Privacy and your data
What we collect, why we are allowed to, how long we keep it, and how to make us stop.
Who we are and what this covers
Screen Sisters CIC, company 16185639, G06 Annexe Building, 3 Mills Studios, London E3 3DU. We are the data controller.
This covers screensisters.org.uk, every form on it, what you tell us at a session, and anything a referrer sends us. We have a named Data Protection Lead rather than a statutory Data Protection Officer, because the law does not require one at our size.
What we collect, and the lawful basis
Every form on this site. Article references are UK GDPR.
| What | Why | Lawful basis |
|---|---|---|
| Name and contact details | To answer you | 6(1)(b), or 6(1)(f) legitimate interests for an organisational enquiry |
| Application details | To decide on a place | 6(1)(b) |
| Faith needs for delivery: prayer times, food, single-sex sessions, dates to avoid | To run the course | 6(1)(b) or 6(1)(f), and 9(2)(a) explicit consent |
| Religion or belief for monitoring, separate and optional | Aggregate reporting | 6(1)(f), and 9(2)(g) via paragraph 8, Schedule 1, Data Protection Act 2018 |
| Access and disability requirements | Adjustments | 6(1)(f) and 9(2)(a) explicit consent |
| Referral information about you | To contact you once | 6(1)(f), and 9(2)(a) or Schedule 1 paragraph 18 for safeguarding |
| Photographs, film, audio, testimony | To show and evidence the work | 9(2)(a) explicit consent per use, plus a contributor release |
| Safeguarding records | To protect people | 6(1)(f) or 6(1)(d), and 9(2)(g) via Schedule 1 paragraph 18 |
| Enquiry and supplier records | Quoting, delivery, accounts | 6(1)(b), and 6(1)(c) for accounting records |
The two faith questions, and why they are separate
We ask twice, for two reasons, and the answers are kept apart. It is the only lawful way to do both things.
One is about running the course — prayer times, food, single-sex sessions, dates you cannot attend. It builds the timetable, orders the food and books the room. Explicit consent, Article 9(2)(a), withdrawable, deleted at cohort end plus three months.
Two is about monitoring — optional, with a prefer-not-to-say option. It runs on paragraph 8 of Schedule 1 of the Data Protection Act 2018, which permits processing to review equality of opportunity and forbids using it to make decisions about the individual it came from. It cannot affect whether you get a place.
You are never required to answer either question.
If somebody referred you
UK GDPR Article 14 requires us to tell you certain things when we first contact you holding information that did not come from you.
Our first message says who referred you and what they told us, links here, and offers a way to stop hearing from us in one line. A referrer's tick is not your consent: it buys one contact, and consent is then taken from you directly and recorded.
If you do not reply we try once more and delete what we hold. How referrals work.
Filming, photography and your story
Nothing with your face, your voice or your words in it is published without your written permission for that use. Consent is separate for taking part, being photographed, filmed, interviewed and published, and declining affects neither your place nor your reference.
How long we keep things
No fixed legal period covers most of this. The obligation is to set one, publish it and honour it.
| What | How long | Then |
|---|---|---|
| Enquiries that go nowhere | 12 months | Deleted |
| Faith needs for delivery | Cohort end plus 3 months | Deleted |
| Equality monitoring | Aggregated at once; identifiable version within 12 months | Anonymous totals only |
| Application and participation records | Involvement plus 3 years | Deleted |
| Referral records | Engagement plus 3 years, or at once if you ask | Deleted |
| Safeguarding records | Set by our safeguarding policy | Reviewed, not auto-deleted |
| Filming consents | Licence term plus 6 years | Deleted |
| Accounting records | 6 years | Deleted |
Your rights, and how to use them
All free, and none requires a reason, a form or a solicitor. Email info@screensisters.org.uk and say what you want.
Ask for a copy of what we hold, have it corrected or deleted, restrict processing while a dispute is settled, object to processing done on legitimate interests, take your data elsewhere, and withdraw consent as easily as you gave it. We answer within one month.
Complaints. Tell us first if you can. If you are not satisfied, complain to the Information Commissioner's Office at ico.org.uk.
Sharing, cookies and where your data lives
Short, because the answer to most of it is no.
We do not sell your data and we do not share it for marketing. Participant data is not passed to any other organisation. Where a programme is genuinely delivered jointly, we tell you what is shared before you agree.
A few processors handle email and file storage, the website and forms, accounting and a mailing list, each contracted to use your data only on our instructions.
Cookies: only what makes the site work. No advertising, no trackers, no profile of you. The typefaces currently load from Google Fonts, which sends your IP address to Google; we are self-hosting them before launch. We report a breach to the ICO within 72 hours where the law requires it.
Status of this notice
Written September 2026, reviewed annually and whenever we change what we collect. Where our practice and this page disagree, this page is wrong: tell us and we will correct it. Team and governance.