Introduction

The scope of this privacy notice covers the data processed within our enterprise business systems, customer support portal and digital marketing platforms. Please see section 2 below for a breakdown of how we collect your data. This policy does not cover any specific product-based privacy notices for the products that we sell: these separate policies can be located within the products themselves.

Cayman Arts Trust are fully committed to keeping your information safe. This privacy notice explains what personal information we collect, why we collect it, and how we use it. We hope our policy is clear and transparent, but if you have any questions, please get in touch via the contact details at the bottom of the page.

Contents

• 1. Who collects your personal information
• 2. How we collect it
• 3. What personal information do we collect
• 4. How we use your personal information
• 5. What our legal basis is for processing your personal information
• 6. Where and how your data is stored
• 7. How long do we keep your personal information
• 8. Who we share your personal information with
• 9. How you can amend your preferences
• 10. Your rights

1. Who collects your personal information

Cayman Arts Trust
PO Box 32072
George Town
Grand Cayman
Cayman Islands KY1-1208

T: +1 345 926 2040
E: dataprotection@caymanartstrust.com

2. How we collect it

Cayman Arts Trust collects your data through our website, ticketing portal and email systems. Our lesson delivery partner also collects information through its client CRM portal.
*Our website is www.caymanartstrust.com
***Our customer support portal is https://musiciansltd.asapconnected.com/Login
***Our ticket purchasing support portal is https://cat.frsolutions.ky/#/event-details/

3. What personal information do we collect

We collect personal information about youand/or your child (such as your name, address, email address or telephone number) when you give this to us as part of becoming a customer, registering for lessons with a customer portal login, signing up to our newsletters, completing a website form, or making a lesson, class or support enquiry.

When you subscribe to any of our marketing or communications, you indicate that you have a preference to receive these communications. We store your preferences and give you the option to amend these at any time either by opting out of a marketing communication or by editing your customer portal profile as applicable.

As part of using our websites and customer portal, we may also store information about how you use our sites, for example the pages viewed, time spent on each page etc in order to be able to take steps to improve your digital experience. These behaviours including IP addresses are captured within Google Analytics, Power BI and other similar tools. You can read more in our website cookie policy.

As acustomer or parent of a child, in order to provide our services to your child we may need to collect personal information which data protection legislation defines as special category data, such as dietary requirements, allergies, data entered into our parent portalthat we need in order to schedule and manage the lessons and classes we provide to you or your child. As a customer you agree to the need for us to process this information as part of your engagement with the Cayman Arts Trust, or by submitting this information through the customer portal, email or applicable form.

4. How we use your personal information

We may use your personal information following a:

• Customer visit – whereby we may contact you regards to items discussed or similar products and solutions you have expressed an interest in.
• Class or camp attendance or registration in order to contact you about the event itself and/or possibly future events and/or to obtain feedback. When registering for event we may ask you for special category data, such as dietary requirements, in order to meet your needs at the event(s).
• General enquiry or feedback where you may contacted us via telephone, email or other channels requesting information about products and services and we may use the data captured to help improve services or assist in finding a resolution to your enquiry.
• Marketing subscription where you would have signed up via a web form or other data capture point. This information will be processed in accordance to that stated at the point of capture. You can unsubscribe anytime or customise your preferences (See Section 9. How can I amend my preferences?)
• Customer portal registration where we may use your data to send important updates, event information, direct marketing and other useful information that will help you get the most out of the products and services available to you.
• Lesson Enquiry where you may have contacted us via telephone, email or other channels requesting information about lessons and classes we have to offer or we have contacted you and you have expressed an interest. You can unsubscribe anytime or customise your preferences (See Section 9. How can I amend my preferences?)
• Support Enquiry where you may have contacted us via our support portal, email or other channels to log a support enquiry about an issue or for general assistance. We may use the data captured to help to resolve your enquiry and may contact you after for feedback to help improve the service offered.

5.What our legal basis is for processing your personal information

We will only collect and use your personal information (as described in section 4) in accordance with data protection legislation. Our legal basis for processing your personal information are as follows:

• 1. Contractual – We may process personal data associated to a contract or product purchase. It is important for us to hold this data in order to ensure that we have records from a legal perspective to whom signed and agreed to the terms of agreements and who to contact following issues and/or to send renewal information.
• 2. Consent – Where necessary we will only collect and process your personal information if you have given your consent for us to do so, for example, we will only send you certain marketing emails and process any sensitive information about you if we have your consent.
• 3. Legitimate Interests – We may use and process some of your personal information where we have conducted Legitimate Interest Assessment and have a legitimate business grounds for doing so. Under European privacy legislation there is a concept of “legitimate interests” as a justification for processing your personal information. As such, we may send you direct marketing if you are either an existing customer or previous customer.

You have a right to object to our use of your personal information for these legitimate interests. Please see section 10 – Your rights and how to contact us for how to do this.

6. Where and how your data is stored

We store our customers’ personal information in cloud-based enterprise business systems, which is a combination of Vanco ASAP, Ticketsocket and Office365 applications.

Cayman Arts Trust utilises specialist software called Vanco ASAP to schedule and manage our lessons and classes. We also provide our customers with a customer web portal where you may update your data, review schedules and pay your invoices using secure credit card processing.

ASAP takes rigorous measures to protect our web portal customer and student data. VancoASAP currently meets the stringent requirements of FERPA and PCI DSS for secure online debit/credit card transaction processing.

Your data is also protected by multiple layers of security controls including, network segmentation enforced by firewalls, encryption in transit via TLS1.2, OS hardening, logical access controls at the system and app level, the use of file integrity monitoring, audit logs that flow into a SIEM that our SOC reviews on a continuing basis, IDS/IPS protecting the perimeter and multi factor authentication; just to name a few. VancoASAP undergoes annual penetration tests and monthly external application scans. Vanco ASAP also conduct source code security vulnerability scans on each deployment. Vanco ASAP also require annual security awareness training for all employees and conduct background checks on all new hires.

The Cayman Arts Trust parent portal is hosted in the USA in Switch Data Centres. Switch data centre designs, facilities and operations far surpass the highest data centre benchmarks. Switch SUPERNAP is the world’s first Tier 5 Platinum data centre.

The Cayman Arts Trust Microsoft Office 365 instance resides inMicrosoft Azure datacentres in the USA and all data is encrypted at rest and in transit and complies to ISO27001 standards. You can read more about Microsoft’s commitment and compliance to data privacy and security in their onlineTrust Center.

7. How long do we keep your personal information

All personal data will be held in accordance with Cayman Arts Trust policy, and historical records will not be held without legitimate reason. We will only hold your personal information on our systems for the period necessary to fulfil the purposes outlined in this privacy notice or until your request it is deleted.

8.Who we share your personal information with

The only people who have access to your personal information are staff within Cayman Arts Trust whom require access to this to carry out their job in order to provide services to you
In addition, we sometimes need to provide access to technical support partners in order to receive support relating to our enterprise business systems and for products services we provide you our customer.

9. How you can amend your preferences

If you don’t want to be on our marketing mailing lists, you can unsubscribe by opening the last email received from us and clicking on the unsubscribe or change my preference link usually found at bottom of the email. This will take you to your preference page.

If you are a Cayman Arts Trust client, you can email dataprotection@caymanartstrust.com to have your help deskand CRM records deleted.

10. Your rights

Under data protection legislation you have a number of rights in relation to your personal information. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within 30 days after we have received this information or, where no such information is required, after we have received your request. This section explains what they are and how you can use them, if you wish.

Accessing your personal information

You have the right to request a copy of the personal information that we hold about you. This is known as a Subject Access Request.

If you wish to request a copy of your personal information please address requests to dataprotection@caymanartstrust.com

Correcting and updating your personal information

The accuracy of your information is important to us. If you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by getting in touch with your account manager or our help desk.

If you have a customer portal login, you can make some of these changes yourself by editing your profile.

Erasing your personal information or restricting its processing

You may ask for your personal information to be removed from our systems. Unless we are legally permitted or required to keep the data, we will comply with your request.

You may also ask us to restrict processing your personal information in the following situations:

• Where you believe it is unlawful for us to process the data,
• You have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings

If you wish to exercise any of these rights please email your request to dataprotection@caymanartstrust.com. We will endeavour to complete your request as swiftly and diligently as possible.

Changes to our Privacy Notice

This Privacy Notice may be updated from time to time so you may wish to check it each time you submit personal information to us. The date of the most recent revisions will appear on this page. If material changes are made to this Privacy Notice, for instance affecting how we would like to use your personal information, we will provide a more prominent notice (including email notification of the changes to the notice).

Contacting us

If you any questions or comments regarding the content of this Privacy Notice, please contact:

dataprotection@caymanartstrust.com

Or alternatively,

The Data Protection Officer
Cayman Arts Trust
PO Box 32072
George Town
Grand Cayman
Cayman Islands KY1-1208