Privacy Policy

Privacy

Blue Box is committed to protecting your privacy and maintaining the security of any personal information received from you. We strictly adhere to the requirements of the data protection legislation in the UK.

What information do we collect?

Personal information in the context of Blue Box typically means your name, work email address, and place of work, but may also on occasion include your mobile phone number if you give it to us.

We do not collect sensitive information about you except when you specifically knowingly provide it. As our customers are typically schools we do not store any personal financial information. We do not store any personal information regarding children who attend schools we visit.

The current and proposed ePrivacy Regulation differentiates between individual and corporate subscribers. For our purposes, the government bodies (public schools) and corporations/charities (private schools) are considered to be corporate subscribers. In this case, the teachers’ email addresses are defined as ‘users’ and consent is not a requirement for processing the data, providing we also comply with GDPR.

We typically collect this information from forms on our website. We also use headteacher names and in some cases direct email addresses from the Department for Education.

You can check, update or remove your personal details by emailing us on office@westendinschools.org.uk. You can also ask us to delete your personal information, and ask us to cease contacting you by emailing this address.

We also currently work with a marketing agency which emails schools and teachers about our products. We have reviewed their data protection and GDPR policies and will not contact you unless you contact us first through one of their emails.

Do we sell or rent your personal information to third parties?

No. We have never shared information to third parties, and will not do so without your explicit consent.

How do we secure your personal information?

We use a number of services to administer our business, and therefore personal information can be stored in Google Drive, in our CRM system and our emailing server. All such systems use industry standard security and access to them is restricted to our staff and in some cases the support staff of others. These systems are either based within the EU or are established businesses with good reputations and data protection agreements that we have reviewed. Our business computers use encrypted hard drives, so a lost or stolen computer would not enable access to any information it holds without the user’s password.

How do we use your personal information?

When you provide us with your personal information in an enquiry we will use this personal information only for the purpose you intended.

For example: if you complete a form on our website enquiring about a visit to your school, we will use that information to answer your query.

We may also assess whether there are other related visits you may be interested in and one of our team may contact you about these as well. We email customers about our range of work via a mailing list but if you do not book then we will not subscribe you to any regular mailing lists unless you request us to do so.

We have email lists that contain personal information (ie email addresses typically of the form j.smith@school.sch.uk) including:

1. Past customers

2. An opt-in newsletter list where all recipients have explicitly consented to receive such emails

3. Headteachers whose personal information we have collated from publicly available sources (the Department for Education and the UK Government’s published database of schools and headteachers - Edubase)

Each email sent from such a mailing list contains an unsubscribe link which is obeyed by our systems. If you wish not to receive any marketing communications from us you can additionally email us at office@westendinschools.org.uk and we will ensure you are removed from any marketing communications.

Additionally, if you make an enquiry about our work we will store this information on our CRM system for archive purposes. We may assess whether there are other related visits you may be interested in, and one of our team may contact you about this on a direct one-to-one basis. In all of these cases, you will have the opportunity to cease communications by replying to the email or requesting it in any other manner.

Retention of your personal information

We will retain your information only for as long as is necessary for the purposes set out in this policy, and to comply with our legal obligations (for example, if we are required to retain information to comply with HMRC).

We update our mailing lists on an annual basis, in keeping with the school year. If you unsubscribe from a list we will cease communications. We will however continue to store your information for archive purposes to ensure that have have the opt-out on record, unless you specifically request that we delete the information.

We also retain information for past prospects and customers on our CRM system for archive purposes.

How do we use IP addresses and cookies?

Our website and email programmes can use IP addresses and/or cookies to monitor how they are working. This enables us to make our website and emails as easy to use and as effective as possible.

These IP addresses and cookies are not linked to personally identifiable information, other than it is in some cases possible for us to see if an email we have sent has been opened. We use IP addresses and cookies to analyse trends, administer our website, track general user movements, and gather broad demographic information for aggregate use.

In some cases we use cookies to track the journeys of visitors to our website, which sometimes includes how a visitor came to be on our website eg via Google, or by clicking on a link on a marketing email etc.

If your browser rejects a cookie, you may still use our website.

Personal information relating to employees, freelancers and job applicants

We retain personal information on employees and freelancers to enable us to offer and pay for work, comply with our legal responsibilities and remain in contact. This information can at times be ‘more personal’ in that it may include CV’s, bank details, health matters etc.

We retain on file information supplied by previous job applicants in case a role comes up which may be suitable.

This information is kept on our systems, including our internet forms provider, accounting software and online banking all of which use bank level security encrypted connections.

If you have applied to or worked with us and require more information or to exercise your rights under GDPR, please speak to Nigel Godfrey.

Legitimate Interest Assessment

Emails sent to customers via lists in groups 1 and 3 above are sent on the basis that we have assessed that we have a legitimate interest in sending such an email.

The data

The personal data that West End in Schools processes for these purposes is the names, work email addresses, and job roles of UK school staff. For example:

Name: Nigel Godfrey

Job role: Headteacher

School email address: nigelgodfrey@londonschool.sch.uk

As explained above, schools are considered corporate subscribers and the teachers’ email addresses are defined as ‘users’. As such consent is not a requirement for processing the data, providing we also comply with GDPR.

The data was and is collected by our in-house team from publicly available sources, including data provided by the UK Government’s published database of schools and headteachers (Edubase) and by the Department for Education.

Our communications

We process the data used for our marketing communications using the legal ground of legitimate interest.

Under PECR (the Privacy and E-Communication Regulations) it is legal to send electronic marketing to corporate subscribers. In order to meet these regulations, we ensure that in all of our communications we identify ourselves, provide contact details, and provide the option to opt-out.

We ensure that our communications are specific by only contacting individuals within primary schools about work that is directly relevant to them. The recipients of campaigns are selected based on their role of responsibility (e.g. Headteacher; Literacy Coordinator) and the location of the school.

Part 1. Identifying a Legitimate Interest

Why process the data?

We are processing this data for the commercial interests of marketing and promoting our work within UK schools to the teachers working at these schools across the UK.

Our work is created specifically for primary schools and includes a range of creative and performance-based work designed to inspire children and engage them with the performing arts. This includes but is not limited to pantomimes, literacy musicals, dance workshops, drama workshops, Shakespeare workshops, and workshops based on the topics children are studying in the classroom.

By maintaining and communicating with our database of primary school teachers we are able to communicate directly with the people who have the potential to book our work and bring it into their school.

Benefits to us, third parties and the wider public

The processing is necessary for us to maintain awareness within UK schools, to promote our work to the teachers who have not heard about our work, and to past customers who know about one strand of our work but not others. By communicating with them regularly about our work we ensure that we can meet the needs of our potential customers at the times when our work is relevant to them. This is necessary for us to run a business and trade profitably.

The third parties who benefit from our processing and marketing include over 200 freelance actors, dancers and creatives who deliver our work on a yearly basis. By promoting our work and increasing the work that we do in schools, we are providing work for creative professionals that allows them to develop their craft and sustain their career.

We provide a public benefit to our customers through the introduction of theatre, performance and creative learning to children age 4 - 11 across the UK. Our company vision is ‘every child’s imagination should be inspired by the arts’, and at present we deliver work to over a quarter of a million children per year. This reflects the core aim of the company, and our belief in the importance of inspiring creativity in schools. This importance can be evidenced by the numerous reports and testimonials from teachers acknowledging the benefits of our work on the children. This includes benefits directly relating to improving engagement with performing arts, as well as increased confidence, increased interest in literacy and improved collaborative and presentation skills.

The fact that many of the children taking part in our workshops and watching our performances have never before set foot in a theatre, or had the chance to experience the performance arts on this level, in many cases because they could not otherwise afford to makes us confident that our work has a wide public benefit. The alternative for schools would be to take children on a trip to a theatre or theatrical venue, which is both expensive and logistically challenging. Many schools book us on an annual basis as a cost-effective and high-quality alternative.

The importance of processing the data

The processing activity is important to us for two main reasons. Firstly because it allows us to reach our customers and communicate with them directly, and secondly because of the public interest in what we do. We are confident that our work in schools has a positive impact. If we were not able to process the data it would have a large negative impact on our company, as it would decrease the reach of our work and prevent schools from learning about the work we provide for their children.

Compliance with data protection and regulation

As outlined above we are complying with the current Privacy and E-Communication Regulations in emailing corporate subscribers. In compliance with GDPR we also have a legitimate interest in processing school staff-at-work data for marketing purposes.

Part 2. The Necessity Test

The processing of teachers’ names, work email addresses, and job roles in some cases and just their email addresses in others is necessary for us to achieve our aim of marketing to potential customers. As outlined above this allows us to directly reach those who would benefit from our work. Moreover we are specific in the data that we process, ensuring that we only process data for teachers in UK primary schools, and only communicate with them about the work that is relevant to them. For example there are some workshops that we do not deliver in Scotland, and so we do not contact teachers in Scottish schools about these workshops.

The names, work email addresses and job roles is the minimum amount of data we need to process in order to achieve our objectives. As it does not relate to sensitive or private information we believe the processing to be unobtrusive, low-risk and to have a minimum privacy impact.

Legitimate interest is the most relevant ground for processing for our purposes. The best alternative, consent, would be extremely difficult to fulfil not because the school staff members object to what we do, but because asking them to provide an affirmative action would require time and effort from them that they do not necessarily have within their already busy schedules. The continued interest from teachers who have not heard of us and positive reviews of our work when we do visit their school for the first time makes us confident that there is a benefit to us processing the data without explicit consent.

Finally, the fact that the data that we process is already in the public domain, whether in the government’s publicly available database or on the individual schools’ websites, suggests that the staff would reasonably expect relevant organisations to process this data. Processing public school data for the purpose of promoting a service that would benefit the school’s children is therefore reasonable and proportionate.

Part 3. The Balancing Test

Nature of the personal data

The data that we process is already publicly available and highly unlikely to be considered particularly private. We only ever use data relating to people’s professional capacity unless they personally give us a different email address to use themselves, and additionally state school teachers (who make up the majority of our data) are considered public servants.

Reasonable expectations

There is a historic precedent for school staff to receive information and marketing from external parties and it is commonly accepted that they will receive information about relevant things relating to their subject and their school’s needs.

We have used school data for marketing purposes in this way since 2009 and when teachers have asked to unsubscribe from marketing lists we have complied.

In the case of past customers and prospects we have collected the data directly from the individuals. In both cases, they gave us their data in response to clear information about our work in schools and interest in inviting us to deliver work in their schools. Past customers then entered into a contract with us upon booking the work.

The rest of the data was collected from publicly available information as outlined above.

We update our database on an annual basis at the start of each school year, which is a reasonable cycle within the education sector.

Likely impact

We do not process any sensitive data, or ‘special data’ as defined by GDPR. The only data that we process (name, job role and school email address) is used in a professional capacity and the processing is highly unlikely to have any negative impact.

The messages we deliver would not negatively impact the individual’s rights, as they are communications about educational and creative experiences for children.

We believe that the processing is in the interests of the school staff as the information we broadcast enables them to learn about experiences that may be of benefit to the children at the school. We would be happy to explain the processing to the individuals at the schools.

Very few safeguarding measures are needed, aside from the controls which are already a legal requirement such as the option to opt-out. Moving forward we will continue to make sure to honour requests to unsubscribe and make it as clear as possible to individuals that they can do this at any time.

Outcome

Taking everything into account, we believe that West End in Schools has a legitimate interest in processing schools’ data. We will continue to keep the data we process to the minimum required: Name, job role and school email address.