Draft for review and tailoring by The Hibernian Orchestra. This document is intended as a general website privacy policy for an Irish arts organisation and should be reviewed against the orchestra\u2019s actual data processing practices, suppliers, and retention periods before publication.<\/p>\n\n\n\n
The Hibernian Orchestra is committed to protecting and respecting personal data. This Privacy Policy explains how personal data may be collected, used, stored, shared, and otherwise processed through the orchestra\u2019s website and related activities. Under the GDPR, privacy notices should accurately reflect an organisation\u2019s real processing activities and should be reviewed and updated as those activities change.dataprotection+1<\/p>\n\n\n\n
Personal data must be processed lawfully, fairly, and transparently, and information about that processing should be clear, accessible, and easy to understand.<\/p>\n\n\n\n
This policy is intended for website visitors, concert attendees, mailing list subscribers, supporters, Friends of the Orchestra, prospective players, competition applicants, volunteers, contractors, suppliers, donors, and anyone else whose personal data may be processed in connection with the orchestra\u2019s website or activities.<\/p>\n\n\n\n
<\/p>\n\n\n\n
The data controller for the purposes of this website and related activities is:<\/p>\n\n\n\n
The Hibernian Orchestra<\/strong> If the orchestra appoints a dedicated data protection contact or Data Protection Officer in future, that person\u2019s details should be added here. Under Articles 13 and 14 GDPR, a privacy notice should identify the controller and, where applicable, the Data Protection Officer or relevant contact for data protection matters.<\/p>\n\n\n\n Depending on how an individual interacts with the website or the orchestra, the following categories of personal data may be collected:<\/p>\n\n\n\n Under GDPR transparency requirements, individuals should be told what categories of data are processed, the purposes of processing, recipients, retention periods, lawful bases, and their rights.<\/p>\n\n\n\n Personal data may be collected in a number of ways, including:<\/p>\n\n\n\n Where personal data is collected directly from an individual, the required transparency information should be provided at the time of collection<\/p>\n\n\n\n Personal data may be processed for the following purposes:<\/p>\n\n\n\n Under the GDPR, the purposes of processing should be explicit and legitimate, and data should not be further processed in a way that is incompatible with those purposes.<\/p>\n\n\n\n The orchestra may rely on one or more of the following lawful bases under Article 6 GDPR, depending on the circumstances:<\/p>\n\n\n\n The DPC notes that personal data must have a lawful basis for processing and identifies consent, contract, legal obligation, vital interests, public task, and legitimate interests as the six lawful reasons available under Article 6 GDPR.<\/p>\n\n\n\n Where the orchestra sends newsletters, concert announcements, fundraising messages, or other direct electronic communications, it will do so in accordance with applicable Irish and EU data protection and ePrivacy rules. Where consent is required, marketing communications will only be sent where valid consent has been obtained, and individuals will be able to withdraw that consent or unsubscribe at any time.dataprotection+1<\/p>\n\n\n\n An unsubscribe link should be included in relevant emails where appropriate, and withdrawal of consent should be as easy as giving it. Where the orchestra relies on legitimate interests rather than consent for certain communications, individuals should be informed of that and of their right to object.<\/p>\n\n\n\n The website may use cookies and similar technologies to support core site functions, improve performance, analyse traffic, remember preferences, and help protect the website from misuse. The Irish Data Protection Commission provides specific guidance on cookies and other tracking technologies, and cookie use should be assessed separately from the general privacy policy.dataprotection<\/a><\/p>\n\n\n\n A separate Cookie Policy or Cookie Notice should explain:<\/p>\n\n\n\n Where cookies are not strictly necessary, appropriate consent should be obtained before they are placed on a user\u2019s device.Cookies and Similar Technologies<\/p>\n\n\n\n Personal data may be shared, where necessary and appropriate, with the following categories of recipients:<\/p>\n\n\n\n The privacy notice should state the recipients or categories of recipients of the personal data.dataprotection+1<\/p>\n\n\n\n Where third-party service providers process personal data on behalf of the orchestra, the orchestra should ensure appropriate controller-processor arrangements are in place, including contracts that satisfy GDPR requirements.<\/p>\n\n\n\n Some service providers used by the orchestra may store or process personal data outside the European Economic Area. Where personal data is transferred to a third country or international organisation, the orchestra will take steps to ensure that appropriate safeguards are in place, as required by the GDPR, such as adequacy decisions or approved transfer mechanisms.dataprotection+1<\/p>\n\n\n\n If the orchestra does not transfer personal data outside the EEA, this section should be amended to say so.<\/p>\n\n\n\n Personal data will be retained only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, reporting, governance, safeguarding, and dispute-resolution requirements. GDPR transparency rules require the retention period, or the criteria used to determine it, to be provided to individuals.dataprotection<\/a><\/p>\n\n\n\n In practice, retention periods may vary depending on the type of data, for example:<\/p>\n\n\n\n The orchestra should insert its actual retention schedule or a more specific summary once internal review is complete.<\/p>\n\n\n\n The GDPR requires personal data to be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.dataprotection<\/a><\/p>\n\n\n\n The orchestra will use reasonable technical and organisational measures to protect personal data, which may include:<\/p>\n\n\n\n No internet-based transmission or storage system can be guaranteed to be completely secure, but appropriate steps should be taken to reduce risk and protect personal data proportionately.<\/p>\n\n\n\n Subject to applicable law and exemptions, individuals may have the following rights under data protection law:<\/p>\n\n\n\n The DPC states that these rights, together with information on how to exercise them, should be included in a privacy notice where relevant.dataprotection<\/a><\/p>\n\n\n\n Requests relating to personal data should be sent to the orchestra using the contact details above. The orchestra may ask for proof of identity before responding to a request where this is necessary to protect personal data.<\/p>\n\n\n\n Where the orchestra relies on consent as the lawful basis for processing, that consent may be withdrawn at any time. Withdrawal will not affect the lawfulness of processing carried out before the consent was withdrawn<\/p>\n\n\n\n Any individual who is unhappy with how their personal data has been handled should contact the orchestra first so that the matter can be considered and, where possible, resolved.<\/p>\n\n\n\n Individuals also have the right to lodge a complaint with the Irish Data Protection Commission:<\/p>\n\n\n\n
Dublin, Ireland
Email: manager@thehibernianorchestra.ie<\/a><\/p>\n\n\n\nPersonal Data the Orchestra May Collect<\/h2>\n\n\n\n
\n
How Personal Data May Be Collected<\/h2>\n\n\n\n
\n
Purposes of Processing<\/h2>\n\n\n\n
\n
Lawful Bases for Processing<\/h2>\n\n\n\n
\n
Marketing Communications<\/h2>\n\n\n\n
Cookies and Similar Technologies<\/h2>\n\n\n\n
\n
Sharing Personal Data<\/h2>\n\n\n\n
\n
International Transfers<\/h2>\n\n\n\n
Data Retention<\/h2>\n\n\n\n
\n
Data Security<\/h2>\n\n\n\n
\n
Individual Rights<\/h2>\n\n\n\n
\n
Withdrawal of Consent<\/h2>\n\n\n\n
Complaints<\/h2>\n\n\n\n