Privacy Notice
Last updated: August 2026
1. Introduction
Total Insight Theatre is committed to protecting your privacy and handling your personal information responsibly, transparently and securely.
This Privacy Notice explains how we collect, use, store, share and protect personal information when you engage with us, including when you:
visit our website;
contact us;
take part in our programmes or activities;
submit a referral;
apply to work or volunteer with us;
work in partnership with us; or
otherwise provide us with your personal information.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
Protecting the privacy of children and young people is particularly important to us. We recognise that some of the information we process may be sensitive, including information relating to health, wellbeing and safeguarding, and we take appropriate measures to protect it.
2. About Us
Total Insight Theatre is the data controller for the personal information described in this Privacy Notice.
Total Insight Theatre
Registered Charity Number: 1184076
Company Number: 09293224
If you have any questions about this Privacy Notice or how we process your personal information, please contact us:
Email: info@totalinsighttheatre.com
3. The Information We Collect
The personal information we collect depends on how you interact with us.
This may include:
Identity information
name
date of birth
gender (where relevant)
relationship to a child or young person
Contact information
postal address
email address
telephone number
Referral information
Where referrals are made into our services, we may collect information necessary to assess suitability and provide appropriate support, including:
presenting needs
wellbeing information
mental health information
educational information
information relating to disability or additional needs
safeguarding information
risk information
emergency contact details
referrer details
Special category personal information
Some of the information we process may be classified as special category personal data under UK GDPR.
This may include information about:
physical health
mental health
disability
ethnicity (where relevant to service delivery or monitoring)
information required to safeguard children and vulnerable adults.
We only collect this information where it is necessary, lawful and proportionate.
Employment and volunteering
Where applicable, we may collect:
employment history
qualifications
references
Disclosure and Barring Service (DBS) information
right to work documentation
emergency contact information
Website information
When you visit our website we may collect information such as:
IP address
browser type
device information
pages visited
time spent on our website
referring website
This information is collected through website analytics and cookies.
4. How We Collect Information
We collect personal information:
directly from you;
from parents or carers;
from schools and educational settings;
from NHS services;from CAMHS;
from local authorities;
from other authorised professionals;
from partner organisations;
through our website;
through secure online referral forms;
by email;by telephone;
during meetings and sessions.
Where information about a child or young person is provided by another organisation, we expect that organisation to have obtained the necessary lawful authority to share the information.
5. How We Use Your Information
We use personal information to:
deliver our charitable activities;
assess referrals;
determine eligibility for services;
provide support to children, young people and families;
communicate with service users and referrers;
work with partner organisations where appropriate;
safeguard children and vulnerable adults;
recruit and manage staff and volunteers;
administer programmes and projects;
evaluate and improve our services;
monitor outcomes;comply with legal and regulatory obligations;
manage our organisation effectively.
We will only process personal information where we have an appropriate lawful basis.
6. Our Lawful Basis for Processing
Under UK GDPR, we rely on one or more of the following lawful bases:
consent;
performance of a contract;compliance with a legal obligation;
legitimate interests;performance of a task carried out in the public interest where applicable.
Where we process special category personal information, we rely on an additional lawful condition under Article 9 UK GDPR, such as:
explicit consent;
health or social care purposes;
safeguarding of children and individuals at risk;
substantial public interest where permitted by law.
The lawful basis used will depend upon the nature of the service being provided.
7. Referrals
Where referrals are submitted through our website, we collect the information necessary to assess, administer and manage referrals into our services.
Referral information may include sensitive personal information relating to health, wellbeing or safeguarding.
Referral forms are hosted using secure online systems approved by Total Insight Theatre.Access to referral information is strictly limited to authorised personnel who require access in order to assess referrals, deliver services or fulfil safeguarding responsibilities.
Sensitive referral information is not routinely transmitted by email.
8. Sharing Your Information
We treat personal information confidentially.
We will only share information where:
you have given permission;
it is necessary for providing services;
it is necessary to safeguard a child or vulnerable adult;
we are required to do so by law;
it is necessary to protect someone’s vital interests.
Information may be shared, where appropriate, with organisations such as:
schools;NHS services;
CAMHS;
local authorities;
safeguarding agencies;
other authorised professionals involved in providing support.
We will never sell your personal information.
9. Third-Party Service Providers and International Transfers
We use trusted third-party service providers to help deliver our services and operate our organisation.
These may include providers of:
website hosting;
secure online referral forms;
cloud-based document storage;
email services; and
website analytics.
Where a third-party provider processes personal information on our behalf, we take appropriate steps to ensure that suitable data protection, security and contractual arrangements are in place.
Our secure online referral forms are provided by Cognito Forms. Total Insight Theatre is the data controller for information submitted through these forms and Cognito Forms acts as a data processor on our behalf.
Some of our service providers, including Cognito Forms and its authorised sub-processors, may process personal information outside the United Kingdom, including in the United States.
Where personal information is transferred outside the UK, we require appropriate safeguards to be in place in accordance with UK data protection law. These may include recognised data-transfer frameworks, adequacy regulations or other approved transfer mechanisms.
Cognito Forms states that it participates in the UK Extension to the EU–US Data Privacy Framework for transfers of personal information from the UK to the United States.
10. Keeping Your Information Secure
We take the security of personal information seriously.
Measures we use include:
encrypted connections (HTTPS);
secure cloud-based systems;
role-based access controls;
multi-factor authentication where available;
restricted staff access;
secure passwords;
staff training;
safeguarding procedures;
regular review of access permissions.
Only authorised individuals who need access as part of their role are permitted to access personal information.
11. How Long We Keep Information
We retain personal information only for as long as necessary.
Retention periods depend on:
legal obligations;
safeguarding requirements;
contractual requirements;
funding requirements;
the purpose for which the information was collected.
Where appropriate, referral and service records will generally be retained for up to six years following the end of our involvement, unless a longer retention period is required by law, safeguarding guidance or contractual obligations.
When information is no longer required, it will be securely deleted or destroyed.
12. Children’s Information
We recognise our responsibilities when processing children’s personal information.
Where appropriate, we will seek consent from a parent or person with parental responsibility.
However, there are circumstances where we may process children’s information without consent where permitted or required by law, including safeguarding responsibilities.
The welfare of children and young people will always be our priority.
13. Your Rights
Under UK GDPR you have the right to:
be informed about how your information is used;
request access to your personal information;
request correction of inaccurate information;
request deletion of information where applicable;
request restriction of processing;
object to certain processing;
request transfer of your information where applicable;
withdraw consent where consent is the lawful basis.
Some rights may be limited where legal obligations or safeguarding responsibilities apply.
14. Cookies and Website Analytics
Our website uses essential cookies that are necessary for the website to function.
With your permission, we also use analytics cookies to help us understand how visitors use our website and improve our services.
We currently use:
Squarespace Analytics; and
Google Analytics.
Optional analytics and advertising cookies are disabled unless you choose to accept them.
When you visit our website, you can accept all optional cookies, decline them or manage your individual cookie preferences through our cookie controls. You can change your cookie preferences at any time.
15. Links to Other Websites
Our website may contain links to external websites.
We are not responsible for the privacy practices of other organisations or websites.
We encourage you to read the privacy notices of any websites you visit.
16. Data Breaches
If we become aware of a personal data breach, we will investigate promptly and take appropriate action.
Where required by law, we will notify the Information Commissioner’s Office and affected individuals.
17. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in legislation, guidance or the way we provide our services.
The latest version will always be published on our website.
18. Contact Us
If you have any questions about this Privacy Notice or wish to exercise your data protection rights, please contact:
Email:info@totalinsighttheatre.com
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office.
Information about making a complaint can be found at:https://ico.org.uk