Who is responsible
[registered name of the operator], of [registered address], is the controller of the personal data described here. Write to us at [contact address] about anything in this document.
We keep as little as the site can be run on. There is no advertising here, no profiling, and nothing is sold or handed to anyone for their own purposes.
What we hold
- Your membership. The correspondence address your membership was issued to, and the record of the invitation it came from.
- Your visit. A sign-in session, held in a cookie for as long as the browser is open, and your answer to the question about the film players — see the Cookie Policy, which lists both by name.
- Server records. Our web server logs each request: the address it came from, the time, the page asked for and the browser that asked. These are ordinary operational logs, kept for security and for finding faults.
- Anything you write to us. Correspondence, and what it concerns.
We do not ask for, and have no use for, payment details, dietary information or anything about your health.
Why we hold it, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Membership record | To admit you, and to know whose membership is whose | Performance of a contract with you |
| Sign-in session | To keep you signed in from one page to the next | Performance of a contract with you |
| Server records | To keep the archive secure, and to trace faults and abuse | Our legitimate interest in a site that works and is not misused |
| Your answer about the film players | To honour it, and to know when to ask again | Our legal obligation to keep a record of what you consented to |
| Loading a film player | To play the film, which is done by Vimeo or YouTube rather than by us | Your consent — asked for before any player is loaded, and withdrawable at any time |
| Correspondence | To answer you | Our legitimate interest in replying, or performance of a contract |
Who else sees it
- Our hosting provider, which runs the servers the site sits on and processes data only on our instructions.
- The film services, but only once you have said they may. The films are played from Vimeo and, where used, YouTube; loading one of their players contacts them directly from your browser, and they see that request, including your address and the film you opened. No player is put on a page until you have allowed it, and until then nothing of yours has reached them. We ask both not to track you — Vimeo’s do not track setting, and YouTube’s no-cookie host — but they are separate controllers and their own privacy notices govern what they do.
- Anyone we are legally required to tell, and no one else.
Where it is held
The site and its records are held in the United Kingdom or the European Economic Area. The film services are based in the United States, so allowing a player and playing a film sends that request outside the UK; those transfers rely on the providers’ own approved safeguards, such as the UK Addendum to the standard contractual clauses, and on the consent you gave before the first of them was loaded.
How long we keep it
- The sign-in session ends when you leave the Academy or close the browser.
- Your answer about the film players stands for six months, and then you are asked again.
- Server records are kept for a short operational period and then discarded.
- Your membership record is kept for as long as the membership stands, and for a reasonable period afterwards so that a lapsed member can be readmitted and so we can answer questions about the account.
- Correspondence is kept for as long as it is useful to keep.
Your rights
Under the UK GDPR you may ask us to give you a copy of what we hold about you; to correct it; to erase it; to restrict what we do with it; to hand it over in a portable form; and you may object to processing we carry out on the basis of a legitimate interest. Where we rely on your consent for something, you may withdraw it at any time.
Write to [contact address] and we will answer within one month.
If you think we have handled your data badly, we would rather hear it first — but you are entitled to complain to the Information Commissioner’s Office at ico.org.uk.
Keeping it safe
The archive sits behind the members’ entrance and is served over an encrypted connection. Sessions are renewed on sign-in so a session identifier cannot be planted in advance. Access to membership records is limited to those who need it to run the Academy.
No arrangement is perfect. If something goes wrong in a way that puts you at risk, we will tell you and the Information Commissioner, as the law requires.
Changes to this policy
We may revise this notice. The revision date at the head of the page is the one that matters, and a material change will be flagged when you next sign in.