Privacy Notice

GRASS Cliftonville CIC
Last updated: 23 August 2026

1. Who we are

GRASS Cliftonville CIC (referred to in this notice as “GRASS”, “we”, “us” or “our”) is the data controller for the personal information described in this notice.

We operate The Oval Bandstand & Lawns and related community, cultural, wellbeing and fundraising activities.

Organisation: GRASS Cliftonville CIC
Address: The Oval Bandstand & Lawns, Eastern Esplanade, Cliftonville, Margate, Kent CT9 2HL
ICO registration number: ZB128757
Data protection lead: Stephen Darrer
Contact: through the contact form on www.theovalbandstand.co.uk, or by writing to the address above.

This notice explains how we collect and use personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data-protection and electronic-marketing laws.

2. The information we may collect

Depending on how you interact with us, we may collect:

• your name, postal address, email address and telephone number;
• information you provide in enquiries, applications, feedback, complaints or correspondence;
• booking, ticket, attendance and transaction information;
• marketing preferences and records of when, how and through which form you subscribed;
• information about performers, contractors, stallholders, volunteers, workers, partners and suppliers;
• accessibility or health information that you choose to give us so we can make appropriate arrangements;
• photographs and video taken at our venue or events;
• CCTV images and body-worn camera video and, where enabled, audio;
• technical information generated when you use our website, such as your IP address, device or browser information and cookie choices; and
• any other information you choose to give us.

We do not intentionally collect more personal information than we need.

3. How we collect information

We may collect personal information:

• directly from you, including through our website, email, telephone, forms and face-to-face contact;
• when you subscribe to our mailing list;
• when you book or attend an event, apply to perform, volunteer, work with us or supply services;
• through ticketing, mailing-list, payment, website and other service providers acting on our behalf;
• from event partners or referral organisations, where they are permitted to share it with us;
• through CCTV, staff-worn body cameras and authorised event photography or filming; and
• from publicly available sources where this is necessary and lawful.

If another organisation collects information for its own purposes, its own privacy notice will also apply.

4. Why we use personal information and our lawful bases

We use personal information only where we have a lawful basis. Depending on the circumstances, we may use it:

Purpose	Usual lawful basis
Responding to enquiries, managing bookings and providing tickets, activities or services	Taking steps at your request and performing a contract; legitimate interests
Processing payments, maintaining accounts and meeting tax, company, licensing, safeguarding or other legal requirements	Contract; legal obligation; legitimate interests
Administering performers, contractors, suppliers, volunteers and workers	Contract; legal obligation; legitimate interests
Operating and improving our venue, events, website and community activities	Legitimate interests in running GRASS effectively and improving our services
Sending email marketing and newsletters	Consent, together with the requirements of the Privacy and Electronic Communications Regulations 2003 (PECR)
Protecting people, property and the venue; preventing and investigating crime, disorder, harassment, threats, accidents and misconduct; and dealing with complaints, insurance claims and legal matters	Legitimate interests; legal obligation where applicable; establishment, exercise or defence of legal claims
Taking and using general event photographs or video to document and promote GRASS, The Oval and our community activities	Legitimate interests in recording and promoting our work, balanced against people’s privacy rights; consent where specifically requested or more appropriate
Making reasonable accessibility arrangements or responding to emergencies	Consent or explicit consent where appropriate; vital interests; legal obligation; or another applicable condition under data-protection law

Our legitimate interests include operating a safe and secure venue, administering our organisation, communicating with people who contact us, preventing fraud and misuse, establishing or defending legal rights, and documenting and promoting our not-for-profit community work. We consider whether our interests are necessary and proportionate and balance them against the rights and interests of the people affected.

Where we need information to enter into or perform a contract, or to comply with a legal requirement, failure to provide it may mean that we cannot provide the relevant booking, service, opportunity or arrangement.

5. Mailing list and direct marketing

We use Brevo to manage our mailing list and send newsletters and information about events, activities, fundraising and The Oval.

We will normally send marketing emails only where you have actively opted in. We keep a record of your consent, including when and how you subscribed and what you were told at the time. You can withdraw your consent at any time by using the unsubscribe link in any marketing email or by contacting us.

Withdrawing consent does not affect the lawfulness of anything done before withdrawal. We may retain a minimal suppression record so that we can respect your request and avoid adding you back to marketing unintentionally.

We do not sell our mailing list.

6. CCTV

CCTV operates at The Oval Bandstand & Lawns. Cameras may record people entering, leaving or moving around the venue and its immediate surroundings.

We use CCTV to:

• help protect visitors, staff, volunteers and contractors;
• protect the venue, equipment and property;
• deter, detect and investigate crime, anti-social behaviour, harassment, threats, accidents and other incidents;
• establish what happened when an incident, complaint or claim is reported; and
• provide evidence to the police, insurers, legal advisers or other authorised bodies where it is necessary and lawful.

We display signs to make people aware that CCTV is in operation. Cameras are positioned and used only where we consider recording necessary and proportionate. We do not use facial-recognition technology or make decisions about people solely by automated means using CCTV footage.

CCTV recordings are normally retained for up to 14 days and then overwritten or securely deleted. Relevant footage may be isolated and retained for longer where it is reasonably required for an incident investigation, complaint, safeguarding matter, insurance claim, legal proceedings or a request from law enforcement. It will then be retained only for as long as necessary for that purpose.

7. Staff-worn body cameras

Authorised members of staff may wear body cameras while working at the venue or our events. The presence of a body camera does not mean that it is recording continuously.

A body camera may be activated where the wearer reasonably believes recording is necessary and proportionate, including where:

• an incident is occurring or appears likely to occur;
• someone is behaving aggressively, threateningly or abusively;
• there is a risk to the safety of a member of the public, staff member, volunteer or contractor;
• a person has been asked to leave or venue rules are being enforced;
• an allegation, dispute, accident or safeguarding concern needs to be accurately recorded; or
• evidence may be required concerning suspected crime, disorder, harassment, damage or misconduct.

Body cameras may capture video and audio. Where it is safe and reasonably practicable, the wearer will make it clear that recording has started. A visible recording indicator may also be displayed on the device. Recording may begin without advance warning where giving a warning would be unsafe, impracticable or could undermine the purpose of recording.

Body-camera footage is not used for entertainment or routine promotional purposes. Access is restricted to authorised people and recordings are handled securely. Footage is normally retained for up to 14 days, unless it is required for an incident, complaint, safeguarding matter, insurance claim, legal proceedings or lawful request by the police or another authorised body. In those circumstances, relevant footage may be retained for as long as reasonably necessary.

8. Event photography and filming

Authorised photography or filming may take place at our public events. We will take reasonable steps to make people aware of this, for example through event information, notices or announcements.

General crowd and event images may be used on our website, social-media channels, printed publicity, reports, funding applications and other material that documents or promotes GRASS and The Oval. We will take additional care where children or vulnerable people are identifiable and will seek consent where this is appropriate, particularly for posed or featured images.

If you do not wish to be photographed or filmed, please tell a member of staff or the photographer. We will take reasonable steps to respect your request, although it may not always be possible to exclude someone from wide-angle or background crowd footage at a public event. You may also contact us afterwards about a particular image.

Commercial or third-party photographers and videographers must obtain our permission before filming at the venue. Where they act as a separate data controller, they are responsible for providing their own privacy information.

9. Cookies and website information

Our website may use essential cookies needed for it to operate. We will ask for consent before using non-essential cookies or similar technologies where consent is required by law. You can manage your choices through our cookie controls and browser settings.

More information about the cookies in use, their purposes and duration should be provided in our separate Cookie Policy or cookie-preference tool.

10. Who we may share information with

Where necessary and lawful, we may share personal information with:

• service providers that support our website, email, ticketing, payments, communications, IT, security, storage, professional advice or administration;
• event partners, performers, contractors and suppliers where needed to deliver an event or activity;
• our insurers, accountants, legal advisers and other professional advisers;
• the police, emergency services, local authorities, regulators, courts and other public bodies;
• safeguarding organisations where necessary to protect someone; and
• a person or organisation involved in a complaint, dispute, insurance claim or legal matter, where disclosure is necessary and lawful.

Service providers may only use information in accordance with our instructions and appropriate data-protection arrangements, unless they act as a separate data controller. We do not sell personal information.

11. International transfers

Some of our service providers may process personal information outside the United Kingdom. Where this happens, we take reasonable steps to ensure that an appropriate safeguard or other lawful transfer mechanism is in place, such as UK adequacy regulations or approved contractual protections. You may contact us for more information about the safeguards relevant to your information.

12. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, insurance and safeguarding requirements. Our usual periods are:

Information	Usual retention period
General enquiries and routine correspondence	Up to 2 years after the matter is closed, unless needed for longer
Booking, contract, payment and accounting records	Usually 6 years after the end of the relevant financial year or contractual relationship
Mailing-list records	Until you unsubscribe or consent is otherwise withdrawn; a minimal suppression record may be retained afterwards
Unsuccessful performer, contractor, volunteer or recruitment applications	Normally up to 12 months
CCTV and body-camera recordings	Normally up to 14 days, unless retained for an incident or other specified purpose
Incident, complaint, safeguarding, insurance or legal records	For as long as necessary in light of the matter and any applicable limitation or legal period
Event photographs and promotional video	For as long as they remain relevant to our historical, reporting and promotional record, subject to periodic review and individual rights

We may securely delete or anonymise information earlier when it is no longer needed.

13. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Access is restricted to people who need the information for authorised purposes. No system can be guaranteed completely secure, but we review our arrangements and take proportionate steps to manage risk.

14. Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests or for direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where we rely on consent; and
• receive safeguards in relation to certain solely automated decisions.

These rights are not absolute and exemptions may apply. We may need information to confirm your identity and locate the relevant records. We normally respond within one month, although the law permits an extension in some circumstances.

If you request CCTV or body-camera footage, please contact us promptly and provide enough detail to help locate it, such as the date, approximate time, location and a description of yourself. Footage may be overwritten before a late request is received. We may need to redact or withhold images or audio relating to other people where disclosure would adversely affect their rights or where another legal exemption applies.

15. Complaints

Please contact us first if you have a question or concern about how we use your information so that we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

Website: www.ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

16. Changes to this notice

We keep this privacy notice under review and may update it when our activities, systems or legal obligations change. The current version will be published on our website with the date it was last updated.