This policy explains how The Space CIC (“The Space”) collects, uses, stores, and protects your personal data whether you are a website visitor, project applicant, contributor, programme participant, service user, or supplier.
About us
The Space supports the arts, culture, and heritage sectors to build digital skills and create engaging digital experiences through commissioning, training, mentoring, research, and consultancy. We work alongside public funders, broadcasters, local government, and sector partners.
- Data Controller: TheSpace CIC
- Company Registration: Registered in England (No. 08241091)
- Registered Office: c/o Black Country Touring, Thimblemill Library, Thimblemill Rd, Smethwick B67 5RJ
.
1. The personal information we collect
We collect and process the following categories of information:
- Identity Data: first and last names (including names of project participants you share with us)
- Contact Data: postal address, phone number, and email address (personal or professional)
- Usage Data: details about how you interact with our website, content, and services.
- Safety & Regulatory Data: details needed for health, safety, access, or safeguarding requirements
- Financial Data: bank details for making or receiving payments
- Diversity Data: demographic details (e.g., age, ethnicity, disability, gender) to support our sector equality monitoring
- Communications: records of correspondence when you contact or enquire with us.
- Applicant & Contributor Data: Career history, skills, project work, and biographical information.
If you do not provide required data: Where we need data by law or under a contract and you do not provide it, we may be unable to perform our contract or deliver services to you. We will inform you if a service must be cancelled for this reason.
2. Children and young people (under 18s)
Some of the projects we support, fund, or commission involve participants under the age of 18. Where we collect or process personal data relating to children or young people (such as for project participation, safeguarding, or media consent):
- We ensure appropriate parental, guardian, or legal representative consent is obtained where required by law.
- We process this data strictly in accordance with UK safeguarding legislation and data protection standards.
- Information relating to under-18s is given extra protection and is shared only on a strict need-to-know basis (for example, with authorized project managers or statutory authorities for safeguarding purposes).
3. Special categories of personal data
We do not routinely collect special category data unless necessary—for example, to accommodate access requirements, meet health and safety or safeguarding obligations, or support equal opportunity monitoring. This may include health or disability information you choose to share with us so we can deliver accessible, safe services.
4. How we collect and use your information
We collect data directly from you or from partners involved in delivering our services. We use this information to:
- Manage contracts, relationships, and payments.
- Deliver funding, mentoring, training, and strategic consultancy.
- Answer enquiries and provide updates on our work or similar services (you can opt out at any time).
- Comply with legal, safeguarding, and CIC governance obligations.
- Monitor, evaluate, and report on our activities for funders and partners (diversity data is always anonymised unless you explicitly consent otherwise).
- For Contributors: Manage audio/video/text contributions and process release forms.
- For Applicants: Process funding applications, connect you with mentors/experts, and manage project delivery.
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for our processing this information are:
- Your consent. Where consent has been given, you are able to remove your consent at any time. You can do this by contacting us.
- We have a contractual obligation. For example, where the processing is necessary for the performance of a contract to which you are a party, or to take steps prior to entering into a contract with you, for us to provide you with our services.
- We have a legal obligation. For example, where processing is necessary in order for us to meet our requirements under Safeguarding legislation, or to provide information to law enforcement organisations or the Courts.
- We have a legitimate interest. For example, where it is necessary for the purposes of our legitimate interests, except where our interests are overridden by the interests, rights or freedoms of affected individuals (such as you). To determine this we shall consider a number of factors, such as what you were told at the time you provided your data, what your expectations are about the processing of your personal data, the nature of the personal data, and the impact of the processing on you. Our legitimate interests may include processing necessary to improve and to promote our services and to better understand our customers’ interests and knowledge and to administer the technical aspects of our services.
Or on rarer occasions:
- Where we need to protect your interests (or someone else’s interests); and/or
- Where it is needed in the public interest or for official purposes
5. Sharing your data
We will never sell your personal information. We only share data when required by law or to fulfil our service delivery. This includes sharing with:
- Funders & Partners: for activity reporting (diversity characteristics are always anonymised unless you consent to sharing).
- Third-Party Service Providers: suppliers who support our business operations, such as IT hosting, accounting, website management, communication tools, and legal advisors.
- Project Freelancers & Consultants: contractors engaged to manage services on our behalf (bound by strict confidentiality obligations).
- Statutory & Legal Authorities: courts, regulators, or law enforcement bodies when legally required or to protect safety and rights (including safeguarding matters).
6. International data transfers
Where your data is processed outside the UK (such as through international software platforms), we ensure appropriate safeguards are in place. This includes using UK Government adequacy decisions or ICO-approved transfer mechanisms, such as International Data Transfer Agreements (IDTAs) and Standard Contractual Clauses (SCCs).
7. Automated decision-making
We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you. All application reviews and operational decisions are conducted with human involvement.
8. Cookies and tracking technologies
Our website uses cookies and similar tracking technologies to improve user experience, manage site functionality, and analyse web traffic. For detailed information on the cookies we use and how to manage your preferences, please view our Cookie Policy.
9. Links to third party websites
Our website and communications may contain links to external websites operated by partners, cultural organisations, or third parties. We do not control these external sites and are not responsible for their privacy practices. We encourage you to read the privacy notice of any website you visit.
10. Keeping your data safe
We maintain appropriate technical and organisational security measures to protect your personal data from loss, unauthorised access, misuse, or alteration. We mandate similar security standards for our third-party suppliers and provide data protection training for our team.
11. Data retention
We keep your personal information only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, and reporting obligations.
- Funding Applications: Retained for up to 1 year from the application deadline.
- Contracts & Funding Agreements: Retained for 7 years after the contract end date.
After these periods expire, your data is securely deleted or permanently anonymised.
12. Keeping your data accurate
We strive to keep your data accurate and up to date. If any of your details change or contain errors, please contact us so we can update our records.
13. Your data protection rights
Under data protection law, you have rights including:
- Your right of access – you have the right to ask us for copies of your personal information.
- Your right to rectification – you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – you have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing – you have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – you have the the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability – you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
- Your rights in relation to automated decision making and profiling – as a matter of principle, you have the right not to be subject to a decision based solely on automated processing, including profiling. However, we may automate such a decision if it is necessary for the entering into or performance of a contract between us, authorised by law or regulation or if you have given your explicit consent
You are not usually required to pay any charge for exercising your rights. If you make a request, we have a calendar month to respond to you.
Please contact us if you wish to make a request.
14. How to complain
If you have questions about this policy or wish to exercise your data protection rights, please contact us:
- Email: contactus@thespace.org
- Post: The Space CIC, c/o Black Country Touring, Thimblemill Library, Thimblemill Rd, Smethwick B67 5RJ
- ICO Registration: ZA784373
How to Complain to the Regulator
If you are unhappy with how we have used your data or handled your request, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: www.ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
The Space’s Cookie Policy