer relevant, is never shared with third parties, and is available to you at any point should you wish to see it.

How will Blue Ocean Waves use your personal data?

Blue Ocean Waves will use your personal information for the following purposes:

For administrative reasons, including:

• “Service Administration”, which means that Blue Ocean Waves’ may contact you for reasons related to administering any activities, events or online content you have signed up for.
• To confirm receipt of any payments or registration material (unless you have asked us not to do this).
• In relation to correspondence you have entered into with us whether by letter, email, text, social media, message board or any other means, and to contact you about any content you provide.
• For internal record keeping to keep a record of your relationship with us
• To fulfil agreements, you have entered with Blue Ocean Waves.
• To provide logistical information to people who are taking part in Blue Ocean Waves’ activities and events.
• To communicate with Blue Ocean Waves’ volunteers.
• To implement any instructions, you give us to about withdrawing consent to send marketing information.
• To use IP addresses to identify the location of users, to block disruptive use and to establish the number of visits from different countries.
• To protect our team and those with whom we work, or to prevent crime and dishonesty.

For marketing and fundraising reasons For market research

• to invite you to participate in surveys or research about our work;
• • to analyse and improve the activities, events and online content offered by Blue Ocean Waves. We may also use and disclose information in aggregate(so that no individuals are identified) for marketing and strategic development purposes.

Job Applicants

If you apply to work for Blue Ocean Waves, we will only use the information you give us to process your application or to monitor recruitment statistics on an unidentified basis. If we want to disclose information to someone outside Blue Ocean Waves, for example, if we need a reference from your previous employer, we will tell you beforehand. The only exception is where the law obliges us to disclose information to a third party (such as the police) and we are not allowed to tell you.

We will hold 2 interviews. A skills interview and a HR interview. The skills interview will give us a clear idea of all your skills pertaining to the type of job you are applying. For example if you are applying for a piano teacher, we may ask you to play a piece likewise if you apply for a drama teacher, we may give you a dialogue to be delivered in a certain style.The HR interview is taken by our HR manager who checks your credentials, structure of work and salaries.

If you are unsuccessful in your application, we may hold your personal information after we’ve finished recruiting for the role you applied for, for up to 12 months to deal with any follow up queries or issues.

If you commence working with Blue Ocean Waves, your personal information will be processed in accordance with your appointment contract and other applicable policies we have from time to time.

Will Blue Ocean Waves share your personal information with anyone else?

We will only use your information within Blue Ocean Waves for the purposes for which it was obtained. Blue Ocean Waves will not, under any circumstances, share or sell your personal data with any third party for their own marketing purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.

Blue Ocean Waves Partners and Funders

We may need to share your information with organisations that support Blue Ocean Waves in its work such as funding partners, who require proof that our work engaged who we said it would – but in these cases the data will be shared in an anonymised way to protect your name and any contact details with the utmost privacy.

In exceptional cases where partners who support us to do our work require personal data, these “data processors” will be subject to contractual obligations containing strict data protection clauses. We do not allow these organisations to disclose your personal data to other third parties without our consent and we will take all reasonable care to ensure that they keep your data secure.

Social Media Sites

We may also use your email address and phone number to match to your account on social media sites to show you Blue Ocean Waves content while using these services. We only do this where you have opted into marketing emails or phone calls. No data we hold about you is retained by the third party.

In addition, we may also use your email address and phone number to link to social media sites to identify other users of these sites whom we believe would be interested in, and we may then show them Blue Ocean Waves content. No data we hold about you is retained by the third party.

There are two ways to prevent this use of your data, you can either update your preferences with Blue Ocean Waves by opting out of the relevant channel of communication or you can do this via the social media site:

Facebook: https://www.facebook.com/help/568137493302217 Instagram: https://help.instagram.com/402411646841720 LinkedIn: https://www.linkedin.com/help/linkedin/answer/62931

Updating your preferences with Blue Ocean Waves will not guarantee that you never see Blue Ocean Waves content on social media, since the social media site may select you based on other criteria and without your data having been provided by Blue Ocean Waves.

Current and Former Blue Ocean Waves employees and freelance workers

When you stop working for Blue Ocean Waves, Blue Ocean Waves may process your data to respond to requests for employment references.

Where legally required, We will also comply with legal requests where disclosure is required or permitted by law (for example to government bodies, statutory bodies, or law enforcement agencies for tax purposes, where it is in the public interest, or the prevention and detection of crime, subject to appropriate protection in law).

How to control what we send you or request we update your personal information?

The accuracy of your information is important to us. We want to ensure that we can communicate with you in ways that you are happy with, and to provide you with information that is of interest.

If you wish to change how we communicate with you, or update the information we hold, then please contact us:
email us at [email protected]
Additionally, you can opt out of email separately.

How long will it take for these changes to be effective?

We endeavour to meet the following service levels where supporters request, we do not send them marketing information: Email: 48 hours from receipt of email
Telephone: 48 hours from receipt of request to opt out
Should you request we stop marketing to you by completing the contact us page on our website, it may take up to 14 days to complete your request due to the manual nature of this process.

How Blue Ocean Waves keeps your data safe

We ensure that there are appropriate technical controls in place to protect your personal details. We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by staff, volunteers and contractors who comply with this privacy policy.

Where we use external companies who may collect or process personal data on our behalf, we undertake comprehensive checks on these companies before we work with them and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they collect on our behalf or have access to. These organisations – referred to as “Data Processors” also have legal liability for the way in which your data is used, providing you with additional protection.

Your Rights Over Your Personal Data

You have a variety of rights in respect of your data, including the rights to see, update, restrict, object to the use of or withdraw use of your data. Depending upon why we hold your data, you may have the right to request:

• Access to the personal data we hold about you, including how we first obtained your details, free of charge in most cases (this is known as a ‘Subject Access Request’).
• The correction of your personal data when incorrect, out of date or incomplete.
• That we stop using your personal data for direct marketing (either through specific channels, or all channels).
• That we delete your personal data from our systems (this is known as the “Right to be Forgotten”).
• That we no longer process your data automatically to decide whether marketing activities are likely to be of interest. This is known as profiling and helps us to ensure that our marketing is relevant and appropriate.

You can contact us to request to exercise these rights at any time.

Opting out of Direct marketing

You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We will always comply with your request. Where we are sending you direct marketing on the basis of our legitimate interest, you can also ask us to stop. Where we send email marketing on a soft opt in basis, we will also comply with all requests to opt out.

Right To Be Forgotten

Upon request we will delete your personal data from our systems to the extent that we are permitted to by law or regulatory guidelines. For instance, under HMRC rules we are required to retain financial data for 7 years for audit purposes.

Subject Access Requests

You have the right to request a copy of the personal information we hold about you. We will provide this as soon as possible, and within a month unless there are specific reasons why this would not be possible. We will always let you know if this is likely to be the case.

Checking Your Identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act

How to find out more, or make a complaint

If you would like more information, to update your details or have any questions about this policy, please email at [email protected] or call on our official number 07407298019. To make a formal complaint about Blue Ocean Waves’ approach to data protection or raise privacy concerns directly please contact:
Jolene Dias
Email: [email protected]