Privacy Policy

Who we are

Starburst Foundation is a registered charitable organisation based at Starburst Studios, Old School Lane, Yateley, GU46 6NG, United Kingdom. We operate several departments including our Theatre company, performing arts Academy, Studios venue hire, and community funding Applications programme.

If you have any questions about this privacy notice, or would like to make a data protection rights request, please contact us by using Our Contact Form or write to us at the address above.

Our promise to you

Starburst Foundation is committed to protecting your personal data and ensuring that your rights to privacy are respected. Your data will be stored on secure systems and access will be permitted only to those with a need to know.

This Privacy Policy sets out how and why we obtain, use and protect personal information. We are responsible for protecting your personal information as a "data controller" under applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR).

However you choose to interact with us - whether performing in a show, enroling in our Academy, hiring a studio space, or simply getting in touch - we will always respect your rights and your choices.

What information we collect, use, and why

To provide services and goods, including delivery and third-party referrals

We collect or use the following information for this purpose:

• Names and contact details
• Gender
• Addresses
• Date of birth
• Emergency contact details
• Next of kin details
• Photographs or video recordings
• Health information (including medical conditions, test results, allergies, medical requirements and medical history)
• Dietary information (including allergies and health conditions)
• Information about care needs (including disabilities, home conditions, dietary requirements and general care provisions)
• Information about support requirements
• Website user information (including user journeys and cookie tracking)
• Information relating to compliments or complaints

We also collect or use the following special category information for this purpose. This information is subject to additional protection due to its sensitive nature:

• Health information

To receive donations or funding and organise fundraising activities

We collect or use the following information for this purpose:

• Names and contact details
• Addresses
• Tax payer information (for Gift Aid purposes)

For the prevention, detection, investigation or prosecution of crimes

We collect or use the following information for this purpose:

• Names and contact information
• Criminal offence data (including Disclosure and Barring Service (DBS) checks)
• Video recordings of public areas (including indoor and outdoor spaces)
• Video recordings of private or staff-only areas
• Information relating to health and safety

For service updates or marketing purposes

We collect or use the following information for this purpose:

• Names and contact details
• Marketing preferences
• Records of consent, where appropriate

To comply with legal requirements

We collect or use the following information for this purpose:

• Name
• Contact information
• Identification documents
• Any other personal information required to comply with legal obligations
• Health and safety information
• Safeguarding information
• Criminal offence data

We also collect or use the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:

• Health information

For dealing with queries, complaints or claims

We collect or use the following information for this purpose:

• Names and contact details
• Witness statements and contact details
• Relevant information from previous investigations
• Information relating to health and safety (including incident investigation details and reports and accident book records)
• Correspondence

For administering membership records

We collect or use the following information for this purpose:

• Names and contact details
• Addresses
• Date of birth
• Emergency contact details
• Next of kin details
• Photographs or video recordings
• Health information (including medical conditions, test results, allergies, medical requirements and medical history)
• Dietary information (including allergies and health conditions)
• Information about care needs (including disabilities, home conditions, dietary requirements and general care provisions)
• Information about support requirements
• Criminal offence data (including Disclosure and Barring Service (DBS) checks)
• Records of consent, where appropriate

We also collect or use the following special category information for administering membership records. This information is subject to additional protection due to its sensitive nature:

• Health information

How we collect information

When you contact us via our website

We collect your name, email address, department selection, subject, and message content when you submit our contact form. Your submission is stored in our project management system (Monday.com) for organisational purposes and follow-up. A confirmation email is sent to you via Microsoft 365.

When you sign up to our mailing list

We collect your email address and the date you subscribed. We use this data to send you newsletters and updates about our activities. You can unsubscribe at any time.

When you report a bug on our website

We collect the page URL where the issue occurred, a description of the problem, and optionally your email address if you would like to be contacted about the resolution.

When you book a studio space

Our room booking system is provided by HallMaster. When you use the booking widget on our website, you interact directly with HallMaster's service and their own privacy policy applies. We do not collect or store booking data on our website.

When you make a purchase or donation

Our online store is operated by Square and donations are processed through external platforms. When you make a purchase or donation, you interact directly with these third-party services and their respective privacy policies apply.

When you visit our website

We may collect technical information relating to your use of our website, including your browser type, operating system, screen resolution, the Internet Protocol (IP) address used to connect your device to the internet, and general information about which pages you visit, how long you spend on them, and how you arrived at our site. Wherever possible, we use aggregated or anonymous information which does not identify individual visitors.

Other sources

We may also receive personal information from:

• Directly from you (in person, by phone, by email, or via forms)
• Family members or carers
• Schools, colleges, universities or other education organisations
• CCTV footage or other recordings

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure - You have the right to ask us to delete your personal information.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
• Your right to object to processing - You have the right to object to the processing of your personal data.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent - When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Providing services and goods, including delivery and third-party referrals

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Receiving donations or funding and organising fundraising activities

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Prevention, detection, investigation or prosecution of crimes

Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We operate CCTV at our venue (Starburst Studios) to deter criminal activity, protect the safety of visitors (including children and vulnerable adults), staff, and volunteers, and to safeguard our property. This processing is necessary because alternative measures alone (such as staffing or physical security) would not provide the same level of deterrence or evidential capability in the event of an incident. CCTV coverage is limited to areas where it is proportionate, signage is clearly displayed, and footage is retained only for as long as necessary and access is restricted to authorised personnel. We also collect personal information to submit Disclosure and Barring Service (DBS) check requests for volunteers, in line with our safeguarding and child protection policies. This is necessary to ensure that individuals working with children and vulnerable adults do not pose a known risk. The benefit to the individuals we serve - particularly children and vulnerable people - in ensuring a safe environment substantially outweighs the limited privacy impact on those whose data is processed, especially given that volunteers would reasonably expect such checks to be carried out.

Service updates or marketing purposes

Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

We collect and use limited contact information (such as name, email address, and marketing preferences) to send service updates and information about our activities that are relevant to individuals based on their previous engagement with us, such as attendance at our events or use of our services. This processing is necessary to keep our community informed about opportunities, events, and services that may benefit them, and we cannot reasonably achieve this without holding basic contact details. The impact on individuals is low: we only contact people where their prior interactions suggest they would reasonably expect to hear from us, we always provide a straightforward way to opt out of future communications, and we do not share contact information with third parties for their own marketing purposes. The benefit of keeping people informed about relevant services and opportunities outweighs the minimal intrusion involved.

Complying with legal requirements

Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Dealing with queries, complaints or claims

Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

When someone submits a query, complaint, or claim, we collect the personal information necessary to understand the matter, investigate where appropriate, and provide a meaningful response. This typically includes the individual's name, contact details, and any information they provide about the issue. This processing is necessary because we cannot investigate or resolve matters without identifying the individual and maintaining a means of communicating our findings or response to them. We limit collection to what is directly relevant to the matter at hand and retain records only for as long as needed to resolve the issue and meet any legal or regulatory obligations. Individuals who contact us with a query or complaint would reasonably expect us to use their information in this way. The benefit - ensuring people receive a proper and timely response - outweighs the minimal privacy impact of processing limited personal data for this purpose.

Administering membership records

Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details provided above.

How long we keep information

We keep your information for no longer than is necessary. We will retain your information for any period required by law. Where we are not under a legal obligation to retain your information, we will determine what is necessary by reference to the lawful basis for processing and our legitimate interests.

• Contact form submissions: retained for as long as needed to resolve your enquiry and for a reasonable period afterwards for reference.
• Mailing list subscribers: your email address is retained until you unsubscribe.
• Membership records: retained for the duration of your membership and for a reasonable period afterwards to meet any legal or safeguarding obligations, or where we believe you may have a vested interest in receiving updates and/or news from Starburst Foundation.
• CCTV footage: retained only for as long as necessary and in accordance with our CCTV policy.
• DBS check records: retained in accordance with our safeguarding policy and relevant legal requirements.
• Health and safety records: retained in accordance with legal requirements.
• Bug reports: retained until the reported issue has been resolved.
• Analytics data: retained according to the default retention periods of each analytics provider (typically 14-26 months).
• Cookie consent preferences: retained for 6 months.

For more information on how long we store your personal information or the criteria we use to determine this, please contact us using the contact details provided above.

How do we protect personal information?

We take appropriate technical and organisational measures to ensure that the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used.

You should be aware that the use of the internet is not entirely secure and although we will do our best to protect your personal data we cannot guarantee the security or integrity of any personal information which is transferred from you or to you via the internet. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Children's privacy

Our Academy provides performing arts education to children and young people. We do not knowingly collect personal data directly from children through this website. Enrolment and communication regarding children's participation in our programmes is handled through parents or guardians.

If you believe a child has submitted personal data through our website without parental consent, please contact us and we will promptly delete it.

Information about cookies

We use cookies on our website to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve the site.

A cookie consists of information sent by a web server to a web browser and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

We may use both "session" cookies and "persistent" cookies on the website. Session cookies will be deleted from your device when you close your browser. Persistent cookies will remain stored on your device until deleted, or until they reach a specified expiry date.

When you first visit our website, you will be shown a cookie consent banner where you can choose which categories of cookies to accept:

Most browsers allow you to refuse to accept cookies. This will, however, have a negative impact upon the usability of many websites, including this one. You can also change your cookie preferences at any time by clicking the cookie settings link in the footer of any page.

Changes to this policy

Any changes we may make to our privacy policy in the future will be posted on this page. Please check the website frequently to see any updates or changes to our privacy policy. By continuing to use our website you will be deemed to have accepted such changes.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

Please contact us in the first instance and allow us to attempt to address your complaint directly with you.

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Our registration reference is: ZC087429