Privacy Policy

SPACE: Privacy, Data Protection and Freedom of Information Policy

Quick Summary: The Main Points

  • Who we are: We are SPACE (the trading name of Art Services Grants Limited), a registered charity.
  • What this document does: It explains how we look after personal information for website users, visitors, artists, studio tenants, supporters, job applicants, and our staff.
  • It also explains: How we handle Data Protection Complaints, Freedom of Information (FOI) requests, and the rules SPACE staff must follow to keep information safe.
  • We respect your privacy: We only collect the information we need. We never sell your personal information.
  • Who to contact: If you have any questions, want a copy of your information, or want to make a complaint, please contact us by email or post, attention of Hannah Princewill, our Operations Director:

Part 1: Visitors, Artists, Tenants and Supporters

1. What personal information do we collect about you?

The information we collect depends on how you interact with SPACE. It may include:

  • Your contact details: Your name, email address, phone number, postal address, and the organisation you work with.
  • Messages and forms: Information you give us when you send an enquiry, give feedback, register for an event, or apply for a studio or artist opportunity.
  • Payments and donations: Records of studio rent, bookings, purchases, or donations (including Gift Aid).
  • Your mailing choices: Whether you have asked to receive our newsletters and updates.
  • Website use information: Technical details collected by our website, such as your IP address (your computer’s internet address), browser type, device type, and which pages you visit.
  • Building safety records: Visitor sign-in books, studio key-fob logs, and CCTV where used at our buildings to keep people safe.
  • Equal opportunities monitoring: If you apply for an artist opportunity or studio, we may ask optional diversity questions to help us report to our funders (such as Arts Council England). This is voluntary and anonymous.

Please note: Please do not send sensitive personal information (such as medical details) through a general website form unless we have asked for it and explained how we will look after it.

2. Where do we get your information from?

  • Directly from you: Most of the time, you give us your information directly when you email us, fill in a form, apply for a studio, sign up to our mailing list, or make a payment.
  • Automatically from our website: Our website collects some technical information automatically when you browse www.spacestudios.org.uk.
  • From other people or organisations: Sometimes we receive information from referees on applications, partner arts organisations, our payment provider (Stripe), or public records (such as Companies House or the Charity Commission). If the law says we must tell you when this happens, we will let you know.

3. Why do we use your information? (Our legal reasons)

Data protection law says we must have a valid legal reason (called a lawful basis) whenever we use your personal information.

Here is why we use your information and our legal reasons for doing so:

  • To answer your questions and messages:
    • Legal reason: Our legitimate interests (it is reasonable for us to reply when you contact us) or taking steps before a contract (if you are asking about a studio or service).
  • To run studio lets, artist applications, events, donations, and sales:
    • Legal reason: Performing a contract with you (or taking steps at your request before a contract starts), meeting a legal obligation (such as tax and Gift Aid rules), or our legitimate interests in running our charity properly.
  • To send you newsletters and marketing updates:
    • Legal reason: Your consent (where you choose to sign up) or our legitimate interests where the law allows us to update existing supporters. You can unsubscribe at any time by clicking the link at the bottom of any newsletter.
  • To keep our website, computer systems, and buildings safe and working well:
    • Legal reason: Our legitimate interests in preventing fraud, fixing website problems, and keeping our buildings and studio community safe.
  • To meet our legal, charity, and accounting duties:
    • Legal reason: Legal obligation (following UK charity, tax, company, and health and safety laws) and our legitimate interests in keeping proper records and reporting to funders like Arts Council England.

4. How do we use cookies on our website?

  • Cookies are small text files placed on your computer or phone when you visit a website.
  • They help our website work properly and help us understand how people use our pages.
  • We have a separate Cookie Policy on our website. It explains which cookies we use, who provides them, and how you can change your cookie settings at any time.

Part 2: Employees, Freelancers, Volunteers and Job Applicants (“Staff”)

This section explains how SPACE looks after personal information for job applicants, current and former employees, casual workers, freelancers, volunteers, and trustees.

(Note: This policy gives you information. It is not part of any employment or freelance contract.)

5. What information do we collect about Staff and Job Applicants?

If you apply to work or volunteer at SPACE, or if you already work with us, we may collect:

  • Personal and contact details: Your name, address, phone number, email address, date of birth, and emergency contact (next-of-kin) details.
  • Job application and recruitment records: Your CV, application form, interview notes, references from past employers, and proof of your right to work in the UK (such as a passport or Home Office share code).
  • Work and contract records: Your job contract, job title, start and end dates, working hours, appraisals, training records, holiday records, and any disciplinary or grievance notes.
  • Pay, tax, and pension details: Your bank account details, National Insurance number, tax code, payslips, P45/P60 forms, pension contributions, and sick pay or family leave pay records.
  • Use of SPACE systems and buildings: Records of your SPACE work email, computer use, building access fobs, and health and safety logs.

6. Sensitive (“Special Category”) and Criminal Record Information for Staff

Sometimes we need to hold more sensitive information about Staff and Applicants. We treat this with extra care:

  • Health and medical information: Sickness absence notes, doctor’s fit notes, occupational health reports, and information about a disability so we can make reasonable adjustments to support you at work.
  • Equal opportunities monitoring: Voluntary information about your ethnicity, religion, sexual orientation, gender identity, or disability. We use this anonymously to make sure SPACE is fair and inclusive, and to report to funders like Arts Council England.
  • Maternity and family leave: Information needed to keep pregnant staff safe at work and to arrange maternity or parental leave.
  • Criminal record checks (DBS checks): If your role involves working closely with children, young people, or vulnerable adults in our community programmes, we will carry out a legally permitted Disclosure and Barring Service (DBS) check.

7. Our legal reasons for using Staff information

We use Staff and Applicant information for the following legal reasons under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025:

  • To carry out your employment or work contract: For example, to check your application, pay your wages, provide your pension, and manage your work role.
  • To obey UK laws: For example, checking your right to work in the UK, paying tax and National Insurance to HMRC, following health and safety laws, making disability adjustments under the Equality Act 2010, and checking trustee eligibility for the Charity Commission.
  • Our legitimate interests: To run SPACE safely, fairly, and effectively—for example, recruiting the right staff, managing performance, keeping our IT systems secure, and handling any workplace disputes or legal claims.
  • Special legal rules for sensitive data: When we use health, diversity, or DBS information, we follow strict extra rules under the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) (such as employment law duties, occupational health, safeguarding children and adults at risk, and equal opportunities monitoring). We also keep an internal compliance record (called an Appropriate Policy Document) explaining how we protect this sensitive data.

Workplace IT and Email Checks:
We do not secretly spy on staff. However, SPACE owns its work email and computer systems. Senior management may check work emails or files if truly needed—for example, when someone is off work, to investigate a serious rule break or security issue, or to answer a legal request for information.

Part 3: Sharing, Security, Retention, Rights and Rules for Everyone

(This part applies to everyone: website users, visitors, artists, tenants, supporters, and SPACE Staff.)

8. Who do we share personal information with?

We never sell your personal information. We only share information when it is necessary and lawful:

  • Online payments through Stripe:
    • If you make a payment or donation on our website, it is handled by Stripe, our secure payment provider.
    • Stripe processes your name, contact details, and card payment details to complete the transaction.
    • SPACE does not see or keep your full card numbers.
    • You can read how Stripe looks after your data in the Stripe Privacy Policy: https://stripe.com/gb/privacy
  • Trusted service providers who help us run SPACE:
    • For example, our IT support, cloud storage, website hosts, email newsletter service, and our payroll and accounting providers. They must sign strict contracts promising to keep your data safe.
  • Official bodies, funders, and advisers:
    • For Staff: HMRC (for tax), our workplace pension provider, occupational health doctors, the Home Office, the DBS service, or future employers if you ask us to give you a reference.
    • For Charity Governance & Funding: The Charity Commission, Companies House, our financial auditors, and Arts Council England (information shared with funders is usually anonymous statistics).
    • For Legal and Safety Reasons: Courts, regulators (like the ICO), the police, or our lawyers and insurers if the law requires it, or to protect the safety and rights of SPACE and other people.

9. Sending information outside the UK (International Transfers)

  • We mainly keep personal information inside the United Kingdom.
  • However, global providers like Stripe (and some cloud software providers) may process information outside the UK, including in the United States.
  • Whenever this happens, we make sure your information is protected by UK-approved legal safeguards. For example, Stripe uses recognised legal protections including the UK Extension to the EU–US Data Privacy Framework. You can read more at: https://stripe.com/gb/privacy

10. How long do we keep your information?

We only keep personal information for as long as we need it for the purpose it was collected, or to meet legal and accounting rules. When we no longer need your information, we delete it safely or shred paper copies.

11. How do we keep your information safe?

  • We use both technical and practical security measures to protect your information from being lost, stolen, changed, or seen by the wrong people.
  • This includes password protection, secure cloud systems, locked filing cabinets for paper records, and making sure only staff who need the information for their job can see it.
  • No internet system is 100% secure, but we take every reasonable step to protect your data.

12. What are your Data Protection Rights?

Under UK law, you have important rights over your personal information. Depending on the situation, you can:

  1. Ask for a copy of your information: (Called a Subject Access Request). We will carry out a reasonable and proportionate search to give you a copy of the personal data we hold about you.
  2. Ask us to fix mistakes: Ask us to correct information that is wrong or out of date.
  3. Ask us to delete your information: In certain situations, where we have no good legal reason to keep it.
  4. Ask us to pause using your information: While we check a concern you have raised.
  5. Object to how we use your information: You can object if we are relying on “legitimate interests”, and you can always tell us to stop sending marketing emails.
  6. Ask us to transfer your information: Ask for data you gave us to be sent to you or another organisation in a standard computer file (where this rule applies).
  7. Withdraw your consent: If you gave us permission (consent) to use your data, you can change your mind at any time.

How to use your rights:

  • Email us at Hannah@spacestudios.org.uk or write to SPACE, 129–131 Mare Street, Hackney, London E8 3RH.
  • We may ask for proof of your identity first to make sure we do not give your information to the wrong person.
  • We will normally reply within 1 month. (If we need to check your identity or ask you to clarify what you are looking for, the 1-month clock pauses until you reply).

13. How to make a Data Protection Complaint

If you are unhappy with how SPACE has collected or used your personal information, you have a legal right to complain directly to us.

Step 1: Contact us first

  • Email us at Hannah@spacestudios.org.uk or write to SPACE, 129–131 Mare Street, Hackney, London E8 3RH.
  • Simply explain what you are unhappy about. You do not need to use a special form.

Step 2: How we will deal with your complaint

  • We will reply to confirm we have received your complaint within 30 days.
  • We will look into your complaint fairly and carefully, and keep you updated if it takes time.
  • We will write to tell you the outcome and any steps we have taken to put things right.

Step 3: Contacting the Regulator (the ICO)

  • You must contact us first. However, if you are still unhappy, you can then complain to the UK’s data protection regulator, the Information Commission (ICO):

14. Freedom of Information (FOI) – How it works at SPACE

  • What is Freedom of Information (FOI)?
    The Freedom of Information Act 2000 gives people the right to ask public authorities (like government departments, councils, and Arts Council England) for recorded information they hold.
  • Does the FOI Act apply to SPACE?
    No. SPACE is an independent charity. Receiving grant money from Arts Council England does not make SPACE a public authority under the FOI Act. We will review this if our legal status ever changes.
  • How does Arts Council England funding affect information we hold?
    Arts Council England is a public authority under the FOI Act. Under our funding agreements, reports or information we send to Arts Council England (or hold for them under our grant contract) might be requested from Arts Council England under an FOI request.
  • How we handle FOI requests and protect your privacy:
    • If someone sends an FOI request directly to SPACE, we will look at it carefully and seek advice where needed rather than just ignoring it.
    • We will never hand over anyone’s private personal information just because an FOI request has been made. Both SPACE and Arts Council England must obey strict data protection laws that protect personal privacy and confidential information.
  • Want a copy of your own personal information?
    If you want a copy of information about you, please ask for it as a Data Protection Subject Access Request (see Section 12 above), not an FOI request. Contact us at Hannah@spacestudios.org.uk.

15. Golden Rules for SPACE Staff (Keeping Data Safe at Work)

All SPACE employees, freelancers, volunteers, and trustees must help keep personal information safe. Breaking these rules seriously or deliberately may lead to disciplinary action.

When working for SPACE, you must follow these 5 Golden Rules:

  1. Only look at what you need: Only open or use personal information that you need for your job role. Never share your passwords.
  2. Take care with emails: Double-check who you are emailing before pressing send. Use BCC (blind copy) when emailing a group of external people who do not know each other. Put passwords on sensitive files (like payroll or HR spreadsheets).
  3. Lock away paper and screens: Lock your computer screen whenever you leave your desk, and lock paper files containing personal details in a cabinet at the end of the day.
  4. Use approved SPACE systems: Do not save SPACE personal data onto personal memory sticks (USBs) or unsecure personal computers.
  5. Report problems and requests immediately: Because strict legal time limits apply, you must tell our Operations Director (Hannah@spacestudios.org.uk) straight away if:
    • There is a data security mistake or breach (for example, a lost work laptop/phone, or an email containing personal data sent to the wrong person—we may have only 72 hours to report serious breaches to the ICO).
    • Someone asks for a copy of their personal data or asks to delete their data.
    • Someone makes a data protection complaint.
    • Someone sends a Freedom of Information (FOI) request or Arts Council England contacts us about an FOI request.

16. Links to other websites and updates to this policy

  • Other websites: Our website contains links to other websites. SPACE does not control those websites, so please check their own privacy policies before giving them your details.
  • Updates to this policy: We review and update this policy when our work or the law changes. The latest version will always be on www.spacestudios.org.uk and shared with our staff. If we make any major changes, we will let you know clearly.

Last updated: 21 October 2026

Mission, vision & values

Florence Peake 'The Performers' at London Fields

Trustees & Advisors