Privacy Policy

Last updated: 30 September 2026

Cement Fields respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how Cement Fields collects, uses, stores and protects personal data, and explains your rights under applicable data protection legislation.

This Privacy Policy is intended to comply with the transparency requirements of:

The UK General Data Protection Regulation (UK GDPR);
The Data Protection Act 2018;
The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), where applicable; and
The European Union General Data Protection Regulation (EU GDPR) where the EU GDPR applies to our processing.

Nothing in this Privacy Policy removes or restricts rights that individuals have under applicable data protection law.

Who we are

Cement Fields is a registered charity in England and Wales (charity number 1122498) and a company incorporated in England and Wales (company number 6272178).

Our registered office is:

Cement Fields
Suite 145, 7–8 New Road Avenue
Chatham, Kent
ME4 6BB
United Kingdom

For the purposes of UK data protection legislation, Cement Fields is generally the data controller responsible for personal data that we process for our own purposes.

What is personal data?

Personal data means information relating to an identified or identifiable living individual.

It can include information such as your name, email address, telephone number, postal address, photographs, online identifiers, information about your participation in an event, or information contained in an application.

Some information is considered special category data because it is particularly sensitive. This can include information concerning health, racial or ethnic origin, religious or philosophical beliefs and certain other categories specified by law.

The personal data we may collect

Depending on how you interact with Cement Fields, we may collect:

Name, title, and contact details.
Email address, telephone number and postal address.
Date of birth or age, where necessary for a particular activity.
Information contained in applications, submissions, portfolios, CVs and supporting materials, such as details relating to prior employment, commissions, residencies, open calls and other opportunities.
Payment, donation and transaction information.
Communications and correspondence between you and Cement Fields.
Mailing-list subscriptions and communication preferences.
Feedback, survey responses, and evaluation information.
Photographs, video, audio recordings and other content created or provided in connection with our activities, where appropriate.
Accessibility information, where necessary to enable participation in our activities.
Health or safety information, where necessary and proportionate for the safe delivery of an activity.
Information about your use of our website, such as IP address, browser type, device information and similar technical information.
Information about how you interact with our emails, where our email provider (Mailchimp) provides this functionality.
Information you make available to us through social media or other public platforms.
Information provided by organisations or partners involved in delivering a programme or activity, where lawful.
Information relating to suppliers, contractors, artists, freelancers, employees and other professional contacts.
Any other personal information you voluntarily provide to us.

We seek to follow the principle of data minimisation and will collect only information that is adequate, relevant and necessary for the purposes for which it is processed.

How we collect personal data

We may collect personal data:

Directly from you, when you contact us.
When you subscribe to our mailing list.
When you register for or attend an event.
When you participate in a workshop, programme or other activity.
When you make a donation or payment.
When you apply for a job, commission, residency, open call or other opportunity.
When you work with Cement Fields.
When you provide feedback or complete a survey.
When you use our website and other digital platforms.
Through cookies and similar technologies, where permitted.
Through social media or other publicly available sources.
From partners, organisations or service providers involved in delivering an activity.
From other third parties where we have a lawful basis to obtain and use the information.

How we use personal data

We may process personal data for the following purposes:

Delivering our programmes and activities - We use personal data to organise, administer and deliver our activities.
Managing applications - We process information submitted in applications for jobs, commissions, residencies, open calls, programmes and other opportunities.
Communicating with you - We use contact information to respond to enquiries, provide information about activities you have registered for, and keep you up-to-date with relevant information.
Marketing and communications - Where permitted by law, we may send information about Cement Fields, including news, events, programmes, opportunities and activities.
Donations and payments - We use personal data to process donations, payments, Gift Aid claims and associated financial administration.
Evaluation and research - We may use information to evaluate our programmes, understand participation and audiences, improve our activities and demonstrate the impact of our work. Where appropriate, evaluation data will be anonymised or aggregated.
Administration - We use personal data for organisational administration, including accounting, record keeping, employment, supplier management and governance.
Legal and regulatory compliance - We may process personal data where necessary to comply with legal, regulatory, accounting, tax, safeguarding or reporting requirements.
Security and fraud prevention - We may process information to protect our systems, premises, people and services and to detect or prevent fraud, misuse or other unlawful activity.
Legal claims - We may process information where necessary to establish, exercise or defend legal claims.

Our lawful basis for processing personal data

We will only process personal data where we have a lawful basis under applicable data protection law. The lawful basis depends on the particular processing activity. We will not use a particular lawful basis merely because it is convenient. The appropriate lawful basis depends on the actual circumstances and purpose of the processing.

Legitimate interest

Where we believe it is of legitimate interest to you, or us, to process your data, we will. Where we rely on legitimate interests, we will identify the relevant legitimate interest, consider whether the processing is necessary and balance our interests against your rights and freedoms.

This includes: delivering a programme, event or activity; processing applications; responding to enquiries; managing employment; processing donations and payments; website operation; security and fraud prevention; safeguarding; research and evaluation.

Legal obligation

We may need to collect, process and disclose personal information to comply with a legal obligation. For example, where we are ordered by a court or regulatory authority, or we are legally required to hold details.

This includes: managing employment; processing donations and payments; gift aid; accounting and financial records; security and fraud prevention; legal claims; safeguarding.

Contract

We may collect and process personal information in the course of performance of a contract. For example, if you agree to work for us, make a purchase from us or make a donation to us, we need to be able to process your information for the purpose of meeting our contractual obligations such as contacting you by email or telephone in the case of the cancellation of an event.

This includes: delivering a programme, event or activity; processing applications; managing employment; processing donations and payments; responding to enquiries.

Consent

In many instances, we will rely on obtaining your consent to our use of your personal information in a certain way. For example, asking for your consent to use your personal information to send you direct marketing information. For any situations where the above are not appropriate, we will instead ask for your explicit consent before using your personal information in that specific situation.

This includes: delivering a programme, event or activity; processing applications; sending certain direct marketing communications; website operation; non-essential analytics or tracking; research and evaluation; documentation.

Where we rely on consent, consent will be obtained in accordance with applicable data protection law.

Consent will be:

Freely given.
Specific.
Informed.
Unambiguous.
Given through a clear affirmative action where required.

You can withdraw consent or opt out of marketing at any time by:

Using the unsubscribe facility in our emails; or
Contacting info@cementfields.org.

Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn. If you opt out of marketing, we may retain a limited record of your preference to ensure that we respect your request. This does not prevent us from sending essential administrative communications – for example, information about an event you have booked or a transaction you have made.

Sensitive personal data

Data Protection law recognises that certain categories of personal information are more sensitive such as health information, race, religious beliefs and political opinions.

We will only collect and use such information where necessary and proportionate. For example, we may collect health information about participants taking part in workshops to ensure accessibility.

We will not routinely collect sensitive personal information unless there is a clear and lawful reason for doing so.

Safeguarding

Some Cement Fields activities may involve children or young people.

Where we process children's personal data, we will take appropriate steps to protect their information and provide age-appropriate privacy information, where appropriate.

We will collect only the information reasonably necessary for the relevant activity.

Cookies

Cookies are text files placed on your computer by a website when you use it to collect standard internet log information and information about the behaviour of visitors to that website. For more information on cookies, visit www.aboutcookies.org or www.allaboutcookies.org.

Our website may use cookies and similar technologies.

Cookies may be used for purposes including:

Essential website functionality.
Security.
Remembering preferences.
Analytics.
Embedded content.
Measuring website performance.
Marketing or advertising, where applicable.

We will not use non-essential cookies or similar technologies where consent is legally required unless and until the appropriate consent has been obtained.

Third-party websites and services

Our website may contain links to websites operated by third parties.

We may also embed content or functionality provided by third parties, including ticketing, video, audio, social-media or payment services.

Those organisations may process personal data according to their own privacy policies.

We are not responsible for the privacy practices of third-party websites that we do not control.

Where third-party content causes information to be stored or accessed on your device, we will take appropriate steps to comply with applicable cookie and electronic-privacy requirements.

Who we share personal data with

We never sell personal data.

We may disclose personal data to organisations and individuals where necessary and lawful, including:

Event and ticketing providers (we use: Eventbrite).
Payment and donation providers (we use: Paypal).
Email and mailing-list providers (we use: Mailchimp).
Website hosting and technical service providers (we use: Zen).
Cloud storage and productivity providers (we use: Google; Whereby).
Accounting and financial service providers (we use: Xero).
Payroll and HR providers.
Professional advisers.
Recruitment service providers.
Programme partners and delivery organisations.
Funders or public bodies where reporting requirements apply.
Insurers.
Legal advisers.
Government bodies, regulators and law-enforcement authorities where legally required.
Other service providers acting on our behalf.

Where a third party processes personal data on our behalf, we will use appropriate contractual arrangements and require the processor to comply with applicable data protection obligations. Depending on the circumstances, these arrangements may require the processor to:

Process personal data only on our documented instructions.
Maintain appropriate confidentiality.
Implement appropriate technical and organisational security measures.
Assist us with data-subject rights.
Assist with security incidents and data breaches.
Delete or return personal data when the processing relationship ends, subject to legal requirements.
Provide information necessary to demonstrate compliance.

Some of our service providers may process personal data outside the United Kingdom or European Economic Area.

Where applicable, we will only make international transfers in accordance with applicable UK and EU data protection law.

Depending on the destination and circumstances, we may rely on:

An adequacy decision;
Appropriate safeguards such as standard contractual clauses or the relevant UK international-transfer mechanism;
Binding corporate rules; or
A permitted derogation under applicable law.

Where required, we will undertake appropriate assessments of the transfer and implement supplementary measures where necessary.

Where personal data is transferred internationally, we will provide the information required by applicable law about the relevant transfer mechanism.

How long we keep your information

We will not keep personal data for longer than is necessary for the purpose for which it was collected, unless we have a lawful reason to retain it for longer.

Retention periods vary depending on the type of information and why we process it.

We consider factors including:

The purpose for which the information was collected.
Whether our relationship with you is ongoing.
Legal, accounting and regulatory requirements.
Contractual requirements.
Limitation periods for potential legal claims.
Safeguarding requirements.
Funding and reporting requirements.
Historical or archival value.

Where we do not have a fixed retention period, we will use appropriate criteria to determine how long information should be retained. When information is no longer required, we will securely delete, destroy or anonymise it.

Some personal information may be retained by us in archives for statistical or historical research purposes. Where archival retention involves personal data, we will ensure that the processing has an appropriate lawful basis and complies with applicable data protection requirements. Where appropriate, information will be anonymised or retained in a form that minimises risks to individuals.

Data security

While no method of transmitting information over the internet or storing electronic information can be guaranteed to be completely secure, we take appropriate technical and organisational measures to protect personal data against:

Unauthorised access.
Accidental loss.
Destruction.
Damage.
Unauthorised disclosure.
Alteration.
Other unlawful or unauthorised processing.

Our security measures include: access controls, authentication, secure storage, staff procedures, supplier controls and appropriate backups. Access to personal data is limited to people who need it for legitimate purposes.

If Cement Fields becomes aware of a personal data breach, we will assess the incident and take appropriate steps in accordance with applicable data protection law. Where required, we will notify the ICO or another relevant supervisory authority within the applicable legal timeframe. Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals where required by law.

Your rights

Subject to applicable legal conditions and exemptions, you may have the following rights:

Right to be informed
You have the right to receive clear information about how your personal data is used.
Right of access
You may request a copy of personal data we hold about you.
Right to rectification
You may ask us to correct inaccurate or incomplete personal data.
Right to erasure
In certain circumstances, you may ask us to delete your personal data. This is sometimes called the right to be forgotten.
Right to restriction
In certain circumstances, you may ask us to restrict how we process your personal data.
Right to object
You may object to certain processing, including processing based on legitimate interests.
You have an absolute right to object to direct marketing.
Right to data portability
In certain circumstances, you may request that personal data you have provided to us is supplied in a structured, commonly used and machine-readable format, or transferred to another organisation.

How to exercise your rights

If you would like to exercise any of these rights, please contact us at info@cementfields.org.

We may need to request information to verify your identity before fulfilling a request.

We will respond without undue delay and, in accordance with applicable law, normally within one month of receiving a valid request. Where permitted by law, the response period may be extended where a request is particularly complex or multiple requests have been made.

If you have any concerns about how we handle your personal information, you have the right to make a complaint to the Information Commissioner’s Office (ICO), which regulates and supervises the use of personal data in the UK. See their website for more details: https://ico.org.uk/concerns/handling/

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes to our activities.
Changes to the personal data we process.
Changes to our service providers.
Changes to our website or technology.
Changes to applicable legislation or regulatory guidance.

The latest version will be published on our website with its effective date.

Where a change materially affects how we use personal data, we will provide additional information where required.

How to contact us

If you have any questions about this Privacy Policy or Cement Fields' use of personal data, please contact:

Cement Fields
Suite 145
7–8 New Road Avenue
Chatham
Kent
ME4 6BB
United Kingdom

Email: info@cementfields.org

Charity number: 1122498
Company number: 6272178