sundown festival • norwich • 2–4 september 2022

COVID-19 Privacy Policy

Test and Trace

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, we have been requested to collect and keep a limited record of staff, guests and visitors who come onto our premises for the purpose of contact tracing.
By maintaining records of staff, guests and visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to the coronavirus.
As an audience member at Sundown Festival you may be asked to provide some basic information and contact details. The following information will be collected:

  • The names of all ticket holders
  • A contact phone number ticket holder
  • Date of visit and arrival time and departure time

Sundown Festival Limited, as the data controller for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information. When that information is requested by the NHS Test and Trace service, the service would at this point be responsible for compliance with data protection legislation for that period of time.
The NHS Test and Trace service as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the venue/establishment, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.
NHS Test and Trace asks us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. We will only share information with NHS Test and Trace if it is specifically requested by them.
For example, if another audience member at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of audience details for a particular time period (for example, this may be all audience members who visited on a particular day or time-band, or over a 2-day period).
We will require you to pre-book appointments for activities or to complete a form on arrival.
Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing, it will be destroyed by us 21 days after the date of your visit.
However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name, date of birth and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.
Your information will always be stored and used in compliance with the relevant data protection legislation.
The use of your information is covered by the General Data Protection Regulations Article 6 (1) (c) – a legal obligation to which we as a venue/establishment are subject to. The legal obligation to which we’re subject, means that we’re mandated by law, by a set of new regulations from the government, to co-operate with the NHS Test and Trace service, in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus.

COVID-19 Ticket Policy

If you are unable to attend Sundown Festival or are required to self-isolate, under our COVID-19 Ticket Policy, you may be eligible to rollover your ticket to another event or apply for a refund. In checking your eligibility, we may ask you to provide supporting evidence in order to ensure your application is valid. The following information will be collected from affected ticket holder(s):

  • Full name
  • Contact details including phone number and email address
  • Age
  • Address
  • Ticket details including reference number and ticket type
  • Date of visit and arrival time and departure time
  • The following information may be collected from affected ticket holders (where applicable):-
  • Officially recorded results of NHS COVID-19 tests (Lateral Flow and PCR)
  • Officially recorded self-isolation status from NHS Test and Trace
  • Proof of identity
  • Proof of address
  • Such other information as we reasonably require to process your application

Sundown Festival Limited, as the data controller for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information.
Under Article 6 of the of the GDPR, the legal bases for which Sundown Festival will collect this information is:
b) Performance of a contract in order to honour the COVID-19 Ticket Policy with our customers;
c) To comply with legal duty of care owed to staff and customers
f) Legitimate interests (implementation of reasonable measures to reduce risk of transmission of Covid-19 and provide reassurance to Event attendees of Covid-19 safety of the Event)
Any health data collected is done so under GDPR Article 9(i), Public health condition for the processing activity. Sundown Festival will not disclose any such special category data and it will be securely stored with extremely limited access and subsequently destroyed as soon as possible once the verification process has been satisfied.

General

Your data may occasionally be processed and held by third parties outside the European Economic Area (EEA).
Whereas in the UK and EEA, we implement a high standard of data protection law, some parts of the world do not implement such stringent laws. As a result, if we do send personal information overseas we will make sure that appropriate safeguards are in place to ensure it is protected in accordance with UK and European data protection laws.
By law, you have a number of rights as a data subject, such as the right to be informed, the right to access information held about you and the right to rectification of any inaccurate data that we hold about you.
You have the right to request that we erase personal data about you that we hold (although this is not an absolute right).
You have the right to request that we restrict processing of personal data about you that we hold in certain circumstances.
You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again this right is not absolute).