Privacy Notice

Campbell Young Associates are committed to protecting your privacy and ensuring that your personal information is collected and used appropriately, lawfully, and transparently. This Privacy Notice explains:

Who we are
What personal information we collect
Definition of personal information and processing
Data protection principles
Our legal basis (grounds) for using personal information
How we use your personal information
Who we share your information with and why
How we keep your information secure
How long we keep your information
Your Data Protection rights
How to contact us
How to complain
Changes to this Privacy Notice

1. Who we are

Campbell Young Associates create outstanding hair, wigs and makeup for theatre, opera, film, and television. Our reputation for excellence has led us to become one of the most prestigious names in the industry.

Designing for first class theatrical productions in London’s West End and on Broadway, with wig making studios in the UK and the US, we produce made-to-measure, handmade human hair wigs, hairpieces, and facial to order.

We comply with GDPR regulations in the UK and extend our commitment to data protection and privacy to cover our work in the US and worldwide.

Campbell Young Associates determines the purposes and means of processing personal data relating to providing its services. This means we are the data controllers for these core services and therefore responsible for managing this data and ensuring compliance.

2. What personal information we collect

Personal information is any information that relates to you that can be used directly or indirectly to identify you. This can include your name, address, email address, phone number, images or other information that is not otherwise publicly available.

We collect personal information about you when you contact us about our services by email, phone or in person, or when you meet with us for hair and makeup consultations and wig fittings.

We do not place cookies on your device when you visit our website, we do not use Google analytics to track your activity on our website, and we do not have a contact form on our website.

The type of personal information we collect about you will depend on the purpose for which it is collected, but you can ask us at any point what information we hold about you, this is covered in section 10.

3. Definition of personal information and processing

Personal information and processing are defined as follows:

Personal data is information relating to an identifiable person, i.e. can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person (UK GDPR article 4)
Special categories of personal data means information about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation and biometric/genetic data (GDPR article 9)
Processing means any set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction (GDPR article 4)

4. Data protection principles

We process personal data in accordance with the following data protection principles:

We process personal data lawfully, fairly and in a transparent way
We collect personal data only for specified, explicit and legitimate purposes
We process personal data only where it is adequate, relevant, and limited to what is necessary for the purposes of processing
We keep accurate personal data and take all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay
We keep personal data in a form which permits identification from personal data for no longer than is necessary for the purpose of the processing or, if for longer periods, for such reasons as permitted by the GDPR
We adopt appropriate measures to make sure that personal data is secure, and protected against unauthorised or unlawful processing, and accidental loss, destruction, or damage

We will not process personal data of individuals for reasons other than the stated purpose or purposes.

Where we process special categories of personal data to perform obligations, this is done in accordance with a policy, or for legal reasons. We will update personal data promptly if an individual advises that his/her information has changed or is inaccurate.

5. Our legal basis (grounds) for using personal information

There are several reasons why we hold, process, and share personal data. Under data protection laws, the lawful reasons for processing personal data include:

Consent – you can remove your consent at any time by contacting our Data Protection Leads, whose contact details are at the end of this Privacy Notice
We have a contractual obligation – for the performance of a contract
We have a legal obligation – to comply with a legal or regulatory obligation
We have a vital interest – to protect the vital interests of yourself or another person
We need it to perform a public task – a task carried out in the public interest
We have a legitimate interest – a legitimate interest for yourself or one of the organisations you/we share data with (e.g. legal adviser) except where those rights are overridden by the interests or fundamental rights and freedoms of the data subject which require protection, particularly in the case of a child

Sometimes the handling of personal data may fall within several of the above lawful grounds, most frequently based on consent, contractual obligation on the basis there is a contract with you or your employer to do so.

6. How we use your personal information

We use the information that we hold in order to support and maintain our contractual relationship with you or your employer, and to comply with legal and regulatory requirements. This includes providing our services to you and any related activities required or requested. We also process your data for specific business purposes to enable us to give you the best support services and the best experience. You have the right to object to this processing if you wish, please see ‘Your Data Protection Rights’ section.

Our business purposes include the following:

To ensure that we deliver outstanding hair, wigs and make-up based on the personal information we have collected from you or your employer
To meet our contractual obligations to you or your employer
To meet our regulatory requirements

7. Who we share your information with and why

We may also share your information with external third parties who perform tasks for us and help us to provide the services you require these include:

Colleagues and associates of Campbell Young Associates
Other organisations, including regulatory bodies, the police and fraud prevention agencies, to prevent and detect fraud
Third parties where required by law, court order or regulation; and/or as part of an acquisition or sale

8. How we keep your information secure

We are committed to ensuring the confidentiality of the personal information that we hold about you, and we continue to review our security controls and related policies and procedures to ensure that your personal information remains secure. When we contract with third parties, we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal information is kept secure.

If we work with third parties in countries outside the EU we ensure these are countries that the European Commission has confirmed have an adequate level of protection for personal information, or the organisation receiving the personal data has provided adequate safeguards. Data may be accessed outside of the EEA by our team in the US or when we travel for international productions. In these circumstances we ensure there are appropriate information security measures in place to safeguard your information.

We are registered with the Information Commissioner’s Office as a Data Controller. Our registration number is: ZB630067.

9. How long we keep your information

We keep your personal information only as long as is necessary for the purpose for which it was collected and to meet regulatory, audit or legislative requirements. Personal information will be securely disposed of when it is no longer required.

10. Your Data Protection Rights

Your right of access – you have the right to ask us for copies of your personal information
Your right to rectification – you have the right to ask us to rectify information you think is inaccurate. You also have the right to complete information if you think it is incomplete
Your right to erasure – you have the right to ask us to erase your personal information in certain circumstances
Your right to restriction of processing – you have the right to ask us to restrict the processing of your information in certain circumstances
Your right to object to processing – you have the right to object to the processing of your personal data in certain circumstances
Your right to data portability – you have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances

You are not required to pay any charge for exercising your rights. If you make a request we have one calendar month to respond to you.

Please contact Katherine Rich or Helen Armstrong, our Data Protection Leads at Campbell Young Associates, using the contact details below, if you wish to make a request.

11. Our contact details

Name: Katherine Rich
Email: admin@cyassocs.com

Name: Helen Armstrong
Email: studio@cyassocs.com

Address: Campbell Young Associates
First Floor, St Thomas Court
Thomas Lane
Bristol
BS1 6JG
Phone: +44 (0) 117 922 1971

12. How to complain

If you have any queries or concerns regarding the personal information that we hold about you then we request that in the first instance you contact us directly using the contact details above. However, you can also complain to the Information Commissioner’s Office if you are unhappy with our response or how we have used your data.

Name: Information Commissioner’s Office
Address: Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline No: +44 (0) 303 123 1113

13. Changes to this Privacy Notice

We keep this Privacy Notice under regular review, and we may from time to time, update or modify it as necessary. We will always post the latest version of our Privacy Notice on our website so please feel free to check back for the latest version should you need to.

This Privacy Notice was last modified on 20/12/2023.