INTRODUCTION

Starmaker Theatre Company collects, stores and processes personal information to enable us to operate effectively, deliver our charitable objectives, safeguard children and young people, manage our activities and meet our legal responsibilities.

We are committed to ensuring that all personal data is collected, stored and processed fairly, lawfully and securely in accordance with:

• UK General Data Protection Regulation (UK GDPR);

• Data Protection Act 2018;

• Other relevant data protection legislation and guidance.

The purpose of this policy is to ensure that everyone handling personal information understands their responsibilities and follows appropriate data protection procedures.

​
 

SCOPE

This policy applies to personal information relating to:

• Children and young people participating in Starmaker activities;

• Parents and guardians;

• Students attending classes;

• Members of productions;

• Staff;

• Freelance workers;

• Volunteers;

• Trustees and committee members;

• Artistic Development Team members;

• Supporters and alumni;

• Patrons who attend performances or request information;

• Providers of performing arts services.

This policy applies to all personal information held in electronic or paper formats.
 

 

DATA PROTECTION PRINCIPLES

Starmaker Theatre Company will ensure that personal data is:

a) Lawful, fair and transparent

Personal information will only be collected and used where there is a lawful reason for doing so, and individuals will be informed about how their information will be used.

b) Collected for specific purposes

Information will only be collected for clear, legitimate purposes and will not be used for unrelated purposes without appropriate permission or legal justification.

c) Adequate and necessary

Only information that is relevant and necessary for the purpose will be collected.

d) Accurate and up to date

Reasonable steps will be taken to ensure information is accurate and corrected when necessary.

e) Retained appropriately

Personal information will only be kept for as long as necessary for the purpose it was collected for or where required by law.

f) Kept secure

Personal information will be protected against unauthorised access, unlawful processing, accidental loss, destruction or damage.

 

WHAT IS PERSONAL DATA?

Personal data means any information that identifies, or could identify, an individual.

Processing personal data includes:

• Collecting;

• Storing;

• Accessing;

• Using;

• Amending;

• Sharing;

• Deleting;

• Destroying.

This applies to both electronic and paper records.
 

 

INFORMATION PROCESSED

Starmaker processes personal information for the following purposes:

Members and Students

Information relating to members and students is processed for:

• Managing classes and productions;

• Safeguarding;

• Emergency contact purposes;

• Licensing requirements;

• Examinations;

• Communication with families;

• Attendance monitoring.

Trustees and Management Team

Information relating to trustees, committee members and management team members is processed for:

• Running the charity;

• Governance requirements;

• Legal obligations;

• Regulatory compliance.

Staff, Volunteers and Supporters

Information relating to staff, volunteers, supporters and alumni is processed for:

• Managing involvement with Starmaker;

• Communication;

• Delivery of activities;

• Safeguarding;

• Administration.

• Payroll.

Patrons and Supporters

Information relating to patrons and supporters is processed for:

• Ticketing;

• Communication;

• Fundraising;

• Keeping individuals informed about Starmaker activities where permission has been provided.

 

TYPES OF INFORMATION HELD

Personal information may include:

• Names;

• Contact details;

• Emergency contact details;

• Attendance records;

• Photographs and videos where consent has been provided;

• Medical information required for safeguarding and welfare purposes;

• Disability or additional support information;

• DBS information where relevant;

• Examination and licensing information.

Some information, including medical and safeguarding information, is classed as special category data and will receive additional protection.

 

STORAGE AND SECURITY OF INFORMATION

Personal information may be stored:

• On secure cloud-based systems;

• In password-protected digital files;

• In secure paper records;

• Within attendance registers and emergency contact records;

• Within licensing and examination documentation.

Starmaker Theatre Company will ensure:

• Access is restricted to authorised individuals;

• Passwords and security measures are used;

• Information is not stored unnecessarily;

• Paper records are securely stored;

• Personal information is not shared without appropriate authority.

Personal information must not be stored on personal devices unless specifically authorised and appropriately protected.

 

CHILDREN’S PERSONAL DATA

Starmaker recognises that children’s personal information requires additional care and protection.

Information relating to children and young people will only be collected where necessary for:

• Safeguarding;

• Participation in activities;

• Emergency arrangements;

• Legal requirements;

• Communication with parents/carers.

Parents or guardians will be informed about how their child’s information is used.

 

RESPONSIBILITY FOR DATA PROTECTION

Under UK GDPR, the Board of Trustees has overall responsibility for ensuring Starmaker complies with data protection requirements.

The Board delegates responsibility for day-to-day data protection management to the Chairman of the board of Trustees as the Data Controller.

The Data Controller is responsible for:

• Ensuring compliance with data protection principles;

• Maintaining appropriate procedures;

• Responding to data protection enquiries;

• Managing data breaches;

• Ensuring staff and volunteers understand their responsibilities.

All individuals who process personal information on behalf of Starmaker must comply with this policy.

 

RESPONSIBILITIES OF STAFF, VOLUNTEERS AND CONTRACTORS

Anyone handling personal information must:

• Understand their responsibilities;

• Keep information confidential;

• Only access information required for their role;

• Store information securely;

• Report concerns or breaches immediately;

• Follow Starmaker data protection procedures.

All trustees, committee members, volunteers and performing arts professionals who receive access to personal information may be required to confirm that they have read and agreed to follow this policy.

Failure to comply may result in:

• Removal from duties;

• Termination of contracts;

• Disciplinary action;

• Legal action where appropriate.

 

COLLECTING PERSONAL INFORMATION

Before collecting personal information, Starmaker will consider:

• Why the information is needed;

• The lawful basis for processing;

• How it will be stored;

• Who will have access;

• How long it will be retained.

Individuals will be informed:

• What information is collected;

• Why it is required;

• How it will be used;

• Who it may be shared with.

 

ACCURACY AND RETENTION

Starmaker will take reasonable steps to ensure information is accurate and up to date.

Parents/carers, members and individuals may be asked to confirm or update information periodically.

Personal information will be securely deleted when:

• It is no longer required;

• There is no legal reason to retain it;

• Retention periods have expired.

 

SHARING PERSONAL INFORMATION

Personal information will only be shared where:

• There is a legal requirement;

• Safeguarding requires disclosure;

• Consent has been provided;

• It is necessary to deliver services safely.

Information will never be sold or shared unlawfully with third parties.

 

DATA BREACHES

A data breach includes:

• Loss of personal information;

• Unauthorised access;

• Accidental disclosure;

• Theft or destruction of records.

Any suspected breach must be reported immediately to the Data Controller.

Starmaker will assess the breach, take appropriate action and report to the Information Commissioner’s Office (ICO) where legally required.

 

INDIVIDUALS’ RIGHTS

Individuals have rights under UK GDPR, including the right to:

• Know what personal information is held;

• Request access to their information;

• Request correction of inaccurate information;

• Request deletion where appropriate;

• Object to certain processing;

• Request restrictions on processing.

 

SUBJECT ACCESS REQUESTS

Anyone wishing to request access to their personal information should contact:

Email: chairman@starmaker.org.uk

Starmaker may require proof of identity before providing information.

Accepted identification may include:

• Passport;

• Driving licence;

• Council tax statement;

• Utility bill.

Requests will normally be responded to within one month of receipt, in accordance with UK GDPR requirements.

 

CONFIDENTIALITY

All personal information will be treated confidentially.

Information will only be shared with individuals who require access to carry out their responsibilities safely and lawfully.

​

REVIEW

This policy will be reviewed every three years or sooner if required due to changes in legislation or government guidance, or the charity's operations.

Approved by: Board of Trustees July 2026

Review Frequency: Every three years