Privacy Policy

Last updated: 17 September 2026

Halo Arts (Education) Ltd (“Halo Arts”, “we”, “us”, “our”) is committed to protecting the privacy of everyone who visits our website, takes part in our projects, or otherwise interacts with us — including participants, parents and carers, audience members, funders, contractors and supporters. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have over it.

This policy applies to www.wearehaloarts.com and to personal data we collect offline in connection with our events, youth theatres, workshops, bookings and productions (such as WestFest and Wee Jock and the Beanstalk).

1. Who we are

Halo Arts (Education) Ltd is a company registered in Scotland (Company No. SC574600), with its registered office at The White House, Dowanhill Park, Glasgow, G11 5JE.

We are the “data controller” for the personal data described in this policy, meaning we decide how and why it is processed.

Contact us: Brendon@wearehaloarts.com

2. The information we collect

The personal data we collect depends on how you interact with us. It may include:

  • Contact details — name, email address, postal address and phone number, for example when you make an enquiry, book a place on a project, or sign up to a mailing list.

  • Booking and participation information — details provided when booking tickets, enrolling in a youth theatre, workshop or panto production, including emergency contact details, dietary or access requirements, and photo/video consent.

  • Children’s information — where a child takes part in one of our youth theatres, schools’ projects or workshops, we collect the information a parent or guardian provides on the registration or consent form, such as the child’s name, age, school, and any relevant medical, dietary or access information.

  • Payment information — processed securely by our payment providers; we do not store full card details ourselves.

  • Funding and governance information — information provided by trustees, contractors, funders and partner organisations in connection with grant applications, contracts and reporting.

  • Website usage data — technical information such as IP address, browser type, device information and pages visited, collected automatically through cookies and similar technologies (see Section 7).

  • Communications — records of correspondence if you contact us by email, social media or phone.

3. How we use your information

We use personal data to:

  • Process bookings, enrolments and ticket sales for our events and productions

  • Deliver our youth theatre, schools’ and community programmes safely, including managing emergency contacts, welfare and access requirements

  • Respond to enquiries and provide customer service

  • Send updates about events, projects and opportunities to people who have opted in to hear from us

  • Administer funding applications, contracts and reporting to funders and regulators

  • Maintain the safety and security of our events and premises, including CCTV where used at venues

  • Meet our legal, tax, health and safety and safeguarding obligations

  • Understand how our website is used, so we can improve it

4. Our legal basis for processing

Under UK data protection law, we rely on one or more of the following legal bases, depending on the activity:

  • Consent — for example, when you opt in to marketing emails, or a parent/guardian consents to a child’s participation, photography or filming

  • Contract — to process a booking or deliver a service you have requested

  • Legal obligation — for example, safeguarding, health and safety, and financial record-keeping requirements

  • Legitimate interests — for example, to run our organisation effectively, keep records for funders, and safeguard participants, where this does not override your rights and freedoms

Where we rely on consent, you may withdraw it at any time by contacting us using the details in Section 1.

5. Children’s data

Many of our activities — including our youth theatres, schools’ projects and community panto — involve children and young people. We only collect a child’s personal data with the consent of a parent or guardian, gathered through our registration and consent forms. We use this information solely to deliver the relevant project safely (including welfare, safeguarding and emergency contact purposes) and do not use children’s data for marketing. Parents and guardians can contact us at any time to review, update or ask us to delete their child’s information, subject to our safeguarding and record-keeping obligations.

6. Sharing your information

We do not sell personal data. We may share information with:

  • Trusted third-party service providers who support our operations, such as payment processors, ticketing platforms, email marketing providers and website hosts — who only process data on our instructions

  • Funders and regulators, where we are required to report on the delivery or impact of funded projects (this is usually anonymised or aggregated where possible)

  • Venues and partner organisations, where necessary to deliver an event or programme (for example, sharing participant numbers or access requirements with a venue)

  • Professional advisers, such as accountants or legal advisers, where necessary

  • Authorities, where required by law, or to protect the safety of a participant or the public

We do not knowingly transfer personal data outside the UK/EEA; where a service provider we use does process data outside the UK/EEA, we ensure appropriate safeguards are in place.

7. Cookies and website analytics

Our website may use cookies and similar technologies to help it function and to understand how visitors use it, such as analytics cookies that tell us which pages are popular. You can control or disable cookies through your browser settings; please note that some parts of the website may not work as intended if you do so. Where our cookie use requires your consent, we will ask for it via a cookie banner on the site.

8. How long we keep your information

We keep personal data only for as long as necessary for the purposes it was collected, taking into account:

  • Our legal and regulatory obligations (for example, financial records are typically kept for at least 6 years)

  • Safeguarding record-keeping requirements for work involving children and young people

  • Funder reporting requirements, which may specify a minimum retention period

  • Whether you remain an active participant, subscriber or contact

When information is no longer needed, we securely delete or anonymise it.

9. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

  • Be informed about how we use your personal data

  • Access a copy of the personal data we hold about you

  • Have inaccurate personal data corrected

  • Ask us to delete your personal data, in certain circumstances

  • Restrict or object to certain processing of your personal data

  • Request that your data be provided to you or transferred to another organisation, in certain circumstances

  • Withdraw consent at any time, where we rely on consent

To exercise any of these rights, contact us at Brendon@wearehaloarts.com. We will respond within one month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling 0303 123 1113.

10. Keeping your information secure

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, including restricting access to those who need it and using secure, reputable third-party platforms for bookings, payments and email communications.

11. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our activities or the law. The “Last updated” date at the top of this page shows when it was last revised. We encourage you to check back periodically.

12. Contact us

If you have any questions about this policy or how we handle your personal data, please get in touch: