Last updated: 27.01.2026
Tree of Strings (“Tree of Strings”, “we”, “us”, “our”) is committed to protecting your personal information and being transparent about how we use it.
This policy explains what data we collect, how we collect and use it, and your rights in relation to that information under UK data protection law.
It applies to personal data provided to us by individuals themselves or by others. Your use of our services or your provision of information to us constitutes your acknowledgement of the terms of this Privacy Policy. Please do not send us any of your information if you do not want it to be used in the ways described in this Privacy Policy.
Personal data (or information) is any information relating to an identified or identifiable living person. When collecting and using your personal information, we will be transparent about why and how we process personal data.
If you have any questions, please contact us at:
Email: info@treeofstrings.org
Postal address:
Marine House
151 Western Road
HAYWARDS HEATH
West Sussex
RH16 3LH
1. Who we are
Tree of Strings is a not-for-profit organisation based in South-West England. We support young artists, deliver creative projects and bring performances to venues across the region.
For the purposes of data protection law, Tree of Strings is the “data controller” of the personal information we hold about you.
If we ever act as a “data processor” on behalf of another organisation (for example, a school or partner organisation), we will do so under their instructions and their privacy notice will apply.
2. How we collect your information
We collect information in several ways, including when you:
- visit our website
- sign up to our mailing list
- make a donation
- book tickets for an event (directly or via a ticketing partner)
- take part in a project, workshop or performance
- apply for a role, bursary or opportunity
- deliver services on behalf of Tree of Strings
- contact us by email, phone or in writing
- request information from us
- engage with us on social media
We may also receive information indirectly, for example from:
- ticketing providers
- fundraising or donation platforms
- partner organisations such as schools, venues or community groups (where you have given them permission to share your details with us)
- publicly accessible sources.
3. The information we collect
The personal information we collect will depend on how you interact with us, but may include:
3.1 Basic contact details
- Name (including prefix or title)
- Email address
- Postal address
- Phone number (landline and/or mobile)
3.2 Donors and supporters
- Contact details
- Donation history (amounts, dates, methods of giving)
- Gift Aid declarations (if applicable)
- Communication preferences
- Notes about your relationship with us (for example, if you are a founding supporter or regular donor)
We do not store your full payment card details. Payments are processed securely by third-party providers such as Stripe, PayPal or a similar service. Only the provider has access to your card details.
3.3 Ticket buyers and event attendees
- Contact details
- Ticket purchases and event attendance
- Access requirements or other information you choose to provide (for example, dietary needs for certain events)
Where we use a ticketing platform, some of your data will also be held by that platform under its own privacy policy.
3.4 Participants in projects and workshops
For adults:
- Contact details
- Project, workshop or performance you are involved in
- Any relevant access, health or support information you choose to share (for example, mobility needs, communication needs)
- Photographic images and/or video footage (with permissions where necessary)
For children and young people (where applicable) we may collect:
- Name and age of the child or young person
- Parent or guardian contact details
- School or organisation (if participating through a partner)
- Emergency contact information
- Relevant medical or access information
- Permissions for photography or filming and photographic images and/or video footage
We understand the sensitive nature of this information and we handle it with extra care.
3.5 Mailing list subscribers
- Name
- Email address
- Your preferences (for example, whether you are mainly interested in events, opportunities for young artists, or supporting our work)
3.6 Website usage and cookies
When you use our website, we may automatically collect:
- IP address
- Device and browser type
- Approximate location (city or region level)
- Pages visited, time on page, links clicked
We use cookies and similar technologies to help run the site and understand how it is used. For more information, see the Cookies section below and our Cookie Policy.
3.7 Special category data
We normally avoid collecting “special category” data (such as health information) unless it is clearly necessary, for example to ensure safe participation in a workshop or to meet specific access needs.
Where we do collect this, we only do so:
- with your explicit consent, or
- to protect your vital interests or those of another person (for example, in an emergency).
4. How we use your information (and our legal bases)
We will only use your personal information where we have a lawful basis to do so. These are the main ways we use your data and the legal bases we rely on:
4.1 To provide our services and run our events
- Managing ticket bookings and event attendance
- Communicating with you about an event or project you are involved in
- Facilitating participation in workshops, performances and educational projects
Legal basis:
- Performance of a contract (where you buy tickets or sign up to a project)
- Legitimate interests (running our programme and delivering cultural activity)
4.2 To manage donations and fundraising
- Processing your donations and Gift Aid (if applicable)
- Thanking you and keeping appropriate records of your support
- Understanding trends to plan fundraising sustainably
- Producing pitches to funders and reporting back / updating funders
Legal basis:
- Performance of a contract (processing a donation you ask us to take, reporting obligations to funders)
- Legal obligation (Gift Aid and financial records)
- Legitimate interests (developing our supporter base and fundraising responsibly)
4.3 To send you news, updates and opportunities
- Email newsletters and social media posts about our programme, projects, fundraising and opportunities
- Information about how to book tickets or support Tree of Strings
Legal basis:
- Consent (where you have actively opted in to receive information / updates)
- Legitimate interests (in some cases, contacting existing supporters about similar activities, in line with e-privacy rules)
You can unsubscribe from marketing emails at any time by clicking “unsubscribe” in our emails or contacting us at info@treeofstrings.org.
4.4 To improve our website and communications
- Analysing website usage to understand what people are interested in
- Testing and improving the design and content of the site
- Ensuring the security and performance of our digital services
Legal basis:
- Legitimate interests (ensuring our website works well and is relevant)
4.5 To meet our legal and regulatory obligations
- Keeping proper financial records
- Complying with charity, company and tax regulations (where applicable)
- Safeguarding children, young people and vulnerable adults
Legal basis:
- Legal obligation
- Vital interests (where we need to protect you or someone else from harm)
4.6 To consider applications and recruit people
- Reviewing and responding to job, trustee, volunteer, contractor or participant applications
- Taking up references where appropriate
Legal basis:
- Performance of a contract or steps prior to entering a contract
- Legitimate interests (building an effective team and governance)
- Vital interests
4.7 To respond to you
- Processing and responding to any requests, enquiries or complaints from you
Legal basis:
- Consent (where you have actively opted in to receive a response)
- Legitimate interests (to address incoming requests)
5. Who we share your information with
We may share your personal information with trusted third parties where necessary, for example:
- Ticketing providers to manage bookings
- Payment processors (such as Stripe, PayPal or similar) to handle card payments
- Email platforms (such as Mailchimp or similar) to send newsletters and updates
- Cloud storage and IT providers for secure storage and administration
- Accountants, legal or professional advisors when seeking their services
- Partner organisations (such as schools, venues or festival partners)
We require all third-party service providers to respect the security of your personal information and to treat it in accordance with the law. We do not sell your personal data.
Some of these providers may be based outside the UK and the European Economic Area. Where this is the case, we will take reasonable steps to ensure appropriate safeguards are in place (for example, standard contractual clauses) so that the information is treated securely and the means of transfer provides adequate safeguards.
We may disclose your information to third parties if we are required to do so through a legal obligation (for example to the police or a government body).
6. How long we keep your information
We will only keep your personal information for as long as it is needed for the purpose(s) we collected it for, and to meet any legal, accounting or reporting requirements. We determine the appropriate period for retention of personal information by considering the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of the personal information, the purposes for which we process your personal information and whether we can achieve these purposes through other means and the applicable legal requirements. For example:
- Ticketing records: typically kept for up to 6 years for accounting and audit purposes
- Gift Aid records: must be kept for at least 6 years after the end of the relevant tax year
- Project participation records (including safeguarding information): kept for as long as necessary to ensure safety, accountability and good practice, and then securely deleted or anonymised
- Photo images and video content: until you withdraw consent to use such images / content electronically. We will not use any images to create print material after consent is withdrawn; however, we will not recall any print materials that were created before consent is withdrawn. For any images / video content that we collect and we identify that we will not use these in line with the purposes stated in this policy, we aim to delete these within one month of receipt.
When data is no longer needed, we will delete it securely or anonymise it.
7. Children and young people
We take particular care when working with children and young people.
- We will only collect the personal information that is genuinely necessary to manage their involvement in our projects and to keep them safe.
- We will usually obtain consent from a parent or guardian for under 18s, unless we are working within a school or partner setting under that organisation’s own safeguarding policies.
- Any images, audio or video recordings of children will only be captured and used where we have appropriate permissions in place (that may be obtained directly or through schools or partners), and in line with the purposes in this Privacy Policy and our safeguarding procedures.
If you are a parent or guardian and have concerns about the information we may hold about your child, please contact us at info@treeofstrings.org.
8. Cookies and website analytics
Our website uses cookies and similar technologies to:
- make the site work properly (for example, remembering your preferences)
- understand how visitors use the site, so we can improve it
- in some cases, support third-party services such as embedded videos or analytics
Where required by law, we will ask for your consent before placing non-essential cookies (for example, analytics or marketing cookies). You can manage your cookie preferences via your browser settings and, if available, our on-site cookie banner.
For more details about the cookies we use, please see our Cookie Policy.
9. Your rights
Under data protection law, you have a number of rights in relation to your personal data. These include the right to:
- Access: the right to be provided with a copy of the personal data we hold about you
- Rectification: the right to request us to correct any inaccurate or incomplete information
- Deletion: the right to request we delete your data in some circumstances
- Restriction of processing: the right to request the restriction of processing your data in some circumstances
- Be informed in a clear, transparent and understandable way about how we process your data
- Portability: is the right to request a copy of your data in a commonly used format where technically feasible and where processing is based on consent or contract
- Withdraw consent at any time, where we rely on consent, for example for email marketing
- Objection: the right to object to your personal data being processed for direct marketing (including profiling); and in certain other situations to our continued processing of your personal information, e.g. processing carried out for the purpose of our legitimate interest where you want to object as you believe it impacts on your fundamental rights, interests and freedoms.
Please note that your objection (or withdrawal of any previously given consent) could mean that you are not able to make use of our services. Please also note that we may be able to continue to process your personal information even after you have chosen to withdraw your consent as required or otherwise permitted by law.
To exercise any of these rights, please contact us at info@treeofstrings.org. We may need to verify your identity before responding to your request.
Further information on your rights may be obtained from the Information Commissioner’s Office. For example, see.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office if you are unhappy with how we handle your data. Please see section 12 of this policy for further details.
Personal information we hold about you should be accurate and up to date. Please advise us of any changes to your information by email to info@treeofstrings.org. We will respond to you as soon as we can.
10. Security
We take the security of your personal information seriously and use appropriate technical and organisational measures to protect it, including:
- using secure, password-protected systems
- limiting access to staff and trustees who need the information
- using reputable third-party providers with strong security standards
- regularly reviewing our data protection practices
However, no system can be completely secure, and we cannot guarantee the security of information transmitted over the internet. Any transmission is at your own risk.
11. Links to other websites
Our website may contain links to other websites, such as partner organisations, venues, funders or social media platforms. This privacy policy only covers Tree of Strings’ own website.
We are not responsible for the privacy policies and practices of other sites, so we encourage you to read their policies when you visit them.
12. How to complain
If you are unhappy with the way we are using your personal information, please contact us first to seek to address your concerns. Please email us at info@treeofstrings.org.
If we cannot resolve your concerns satisfactorily, you have the right to complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. The ICO’s address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our activities, the law or best practice. The “last updated” date at the top of this page shows when it was last revised.
These changes will be posted on our website and where appropriate, we may notify you by email or by a notice on our website.
14. How to contact us
If you have any questions, concerns or requests about this Privacy Policy or how we hold or use your personal information, please contact:
Tree of Strings Email: info@treeofstrings.org
Postal address:
Marine House
151 Western Road
HAYWARDS HEATH
West Sussex
RH16 3LH