Registered Charity in Gibraltar No. 379 · PO Box 822, Gibraltar · info@gibraltarmusictrust.com
Purpose
The Gibraltar Music Trust (the Trust, we, us, our) respects your privacy and is committed to protecting your personal data. This privacy notice explains how we collect, use, store and share your personal data when you:
- make a donation to the Trust or sponsor our work;
- offer or donate a musical instrument;
- borrow an instrument, or sign a loan agreement for a child in your care;
- volunteer with us;
- sign up to our mailing list;
- contact us by email, telephone, WhatsApp, post or through our website;
- attend, or appear in photographs or video at, our workshops, flag days and events;
- work with us as a school, partner, sponsor or supplier; or
- visit our website.
It also explains your privacy rights under applicable data protection laws. In this notice, Data Protection Laws means, as applicable to the relevant processing:
- the Gibraltar General Data Protection Regulation (Gibraltar GDPR) and the Gibraltar Data Protection Act 2004;
- the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018; and
- Regulation (EU) 2016/679 (EU GDPR) and applicable EU Member State data protection legislation.
Controller for personal data
A controller is a person or organisation that, alone or jointly with others, determines the purposes and means of processing personal data. Unless we notify you otherwise, the Trust, acting through its trustees, is the controller of personal data processed for the purposes described in this notice.
Schools, payment providers and other organisations may act as separate controllers for personal data they process for their own purposes. For example, Stripe processes payment information under its own privacy notice, and a school keeps its own records about its pupils.
Scope
This privacy notice applies to our processing of personal data in connection with:
- Donors and sponsors: individuals and businesses who give money to the Trust, once or regularly, or sponsor instruments, classrooms or projects.
- Instrument donors: people who offer or give us a musical instrument or equipment.
- Borrowers: the responsible adult (aged 18 or over) who signs an instrument loan agreement, for themselves or for a child in their care.
- Volunteers: people who apply to volunteer or volunteer with us.
- Mailing list subscribers: people who ask to receive news from the Trust.
- Participants and audiences: people who take part in or attend our workshops, flag days and events, including people who appear in our photographs or video.
- Schools, partners and suppliers: organisations we work with, and the individuals who represent them, such as teachers, owners, employees and other representatives.
- Website visitors: anyone browsing our website or interacting with our online content.
Types of personal data
Personal data means any information relating to an identified or identifiable individual. It does not include information that has been genuinely anonymised so that an individual can no longer be identified.
Depending on your relationship and interactions with us, we may collect, use, store and transfer the following categories of personal data:
| Category | What it includes |
|---|---|
| Identity Data | Your name and title. For schools, partners, sponsors and suppliers, this may include your role and the organisation you represent. |
| Contact Data | Your email address, telephone number and postal or home address, where relevant. |
| Donation Data | The amount and date of your gift, whether it is one-off or monthly, the payment reference and status, and any message you send with it. Payments are handled by our payment provider, Stripe. We never receive or store your full payment card details. |
| Recognition Data | The name of the person or business you would like credited as a donor or sponsor, and your choice about being named publicly. |
| Instrument Data | Details and photographs of instruments you offer, donate or borrow, the location for collection, loan dates, the condition on handover and return, and deposit records. |
| Loan Contact Data | For a loan to a child, the responsible adult's details and the child's first name and class or year group only. |
| Volunteer and Vetting Data | Your skills, interests and availability, whether you are 18 or over, your emergency contact, your home address, a copy of your passport or ID card, proof of address, two references (including your referees' names and contact details) and the outcome of a Royal Gibraltar Police vetting check. |
| Image Data | Photographs and video taken at our workshops, flag days and events, and records of photo consent. |
| Technical Data | Your internet protocol (IP) address, browser type and version, operating system and other information about the device you use to visit our website. |
| Usage Data | Information about how visitors use our website, counted as totals. |
| Marketing and Communications Data | Your mailing list preferences and records of your consent or objection. |
| Communications Data | The content of your enquiries, correspondence, complaints and messages to us. |
Please refer to the processing tables below for details of how we use these categories and our lawful bases for doing so.
Information about children
We do not collect or keep children's personal information beyond what is set out below. Our website and forms are for adults, parents and guardians. Where our work involves a child, we keep a way of contacting the child's parent or guardian.
- Instrument loans: a loan to a child is agreed and signed by a responsible adult aged 18 or over. We record only the child's first name and class or year group, so we know who has the instrument. We delete them when the loan ends.
- Photographs and video: we only publish photographs or video of a child with the written consent of their parent or guardian. We never publish a child's name with their photograph.
- Rights: where personal data relates to a child, the rights belong to the child. A parent or guardian may contact us to exercise them on the child's behalf, where permitted by applicable law.
Lawful bases: how we use your personal data
We will only use your personal data where we have a lawful basis under applicable Data Protection Laws. Depending on the processing, we rely on:
- Consent: where you have consented to particular processing. Where we rely on consent, you may withdraw it at any time by contacting us. Please also see Mailing list and Cookies and similar technologies.
- Performance of a contract: where processing is necessary to perform a contract with you, such as an instrument loan agreement, or to take steps at your request before entering into a contract.
- Legal obligation: where processing is necessary to comply with a legal obligation applying to us, such as keeping financial records.
- Legitimate interests: where processing is necessary for our legitimate interests, or those of a third party, and those interests are not overridden by your interests, rights and freedoms.
Vetting outcomes are information about criminal convictions and offences. We process them only to keep children and vulnerable adults safe, as Gibraltar law allows, and only the Trust's Designated Safeguarding Lead and Deputy can see them.
Where a table identifies more than one lawful basis, the basis used depends on the specific purpose and circumstances.
How we collect your personal data
Directly from you
You may provide personal data when you:
- make a donation or agree to sponsor our work;
- complete our donate-an-instrument, volunteer, contact or mailing list forms;
- sign an instrument loan agreement or a photo consent form;
- apply to volunteer, including for vetting;
- take part in our workshops, flag days and events; or
- correspond with us by email, telephone, WhatsApp, post or through our website.
From third parties
We may receive information from:
- Stripe, in connection with your donation;
- your referees and the Royal Gibraltar Police, if you apply to volunteer;
- schools, where necessary to arrange or recover an instrument loan; and
- your employer or another organisation you represent.
Through cookies and similar technologies
When you visit our website, we may collect Technical Data and Usage Data. Please see Cookies and similar technologies below.
Processing tables
The tables explain why we process personal data and the lawful bases for doing so. More than one table may apply to your relationship with us.
Donors and sponsors: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Process your one-off or monthly donation and send you a receipt | Identity, Contact, Donation Data | Performance of a contract; legitimate interests in receiving and acknowledging gifts |
| Manage or cancel a monthly donation | Identity, Contact, Donation Data | Performance of a contract |
| Keep financial and accounting records of donations | Identity, Donation Data | Legal obligation for required financial records |
| Name you or your business as a donor or sponsor on our website, instruments or materials | Identity, Recognition Data | Consent |
| Respond to enquiries about your gift | Identity, Contact, Donation, Communications Data | Legitimate interests in responding to supporters |
Instrument donors: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Assess an instrument you offer and arrange its collection | Identity, Contact, Instrument, Communications Data | Legitimate interests in running the instrument library; taking steps at your request |
| Record donated instruments in our register, and the donor's name | Identity, Contact, Instrument Data | Legitimate interests in managing and accounting for our collection |
| Show your name as the donor on the instrument's public page | Identity, Recognition Data | Consent |
Borrowers: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Agree and manage an instrument loan, including handover, return and the £50 refundable deposit | Identity, Contact, Loan Contact, Instrument Data | Performance of a contract |
| Recover an instrument that is late, damaged or lost | Identity, Contact, Loan Contact, Instrument, Communications Data | Performance of a contract; legitimate interests in protecting the Trust's instruments |
| Share loan details with the school involved | Identity, Contact, Loan Contact, Instrument Data | Legitimate interests in running loans with schools |
| Keep records of deposits paid and refunded | Identity, Instrument Data | Legal obligation for required financial records |
Volunteers: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Consider your application and match you with volunteering opportunities | Identity, Contact, Volunteer and Vetting, Communications Data | Legitimate interests in organising volunteers |
| Check your identity, address and references | Identity, Contact, Volunteer and Vetting Data | Legitimate interests in keeping children and vulnerable adults safe |
| Carry out and record a Royal Gibraltar Police vetting check | Identity, Volunteer and Vetting Data | Legitimate interests in safeguarding, with the additional condition for criminal offence data |
| Contact your emergency contact if needed | Volunteer and Vetting Data | Legitimate interests; vital interests in an emergency |
| Arrange safeguarding training and keep training records | Identity, Volunteer and Vetting Data | Legitimate interests in safeguarding |
Mailing list, events and photographs: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Send our newsletter and news about the Trust | Identity, Contact, Marketing and Communications Data | Consent |
| Organise workshops, flag days and events | Identity, Contact, Communications Data | Legitimate interests in running our activities |
| Take and publish photographs and video of our activities on our website and social media | Image Data | Consent (a parent's or guardian's for a child) |
| Publish a quote or story identifying you | Identity, Communications Data | Consent |
Schools, partners, sponsors and suppliers: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Work with schools and partners on music education and instrument loans | Identity, Contact, Communications Data | Legitimate interests in delivering our charitable work |
| Appoint and manage suppliers and pay them | Identity, Contact, Communications Data | Performance of a contract where you are personally the contracting party; otherwise legitimate interests in managing supplies; legal obligation for financial records |
Website visitors: processing information
| Processing activities | Categories of personal data | Lawful basis |
|---|---|---|
| Respond when you contact us through website forms, email or WhatsApp links | Identity, Contact, Communications Data | Legitimate interests in responding to enquiries |
| Administer and protect our website, including troubleshooting, security and spam prevention | Technical, Usage Data; Identity and Contact Data where relevant | Legitimate interests in operating and protecting our website |
Automated processing
We do not make decisions about you by solely automated means, and we do not profile you.
Recognising donors and sponsors
If you agree, we will name you or your business as a donor or sponsor, for example on our website, on the instrument you gave or on materials about the project you supported. We intend these credits to be lasting, so that your support is recognised in perpetuity.
You can ask us to remove your name from our website at any time. Names already printed or engraved, for example on a plaque or a sticker, may not be removable, and we will explain this when we ask for your consent.
Cookies and similar technologies
We use only the cookies and similar technologies that are strictly necessary to run and protect our website and to take donations securely. These do not need your consent. If we ever want to use any other cookies, we will ask for your consent first. Please refer to our Cookie Notice for further information.
Providing personal data
Where we need personal data by law or to enter into or perform a contract with you, failure to provide it may mean that we cannot process your donation, lend you an instrument or accept you as a volunteer. Where relevant, we will explain which information is required and the consequences of not providing it when we request it.
Mailing list
We will only send you our newsletter or news about the Trust if you ask us to. You have the right to object at any time to processing your personal data for direct marketing. You can unsubscribe using the link in every email or by contacting us.
Unsubscribing does not stop us sending messages you need, such as a donation receipt or information about an instrument loan. We may keep limited information on a suppression list so that we respect your choice.
How we disclose personal data
Where necessary for the purposes described in this notice, we may share personal data with:
- Our trustees and volunteers: those who need access to run the Trust and its activities.
- Schools: only what they need to arrange or recover an instrument loan, or to run an activity with us.
- Technology and service providers: Vercel (website hosting, security and image storage), Neon (our database), Cloudflare (our domain name system), Zoho (email and our mailing list, Zoho Campaigns).
- Payment providers: Stripe, to process donations and deposits paid by card, and our bank.
- Social media platforms: when we publish photographs, video or stories you have agreed to.
- Professional advisers: including solicitors, accountants, auditors, bankers and insurers.
- Regulators, public authorities and law enforcement bodies, including the Charity Commissioners for Gibraltar and the Royal Gibraltar Police, where disclosure is required by law or is otherwise lawfully necessary, for example to keep a child safe.
Where service providers act as our processors, they must process personal data under appropriate contractual arrangements and on our instructions. Some recipients, including schools and payment providers, may act as separate controllers for their own processing.
We never sell your personal data.
International transfers
Our service providers or other recipients may process personal data outside Gibraltar, the UK or the European Economic Area (EEA). Where required, we use an applicable transfer mechanism such as:
- an adequacy decision or recognition under the relevant legal regime; or
- appropriate safeguards, including approved contractual clauses and any required supplementary measures.
For UK-restricted transfers, this may include the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. For EU-restricted transfers, this may include the European Commission's Standard Contractual Clauses. Transfers subject to Gibraltar law will be assessed under the applicable Gibraltar requirements.
Data security
We have put in place appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised use or access, alteration and disclosure. We limit access to trustees, volunteers and service providers who need it. Where they act on our behalf, they are subject to appropriate instructions and confidentiality obligations. Paper forms, such as loan agreements and consent forms, are stored securely.
Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, regulatory, tax, accounting and reporting requirements. We may retain relevant information for longer where necessary in connection with a complaint, investigation or actual or reasonably anticipated legal claim.
When deciding retention periods, we consider the nature and sensitivity of the information, the purposes of processing, potential risks, applicable legal requirements and whether those purposes can be achieved with less information. Our planned retention periods are:
| Information | How long we keep it |
|---|---|
| Enquiries and correspondence | 2 years after the last contact |
| Donation and deposit records | 7 years from the end of the financial year, for accounting |
| Donor and sponsor credits | Until you ask us to remove them |
| Donated instrument records | While we hold the instrument, plus 2 years |
| Instrument offers we decline | 2 years |
| Loan agreements | 2 years after the loan ends; the child's first name and class are deleted when the loan ends |
| Volunteer records, including ID copies, proof of address and references | 2 years after you stop volunteering |
| Police vetting checks | We record only the date, reference number and outcome. Any copy of the certificate is destroyed within 6 months |
| Safeguarding concerns about a child | Passed to the child's school or the Care Agency; the Trust's record is kept until the child's 25th birthday |
| Allegations or complaints about a volunteer | 10 years |
| Mailing list | Until you unsubscribe |
| Photographs and video | Until consent is withdrawn |
| Website security logs | 30 days |
Our safeguarding periods follow safeguarding practice in Gibraltar schools. Every volunteer is vetted by the Royal Gibraltar Police and gives two references before they start.
Data subject rights
Subject to the applicable law and relevant conditions, you may have the following rights. Not all rights are absolute.
- Access: to request confirmation of processing and a copy of your personal data.
- Rectification: to request correction of inaccurate or incomplete personal data.
- Erasure: to request deletion in certain circumstances. We may need to retain information where a lawful exception applies.
- Objection: to object to processing based on legitimate interests on grounds relating to your particular situation. We may continue where the applicable legal conditions permit. Your right to object to direct marketing is not subject to this balancing exercise.
- Restriction: to request that we restrict processing, for example while accuracy or an objection is being assessed, or where information is needed for legal claims.
- Data portability: to receive certain information you have provided in a structured, commonly used, machine-readable format and request its transfer where technically feasible. This generally applies to automated processing based on consent or contract.
- Withdrawal of consent: to withdraw consent at any time where we rely on it. Withdrawal does not affect the lawfulness of processing before withdrawal.
Exercising your rights
To exercise your rights, please contact us at info@gibraltarmusictrust.com.
You will not normally have to pay a fee. Where applicable law permits, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive. We may request information reasonably necessary to confirm your identity or your authority to act for someone else, such as a parent acting for a child.
We will respond without undue delay and within the period required by applicable law, generally one month. Where a lawful extension applies because of the complexity or number of requests, we will inform you within the required period and explain why.
Keeping personal data accurate and current
Please tell us if your personal data changes during your relationship with us, for example a new email address or telephone number.
Concerns and complaints
We would appreciate the opportunity to address your concerns. Please contact us using the details below. You also have the right to complain to the relevant supervisory authority. You do not have to contact us first.
Depending on the applicable law, the relevant authority may include:
- Gibraltar: the Information Commissioner at the Gibraltar Regulatory Authority (GRA), 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar · +350 20074636 · info@gra.gi · gra.gi.
- UK: the Information Commissioner's Office (ICO) · ico.org.uk.
- EU: the competent supervisory authority, including, where the EU GDPR applies, the authority in the Member State of your habitual residence, place of work or the alleged infringement.
Changes to our privacy notice
We may update this privacy notice in response to legal, technical or organisational developments, for example when we start our instrument loan scheme or add new features to our website.
The latest version will be available on our website. Where appropriate or required by law, we will notify you of significant changes. If a new or changed processing activity requires consent, we will obtain that consent before undertaking the relevant processing. Updating this notice does not itself constitute your consent.
Contact us
If you would like more information about how we manage your personal data, or wish to exercise your rights, please contact us:
Gibraltar Music Trust · PO Box 822, Gibraltar · info@gibraltarmusictrust.com
Version control
Last updated: 6 November 2026