Skip to content
Legal

Privacy Policy

Last updated July 2026

Symphony Collective Limited (“Symphony”, “we”, “us”), a registered charity in England and Wales (Registered Charity Number 1214476, Company Number 16053342), Symphony Studios, Oasis St Martin’s Village, 155 Tulse Hill, London SW2 3UP. This policy explains how we collect, use and protect your personal data when you use wearesymphony.co, sign up to our newsletter, donate, apply to a programme, volunteer or otherwise contact us.

We are the data controller for the personal data described here. If you have any question about it, email hello@wearesymphony.co.

What we collect

Information you give us. Your name, email address, and anything else you enter into our forms: the newsletter sign-up, the contact form, registering your interest in a programme, and volunteering or working with us. Some forms ask for a phone number, and the programme form asks for the name and age of the young person you are registering.

Donation information. Donations are taken by our donation platform, GiveTap. We receive a record of your gift and your Gift Aid status. Your card details are handled by the payment provider and are never stored by us.

Text giving. If you donate by text, your mobile network and our text-giving provider process the message, and we receive a record of your gift. Some text keywords also opt you in to hearing more from us, and the wording shown at the point of giving tells you which. If you would rather give without hearing more, use the keyword marked for that purpose. You can ask us to stop contacting you at any time by emailing us.

Site statistics. We measure how the site is used with Vercel Web Analytics, which is cookieless. It sets no cookies, stores nothing on your device, and does not follow you to other websites or build a profile of you. For each page view it records the page, the referring page, filtered query parameters, an approximate location (country, region and city), device type, operating system and browser. Visitors are counted using a temporary hash of the request that is discarded after 24 hours, so we cannot identify you from it or reconstruct your browsing.

Marketing cookies. Only if you opt in. See our Cookie Policy.

What we do not collect

We do not ask for special category data (such as health, ethnicity, religion or sexual orientation) through this website. If a specific programme ever needs it, we will ask separately, explain why, and handle it under the additional protections the law requires.

We do not buy personal data from third parties or build profiles of visitors from data collected elsewhere.

How we use it

We use your data to send the updates you asked for, respond to enquiries, process and acknowledge donations (including Gift Aid), assess and administer programme and volunteer applications, and run and improve our work and this website.

We only send marketing, such as our newsletter, where you have opted in, and you can unsubscribe at any time using the link in every email.

For our email newsletter we use double opt-in: after you sign up we email you a confirmation link, and we only add you to the list once you click it. That means we hold a record of when and how you consented.

Legal bases

We rely on the following legal bases under the UK GDPR:

  • Consent, for the newsletter and for marketing cookies. You can withdraw it at any time, and withdrawing it does not affect anything we did beforehand.

  • The performance of a contract, or steps taken at your request, for example processing a donation, a programme application or an order.

  • Our legitimate interests in running the charity, keeping the site secure, and understanding at an aggregate level how this website is used. We have satisfied ourselves that these do not override your rights, and you can object at any time.

  • Legal obligations, for example Gift Aid claims, financial records and safeguarding duties.

Our site statistics run on legitimate interests rather than consent, because nothing is stored on or read from your device and the resulting data is aggregated and anonymous.

Young people’s data and safeguarding

Some of our programmes are for young people, including under-18s. Where a programme involves a child, we collect the minimum data needed, seek appropriate consent from a parent or guardian where required, and handle that data in line with our safeguarding policy.

We agree who owns and can access this data before any form goes live, and we never use children’s data for marketing.

If you are a parent or guardian and want to see, correct or delete data we hold about your child, email us and we will help.

Who we share it with

We use trusted providers who process data on our behalf under contract:

  • Brevo, our email platform, for the newsletter and its double opt-in confirmations.

  • GiveTap, our donation platform, for gifts, Gift Aid and text giving, together with the mobile networks and text-giving provider behind the shortcode.

  • Our forms and records tools, which hold enquiries and applications, and our email provider, which sends the confirmations and internal notifications those forms trigger.

  • Vercel, who host this website and provide the cookieless site statistics described above.

If you opt in to marketing cookies, an advertising provider such as a Meta pixel for social campaigns may also receive data about your visit. Nothing loads unless and until you allow it.

Separately, our contact page embeds a Google map so you can find Symphony Studios. That map loads with the page rather than waiting for your cookie choice, and Google receives your IP address when it does. Our Cookie Policy explains this and how to block it.

Our shop is run on a third-party platform under its own privacy policy. If you buy from it, that platform, not this website, handles your order and payment data.

We never sell your personal data. We share it only where it is needed to deliver something you asked for, or where the law requires it.

International transfers

Some of our providers are based outside the UK. Our website host and analytics provider, for example, is a US company. Where data is transferred internationally we rely on appropriate safeguards, such as UK adequacy regulations, the UK extension to the EU-US Data Privacy Framework, or standard contractual clauses with the UK addendum.

You can ask us for details of the safeguards that apply to a particular transfer.

How long we keep it

We keep personal data only as long as we need it for the purpose it was collected and to meet our legal and financial obligations, then delete or anonymise it. In practice:

  • Newsletter details, until you unsubscribe or ask us to remove them.

  • Enquiries and applications, for the programme cycle they relate to and a reasonable period afterwards.

  • Donation, Gift Aid and financial records, for as long as charity and tax law requires, which is generally at least six years.

  • Safeguarding records, for the period our safeguarding policy sets.

  • Site statistics, which are aggregated and hold nothing that identifies you.

Keeping it secure

The site is served over HTTPS, and we use reputable providers with appropriate technical and organisational measures. Access to personal data is limited to the people who need it to do their job.

No system is completely secure, but if a breach affects your rights we will tell you and the Information Commissioner’s Office as the law requires.

Automated decisions and profiling

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects. Programme and volunteer applications are read and decided by people.

Your rights

Under the UK GDPR you have the right to:

  • Be told how your data is used, which is what this policy is for.

  • Access a copy of the data we hold about you.

  • Have inaccurate data corrected.

  • Have data deleted where we no longer have a good reason to keep it.

  • Restrict how we use your data while a question about it is resolved.

  • Receive your data in a portable format, or have it sent to another organisation, where that applies.

  • Object to processing based on our legitimate interests, including our site statistics.

  • Withdraw consent at any time, for example by unsubscribing or changing your cookie choice.

To exercise any of these, email hello@wearesymphony.co. We will respond within one month, and we will not charge you for it. We may ask you to confirm your identity first, so that we do not hand your data to somebody else.

Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@wearesymphony.co so we can put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk or on 0303 123 1113.

Changes and contact

We may update this policy from time to time. The date at the top shows the latest version, and where a change materially affects you we will say so. For any privacy question, contact hello@wearesymphony.co.