How we collect, use and protect your personal data, and the rights you have over it.
We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, disclose, and protect your personal data when you visit our website (www.istaglobal.org), become an ISTA member, register for an event, or otherwise interact with us. It also outlines your rights under applicable data protection laws, including the UK GDPR.
1Who We Are
We are ISTA Global Arts Learning Ltd. (ISTA), a UK registered charity (No. 1050103) and a company limited by guarantee (No. 03108893), with our registered office at:
71–75 Shelton StreetCovent Garden
London WC2H 9JQ
United Kingdom
We act as a data controller in relation to personal data submitted to us through our website, membership systems, and for participation in ISTA events, festivals, workshops, consultancies and professional development programmes.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZA172994.
If you have questions about this policy or wish to exercise your rights, please contact us:
Email: office@istaglobal.org
2Important Information
- Version: This policy was last updated on 1 July 2026.
- Accuracy: Please keep us informed if your personal data changes during your relationship with us.
- Third-party links: Our website may contain links to external websites, plug-ins, and applications. We do not control these third parties and encourage you to read their privacy policies when leaving our site.
3What Data We Collect and Why
We collect and process personal data in the following contexts:
| Purpose | Data collected | Legal basis |
|---|---|---|
| Membership applications (individual or organisation) | Name, email, job title, school/organisation name, billing details | Performance of a contract |
| Managing membership benefits | Contact details, membership tier, event participation records | Performance of a contract / Legitimate interest |
| Event registrations | Name, age (where relevant), dietary requirements, health/disability needs, emergency contact, travel details | Performance of a contract / Legitimate interest (safe event delivery) / Vital interests / Legal obligations |
| Marketing (newsletters, event promotions) | Name, email, job title, organisation | Consent (individuals) / Legitimate interest (organisations) |
| Website analytics & security | IP address, device type, browsing behaviour | Legitimate interest |
| Photos/video at events | Images, video, audio of participants | Legitimate interest / Consent where required |
| Artist in Residence (AiR) directory | Artist bio, photo, contact details | Legitimate interest |
| Recruitment (staff/contractors) | CV, cover letter, contact details | Legitimate interest |
4Event Participation Data
When a School, Organisation or Individual Participant registers for an ISTA Event, we collect and process personal data necessary for the safe and effective delivery of that Event.
This may include:
- Names
- Contact details
- School or organisational affiliation
- Age (where relevant to participation)
- Dietary requirements
- Health or accessibility information relevant to participation
- Emergency contact details
- T-shirt sizing or other logistical information
We act as an independent data controller in relation to this data and determine the purposes and means of processing.
We process this data in order to:
- Administer Event participation
- Allocate workshops and sessions
- Coordinate accommodation and logistics
- Meet safeguarding and welfare obligations
- Respond to medical or emergency situations
- Communicate essential Event information
Our lawful bases for processing Event data may include:
- Performance of a contract
- Legitimate interests in delivering educational programmes
- Compliance with legal obligations
- Protection of vital interests (for health and emergency purposes)
Where we process special category data (such as health or dietary information), we do so only where necessary for safeguarding, health and safety, accessibility adjustments, or to protect vital interests.
The School or Organisation submitting personal data to ISTA is responsible for ensuring it has a lawful basis for sharing that data with us.
5Cookies
What are cookies?
Cookies are small files placed on your device when you visit our website. They help us understand site usage and enhance your experience.
Types of cookies we use
| Cookie | Purpose | Expiration |
|---|---|---|
| _ga, _gid, _gat | Google Analytics tracking | 24 hours – 2 years |
| ista_logged_in | Tracks logged-in users | Session only |
| YouTube cookies | Embedded video player | Various |
You can manage cookies via your browser settings. For further details, visit: www.allaboutcookies.org
7International Data Transfers
As an international organisation, ISTA works with schools, artists, suppliers and event venues worldwide. Personal data may therefore be transferred outside the United Kingdom.
Where this occurs, we ensure appropriate safeguards are in place, including:
- Transfers to countries with UK adequacy decisions
- Use of Standard Contractual Clauses where required
- Additional technical, contractual and organisational safeguards
We transfer only the minimum data necessary for Event delivery and operational purposes.
8Data Security
We have implemented appropriate technical and organisational security measures to prevent unauthorised access, misuse, alteration or loss of your data, including:
- Access controls (restricted to authorised personnel)
- Encrypted data transfers
- Secure cloud-based storage systems
- Regular system audits and security training
9Data Retention
We retain personal data only for as long as necessary for the purposes outlined in this policy.
Typical retention periods include:
| Data | Kept for |
|---|---|
| Membership data | 7 years after membership ends |
| Event participation data | 7 years after the Event |
| Marketing data | Until you unsubscribe (plus consent record retention) |
| Job applications | 12 months unless employment is offered |
In some cases, we may anonymise data for statistical or research purposes.
10Your Rights
| Right | What it means |
|---|---|
| Access | Request a copy of the data we hold about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Ask us to delete your data (subject to legal requirements) |
| Restriction | Ask us to pause processing where data is disputed |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Withdraw consent | Withdraw your consent where processing relies on it |
To exercise your rights, contact: office@istaglobal.org
If you are dissatisfied with how we handle your data, you may lodge a complaint with the Information Commissioner’s Office (ICO) at: www.ico.org.uk
11Membership Tiers
This policy applies to all ISTA membership types:
- Individual Members: Solo and Ensemble tiers
- Organisation Members: Company and Association tiers
Each tier requires provision of key contact details, payment information and relevant membership data.
12Updates to this Policy
We may update this policy from time to time to reflect changes in our services, operations or legal obligations. Significant updates will be highlighted on our website.
Contact Us
ISTA Global Arts Learning71–75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom
Email: office@istaglobal.org