Privacy Policy

Updated 8 September 2026

About this policy:

At Open City, we take your privacy seriously. We are committed to handling your personal data with care, transparency, and respect.

This policy explains who we are, what information we collect, how and why we use it, how it is stored, who we share it with, and your rights regarding any information you share with us.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2026, and the Privacy and Electronic Communications Regulations (PECR). We aim to be clear and straightforward about how we handle your data and will not use it in ways you would not reasonably expect.

Open City is your data controller. This means that we are responsible for deciding how we hold and use personal information about you, and we are registered by the UK's data protection legislation to explain this to you.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements our other notices and policies and is not intended to override them.

This privacy policy applies to the following groups:

Customers, online users, Open City Friends (members), and donors
Participants and volunteers in our activities and programmes
Suppliers, customers, and industry contacts

This notice does not form part of any contract of employment, and may be amended from time to time.

1. Who we are

Open City is a registered charity (charity number 1072104 and company number 3159878), operating as the data controller for the personal information we process. We are registered with the Information Commissioner’s Office (ICO) under registration number Z1694748.

Open City is referred to throughout this notice as “Open City", "we", "us" or "our".

We process personal data only for the purposes necessary to fulfil our charitable aims and objectives.

If you have questions about this privacy notice or how we handle your personal data, please contact our Data Protection Officer (DPO). Our DPO can be contacted directly on the details below and individuals are welcome to contact them independently with any data protection queries or concerns. It is important that the personal data we hold about you is accurate and current - please let us know if anything changes.

We may update this policy from time to time. Where changes are significant, we will take reasonable steps to bring these to your attention.

Data Protection Officer (DPO): Jessica Denning,

Email address: dataprotection@open-city.org.uk

Postal address: Unit 2, Floor 1, C1, Design District, 1a Cripps Yard, Soames Walk, London, SE10 0AX

2. What information we collect

Personal data is any information about an individual from which that person can be identified, whether directly or indirectly. It includes special category data and pseudonymised personal data, but does not include anonymised data.

Special category data means information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, and biometric or genetic data.

Pseudonymised personal data means replacing information that directly or indirectly identifies an individual with one or more artificial identifiers or pseudonyms so that the person to whom the data relates cannot be identified without the use of additional information that is kept separately and secure.

Anonymised personal data means personal data that has been processed in

such a way that it can no longer be used to identify an individual by any means

reasonably likely to be used.

The types of data we collect from you is listed below:

*Customers, online users, Open City Friends (members) and donors:

We may collect or store the following information from you when you buy a ticket to attend a tour or event, an item from our shop, or other item from us, join our Open City Friends membership scheme, donate, enter into a competition, promotion or survey, complete a form, visit our website or premises, or contact us with an enquiry:

Title, first name and last name
Contact details including organisation/company name and job title (if appropriate), postal address, email address and telephone number(s)
Communication preferences
Membership level
Ticketing, membership, and/or donation history
Transaction history including billing and payment card information (first six digits and last four digits, card expiry data, card type)
Bank details including account name, number, and sort code if you set up a direct debit with us
Gift Aid declaration including a declaration that you are a UK taxpayer
Passport details for members attending events abroad
Social media handle
Technical data including your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, browsing actions and patterns, operating system and platform and other technology on the devices you use to access this website. We collect this data automatically using cookies and similar technologies - please see our Cookies Policy below for further information.
Image and likeness (as captured in photographs and videos we may use for promotional purposes)
Any other information you provide to us by email, letter, telephone, social media, via our website, or in person
Sensitive information: health information (if supplied) related to your booking or membership such as access needs, allergy, or dietary requirements (for you or your party).

Data from third parties

We may also obtain or collect personal information about you from other third-party sources, for example:

When you book a ticket or purchase a product via our online shop or through a third party platform
If we engage an external photographer or videographer to capture events.
From our Board of Trustees or a member of Open City staff, for example if they wish to invite you to an event or introduction.
Via a third party fundraising platform
Publicly available online information, such as information found in places such as Companies House, your biography on your work website, or information that has been published in articles/ newspapers.
From an organisation which funds or works in partnership with Open City, for example, if you attend one of our events or meet with us as a representative of your organisation.

*Participants and volunteers in our activities and programmes

We may collect or store the following information from you when you participate in one of our programme activities, apply to join our training programmes, attend an event, complete a form, sign up for a festival account (including festival contributors, volunteers and visitors), visit our website or premises, or contact us with an enquiry.

First name and last name of participant and parent/guardian/carer where required
Contact details of participant including postal address, email address and telephone number(s) and parent/guardian/carer where required
Emergency/next of kin contact first name, last name, telephone number(s), and relationship to participant
Date of birth
Place of birth, and nationality
School/university name, address, email address(s), headteacher first name and last name, teacher first name and last name, school year, and school group
Communication preferences
Bank details including account name, number, and sort code when submitting expenses.
Passport details for members attending events abroad
Image and likeness (as captured in photographs and videos we may use for promotional purposes)
Any other information you provide to us by email, letter, telephone, social media, via our website, or in person
To support Higher Education Access Tracker (HEAT) for university partners we may also collect: socioeconomic background information e.g. receiving free school meals; social mobility and socioeconomic data, such as the occupation of your main household earner during secondary school and whether you were the first in your family to attend university
Protected characteristics including gender, ethnicity, health information, and age
Publicly available online information, such as information found in places such as Companies House, your biography on your work website, or information that has been published in articles/ newspapers.

Data from third parties

We may also obtain or collect personal information about you from other third-party sources, for example:

Delivery partners (e.g teachers, course leaders, mentors) may provide information to us about your experience and competence.
We may ask parents/guardians/carers or schools to supply information about under 18s for participation in our programmes
If we engage an external photographer or videographer to capture events.
If your details are given as an emergency contact for a participant

*Suppliers, customers, and industry contacts

We may collect or store the following information from you when you supply goods/services to us, purchase products or services from us, are recommended to us, attend an event, visit our website or premises, or contact us with an enquiry.

Organisation name
Designated contact first name and last name
Contact details including postal address, email address(es) and telephone number(s)
Bank details including account number and sort code
VAT and Tax numbers
Record of goods/services provided/received
Communication preferences
Any other information you provide to us by email, letter, telephone, social media, via our website, or in person

Data from third parties

We may also obtain or collect personal information about you from other third-party sources, for example:

When you book a ticket or purchase a product via our our online shop or through a third party platform
If we engage an external photographer or videographer to capture events.
Recommendations and/or references from other organisations, clients, and industry contacts
Publicly available online information, such as information found in places such as Companies House, your biography on your work website, or information that has been published in articles/ newspapers.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit to understand how they use your personal data.

3. How and why we use your data

We will use your information for the purposes listed below under one of the following lawful bases:

Performance of a contract - where we need to process your data to fulfil an agreement with you
Your consent - where you have given us clear agreement to process your data for a specific purpose
To comply with a legal obligation - where we are required to process your data to comply with the law
Our legitimate interests - where processing is necessary for our legitimate charitable interests, provided these are not overridden by your rights and freedoms.
We may also use your personal information in the following situations, which are likely to be rare:
- Where we need to protect your vital interests (or someone else's) where we are unable to obtain their consent (for example, in an emergency)
- Where it is needed to perform a public task for official purposes

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

We have grouped the types of personal data that we process into the following categories:

Identity data: name, title, date of birth, place of birth, nationality
Contact data: email address, postal address, telephone number, social media handle
Transaction data: details of purchases, ticket bookings, donations, and payment information
Financial data: bank account details, direct debit information, Gift Aid declarations
Technical data: IP address, browser type, cookies, browsing actions and patterns, and device information
Profile data: your preferences, interests, membership level (i.e. Friend status) and survey responses
Communications data: your preferences for receiving communications from us
Sensitive data: health information, access requirements, dietary requirements, protected characteristics
Socioeconomic data: background information for programme eligibility, equal monitoring and funder reporting

The tables below set out the categories of personal data that we collect, the purpose for which we process it and the lawful bases for doing so. Where special category data is processed, an additional condition under Article 9 UK GDPR applies and is noted:

Open City Privacy Policy Tables
  
    Customers, Festival visitors/attendees, online users, Open City Friends (members), and donors
    
        Purpose
        Data Used
        Lawful basis
      

    To register you as a user or account holderIdentity, ContactPerformance of a contract
To process tickets, memberships, sign-ups, festival attendance, and donationsIdentity, Contact, Transactional, FinancialPerformance of a contract; Consent to collect donations and set a festival itinerary
To communicate with festival visitors about festival activities, events and infoIdentity, ContactConsent
To process Gift Aid declarations and claim Gift Aid on eligible donationsIdentity, Contact, FinancialConsent to collect; legal obligation to store once submitted
To manage your Friend membership including renewals, benefits, and communicationsIdentity, Contact, Profile, CommunicationsPerformance of a contract; Legitimate interests (to manage our membership programme)
To send you transactional communications such as booking confirmations and receiptsIdentity, Contact, TransactionPerformance of a contract
To send you marketing communications about our events, programmes, appeals, and promotions where you have opted inIdentity, Contact, CommunicationsConsent
To send fundraising appeals and information about supporting Open CityIdentity, Contact, Profile, CommunicationsConsent; Legitimate interests (to further our charitable objectives)
To manage your communication preferences and process opt-outsIdentity, Contact, CommunicationsLegal obligation; Legitimate interests
To invite you to leave a review or complete a surveyIdentity, Contact, ProfileLegitimate interests (to improve our events, programmes and services)
To administer prize draws, ballots, competitions, and promotionsIdentity, Contact, ProfilePerformance of a contract; Legitimate interests (to fairly assess entries, select winners and ensure such promotions run smoothly)
To use data analytics to improve our website, communications, and audience understandingTechnical, ProfileLegitimate interests (to develop our programmes and understand our audiences)
To protect our organisation and website including fraud prevention and system securityIdentity, Contact, TechnicalLegitimate interests (to maintain the security and integrity of our systems); Legal obligation
To manage and respond to complaints and enquiriesIdentity, Contact, Transaction and any other information you provide in relation to your complaint or enquiryLegitimate interests (to ensure that we can effectively resolve complaints, respond to enquiries and improve our services)

  

  
    Participants and volunteers in our activities and programmes
    
        Purpose
        Data Used
        Lawful basis
      

    To process your application and register you for a programme or activityIdentity, ContactPerformance of a contract
To manage your participation including scheduling, communications, and deliveryIdentity, Contact, ProfilePerformance of a contract; Legitimate interests (to ensure a well-organised and effective programme experience for participants)
To ensure your safety and welfare during activities, including contacting emergency contacts where necessaryIdentity, Contact, SensitiveLegitimate interests (to protect the health and safety of participants); Legal obligation; Vital interests (only where it is not possible to obtain consent); Article 9 (2)(a) – explicit consent
To collect and verify eligibility information for specific programmesIdentity, Contact, SocioeconomicPerformance of a contract; Legitimate interests (to ensure programmes reach intended beneficiaries); Article 9 (2)(j) – archiving, research and statistics
To widen participation in higher educationIdentity, Contact, SocioeconomicPublic Task and public interest. Article 9 (2)(g) – substantial public interest
To process expense paymentsIdentity, FinancialPerformance of a contract
To capture photographs and video for promotional and reporting purposesIdentity (image and likeness)Consent
To report to funders on programme delivery and outcomes using anonymised dataSocioeconomic (anonymised)Legitimate interests (to fulfil our obligations to funders and demonstrate charitable impact)
To comply with safeguarding obligationsIdentity, Contact, SensitiveLegal obligation; Legitimate interests (to protect participants, particularly under 18s). Article 9 (2)(b) – processing and legal obligations
To send you follow-up communications about your participation or related opportunitiesIdentity, Contact, CommunicationsLegitimate interests (to support participants beyond their programme); Consent where required
To manage your volunteering including scheduling, shift allocation, and role communicationsIdentity, Contact, ProfileLegitimate interests (to coordinate volunteer activity effectively)
To ensure your health and safety while volunteering, including emergency contact informationIdentity, Contact, SensitiveLegitimate interests (to protect the welfare of volunteers); Legal obligation; Vital interests (only where it is not possible to obtain consent). Article 9 (2)(a) – explicit consent
To send you communications relevant to your volunteering role before, during, and after the festivalIdentity, Contact, CommunicationsPerformance of a contract; Legitimate interests (to support and manage our volunteer programme)
To collect feedback on your volunteering experienceIdentity, Contact, ProfileLegitimate interests (to improve our volunteer programme and opportunities)
To retain your details for future volunteering opportunities where you have given consentIdentity, Contact, ProfileConsent
To recognise and thank volunteers including acknowledgement in our communicationsIdentity, CommunicationsLegitimate interests (to acknowledge and retain our volunteer community)
To manage and respond to complaints and enquiriesIdentity, Contact, Transaction and any other information you provide in relation to your complaint or enquiryLegitimate interests (to ensure that we can effectively resolve complaints and enquiries and improve our services)

  

  
    Suppliers, Open House Festival contributors, customers, and industry contacts
    
        Purpose
        Data Used
        Lawful basis
      

    To co-ordinate the opening of your building or running of your event during the Open House Festival, including sharing relevant resources and materialsIdentity, ContactLegitimate interests (to facilitate the running of our programme)
To manage supplier and contractor relationships including placing and receiving ordersIdentity, Contact, TransactionPerformance of a contract with an individual; Legitimate interests (to manage our operational relationships)
To process payments and invoicesIdentity, Contact, FinancialPerformance of a contract
To maintain records of goods and services provided or receivedIdentity, Contact, TransactionLegal obligation; Legitimate interests (to maintain accurate financial and operational records)
To invite our professional network to Open City events, activities, or networking opportunitiesIdentity, Contact, CommunicationsLegitimate interests (to develop sector relationships in support of our charitable objectives)
To send relevant communications about our work and programmes to our professional networksIdentity, Contact, CommunicationsLegitimate interests (to engage our professional network); Consent where required
To collect feedback on your experience of opening a building or running another event during the Open House FestivalIdentity, ContactLegitimate interests (to improve the running of our programme)
To retain your details and contact you regarding future participation in the Open House FestivalIdentity, ContactLegitimate interests (to facilitate the running of our programme)

  

Customers, Festival visitors/attendees, online users, Open City Friends (members), and donors
Purpose	Data Used	Lawful basis
To register you as a user or account holder	Identity, Contact	Performance of a contract
To process tickets, memberships, sign-ups, festival attendance, and donations	Identity, Contact, Transactional, Financial	Performance of a contract; Consent to collect donations and set a festival itinerary
To communicate with festival visitors about festival activities, events and info	Identity, Contact	Consent
To process Gift Aid declarations and claim Gift Aid on eligible donations	Identity, Contact, Financial	Consent to collect; legal obligation to store once submitted
To manage your Friend membership including renewals, benefits, and communications	Identity, Contact, Profile, Communications	Performance of a contract; Legitimate interests (to manage our membership programme)
To send you transactional communications such as booking confirmations and receipts	Identity, Contact, Transaction	Performance of a contract
To send you marketing communications about our events, programmes, appeals, and promotions where you have opted in	Identity, Contact, Communications	Consent
To send fundraising appeals and information about supporting Open City	Identity, Contact, Profile, Communications	Consent; Legitimate interests (to further our charitable objectives)
To manage your communication preferences and process opt-outs	Identity, Contact, Communications	Legal obligation; Legitimate interests
To invite you to leave a review or complete a survey	Identity, Contact, Profile	Legitimate interests (to improve our events, programmes and services)
To administer prize draws, ballots, competitions, and promotions	Identity, Contact, Profile	Performance of a contract; Legitimate interests (to fairly assess entries, select winners and ensure such promotions run smoothly)
To use data analytics to improve our website, communications, and audience understanding	Technical, Profile	Legitimate interests (to develop our programmes and understand our audiences)
To protect our organisation and website including fraud prevention and system security	Identity, Contact, Technical	Legitimate interests (to maintain the security and integrity of our systems); Legal obligation
To manage and respond to complaints and enquiries	Identity, Contact, Transaction and any other information you provide in relation to your complaint or enquiry	Legitimate interests (to ensure that we can effectively resolve complaints, respond to enquiries and improve our services)

Participants and volunteers in our activities and programmes
Purpose	Data Used	Lawful basis
To process your application and register you for a programme or activity	Identity, Contact	Performance of a contract
To manage your participation including scheduling, communications, and delivery	Identity, Contact, Profile	Performance of a contract; Legitimate interests (to ensure a well-organised and effective programme experience for participants)
To ensure your safety and welfare during activities, including contacting emergency contacts where necessary	Identity, Contact, Sensitive	Legitimate interests (to protect the health and safety of participants); Legal obligation; Vital interests (only where it is not possible to obtain consent); Article 9 (2)(a) – explicit consent
To collect and verify eligibility information for specific programmes	Identity, Contact, Socioeconomic	Performance of a contract; Legitimate interests (to ensure programmes reach intended beneficiaries); Article 9 (2)(j) – archiving, research and statistics
To widen participation in higher education	Identity, Contact, Socioeconomic	Public Task and public interest. Article 9 (2)(g) – substantial public interest
To process expense payments	Identity, Financial	Performance of a contract
To capture photographs and video for promotional and reporting purposes	Identity (image and likeness)	Consent
To report to funders on programme delivery and outcomes using anonymised data	Socioeconomic (anonymised)	Legitimate interests (to fulfil our obligations to funders and demonstrate charitable impact)
To comply with safeguarding obligations	Identity, Contact, Sensitive	Legal obligation; Legitimate interests (to protect participants, particularly under 18s). Article 9 (2)(b) – processing and legal obligations
To send you follow-up communications about your participation or related opportunities	Identity, Contact, Communications	Legitimate interests (to support participants beyond their programme); Consent where required
To manage your volunteering including scheduling, shift allocation, and role communications	Identity, Contact, Profile	Legitimate interests (to coordinate volunteer activity effectively)
To ensure your health and safety while volunteering, including emergency contact information	Identity, Contact, Sensitive	Legitimate interests (to protect the welfare of volunteers); Legal obligation; Vital interests (only where it is not possible to obtain consent). Article 9 (2)(a) – explicit consent
To send you communications relevant to your volunteering role before, during, and after the festival	Identity, Contact, Communications	Performance of a contract; Legitimate interests (to support and manage our volunteer programme)
To collect feedback on your volunteering experience	Identity, Contact, Profile	Legitimate interests (to improve our volunteer programme and opportunities)
To retain your details for future volunteering opportunities where you have given consent	Identity, Contact, Profile	Consent
To recognise and thank volunteers including acknowledgement in our communications	Identity, Communications	Legitimate interests (to acknowledge and retain our volunteer community)
To manage and respond to complaints and enquiries	Identity, Contact, Transaction and any other information you provide in relation to your complaint or enquiry	Legitimate interests (to ensure that we can effectively resolve complaints and enquiries and improve our services)

Suppliers, Open House Festival contributors, customers, and industry contacts
Purpose	Data Used	Lawful basis
To co-ordinate the opening of your building or running of your event during the Open House Festival, including sharing relevant resources and materials	Identity, Contact	Legitimate interests (to facilitate the running of our programme)
To manage supplier and contractor relationships including placing and receiving orders	Identity, Contact, Transaction	Performance of a contract with an individual; Legitimate interests (to manage our operational relationships)
To process payments and invoices	Identity, Contact, Financial	Performance of a contract
To maintain records of goods and services provided or received	Identity, Contact, Transaction	Legal obligation; Legitimate interests (to maintain accurate financial and operational records)
To invite our professional network to Open City events, activities, or networking opportunities	Identity, Contact, Communications	Legitimate interests (to develop sector relationships in support of our charitable objectives)
To send relevant communications about our work and programmes to our professional networks	Identity, Contact, Communications	Legitimate interests (to engage our professional network); Consent where required
To collect feedback on your experience of opening a building or running another event during the Open House Festival	Identity, Contact	Legitimate interests (to improve the running of our programme)
To retain your details and contact you regarding future participation in the Open House Festival	Identity, Contact	Legitimate interests (to facilitate the running of our programme)

Sharing your data with Third parties:

Unless you have provided your consent, we will only share your personal information with third parties where we are required or permitted to do so by law.

Categories of third parties that we may share your data with are set out below:

Payment processors to process donations and payments on our behalf
IT service providers to provide us with IT services and help set up our website
Professional advisors, including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
HM Revenue & Customs, regulators and other authorities based in the United Kingdom where required.
Government and funding bodies (for example Office for Students, Higher Education Statistics Agency (HESA), the Department for Education (DfE), the Higher Education Access Tracker (HEAT) Database.
Partner organisations, including university and school partners
Email marketing and communications providers to manage and send communications on our behalf
Customer relationship management (CRM) systems
E-commerce and subscription management/payment processing:
Donor management platforms
Online forms and data collection tools
Project management and collaboration tools
Cloud storage and processing services
Entities within our group
Emergency services
Freelancers
Developers

All our third-party providers and other entities in the group are required to take appropriate security measures to protect your personal information. We require third parties to respect the security of your data and to treat it in accordance with the law. We do not allow our third-party service providers who act as processors on our behalf to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions. and the terms of our contract with them.

We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share you personal information with a regulator or to otherwise comply with the law.

We may also receive data from third-party and publicly available sources, including:

Technical usage data from analytics and website service providers
Contact, transaction and delivery information from payment processors, e-commerce platforms and other technical service providers.
Identity and contact information from publicly available sources, such as Companies House and the Electoral Register, where permitted by law.
Profile and Transaction Data from our suppliers and business partners.
Information obtained through background screening, safeguarding and vetting processes where these are required for a role or engagement with us.

We will only obtain and use such information where we have a lawful basis for doing so.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us (our contact details are set out above).

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

4. How your data is stored

We have put in place appropriate security measures to ensure your personal data is protected and is not accidentally lost, used or accessed in an unauthorised way. Details of these measures are available from our DPO. .

We limit access to your personal data to authorised and trained employees,approved freelancers and developers, and other third parties who have a business need to know. They will only access your personal data on our instructions, and they are subject to a duty of confidentiality. When we share data with a third party, we ensure the appropriate data sharing or data processing agreements are in place.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We aim to store and process personal information within the UK and European Economic Area (EEA) wherever possible and select service providers that support our commitment to protecting data.

Where we use service providers or platforms that may process personal information outside the UK or EEA, we will ensure that appropriate safeguards are in place in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act of 2018 and any subsequent amendments to UK data protection law. These safeguards may include using countries recognised as providing an adequate level of protection, or using implementing contractual and technical protections as required. We regularly review our suppliers to ensure personal information continues to be handled securely and in line with applicable data protection requirements. You can contact us for more information about the safeguards we rely upon when transferring your personal data outside of the UK or EEA.

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on you.

Data Retention:

We will keep your personal data for as long as is strictly necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our retention periods are detailed below:

Customers, online users, Open City Friends (members), and donors

We will store data in our database system(s) for a maximum of seven years after your last engagement with us, through ticket, gift voucher or membership purchases, or making donations. At that point your data will be deleted, no longer processed, and you will cease to receive communications from us, unless there is an outstanding issue, claim or dispute requiring us to keep such information until resolution.

Participants and volunteers in our activities and programmes

We will store data in our database system(s) for a maximum of six years after your last engagement with us, through participating in our work, or requesting to be kept up to date with our activities. At that point your data will be deleted, no longer processed, and you will cease to receive communications from us, unless there is an outstanding issue, claim or dispute requiring us to keep such information until resolution.

Suppliers, customers, and industry contacts

We will store data in our database and finance system(s) for as long as you continue to purchase services from us, supply us with goods and/or services, or 6 years plus the current tax year, where the relationship is not ongoing. At that point your data will be deleted and no longer processed, unless there is an outstanding issue, claim or dispute requiring us to keep such information until resolution.

5. Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

6. Your rights

Under data protection laws, you have certain rights in relation to the personal information we hold about you. These rights include:

Right to access your personal information (Subject Access Request)

You have the right to ask us for a copy of the personal information we hold about you and to check that we are processing it lawfully. We may need to obtain additional information fromyou in order to respond to your request.

Right to correct your personal information

You have the right to ask us to correct any information that is inaccurate or incomplete. We may need to verify the accuracy of any new information you provide.

Right to request deletion of your personal information (Right to erasure)

You have the right to ask us to delete or remove your personal information where there is no valid reason for us to continue processing it.

There may be circumstances where we are unable to comply with a deletion request, for example where we need to keep information to meet legal obligations or establish, exercise or defend legal claims. If this applies, we will explain the reason.

Right to object to how we use your personal information

You have the right to object to the processing of your personal information where we rely on legitimate interests as our lawful basis for processing if you have a specific reason. Please note that, subject to the below, this is not an absolute right and we may be unable to comply with your objection request where we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment exercise or defence of legal claims.

You have an absolute right to object to the use of your personal information for direct marketing purposes by clicking on the opt out/unsubscribe link in the email you received, or by contacting us. If you opt out of receiving marketing communications, we will retain your contact details and record your preference to stop receiving marketing messages in our opt-out register to ensure that we can comply with your request.

Right to request the restriction of processing of your personal information

You have the right to ask us to restrict how we use your personal information in certain circumstances, including where:

you believe the information is inaccurate and we need to verify it;
our use of the information is unlawful but you do not want us to delete it;
we no longer need the information, but you need us to keep it for legal claims; or
you have objected to our use of your information and we are considering your objection.

Right to request the transfer of your personal information

You have the right to request that certain personal information we hold about you is provided to you or transferred to another organisation in a structured, commonly used and machine-readable format.

This right applies only to information processed automatically where processing is based on your consent or is necessary to fulfil a contract with you.

Right to withdraw consent

Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. This will not affect any processing carried out before you withdrew your consent.

If you withdraw your consent, we may not be able to provide certain services or continue certain activities. We will explain this if it applies.

Right to complain

If you have concerns about how we handle your data, we would welcome the opportunity to resolve them directly with you. Please contact us in the first instance using the details set out below. We will acknowledge your concern within 30 days and aim to respond to you as soon as is possible. To accurately deal with your request we may request additional information. You also have the right to make a complaint at any time to the ICO at www.ico.org.uk (though they would expect you to have raised your concerns with us first).

If you wish to exercise any of your rights, please contact us using the contact details provided in this privacy notice.

You will not usually need to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse a request where it is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

To protect your personal information, we may need to verify your identity before responding to your request. We may also ask for additional information to help us locate the information you are requesting and respond as quickly as possible.

We will aim to respond to legitimate requests within 30 days of receiving your request.

If your request is particularly complex, or if you have made multiple requests, we may

extend this timeframe by up to a further two months. If we need to extend the response period, we will let you know within the first 30 days and explain why.

7. Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.

We use the following cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.

Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.