Introduction

This privacy policy explains how Upė Foundation uses your data, how you can control that use, and what to do if you would like us to change the way we process your data.

Upė Foundation is a private company limited by guarantee registered in England and Wales (company number 16551246). In this document we refer to the organisation as “Upė Foundation”, “Upė”, “we” or “us”.
‍

Why we need your information and whose data we collect

Upė Foundation develops and supports curatorial fellowships, exhibitions, residencies and public programmes connecting the Baltic region and international art communities. To do this well we need to understand who engages with our work.

We hold data on people who do, or might do, the following:

• Visit our website or attend our events and programmes
• Apply to or take part in fellowships, residencies, exhibitions or other opportunities
• Work with us as artists, curators, collaborators, advisors, suppliers or freelancers
• Subscribe to our newsletters or sign up for updates
• Support Upė financially or in other ways
• Work for us or apply for a job or freelance role

In limited cases we may collect data on people who are under 18. Where we do this we will explain exactly how the data will be used at the point of collection.
‍

How we obtain your data from you

Most of the information we hold about you is provided directly by you, for example when you:

• complete an application form
• sign up to our mailing list
• register for or attend an event
• correspond with us by email or other channels
• send us an invoice or contract

From someone other than you
In some cases we may add to the information you give us with data from elsewhere, for example to:

• update or correct contact details
• understand more about professional roles, organisations or networks in the art field
• carry out appropriate due diligence in relation to significant partnerships or donations

Sources might include publicly available information such as organisation websites, news articles, professional profiles, company registers or funder databases. We may also receive information about you from partner institutions when we jointly deliver a programme or event.
‍

What we do with your data

The core activities we carry out with your data enable us to:

• Send you information about Upė Foundation and our programmes
• Administer applications, selection processes and participation in our programmes
• Organise and deliver events, exhibitions, residencies and fellowships
• Manage contracts, fees, payments and donations
• Develop and maintain professional relationships and networks
• Evaluate and report on our activities to partners and funders
• Process job and freelance applications
• Promote the aims and objectives of Upė through related activities

If you do not provide certain personal data we may not be able to provide specific services (for example, we need contact details to administer applications or send joining information for events, and bank details to process fee payments).

What information we collect

We may collect and store the following kinds of information:

• Names, postal addresses, email addresses, phone numbers and other contact details
• Records of applications, participation, donations, contracts and payments
• Information about our relationship with you, including correspondence and notes of meetings or calls
• Professional information such as role, organisation, biography, practice description and relevant areas of interest
• Event attendance, access requirements and, where you choose to share them, dietary requirements
• For job and freelance applicants, information supplied in CVs, portfolios, references and application forms

We aim not to routinely collect “special category” data (such as health information, racial or ethnic origin, or religious beliefs). If we do need to collect such information (for example to meet access needs for an event or residency), we will explain why we need it, keep it secure and only hold it for as long as necessary.
‍

Profiling

We may use your data to understand patterns in how people engage with our work. For example, we might:

• tag records to note attendance at particular types of events or programmes
• group contacts with similar interests so we can send more relevant information
• identify people who may be interested in new opportunities or collaborations

This helps us make our communications more useful and avoid sending irrelevant information.

You have the right to ask us not to do this. If you would prefer us not to use your data in this way, please contact us using the details below.
‍

Protecting and sharing your data

We keep your data in secure systems with appropriate technical and organisational safeguards.

We do not sell your data. We only share it where necessary for the purposes described in this notice, for example:

• With partner institutions when we jointly deliver a programme, residency, exhibition or event
• With service providers who process data on our behalf (for example email newsletter services, cloud storage, event registration or survey tools). In these cases, we remain in control of your data and have contracts in place requiring providers to protect it and only use it as instructed by us
• With professional advisors (such as lawyers or accountants) where necessary
• Where we are legally required to do so, for example to HMRC in relation to tax matters, or to other authorities where required by law

We may provide anonymised or aggregated statistics to funders or partners, but these do not identify individuals.

Our responsibilities and legal bases

Data protection law requires us to tell you the legal bases we rely on to process your data. Depending on the situation, we rely on:

• Consent – for example, when you actively sign up to receive our newsletters or certain types of marketing communications. You can withdraw this consent at any time by using the unsubscribe link in our emails or by contacting us.
• Contract – for example, when we need to process your data to enter into or perform a contract (such as an artist, curatorial, freelance or employment agreement).
• Legal obligation – where we must process data to comply with the law (for example, company, employment or tax requirements).
• Legitimate interests – in most other cases, where processing your data is necessary for the running of Upė Foundation as an arts organisation and does not override your rights or interests. This includes activities such as programme administration, professional communication, fundraising and evaluation.

Where we rely on legitimate interests, we consider the potential impact on you and we only use your data in ways you would reasonably expect, and which are described in this notice.
‍

How long we keep your data
‍

We keep your data for as long as is necessary for the purpose for which it was collected, and in line with legal or regulatory requirements. Broadly:

• Application and programme records are kept for as long as reasonably needed to manage and document the programme or relationship
• Financial and contractual records are generally kept for up to six years after the end of the relevant financial year
• Mailing list data is kept until you unsubscribe or we cease sending that newsletter

If we consider it appropriate to keep data longer (for example as part of our artistic and organisational archive), we will do so carefully and only where this is justified by our role as a cultural organisation.
‍

Your rights

You have a number of rights in relation to your personal data, including the right to:

• request access to the data we hold about you
• ask us to correct inaccurate or incomplete data
• ask us to erase your data in certain circumstances
• ask us to restrict or object to our processing of your data in certain circumstances
• withdraw your consent where we rely on consent
• change or stop the way in which we communicate with you

If you wish to exercise any of these rights, please contact us using the details below. We may need to verify your identity before processing your request.

If you are unhappy with how we have handled your data, you can contact us in the first instance. You also have the right to complain to the UK Information Commissioner’s Office (ICO).
‍

Contacting us

If you have any questions about this privacy notice, about how we process your data, or if you want to change how we use your data, please contact us:

Email: info@upefoundation.org
Post: Upė Foundation, 25 Holland Street, London W8 4NA, United Kingdom

‍