THE ROYAL EDINBURGH MILITARY TATTOO PRIVACY NOTICE AND CONSENT (Performers & Suppliers)
This privacy notice applies to REMT event performers and suppliers only. If you, or your organisation, are performing and/or supplying goods or services at one of our events then we may collect or obtain the personal data outlined in this notice. This Privacy Notice sets out how The Royal Edinburgh Military Tattoo Limited, (registered number SC128255) having our principal office at 1-3 Cockburn Street, Edinburgh, EH1 1QB (referred to as “REMT”, “we”, “us” or “our” in this privacy notice) collect and use your personal data at REMT events.
Please ensure that you read this notice and any other similar notice we may publish on our website https://www.edintattoo.co.uk/ or provide to you from time to time when we collect or process personal information about you.
We collect and process personal data in accordance with current data protection legislation. We are registered with the Information Commissioner's Office (the "ICO"), the UK regulator for data protection issues. Our data protection registration number is Z4681827.
This privacy notice is also issued on behalf of our parent company who we may be required to share personal data with from time to time, The Royal Edinburgh Military Tattoo (Charities) Limited (registered company number SC108857) which also has its principal office at 1-3 Cockburn Street, Edinburgh, United Kingdom, EH1 1QB.
Changes to your personal data
We need to ensure that your personal data is accurate and up to date, please keep us informed if your personal data changes during your relationship with us.
What is personal data, how do we collect it and why do we need it?
Personal data is any information about a living individual from which that person can be identified. It does not include data where the identity of the individual has been removed.
For the purposes of this notice, we collect personal data from you through your interaction with the RFIDentikit Limited (RFID) software platform which we use to manage the accreditation of suppliers, sub-contractors, service providers and performers and any other persons requiring access to an event space (who are not event attendees) or are performing at an event.
REMT will collect and upload the following personal data (either directly from you or from the organisation you are performing with or employed by) to the RFID platform and for the purposes of allowing access to an REMT event and back stage areas and generating your security pass:
• Identity & contact details (needed to contract with you): We collect your name, date of birth, and emergency contact details (i.e. name, relationship, and phone numbers) from you (or your employer or group leader) to put a contract in place with you (or the organiser/supplier) and to support event security and safety.
We have a recognised legitimate interest (RLI) in ensuring the security of our events and prevent and report crimes and ensure safeguarding. Where we rely on an RLI, we will ensure the use is strictly necessary, and only use or share the minimum data required. We also have a legitimate interest in ensuring the security of our events which may involve knowing the number and identity of individuals back stage or in performance areas at any time and ensuring health and safety requirements are complied with at an event.
• Dietary & medical information (needed to support you at the event): We collect dietary requirements and any necessary medical information from you or your group leader (if you are a performer) or you or your employer (if you are a supplier) so we can cater for your needs during August and support your health and safety whilst performing at an event. This information is collected and processed only with your explicit, informed consent.
If you are involved in an accident or medical emergency, we may share health data or details of any known disability or allergy. We will only share this information to protect your vital interests in arranging to obtain medical attention and will only pass this information to trained first responders and medical professionals if you are unable to do so. We are also legally required to obtain and record personal or health information on an accident or incident report.
• Photograph (for access control): We collect your photo from you or your group leader (if you are a performer) or you or your employer (if you are a supplier) to create an ID pass for the contracting period to enable access to venue areas. The use of your image for the photo ID is based on your explicit consent.
Surveys
If you participate in any surveys (whether published on our Website, requested by e-mail or otherwise) we may collect or obtain the following personal data:
• your name, contact address and email address, age, gender or other information as required by each survey or similar (along with your response) in order to record and analyse your survey, consultation or similar responses.
Our surveys are optional and we only ever collect and process the data you submit with your informed and explicit consent. We may use a third-party processor to collect and analyse survey responses. We will let you know when we use these third parties as they may process your personal data and we will provide you with a link to that organisation's privacy notice.
Your responses to a survey or similar may be published on our Website. When we do this, we will always notify you in advance and ask for your permission or we will anonymise your response so that it does not contain your personal data.
Some surveys will be anonymous, so that no identifying information is obtained about you when you fill it out and we will not collect or process any of your personal data. We will make it clear whether a survey is anonymous or not
CCTV
We use CCTV around event areas and at our shows. All of our CCTV systems are sign-posted on location. If you visit any of our event areas with CCTV we may collect or obtain images of all attendees (including visitors, event attendees, employees, performers, sub-contractors, service providers).
We collect these images to ensure the safety of our staff, members, visitors, contractors and suppliers, to monitor visitor flow and to ensure the security of event areas and to detect and prevent crime. We have a recognised legitimate interest (RLI) in ensuring the security of our events and prevent and report crimes and ensure safeguarding. Where we rely on an RLI, we will ensure the use is strictly necessary, and only use or share the minimum data required.
We have a legitimate interest in protecting our attendees, staff, members, contractors, suppliers, and event areas. If we collect images of a crime being committed, then our legal basis is substantial public interest in preventing or detecting unlawful acts.
About the information we collect and hold
1. In some circumstances, we may need to share your personal data with third parties who will also be controllers of that data. This means they will determine the purpose of processing and make decisions about how your personal data is processed in accordance with UK data protection laws and their own privacy statements. These controllers may include professional advisers (such as lawyers, accountants and auditors), insurers, product or service partners or law enforcement agencies. Where this occurs, we will only share personal data where we have a legal basis to do so.
2. We intend to photograph and/or film our events or activities. We have a legitimate interest in capturing REMT events and promoting these events on our website and social media platforms. This may include photographs or films of individuals or small groups of performers or photographs and/or films which may capture suppliers. We will ask for your prior consent to take and use these images by providing you with our Participants' Undertaking. The consent form will set out how we intend to use the images. You have a right to withdraw your consent at any time.
3. We seek to ensure that our information collection and processing is always proportionate. We will notify you of any changes to information we collect or to the purposes for which we collect and process it.
Where information may be held
4. Information relating to performers and/or suppliers will be held on the RFID platform. Where necessary, information may also be held at our offices and those of our group companies, third-party agencies, service providers, representatives and agents. Information may be transferred internationally to other countries around the world, including countries that do not have data protection laws equivalent to those in the UK. We have security measures in place to seek to ensure that there is appropriate security for information we hold (see below section on transfers of personal data).
How long we keep your information
5. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and in any event for a maximum of seven (7) years from collection. Data will only be retained on the RFIDentikit Platform for as long as necessary after completion of all REMT events in August.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable requirements.
Transfers of personal data
6. We seek to hold all personal data we process within the UK, however, some of the organisations with whom we interact and some of our third party-service providers have headquarters or are based (or maintain data storage) outside the UK. Additionally, we host international events and shows which you may be asked to perform at. This means that your personal data may be transferred and processed outside the UK.
Whenever we transfer, or a third party provider transfers, your personal data outside the UK, we will ensure a similar degree of protection (as within the UK) by using appropriate safeguards, which may include the following:
• we will only transfer your personal data to countries that have been deemed by the ICO to provide an adequate level of protection for personal data (including all EEA countries); or
• where there is no deemed adequate protection, we may use specific contracts (or "International Data Transfer Agreements") or standard contractual clauses approved by the ICO which give personal data the same protection as it has in the UK.
These safeguards used will depend on the circumstances of the transfer and the location of the transfer and processing.
Keeping your personal information secure
7. We have appropriate security measures in place to prevent personal information from being accidentally lost or used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those who have a genuine business need to know it. Those processing your personal data will only do so on our instruction, and they are subject to a duty of confidentiality as well as a duty to keep your personal data secure.
8. We also have procedures in place to deal with any actual or suspected data security breach. We will notify you and the ICO of a suspected data security breach where we are legally required to do so.
Your legal rights
Your personal data is protected by legal rights as follows:
• Your right of access - You have the right to ask us for copies of your personal data.
• Your right to rectification - You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal data in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal data in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
• Your right to complain - you have the right to complain to REMT as data controller if you think we are not handling your personal data in accordance with our legal obligations.
• Withdrawal of Consent - Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.
• Automated decision-making - We do not use automated decision-making in relation to your personal data.
Correcting your personal data and exercising your rights
If you wish to correct your personal data or exercise any of your rights in relation to your personal data please contact our Data Protection Officer (DPO) David Webster who can be contacted by phone on 0131 225 4783 or via administration@edintattoo.co.uk. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights.
You will not usually have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
How to complain
9. If you have any queries or concerns about this notice or about our use of your personal information, please contact David Webster by phone on 0131 225 4783 or via administration@edintattoo.co.uk.
10. If our Data Protection Officer is not able to address your query or concern, you can contact the Information Commissioner at https://ico.org.uk/concerns/ or telephone: 0303 123 1113 for further information about your rights and how to make a formal complaint.
CONSENT
I confirm that I have read the Privacy Notice, by or ticking this box I hereby explicitly provide my consent for REMT to:
• store and process any medical or dietary information that I submit for the purposes of ensuring my health and safety whilst attending REMT events; and
• store and process my image for the purposes of providing a security pass which will be used to validate my identity when entering event areas.
I understand that I may withdraw my consent at any time however, in doing so, REMT may not be able to ensure my health and safety or permit access to restricted areas.
