Privacy Policy

Bright Shadow is an arts-based dementia charity. We run a programme of creative activities with and for people living with and affected by dementia. We receive funding from various statutory sources, trusts and foundations as well as donations from private individuals.

At Bright Shadow we are committed to protecting your personal information and being transparent with you about how we use it.

In order to provide a good service, we collect contact data and a history of how you have interacted with us, for example if you have been to a Zest session or purchased a product from us.

This policy is to give you a clear explanation about how we collect and use this information, and how we work with third parties to deliver our service. In particular:

  • What information we may collect about you
  • How we use that information
  • In what situations we may disclose your details to third parties
  • Our use of cookies to improve your experience of our website
  • Information on how we keep your personal information secure, how we maintain it, and your rights to be able to access it.

Why we need your data & How we use it

At Bright Shadow we record and store your personal data responsibly. We store it on password protected databases/software such as Dropbox, Mailchimp and Quickbooks and in limited instances in locked files in our office.

We need your data for a number of reasons:

  • So we can contact you about the event you are attending, and to ask for feedback afterwards, and to complete a purchase if you have bought one of our resources;
  • So we can keep you safe in our sessions and events, and contact your next of kin in the event of an emergency;
  • To uphold your choice of whether you appear in films or photographs of our work;
  • To fulfil the monitoring needs of our funding agreements (usually this is diversity monitoring – ethnicity, gender etc.)
  • To keep you up to date with events and latest news from Bright Shadow (you can decline these at any time);
  • In order to conduct recruitment and DBS checks and to pay staff and freelancers.

Information we collect

When you attend an event or make a donation we will ask for and store contact details, such as name, email address, postal address and telephone number. We may also record details of your purchases and/or donations.

Any credit or debit card details you give us are not held on our system.

When you sign up to our email list we will ask for and store your name and email address.

When you attend or volunteer at our activities regularly (e.g. Zest sessions) we will collect contact details, preferences (e.g. photo consent) and next of Kin/essential health information in order to keep you safe. We may also be asked to conduct monitoring (e.g. diversity monitoring) for our funders and in this case will ask you for this information and keep a secure record of it.

In reporting we will use first names or initials of participants only so that participants cannot be identified, unless permission has been granted e.g. a quote has been provided for publicity purposes.

When you work with us, we will ask for contact information, proof of right to work in the UK, personal information to enable us to conduct a DBS check and will require your bank details for payment purposes. Once complete, we will only keep on file records of the checks carried out rather than copies of the documents themselves.

Sensitive personal data

Data protection law recognises that certain categories of personal information are more sensitive such as health information, race, religious beliefs and political opinions. We do not normally have need to collect this information unless there is a clear need to do so, for example for reporting to funders or to keep you safe if you are attending a Bright Shadow event. Any sensitive information collected will be held securely and only for as long as required for a specific reason.

Legal basis

There are three bases under which we may legally process your data:

Contract purposes
When you make a purchase or a donation, you are entering into a contract with us. In order to deliver the contract, we need to store and process your information. For example, we may need to contact you if an event is cancelled.

Legitimate business interests
In certain situations, we collect and process personal information that are in our legitimate organisational interests. We would only do this if there is no overriding prejudice to you in doing this.

For example:

  • we will hold your information for up to 5 years to enable us to construct reports for funders.
  • we may hold and send (in anonymous form) relevant information to funders
  • we may also use legitimate interest legal basis to contact you with information on future events at Bright Shadow when previous contact indicates you would be interested.
  • we may collect and use data that is in the public domain (e.g. Care Home addresses or local councillor email addresses) in order to inform you of our activities that we believe will be relevant/of interest to you/your business.

With your explicit consent
In any circumstances where the basis above are not appropriate, we will instead ask for your explicit consent before using personal information.

Marketing Communications

We aim to communicate with you about the work we do in ways that you find timely, relevant and respectful. To do this we use the data that we have stored about you, such as previous events you have attended.

We use legitimate business interest as the legal basis for communicating with you by post, phone or email. You will have the opportunity to opt out of any communications when you first register with us, and we then provide an opt-out link with every digital communication, and a postal address on every postal communication, that we send.

We may also contact you about our work by telephone, however we will always get explicit consent from you before doing this. Please note that this does not apply to telephone calls we may need to make if an event is cancelled for example.

Third Parties

There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:

  • To our trusted accountancy supplier in order that staff and freelance workers can be paid, donations processed and our legal duties upheld. Our accountancy supplier’s systems are fully password protected.


We use cookies on our websites, which are placed onto your device to help the website function. You can opt out of this when you first visit our website.

Storing and maintaining your personal information

We store your personal information for at least 5 years, to help us to provide good future service to you, and for us to better understand the preferences of our participants.

Data is currently stored:

  • On password protected Excel databases (for marketing purposes)
  • On password protected Mailchimp (for e-mailouts)
  • On password protected Quickbooks (for finance)
  • On password protected iCloud (for essential contact information for sessions)
  • On password protected Dropbox (for administration)
  • In a locked cupboard in our secure office (limited papers, including finance documents kept to meet our legal requirements)

You can access and amend your personal details at any time by contacting our office.

When data is deleted, it is sent to a secure shredding service, or removed from digital records.

We put in place safeguards to keep your personal information as secure as possible, and we ensure that any third parties we use for processing your information do the same.

Your Rights

Under the Data Protection Act 2018, you have the right to find out what information we store about you. These include the right to:

  • be informed about how your data is being used
  • access personal data
  • have incorrect data updated
  • have data erased
  • stop or restrict the processing of your data
  • data portability (allowing you to get and reuse your data for different services)
  • object to how your data is processed in certain circumstances

Please use the contact details below if you would like to exercise this right or have any questions about any aspect of this privacy policy:
Bright Shadow, Beach House, Beach Street, Herne Bay, CT6 5PT
01227 467272

How to complain

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Helpline number: 0303 123 1113