Fair Processing Policy

Identity and contact details of the controller and where applicable, the controller’s representative) and the data protection officer

The Liverpool City Region Combined Authority is the ‘controller’ for your personal information, on behalf of the Liverpool City Region Music Board (LCRMB). This means that they decide the purpose and means of how your data is used when signing up to receive email news, adding your business to be promoted in the LCRMB Directory and when completing forms to apply for roles and opportunities we offer.

If you have any questions about how your information is being managed you can contact DPO@liverpoolcityregion-ca.gov.uk and you can contact info@lcrmusicboard.co.uk for other enquiries related to this website.

Purpose of the processing and the legal basis for the processing

Your information is being used by LCRMB to enable us to communicate with you, so that you can share your business news and opportunities via the LCRMB website, and so that we can process any applications and expressions of interest in the roles and opportunities we may offer. Our legal basis for processing your information is your consent.

Description of the categories of personal data

The categories of information being processed include the name, email address and phone number, as well as any background and additional information you may add to your application/form (i.e. your CV information and your explanations of your situation which enable us to provide the business support you may require).

We do not anticipate that we will process any ‘special categories’ personal data, which would include information related to your

• racial or ethnic origin
• political opinions
• religious or philosophical beliefs
• trade union membership
• genetic data [i.e. DNA data]
• biometric data [i.e. finger prints]
• data concerning health
• sex life or sexual orientation

Please note that if you are submitting information on behalf of a third party, you must get their permission first.

Details of transfers to third country and safeguards

Your personal data will be transferred outside the European Economic Area (all EU Member States, plus Iceland, Norway and Liechtenstein) to the United States where Mail Chimp is based. We ensure that the security of your personal data is guaranteed by the EU-US Privacy Shield.

Retention period or criteria used to determine the retention period

Your data will be kept for a period of 3 years from the date of entry. This retention has been determined by the LCRMB’s business need.

The existence of each of data subject’s rights

The GDPR provides you with the following rights when it comes to your personal data:

• The right to be informed how your personal data is being processed
• The right of access to the personal data we hold about you, which includes providing copies of the information to you within one month of a request. We may charge a reasonable fee to provide this information based on our administrative costs of responding (i.e. photocopying, postage, etc.).
• The right to rectification of any incorrect or incomplete data we hold about you
• The right to erasure, also known as ‘the right to be forgotten’, where
  • Your information is no longer required for the purpose it was collected
  • You withdraw your consent
  • You object to the LCRMB processing your information (and there is no overriding legitimate interest for continuing the processing)
  • The LCRMB has breached the GDPR when processing your data
  • There is a legal obligation to delete the data (such as a court order)
• The right to restrict processing, which limits what the LCRMB can do with your information
• The right to data portability, where any automated processing of your information based on your consent or as part of a contract is made available for your reuse
• The right to object to direct marketing or any processing based on the performance of a task in the public interest/exercise of official authority or for the purposes of
• scientific/historical research and statistics.
• Rights in relation to automated decision making and profiling, where a decision made by a computer has a legal or significant effect on you.

The right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint regarding the processing of your personal data to the UK’s supervisory authority, the Information Commissioner, who can be reached using the details below:

The Information Commissioner’s Office,
Wycliffe House,
Water Lane, Wilmslow,
Cheshire SK9 5AF
www.ico.gov.uk
0303 123 1113