National Association of Schools of Theatre
Privacy Notice for Residents of the European Economic Area
This notice supplements the information contained in our online Privacy Policy and describes additional rights provided to residents of the European Economic Area (“EEA”) under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) with regard to the personal data that the National Association of Schools of Theatre (“we,” “us,” or “our”) collects and processes, whether online or offline.
Many of the services NAST provides are not directed to individuals outside the United States, but NAST does collect certain personal data from representatives of institutions outside the United States that elect to undergo a Substantial Equivalency evaluation. NAST may collect the types of personal data described in our Privacy Policy for the purposes described in the Privacy Policy. If you are a resident of the EEA and representative of an institution that undergoes a Substantial Equivalency evaluation, NAST’s collection and processing of your personal data is subject to the GDPR, and you have certain rights under the GDPR.
The GDPR requires that we inform you of the legal bases we rely on to process your personal data (referred to in our Privacy Policy as “personal information”). Personal data means any information about an identified or identifiable natural person. The legal bases for processing are set forth below.
- Our legitimate interests. For example, to perform a contract with the institution that you represent, maintain system security, communicate with you, process orders and payments and fulfill your requests, respond to your inquiries, conduct surveys, administer and improve our products and services, and protect your rights, our rights and our business and the rights of others.
- Compliance with laws. For example, to comply with legal and regulatory requirements or respond to a court order or legal request.
- Consent. For example, we obtain consent to send you commercial email marketing messages. Where we rely on consent to process your personal data, you can withdraw your consent at any time, however the withdrawal of consent does not affect the lawfulness of processing before the withdrawal.
As NAST is an association based in the United States, by using NAST’s services you acknowledge that your personal data will be transferred to, and further processed in, the United States. In addition, we may share personal data with service providers and third parties located outside of the EEA.
We will keep your personal data in a form that permits us to identify you as a data subject for no longer than necessary for the purposes for which the personal data was gathered, and in all cases no longer than until you withdraw your consent (if consent is the legal basis for processing of data) or object to processing your data (if you have such a right and we cannot demonstrate compelling legitimate grounds to keep processing your personal data).
The GDPR provides residents of the EEA certain rights with respect to their personal data. You may (with some exceptions):
- Request access to your personal data (including to obtain confirmation as to whether or not your personal data is being processed, obtain additional details about the data being processed, and obtain a copy of such personal data);
- Request correction of your personal data;
- Request erasure of your personal data;
- Object to processing of your personal data; and
- Request to restrict processing of your personal data.
You can exercise these rights by sending an email to info@arts-accredit.org with a description of your request. We will endeavor to fulfill your request to exercise these rights, but we may have legal grounds or obligations to reject your request. We will respond within one month after we have verified that you are the data subject or are authorized to make the request on behalf of the data subject. If necessary, we may extend our response time by an additional two months to respond properly, but we will notify you if that is the case within one month.
If we decide not to fulfill your request, we will tell you the reasons why. If you disagree with our response to your request, you have the right to lodge a complaint with a data protection regulator in Europe. Should you have any concerns, we request that you contact us first so we can investigate, and hopefully resolve, your concerns.
Thank you.