The following information details Hebrides Ensemble’s privacy notice in relation to information collected about you.
Introduction
Hebrides Ensemble (“it”, ”we”, “us”) is committed to protecting your privacy and data. We take our responsibilities with regard to the management of the requirements of data protection very seriously. This policy sets out how we manage those responsibilities.
This Privacy Policy explains how the Hebrides Ensemble collects, safeguards and uses personal information.
We will use the information that we collect about you in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.
Who we are
Hebrides Ensemble is the data controller and responsible for all personal data collected.
Its full details are:
Full name of legal entity: Hebrides Ensemble
Registered address: Third Floor, 3 Hill Street, Edinburgh, EH2 3JP
We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect. Developing a better understanding of our audiences and supporters through their personal data allows us to make better decisions about our programming, fundraise more efficiently and reach our goal of creating a nurturing and inspiring environment where Scottish musical history is made.
This privacy policy sets out the ways in which we use your data and how you can hold us accountable for that. If there are any questions about this privacy policy, including any requests to exercise your legal rights, please contact hello@hebridesensemble.com
We are registered with the Information Commissioners Office, registration reference: ZA001255. Any electronic communications will be made in accordance with the Privacy and Electronic Communications Regulations (PECR).
What information do we collect about you?
We collect your information when you buy a ticket, make a donation, sign-up to our e-newsletter, complete an audience survey or feedback form, apply for a job or to volunteer with us.
Personal information we collect may include: your name, postal address, email address, phone number, date of birth, direct debit instructions for donations, donation history, gift aid declaration, your preferences for how we communicate about you.
When we ask you to provide your personal information, we will let you know why we are asking, and how we will use your data, by directing you towards this notice.
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may track any subsequent actions online, such as buying a ticket. See our Cookie policy for more details.
We only collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) for specific purposes – for example so we know about your access requirements, because you are taking part in a workshop or are applying for a job. If we collect any special categories of personal data for other reasons we do so in an anonymised way which cannot be linked to you as an individual. Data of this nature is only used to help us develop our equalities policy and practices, or to provide aggregate data to relevant statutory bodies.
How we use your personal data
Hebrides Ensemble will only use your personal data when the law allows us to.
We use your data to:
- Respond to information you have asked for
- Adminster your ticket sale or donation, including processing gift aid
- Keep a record of your relationship with us
- Ensure we know how you prefer to be contacted
- Send you information about fundraising and ways to support Hebrides Ensemble
- Undertake audience research to help us understand how we can improve our services
- Analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you.
- To protect against fraud or unlawful activity
- To ensure compliance with policies, procedures and laws.
Our lawful bases for processing your personal data
We rely on the following lawful bases, depending on how you interact with us:
- Performance of a contract
When you purchase tickets, make a donation, or enter into any agreement with us, we process your personal data to fulfil that contract.
- Legal obligation
We are required to retain certain records, such as Gift Aid declarations and financial transactions, to comply with HMRC and other legal obligations.
- Legitimate interests
We use your personal data to:
Maintain records of our relationship with you
Improve our services and audience experience
Undertake audience research and analysis
Send you information about our activities where you would reasonably expect this. In each case, we carefully consider and balance our interests against your rights.
- Consent
Where required (for example, for certain email marketing communications), we will ask for your explicit consent before sending you messages. You can withdraw your consent at any time.If you do not want to receive information by post or email about events, offers, our fundraising activities or customer research, you have the option to change any of your contact preferences by contacting us via the contact details at the end of this policy.
Marketing communications
We may contact you with information about our events, fundraising activities and ways to support us.
Where you have purchased tickets or engaged with us, we may rely on what is known as the “soft opt-in” to send you marketing emails about similar activities, unless you have opted out.
In other cases, we will only send you marketing emails where you have given your explicit consent.
You can opt out of marketing communications at any time by:
- Clicking the “unsubscribe” link in any email, or
- Contacting us at hello@hebridesensemble.com
Even if you opt out of marketing, we may still contact you with essential information relating to transactions, such as ticket purchases or event changes.
We do not share your personal data with third parties for their own marketing purposes without your explicit consent.
How long we retain your data
We review our records periodically to ensure data is not kept longer than necessary. We will not collect or keep more information than we need.
If you have made a donation and a Gift Aid declaration, we are obliged to keep the declaration and the details of the person who made it, for six years.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
This retention period is necessary to meet our financial, auditing, legal and regulatory obligations, to resolve disputes, and to maintain accurate records of customer relationships over time.
For data supplied as part of a job application to us, we will keep your details for six to twelve months, then delete it unless agreed otherwise.
How we manage your data internally
In addition to this Privacy Notice, Hebrides Ensemble maintains an internal Data Protection Policy which governs how staff, contractors and trustees handle personal data. This ensures your data is processed securely, consistently, and in line with data protection law.
Third Parties
We will not share any of your personal details with any other third parties without your agreement, unless required in order to fulfil our contract with you, or allowed by law (for instance, if a safeguarding issue arises). There are certain circumstances under which we may disclose your personal information to third-party providers. In general, the third-party providers used by us to fulfil our contract with you will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us.
These providers include our Ticketing System provider, payment providers, other database software suppliers, email distribution service and insight analysis providers. Agreements are put in place with each provider to ensure that your data is secure at all times and cannot be accessed or used for any other purpose. We require these third parties comply strictly with our instructions and standards for data security, for example around the security of personal data as set out in this policy.
We may share personal information with other organisations who use this to analyse ticket sales for regional and national research into patterns of attendance in Scotland and the UK (for instance, comparison of sales trends over time and geographical comparisons). All data shared is anonymised and does not contain any personal information that would identify you.
Our website may contain links to and from the websites of other organisations. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
How we keep your information secure
We have implemented security procedures, rules and technical measures to protect the personal data that we have under our control from: unauthorised access; improper use or disclosure; unauthorised modification. All our employees and data processors who have access to, and are associated with the processing of personal data, are legally obliged to respect the confidentiality of your personal data.
Your rights
You can ask us if we are keeping any personal data about you and you can also request to receive a copy of that personal data. This is called a Subject Access Request. To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate or driving licence before your request can be processed. Please be as clear as possible about the information you are seeking. Once we have received your Subject Access Request and proof of identity, we will respond within one month, in accordance with UK data protection law. In some cases, where requests are complex, this period may be extended by a further two months, and we will inform you if this applies.
Subject Access Requests should be sent to:
Chief Executive
Hebrides Ensemble
Third Floor, 3 Hill Street
Edinburgh
EH2 3JP
Email hello@hebridesensemble.com
At any time you may request that we delete or correct your personal information by contacting hello@hebridesensemble.com
If you wish to lodge a complaint about Hebrides Ensembles use of your data contact the Information Commissioner’s Office (by calling 0303 123 1113, or emailing casework@ico.org.uk)
Changes to our privacy policy
We regularly review our privacy policy, and may make changes from time to time. Any changes made will be posted to this page, and will apply from the time we post them. This privacy statement was last amended on 10 August 2026.
How to contact us
If you have any comments on our privacy notice, or information we hold about you, please contact us by email hello@hebridesensemble.com or write to us at Hebrides Ensemble, c/o Third Floor, 3 Hill Street, Edinburgh, EH2 3JP