GDPR Policy — Staff & Users

Northern Ballet Technical Equipment Management System

Last Updated: 24 April 2026

1. Data Controller

Northern Ballet Ltd is the data controller for all personal data processed through the Technical Equipment Management System. We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Personal Data We Collect

Identity Data: Full name, job title, department, profile photograph

Contact Data: Email address, phone number

Account Data: Login credentials, role, page access permissions

Activity Data: Equipment check-in/out records, RFID scan logs, activity logs, chat messages, show reports, technical rehearsal notes, fit-up notes

Device Data: Push notification subscription IDs, OneSignal player IDs

Media: Photographs taken of equipment, fault documentation, and stage setups

3. Lawful Basis for Processing

Legitimate Interest (Article 6(1)(f)): Managing technical operations, equipment safety, and tour logistics

Performance of Contract (Article 6(1)(b)): Fulfilling employment or engagement obligations

Legal Obligation (Article 6(1)(c)): Health & safety compliance, equipment inspection records, and insurance requirements

Consent (Article 6(1)(a)): Push notifications — you may opt in or out at any time via Notification Preferences

4. How We Use Your Data

Track and manage technical equipment across venues, trailers, and storage
Maintain safety inspection and certification records
Coordinate tour logistics and venue fit-ups
Enable team communication via in-app chat
Send notifications about inspections, document updates, and schedule changes
Generate show reports and technical documentation
Manage RFID-based equipment location tracking

5. Data Sharing

We share data with:

Venue Partners: Limited show & equipment information with authorised venue staff only
Cloud Service Providers: Base44 (hosting), Supabase (storage)
Communication Providers: SendGrid (email), OneSignal (push notifications)
Integration Partners: Dropbox (document sync), Zapier (workflow automation)

We never sell your data, share it with advertisers, or use it for purposes unrelated to Northern Ballet operations.

6. Data Retention

Equipment inspection records: Retained for 7 years (legal compliance)
Activity logs & scan history: Retained for 3 years
Chat messages: Retained for 2 years of inactivity
Account data: Deleted within 30 days of account deletion request

7. Your Rights Under UK GDPR

You have the right to:

Access — Request a copy of all personal data we hold about you
Rectification — Correct any inaccurate or incomplete data
Erasure — Request deletion of your personal data ("right to be forgotten")
Restriction — Limit how we process your data
Portability — Receive your data in a machine-readable format
Object — Object to processing based on legitimate interest
Withdraw Consent — For consent-based processing (e.g. push notifications)

To delete your account, visit the Account Deletion page. For other requests, contact the Technical Director.

8. Data Security

All data transmitted over HTTPS/TLS encryption
Role-based access controls — users only see data they are authorised for
Secure cloud storage with regular backups
No cross-app tracking, no advertising identifiers collected

9. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Contact

Northern Ballet Technical Department

Address: Quarry Hill, Leeds, LS2 7PA, UK
Email: technical@northernballet.com
Phone: +44 (0)113 220 8000