Data controller Ensemble Vocal Collective is the data controller for the personal information described in this policy. Contact details for questions about this policy or to exercise your data rights are available from our team on request.

Information we collect We collect personal information that you provide to us directly and certain information automatically when you use our services.

Information you provide directly may include:

• Name

• Email address

• Telephone number

• Postal address (where required for billing or mailing)

• Date of birth or age range (where relevant for event eligibility or safeguarding)

• Emergency contact details (for in-person events)

• Payment information (card details are processed via a third-party payment provider; we do not store full card details)

• Any accessibility, medical or dietary requirements you choose to share

• Photographs or videos you consent to provide for promotional use

Automatic and technical information:

• IP address and device/browser information when you visit our website

• Interaction data (such as pages visited, sign-up timestamps)

• Cookie data as described in our Cookies Policy

How we use your information We use personal information for the following purposes:

• To communicate with you about sign-ups, rehearsals, events, cancellations and other operational matters

• To manage the membership and mailing list, including sending newsletters and promotional communications where you have consented or where we have another lawful basis

• To process payments and refunds

• To ensure health and safety, safeguarding and emergency contact procedures are followed

• To personalise and improve our services and website

• To maintain records required by law, including safeguarding records where applicable

• To produce promotional materials (only with your consent for photos/recordings)

• To respond to queries, complaints and legal matters

Lawful basis for processing Where relevant, we process personal data on one or more of the following lawful bases:

• Consent: for marketing communications and for use of photographs or recordings

• Contractual necessity: to fulfil bookings, class enrolments and payment processing

• Legitimate interests: to operate and improve our services, to communicate with members about relevant activities, and to manage safety and administration (balanced against your privacy rights)

• Legal obligation: to comply with statutory requirements, including safeguarding and financial record keeping

Marketing communications We will only send marketing or promotional emails where you have given consent or where we rely on a legitimate interest and you have not opted out. Every marketing message includes simple instructions on how to opt out. You can also contact us at any time to be removed from marketing lists.

Sharing and disclosures We may share personal information with:

• Third-party service providers who perform services on our behalf (payment processors, email and mailing list providers, booking platforms, website hosts, IT support)

• Event venues or partner organisations where necessary for event management and health and safety

• Law enforcement, regulators or other third parties where we are required to do so by law or to protect the rights, property or safety of our members or others

• Professional advisors (accountants, legal advisors) where necessary

We require third-party providers to protect personal data in line with applicable law and not to use it for their own purposes.

International transfers If we transfer personal data outside the UK, we will ensure appropriate safeguards are in place, such as standard contractual clauses or other measures required by law. Contact us for details about specific transfers.

Data security We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Access to personal data is restricted to those who need it for legitimate business purposes.

Data retention We retain personal information only for as long as necessary to fulfil the purposes set out in this policy, including to meet legal, accounting or reporting requirements. Typical retention periods:

• Membership/contact records: for the duration of membership and for a reasonable period after inactivity (generally up to 6 years for accounting and legal purposes)

• Financial records: retained in line with statutory requirements

• Safeguarding records: retained in line with legal obligations and safeguarding best practice

• Marketing consents: until consent is withdrawn

Your rights Subject to applicable law, you have rights in relation to your personal data, which may include:

• The right to access a copy of personal data we hold about you

• The right to correct inaccurate or incomplete data

• The right to request deletion of your personal data (where we have no lawful reason to retain it)

• The right to restrict or object to certain processing activities