Culture Key Privacy Policy
About This Policy
Culture Key is a prototype platform developed by Bath Arts Collective CIC and POLYMATHIC Ltd to empower arts and cultural organisations in Bath and North East Somerset to better understand and evidence their social and economic impact through data. The platform enables participating organisations to upload and visualise anonymised data on audience demographics, ticket sales, and engagement.
Bath Arts Collective CIC and POLYMATHIC Ltd take the security and privacy of the community that we serve seriously, and we are committed to managing personal data in accordance with current legislation and best practice.
This policy explains who we are, what information we collect, how and why we use it, how it is stored, which partners we work with, and your rights regarding any information you share with us.
We will use any personal information we collect about you in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (DPA), and the Privacy and Electronic Communications Regulations (PECR). We aim to be clear when we handle your data, and not do anything you wouldn't reasonably expect.
By visiting www.culturekey.co.uk you are accepting and consenting to the practices described in this policy.
Please read this information carefully, as by providing your data to us you acknowledge you have read this policy and understand we will process your data in accordance with its terms.
Who We Are
Bath Arts Collective (ICO registration ZB914814) and POLYMATHIC Ltd (ICO registration ZB805111) are joint data controllers of Culture Key.
Bath Arts Collective is a Community Interest Company (CIC) registered in England and Wales, with company registration number 15289724 and registered office at 4 Chapel Row, Bath, England, BA1 1HN.
POLYMATHIC Ltd, a privacy limited company registered in England and Wales, with company registration number 15434917 and registered office at 9 Upper Hedgemead Road, Bath, England, BA1 5NE.
For this policy “we”, “us,” and “our” refer to Culture Key.
Contact Us
If you wish to exercise one of your individual rights or have questions about this Privacy Policy, please contact us.
Write to: Data Controller, POLYMATHIC Ltd, 9 Upper Hedgemead Road, Bath, England, BA1 5NE
Email: nigel@polymathic.agency
Data Collection
How We Collect Your Personal Data
You give us your personal information when you:
- visit the Culture Key website
- sign up as a participating organisation
- communicate with us by post, email, telephone, social media, via our websites, or in person
Online Information
We keep a record of the emails we send and receive from participating organisations in order to track progress of the project and to keep a record of our relationship with them.
Culture Key uses cookies to improve your experience on this site. Cookies are small data files stored on your device and are used only for statistical analysis to help us enhance our services. They do not collect any personally identifiable information. Read more in our Cookie Policy.
You can manage or block cookies through your browser settings. Most browsers have a help section that explains how to do this, or you can visit About Cookies for detailed guidance, including how to delete cookies and understand their function.
Please note that restricting cookies may affect the functionality of the site, including features like logging in or submitting content.
Types of Personal Data We Collect
Participating Organisations
We collect:
- First name and last name
- Organisation name
- Job title
- Email address
- Contact telephone number(s)
- IP address
- Platform usage data
Audience
The only personal data we receive is postcodes, which are shared without any names, addresses, or other identifying details – so the data remains anonymous and cannot be linked back to individuals. We collect:
- Order creation date
- Event instance date
- Number of tickets booked
- Total order value
- Ticket price
- Genre
- Venue
- Promoter
- Postcode
Use of Data
We will use your information for the purposes listed below under one of the following lawful bases:
- Performance of a contract between us and you
- To comply with a legal obligation
- Our legitimate interests (except where such interests are overridden by the interests, rights, or freedoms of the individual)
The ways in which we use your data are listed below:
| Purpose | Lawful Basis |
|---|---|
| Keep a record of the relationship we have with participating organisations | Legitimate interests |
| Keep participating organisations informed of any updates to the Culture Key platform | Performance of a contract |
| Store, process, analyse, and visualise aggregated data from our participating organisations | Legitimate interests |
| Share aggregated audience data with our participating organisations | Legitimate interests |
| Promote our work to funders, supporters, and the public via media and social media outlets | Legitimate interests |
| Assist us with reporting and analysis for our own business needs, and those of our funding partners | Legitimate interests |
| Respond to queries, complaints, and feedback received via post, email, telephone, social media, or in person | Legitimate interests |
| Ensure compliance with policies, procedures, and laws | Legal obligation |
Sharing Your Data With Third Parties
We may collaborate with partners and academics in the cultural sector to conduct further analysis of the dataset and provide additional commentary and insights. We may also share these findings with industry bodies to support policy and decision-making. Only aggregated data will be shared – no individual participating organisation's data will be disclosed.
Unless you give us your consent, the personal information that you give us will only be shared with third parties where we are obliged or permitted by law to disclose it, we need to use the services of ‘data processors’ to process your data, or for reporting to our funders.
The personal data that we hold may be transferred to and subsequently processed by external companies. For example, personal data may be stored securely in the cloud on servers belonging to third-party suppliers. Where third-party suppliers have such access, we ensure that proper controls and contracts are in place to regulate how those suppliers manage the personal data to which they have access. Where these companies run their operations outside of the United Kingdom, we take steps to make sure they provide an adequate level of protection in accordance with UK data protection laws by requesting and checking their data policies and associated documents.
If required we may need to pass your details to the police, regulatory bodies, or legal advisors.
Keeping Your Data Secure
Data is stored and processed in our database (UK-based Supabase cloud database).
We take every precaution to protect your personal data, and we hold regular security reviews to ensure that our website is safe and secure for your protection.
Your data is processed in secure systems and digital environments. Only authorised and trained employees and approved contractors/developers are granted access to personally identifiable information. This will be from time to time, and only when they need to perform a specific job or task.
How Long We Keep Your Data
Participating organisations
We will retain the personal data of users from participating organisations for as long as they actively use the platform. If an organisation discontinues its use, we will keep the user's first name, last name, and email address for one year, after which the personal data will be permanently deleted. Only non-personal, organisational data will be retained beyond that point.
Audiences
The only personal data we receive is postcodes, which are shared without any names, addresses, or other identifying details – so the data remains anonymous and cannot be linked back to individuals. All submitted audience data are stored for the life of the Culture Key platform after which point aggregated data will be archived for future statistical use.
Giving You Control
Your Individual Rights
Under data protection laws, you have rights including:
Right to be informed
You have the right to be informed about the collection and use of your personal data, which is what we do in this Privacy Policy.
Right of access
You have the right to request to access and receive a copy of your personal information and other supplementary information. This is also known as a Subject Access Request.
Right to rectification
You are entitled to have inaccurate personal data rectified or completed if it is incomplete.
Right to erasure
You have the right to have your personal data erased. Also known as the ‘right to be forgotten,’ this right is not absolute and only applies in certain circumstances.
Right to restrict processing
You can request the restriction or suppression of your personal data.
Right to data portability
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
Right to object
You have the right to object to the processing of your data in certain circumstances.
Rights in relation to automated decision making and profiling
The UK GDPR has provisions on automated decision making and profiling. If you are an audience member and want to opt out of your data being included in postcode mapping or profiling, please contact the participating organisation you shared your data with – they are responsible for managing your data and can help with your request.
If you wish to exercise any of your individual rights, please contact us using the details listed at the beginning of this Privacy Policy. We will respond to requests within thirty days.
How to Update Your Personal Data
Participating organisations can update their personal data in their online user account or by emailing nigel@polymathic.agency.
How to Make a Complaint
If you wish to make a complaint about how we are using your data, please email nigel@polymathic.agency.
Where you take the view that your personal data is processed in a way that does not comply with the UK GDPR, you have a specific right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at:
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Updates to This Policy
We may change or update this Privacy Policy from time to time. Any significant changes will be communicated on our website or by contacting you directly.
Last updated: 30 September 2025