As part of the day-to-day business of planning, funding, rehearsing and performing amateur Opera, there are times when York Opera will need to collect and store information (e.g. contact details) about individuals. This information is collectively referred to as personal data, and is protected by UK and EU regulations. We will always treat your personal data with respect. This document outlines what data we collect and how we use it. If you have any questions which are not answered in this document, please contact the company secretary (secretary@yorkopera.org).
Who we are
York Opera is an amateur company dedicated to bringing opera of a high quality to the people of York and its surrounding area. We typically perform two major productions a year, including one at York Theatre Royal, in addition to a number of smaller concerts and fundraising events. Volunteer run, we are a registered charity, charity number 700279.
Data processing categories
As part of our everyday activities, York Opera collects a number of separate, distinct sets of personal data.
Data set |
Why we require this data |
| Member data | For the administration of society membership, and membership fees, including Gift Aid |
| Trustee and Committee data | For the management and administration of the society as a whole, and compliance with charity regulations |
| Marketing data | For the promotion of York Opera’s productions and activities to members of the wider public |
| Production data | For the purposes of communicating with the cast of the current production, e.g. to coordinate rehearsal times. Also to coordinate volunteers for other show-related tasks (e.g. set building) |
| Supplier data | For the purposes of coordinating resources for productions and managing payments in line with financial regulations |
| Donor data | For the recording of Gift Aid donations from non-members, in line with charity commission regulations |
What data we collect
The data collected varies between data sets, as outlined in the table below.
Data Set |
What data we collect |
| Member data | Name, email address, postal address for members opting to use Gift Aid. |
| Trustee & Committee data | Name, email address, postal address, telephone number. |
| Marketing data |
Name, email address, record of consent to receive marketing updates. For a small number of long-term patrons of our shows we also hold postal addresses for physical marketing materials; however, this is no longer being collected. |
| Production data | Name, email address, potentially phone numbers for principals or volunteers (e.g. setbuilding crew) |
| Supplier data | Name, email address, postal address, invoice details |
| Donor data | Name and postal address for Gift Aid donations |
Lawful basis for holding data and period of retention
Data for each set is held under grounds legally recognised by the GDPR regulations.
Data Set |
Lawful Basis |
Retention Period |
| Member data | Legal Obligation, Contract | Duration of membership, plus one year. For members using Gift Aid, details may be retained for up to even years after last Gift Aid payment. |
| Trustee & Committee data | Legitimate Interest, Legal Obligation | For the duration of the individual’s membership of the committee/role as a trustee, plus one year. |
| Marketing data | Consent | Until consent is withdrawn, or email delivery consistently fails. |
| Production data | Legitimate Interest | For the duration of the associated production, plus one year. |
| Supplier data | Legal Obligation | For up to seven years after the invoice was submitted. |
| Donor data | Legal Obligation | For donations making use of Gift Aid, details may be retained for up to seven years after the donation was made. |
Your data rights
Under GDPR regulations, you have the following ongoing rights to any of your personal data that we hold:
The right of access – the ability to request details of any/all personal data we hold.
The right to rectification – to request that we correct any of personal data we hold which is incorrect.
The right to erasure – to request that we destroy all personal data.
The right to restrict processing – to request that we limit the ways in which we use your personal data.
The right to object to data processing – to request that your data not be processed in certain circumstances. In particular, this gives you an absolute right to cease email marketing by withdrawing consent (typically via an unsubscribe mechanism).
If you wish to exercise any of these rights, or have any questions in general about your data, please contact the company secretary (secretary@yorkopera.org). We will respond to all requests within one month.
Note that in some circumstances, it may not be possible to grant requests; e.g. if personal data is required for legal obligations, such as Gift Aid declarations. In other circumstances, restricting York Opera’s right to process your personal data may make it difficult or impossible to maintain a working relationship with the company; for example, it would be very difficult to arrange rehearsals and give notes if a principal singer did not allow the company to hold his/her contact details.
If you are not satisfied with our response to your rights requests or questions, you have the right to submit a complaint to the Information Commissioner’s Office. Details about this process.
Third-party data processors
For members and donors making use of Gift Aid, information will be shared with HMRC as part of the legal requirements of this service.
For named trustees and committee members, information will be provided to the Charities Commission, in line with our legal obligations as a registered charity.
For the Marketing data set, York Opera make use of the Mailchimp platform for the coordination of email marketing campaigns, including the collection of personal details (and associated consent statements). Read their privacy statement.
Administration of other data sets makes use of Yahoo Mail.
Any changes to these tools will be reflected in updates to this policy.
Data breach procedures
In the unlikely event of a data breach, York Opera will endeavour to contact all affected individuals as soon as possible, within no more than one month of the York Opera data controller becoming aware of the breach.