fbpx PRIVACY POLICY | CIRCA

Support

PRIVACY POLICY

 

 

CIRCA is subject to English data protection legislation in respect of the personal information you submit to us, or which we collect. 

 

1. WHO WE ARE


This website is operated by CIRCA. CIRCA is referred to in this Privacy Notice as “us” or “we” and you can contact us using the details set out in paragraph 10 below. In this policy we describe the types of personal data which we collect and the uses which we make of it. 

 

2. WHAT IS PERSONAL DATA?


Personal data includes all information held in electronic form or manually in a structured filing system relating to a living individual who can be identified from that data (or from that data and other information in our possession) and includes personal contact information and images, such as from CCTV.

 

3. WHAT PERSONAL DATA DO WE HOLD?


We hold personal data which you provide to us – for example; 

Patrons/ Supporters If you support us, for example make a donation, buy something from our shop, or purchase tickets for an event, we will usually collect: 

Contact Details 

  • Name 
  • Address
  • Phone numbers
  • Email address
  • Date of birth
  • Bank or credit card details
  • Gift Aid status (for donations) 
  • Information you provide us about your interests, including the type of news stories you are interested in 
  • A record of the events you have attended
  • Website and Communication Usage

How you use our website and whether you open or forward our communications, including information collected through cookies and other tracking technologies is outlined on our Cookie Policy.

If you are attending a CIRCA event we may also ask you about your access requirements, dietary preferences, your family and spouse/partner details (if they are attending with you). 

NEWSLETTER SIGN UP
If you sign up to receive our newsletter, we will usually collect:

CONTACT DETAILS

  • Name 
  • Email address 
  • Interests / Events 
  • Information you provide us about your interests, including the type of news stories you are interested in. 

VISITS TO OUR SITE

When visiting our site, we may automatically collect the following information:

Technical information, including: 

  • the Internet protocol (IP) address used to connect your computer to the Internet 
  • your login information 
  • browser type and version 
  • time zone setting 
  • browser plug-in types and versions 
  • operating system and platform 
  • information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time) 
  • products you viewed or searched for 
  • page response times 
  • download errors 
  • length of visits to certain pages 
  • page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.

COOKIES

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy.

In addition, we may collect the following personal data from other sources: 

We may receive information about you if you use any of the other websites we operate or the other services we provide. We are also working closely with third parties including, for example, artists, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers and may receive information about you from them. 

We may also combine information from other sources with the information you have provided us with the aim of understanding our audiences and delivering the highest quality experience of CIRCA. 

The sort of information we obtain from these sources might include details of charities you may support and indicators of your leisure interests and financial status. 

Where we use this data, we will always ensure that we are entitled to by reviewing the privacy notice of that third party to ensure that it informs people that their data may be passed to us.

 

4. PURPOSES FOR WHICH PERSONAL DATA IS USED WE USE YOUR PERSONAL DATA FOR THE FOLLOWING PURPOSES:

 

  • Ensure we know how you prefer to be contacted.
  • We use your personal information to provide you with the information, services, or products you ask for. • We may also use your personal information for other purposes which we specifically notify you about and, where appropriate, obtain your consent.
  • To ensure that you receive relevant and personalised communications, we will use your data to create an individual customer profile. This may include data you have provided, or which is generated by your use of CIRCA information, for example contact details, preferences, donor history, and online behaviour.
  • To allow you to participate in interactive features of our service, when you choose to do so.
  • To measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you.
  • To make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them. 
  • Building profiles and targeting communications. 
  • We use profiling techniques to ensure communications are relevant and timely, and to provide an improved experience to our supporters and visitors. Profiling also allows us to target our resources effectively.

We do this because it allows us to understand the background of the people who support us and helps us to make appropriate requests to supporters. Importantly it enables us to provide you with communications that are better suited to you while raising more funds, sooner, and more cost-effectively, than we otherwise would. 

When building a profile, we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. In doing this, we may use additional information from third party sources when it is available. Such information is compiled using publicly available data about you, for example Companies House, listed Directorships or typical earnings in a given area. All this type of profiling is done under our internal processes and procedures that ensure we have the correct permissions to do so. 

We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities.

 

4a. PROFILING AND AUTOMATED DECISION-MAKING


We use profiling techniques to tailor our communications, marketing, and fundraising efforts. This helps us provide relevant content, improve your experience, and use our resources more effectively. Profiling involves analysing personal data (such as your location, interests, and donation history) to better understand your preferences.

However, we do not use your personal data to make automated decisions that have legal or similarly significant effects on you. All decisions involving personal data are reviewed by a member of staff.

 

5. LEGITIMATE INTERESTS FOR THE USE OF YOUR DATA 


We use your personal data, as permitted by the General Data Protection Regulation, where necessary for the following legitimate business interests:

  • Supporter care, to respond to enquiries 
  • To carry out our obligations arising from any contracts entered into between you and us 
  • We may use your personal information to claim Gift Aid on any eligible donations 
  • We use your information to keep a record of your relationship with us and for internal administrative purposes (such as our accounting and records), and to let you know about changes to our services or policies 
  • We use your personal information to investigate and respond to, complaints, legal claims or other issues 
  • To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes 
  • To improve our site to ensure that content is presented in the most effective manner for you and for your computer
  • As part of our efforts to keep our site safe and secure

 

5. LEGAL BASIS FOR PROCESSING PERSONAL DATA


We rely on the following legal bases under the UK GDPR to collect and use your personal data:

  • Consent: where you have given clear consent for us to process your personal data for a specific purpose (e.g. newsletter sign-up).
  • Contract: where processing is necessary for a contract with you (e.g. processing a purchase).
  • Legal obligation: for compliance with laws (e.g. accounting or tax purposes).
  • Legitimate interests: where processing is necessary for our legitimate interests and these are not overridden by your rights (e.g. event analysis, supporter profiling, marketing).

 

7. DISCLOSURE OF PERSONAL DATA TO THIRD-PARTIES


We will not sell your details to any third parties, but we may sometimes share your information with our trusted service providers who are authorised to act on our behalf, our trading companies, and associated organisations who work on our behalf, or whom we work with in partnership.

Our service providers are sometimes based outside of the European Economic Area (EEA), in these instances we will work to make sure their operations are in accordance with GDPR.

The selected third parties include: 

Business partners, suppliers and sub-contractors for the performance of any contract we enter into with you. 

Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in W1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers’ wishes by displaying their advertisement to that target audience.

Analytics and search engine providers that assist us in the improvement and optimisation of our site.

 If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of CIRCA, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. 

Other artistic organisations and venues We work with other trusted artistic organisations and venues to share our work with the widest possible audience at different locations. For certain events, registration may be run through their website.  In these instances, you are subject to their Privacy Policy, Cookies and Terms & Conditions.

 

8. RETENTION OF PERSONAL DATA

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Accordingly, except in respect of provenance data, we use the following criteria to determine the period for which we retain your personal data:

  • the period for which the personal information is required for the applicable purposes set out in this Privacy Policy; or 
  • any statutory limitation period relevant to the personal information; or 
  • any statutory or regulatory retention period applicable to the personal information.

 

9. ACCESS AND CONTROL OF PERSONAL DATA IN CERTAIN CIRCUMSTANCES, YOU HAVE THE FOLLOWING RIGHTS UNDER DATA PROTECTION LAWS:     


Your Rights Under Data Protection Law
 You have the following rights, which you can exercise at any time:

  • The right to access the personal data we hold about you.
    • The right to rectify any inaccurate or incomplete data.
    • The right to erase your data (“right to be forgotten”).
    • The right to restrict processing of your data.
    • The right to object to processing based on legitimate interests or direct marketing.
    • The right to data portability (in some cases).
    • The right to withdraw consent where processing is based on consent.
    • The right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk

The circumstances in which you may take any of the above actions are set out in the General Data Protection Regulation.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues, and, where we request your consent to process your personal data, to withdraw consent at any time by contacting us using the details set out in section 10 below. 

 

10. HOW DO WE KEEP YOUR PERSONAL INFORMATION SAFE? 


We ensure that there are appropriate technical controls in place to protect your personal details. For example, our online forms are encrypted and our network is protected and routinely monitored.

We undertake regular reviews of who has access to information that we hold to ensure your information is only accessible by appropriately trained staff on a ‘need to know’ basis and for the communicated purposes only. 

Although data transmission over the Internet or website cannot be guaranteed to be secure, we and our business partners work hard to maintain physical, electronic and procedural safeguards to protect your information in accordance with applicable data protection requirements.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. 

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted (using SSL technology). Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. 

SECURE SHOPPING

The payment card information you supply to us for any online transaction is used solely for the purpose of processing that transaction. 

We have partnered with Shopify, a leading payment gateway to accept credit cards and electronic check payments safely and securely for our customers. Shopify manages the complex routing of sensitive customer information through credit card processing networks. 

The company adheres to strict industry standards for payment processing, including: 

128-bit Secure Sockets Layer (SSL) technology for secure Internet Protocol (IP) transactions Industry leading encryption hardware and software methods and security protocols to protect customer information

Compliance with the Payment Card Industry Data Security Standard (PCI DSS). 

 

11. HOW TO CONTACT US IF YOU HAVE ANY QUESTIONS ABOUT OUR USE OF YOUR PERSONAL DATA, PLEASE CONTACT US USING THE DETAILS BELOW:  


Attn: The Data Co-Ordinator E-mail: info@circa.art

 

12. CHILDREN’S PRIVACY


CIRCA is committed to protecting the privacy of children who may engage with our educational and outreach programmes. While we collaborate with schools and young people through exhibitions, workshops, and other creative initiatives, we do not collect or store any personal information that directly identifies children, such as names, contact details, or dates of birth.

Any information collected by schools as part of programme participation is managed solely by the schools themselves. CIRCA does not access or store this information.

All participation is arranged through schools, teachers, or guardians, who act as the primary point of contact and manage any necessary consent. Any work submitted by children (e.g. artwork or creative responses) is anonymised and used only for the purposes of the programme, such as display or reporting, in a way that does not identify individual children.

We do not profile, track, or market to children, and we do not process their personal data for any automated decision-making.

CIRCA takes the responsibility of working with children seriously and always prioritises their safety and privacy in every aspect of our programmes

If you are a parent, carer, or school representative and have questions about how CIRCA manages children’s information, please contact us at info@circa.art

 

13. CHANGES TO THIS POLICY WE MAY UPDATE THIS PRIVACY NOTICE FROM TIME TO TIME TO REFLECT CHANGES TO OUR USAGE OF PERSONAL DATA.


We encourage you to review this Privacy Policy periodically. Where appropriate, we will notify you of any material changes by email or by placing a notice on our website.

 

This policy was last updated on 12/09/2025.