Privacy Policy

Introduction
 
We value the privacy of all our applicants, students, visitors, supporters and employees and strive to meet the highest standards in managing your personal information. This privacy notice explains how we collect and manage personal information, and how we comply with data protection law.

This notice aims to cover all of your rights, and to provide the information required under all applicable data protection laws, including the General Data Protection Regulation (GDPR) and the new Data Protection Act 2018, as well as anticipated regulations. We are continually working to improve our systems, processes and practices, and will update this notice as necessary. It is important that the personal data we hold about you is accurate and current. Please keep us informed via hello@bristolschoolofacting.com if your personal data changes during your relationship with us.

Who are we?

BSA (or Bristol School of Acting Ltd) is an educational institution, dedicated to the highest quality training for the theatre, TV and film industries. It was created in 2021 by Nancy Medina and Stuart Wood. It is a limited company (number 13640052).
In this Privacy Notice and in the privacy statements that you will sign when we collect your personal information, ‘BSA’ and ‘we’ (or ‘us’ or ‘our’) refer to the directors of Bristol School of Acting Ltd. We act as data controllers of your personal information, and we are registered with the Information Commissioner’s Office. If you have a question or concern about personal data at BSA, please contact on hello@bristolschoolofacting.com.

What personal information do we collect about you?

We collect and process a range of personal information.

Information you provide to us

We collect any information that you provide directly to us. This may be via our website when you make a request or query, whether by email, via our website or on the telephone. You may provide some of this information to us when visiting a venue we may be performing in, or via one of our staff.

This includes information that you provide when

• filling in forms on our website, including information provided at the time of joining a mailing list
• applying for a course
• attending a class, course, audition or interview
• buying tickets to a performance or event
• making a donation, or Gift Aid Declaration
• providing us (or offering to provide us) with goods or services
• submitting a CV or applying for a job

This type of information is likely to fall into one of the following categories:

Identity and contact information

• contact details (for example, name, telephone number, email)
• demographic information (for example, date of birth or nationality)
• information relating to other members of your party and/or participants at any event

Financial information

• your credit or debit card, bank and billing address details and other financial information that may be required to process a BACS transfer or payment
• details of other financial information related to your funding such as eligibility for undergraduate grants, student loans, scholarships and bursaries
• details of your declaration if Gift Aid is applicable to any donation that you make

General information

• if you are a student or prospective student applying for, or registering for a course, you may also provide details of your academic records and results and unique learner number
• your preferences, interests and previous activities with BSA, such as performances and courses you have attended and donations you have made, as well as tickets purchased for our performances and events
• your views, opinions, questions and comments
• records of your correspondence with us

Information we collect about you

We also collect information indirectly about you and your activity with BSA. This includes:

• transactional data: we will collect information related to your transactions, including the date and time, the amounts charged and other related transaction details;
• website usage and technical data: details of your visits to any of our websites and the resources you access. This may include your geographical location, device information (such as your hardware model, mobile network information, unique device identifiers) and the data transmitted by your browser (such as your IP address, date and type of the request, and other related information)
• data entered on our websites including non-submitted (or abandoned) data
• images of you when we take photographs or film on our premises. We will endeavour to let you know by printed notices whenever such filming or photography will take place
• academic information about course attendance and progress including assessments and recordings of performances
• your correspondence with BSA and third parties across BSA’s system

Information we collect from third parties about you

Some of the above may be provided to us via third-party sources (i.e. from someone who is not part of BSA). For example:

• you may post reviews or other content relating to BSA or similar organisations via third-party social media platforms and channels, such as Twitter, Facebook or Instagram
• we sometimes run events or competitions with other companies and organisations, and they may pass some personal information about participants or entrants to us
• if you are a job applicant we may contact your recruiters, current and former employers and/or referees, who may be based inside or outside the EU, to provide information about you and your application
• if you are a prospective student we may contact your academic referees to provide information about your application, and we may receive information about you from third parties
• we may collect personal information from an IT support or software provider. For example, we may collect personal information from our calendar scheduling software (Calendly) and our video conferencing host (Zoom) who are based in the US, though are fully compliant with the requirements of the US-EU and Swiss Privacy Shields
• we currently use social media plugins from the following service providers who are based both inside and outside the UK: Facebook, YouTube, Twitter and Instagram. By providing your social media account details you are authorising that third-party provider to share with us certain information about you
• if you are a student or prospective student we may receive an assessment from your medical practitioner, counsellor or other medical professional in order to assess your fitness to train or to ascertain the type and level of reasonable adjustment required in respect of our Higher Education provision
• If you are an employee or prospective employee we may receive an assessment from your medical practitioner, occupational health adviser or other medical professional in order to assess your fitness to work or to ascertain the type and level of reasonable adjustment required in respect of our obligations as an employer
• We might also receive information about you from third parties if you have indicated to such third parties that you would like to hear from us.

We recommend that you check the privacy policy and statements of any third parties that you provide information to, as we are not responsible for the way in which they use, share or make available your personal information.

Sometimes we may collate information that you have provided to us via multiple direct interactions with us with information from third parties or the technical data referred to below so that we can use this to try to improve the services and information we provide to you.

Technical information collected by us automatically about you

As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or not function properly.

Special categories of personal data

We may, on rare occasions, collect special categories of personal data from you. Special categories of data include details about your race or ethnicity, religious or philosophical beliefs, gender, date of birth, income, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. Depending on the circumstances we will also collect information about criminal convictions and offences as described in more detail below.

We need to have further justification for collecting, storing and using this type of personal information.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. The main circumstances in which we may lawfully process special categories of personal information are:

• in limited circumstances, with your explicit written consent
• where we need to carry out our legal obligations or exercise rights in connection with employment
• necessary to protect your vital interests and you are physically or legally incapable of giving consent
• necessary for the establishment, exercise or defence of legal claims
• where it is necessary for reasons of substantial public interest or on the basis of applicable laws, such as to ensure compliance with (i) legislation relating to BSA’s status as a Higher Education provider, or (ii) legislation concerning the safeguarding of children and of individuals at risk, or (iii) legislation requiring us to make reasonable adjustments for protected characteristics, or (iv) equal opportunity monitoring or treatment; or (v) where you have already made the information public.

Depending on the circumstances we collect the following special categories of data:

• if you are a job applicant, we will collect information about (i) your race, ethnicity, religious or philosophical beliefs and sexual orientation for the purpose of our diversity and equal opportunities records (on the basis that it is needed for reasons of substantial public interest, for equal opportunities monitoring); (ii) your health and any disability you may have as necessary for the purpose of arranging your interview (on the basis of compliance with our legal obligations to make reasonable adjustments in relation to protected characteristics), (iii) your criminal record for the purposes of completing background checks necessary for you to be able to work with children to whom we provide some of our courses (on the basis such processing is necessary for reasons of substantial public interest under applicable laws);
• if you are offered a place on one of BSA’s courses, you will be asked to declare details of any relevant unspent criminal convictions, in order for BSA to assess any risk to which staff and other students may be exposed (on the basis such processing is necessary for reasons of substantial public interest under applicable laws);
• if you are a student or an attendee at a workshop, we will collect information related to your health such as allergies to particular forms of medication, or conditions such as asthma or diabetes and dietary requirements (on the basis of your explicit consent). There will be very limited reasons why we might use such information without your explicit consent, for example in a medical emergency to inform medical professionals;
• if you are a student or prospective student, we will collect information about your medical history or requirements if a reasonable adjustment is needed in order to ensure we are able to offer you a fair and equitable assessment (either on the basis of your explicit consent or in compliance with our legal obligation to make reasonable adjustments for your circumstances).

Children’s information

We do not intentionally collect children’s information (anyone under 13 years old) without explicit consent from the parent or guardian. If you believe a person under 13 years old has provided us with their personal information, or have any concerns regarding this aspect of our notice, please contact hello@bristolschoolofacting.com

Our reasons for using your information

The law requires us to ensure we have a lawful basis for processing your personal information. We only use your personal information when we believe it is lawful to do so. Sometimes, we may ask you to consent to our collection and use of your personal information for certain purposes. Where this is the case, you can change your mind and withdraw your consent at any time by emailing hello@bristolschoolofacting.com or by using any of the contact details that appear at the end of this privacy notice. You can always opt out of receiving any marketing or promotional messages from us.

 

Otherwise we process your personal information because it is necessary for one of the following lawful reasons:

• the performance of a contract that you enter in to with us

For example, if you take a place on a course, buy tickets to a performance or event, or are employed or contracted by us, then we must deliver our obligations under the contract we have with you as a result, and your personal information will often be required in order for us to do this. compliance with a legal obligation For example, the law requires us to retain certain information about contracts and transactions for tax and audit purposes
• for your vital interests

For example, if you are a registered student or employee, we may hold emergency contact or medical information that may be needed in an emergency.
• our legitimate interests or those of a third party

This means our legitimate business interests in conducting and managing our business and our relationship with you, including the legitimate interest we have in personalising, enhancing, improving the services and or communications that we provide to you; promoting our services and studying how our website/services are used, to develop them, to grow our business and to inform our marketing strategy
• safeguarding your wellbeing and monitoring your progression as a student on one of our courses, detecting and preventing fraud and operating a safe and lawful business
• maintaining our reputation and standing as a Higher Education Provider
• improving security and optimisation of our network, sites and services.

 

When we hold or process your personal information on the basis of our legitimate interests, we only retain information that is necessary and proportionate, and we consider the impact on your right to privacy before doing so.

 

Why do we keep and use your information?

 

We may use your information for some or all of the following purposes in line with the lawful bases above:

• providing and delivering our services, goods or information you have requested from us including access to our website
• processing job applications and managing our staff
• compliance with relevant policies, procedures and laws
• administering donations and our relationships with supporters including processing any payment and any Gift Aid claims
• gathering feedback
• developing and managing BSA’s courses and commercial activities
• managing activities related to any course, performance, event or hire
• fulfilling and responding to requests from you, or made on your behalf
• managing the security and safety of BSA’s facilities, community and assets
• analysing, tailoring, developing or improving our offer
• communications with you including newsletters, marketing and promotional messages or surveys providing information relating to offers, events, opportunities and new services, or new activities
• running competitions and dealing with competition entries and results
• operating, managing and promoting a membership scheme
• for our internal operational and management purposes including record keeping, staff recruitment and management, ensuring content from our websites is presented to you in the most effective manner for you and for your computer, assessing credit risk, fraud or brand damage risk or for research and audit purposes

 

We may record video conferences and webinars for the purposes of training our staff and development of our services. Participants will be advised when recording is taking place and be given the option not to participate.

 

Do you have to provide personal information?

 

If we need to collect personal information by law, or under the terms of a contract we have with you, and you choose not to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide a place on a course or to sell you a ticket to a performance). In this case, we may be unable to process a transaction and/or may have to cancel something you have requested from us – but we will notify you if this is the case at the time.

 

Who do we share your personal information with?

 

• We maintain internal controls that limit who can access your personal information, but, where appropriate, your data may be accessed by and shared with all parts of BSA
In addition, and in line with the lawful bases above, we may share personal information with third parties as follows:
• Partners and collaborators such as Bath Spa University or Plymouth Marjon University (our validating partners)
Service providers we work with to deliver our business, who are acting as processors and provide us with:
• website development and hosting services, e.g. IT, system administration and security services (including Google and others) based in the UK and the USA
• marketing and advertising services (including the Google Adwords service), analytics providers (including Google Analytics) based in the USA
• social media plugin services including Facebook, Twitter, Instagram, Snapchat and YouTube based in the UK and USA
• Video conferencing (including Zoom) and scheduling software (Calendly) based in the USA
• payment services and box office software (Spektrix, and WorldPay, based in the UK)
• legal, accountancy, auditing and insurance services and other professional advisers based in the UK
• recruitment service providers based in the UK
• travel service providers based in the UK.
• Regulators and governmental bodies: HM Revenue & Customs, regulators, governmental
• bodies and other authorities including, but not limited to the Office for Students (OfS) and the Higher Education Statistics Agency, (HESA), OFQUAL, Qualification Wales, CCEA, UCAS, Learning Records Service, and UKVI, acting as processors or joint controllers based in the United Kingdom who require reporting of processing activities in certain circumstances. The HESA collection notice relating to governors, staff and students is available for you to read here: https://www.hesa.ac.uk/about/regulation/data-protection/notices
• donors and funders: if you are a student receiving a privately funded scholarship or other financial support, we may share details of your activities at BSA with the donor or funder
• marketing parties: any selected third party that you consent to our sharing your information with for marketing purposes;
• prospective sellers and buyers of our business: any prospective seller or buyer of such business or assets, only in the event that we decide to sell or buy any business or assets; and
• other third parties (including professional advisers): any other third parties (including legal or other advisors, regulatory authorities, courts, law enforcement agencies and government agencies) based in the United Kingdom where necessary to enable us to enforce our legal rights, or to protect the rights, property or safety of our employees or where such disclosure may be permitted or required by law.

When we use third-party service providers, we disclose only the personal information that is necessary to deliver the service. We aim to ensure that we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes

Sometimes we may ask for your permission to share your details with others. For example, if you attend a training course, we may ask if delegates are happy for us to share their contact details with other delegates. We may release your information to third parties beyond those listed above only if we are required to do so by law (for example by a court order), or in connection with the prevention of fraud or other crime.

How do we protect the personal information you provide to us?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. This includes:
• ensuring the physical security of our spaces;
• ensuring the physical and digital security of our equipment and devices by using appropriate password protection and encryption;
• maintaining a data protection policy for, and delivering data protection training to, our employees; and
• limiting access to your personal information to those in our company who need to use it in the course of their work.

In addition, we limit access to your personal data to those employees, agents, contractors and other third- parties who have a business need to know. They will only process your personal data on our instructions (which, in the case of our employees and contractors, are set out in our policies) and they are subject to a duty of confidentiality. We regularly review and update our procedures to deal with any suspected personal data breaches. In the event of any suspected personal data breach we will notify the individuals affected and the applicable data regulators, where legally required to do so.

How long will we keep your information?

We aim to keep personal information only for as long as is necessary to fulfil the purposes for which the information was collected. By law we have to keep certain basic information about our customers and supporters and their transactions with us for specified periods of time.

What rights do you have in relation to your personal information?

You have a number of legal rights affecting your personal data. You have the right to:
• Request access to your personal data (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which, if applicable, will be shared with you at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation that makes you want to object to
• processing on this ground, as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use, or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time of your request. These don’t apply in all circumstances, as there are also legal exemptions which may apply, depending on why we have collected the data, and the legal basis on which we are holding the data. We will be happy to explain if you have questions about this.

If you wish to make a formal request for information we hold about you, or to make changes to the data we hold about you, or to opt out of being contacted for marketing purposes then you can contact us at hello@bristolschoolofacting.com (as well as opting out of our marketing messages by using the unsubscribe link that appears on each of them). You may also use these contact details to ask questions or raise concerns about the privacy notice.

Changes to this privacy notice

This privacy notice was created in September 2022. We may change or update this notice from time to time so please check this page occasionally to ensure that you’re happy with any changes.

How can you contact us and/or comment?

Email: hello@bristolschoolofacting.com

Post: BSA, Silver Street, Bristol BS1 2AG

Telephone number: 0117 472 1644

Please use these details for any data protection requests or enquiries, including requests to exercise your rights (such as the rights of access, rectification, erasure, restriction of processing, and data portability). You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK Data Protection Authority (www.ico.org.uk). We would appreciate the chance to deal with your concerns before you approach the ICO so please contact us first.