Privacy Policy

1. Introduction

The Privacy Policy of Alpha Wave MindArtAct clarifies the nature of personal data we gather, the way we manage the information you share with us, and your entitlements regarding that data.

We pledge to defend the privacy and discretion of your personal information and aim to ensure all personal information we hold is handled following the standards of the General Data Protection Regulations (GDPR)

2. Organization Details

Name: Hear the Light LdaAddress: Calçada Marques de Abrantes 95, 1DZip Code: 1200-718City: LisboaCountry: PortugalTax Identification Number: NIF /PT516529854

Contact Email: sofia@alphawaveexperience.com

3. Contacting us

Please email us at sofia@alphawaveexperience.com if you would like to:

Update or opt-out of receiving marketing communications;
Make an inquiry about data protection or modify the way we process your information;
Request access to the information we have about you; or
Express a concern regarding the use of your personal information.

For more information about your rights to access, modify, or delete your data, as well as our complaints process, see below.

This privacy notice provides information on:

The methods of collecting, storing, using, disclosing, retaining, and destroying personal data;
The measures we take to ensure the proper protection of the personal data we process; and
The rights individuals possess when their personal data is processed by us.

We will handle the information you share with us confidentially, and we will not disclose it to third parties unless required by law or as detailed in this privacy notice.

Data Collected Through Our Website

We collect data about website usage to aid in the development and enhancement of our services for the public and to safeguard the integrity of our systems from malicious users. Additionally, we gather information through various features on the site that enable you to share information with us (such as online forms and live-chat functionality) for the purposes outlined later in this privacy notice. Currently, this information includes:

Data gathered by our content management system to analyze user search patterns, what they discover, and instances when no results are found, without identifying individual users;
Information submitted by users via online forms (and live-chat features, which may identify individual users and others based on the information provided by users (we may access information you input in an online form even if you don't submit it, due to the website's automatic saving of partially completed forms at intervals);
Anonymous statistical data obtained using Google Analytics (for more information, refer to the 'How do we use cookies?' section of this privacy notice);
Your IP address and browser details, recorded when you utilize our online forms; and
Your IP address, employed to determine your location if you access any geo-location features on our website, which we use only to display relevant content and do not store or share with third parties.

We have implemented a Cookie Bot plugin on our website, allowing you increased control over cookies and the areas for which you'd like to grant consent.

4. Definition of Personal Data

Personal data refers to any information we manage that pertains to an identified or identifiable individual. An 'identifiable individual' is someone who can be recognized, directly or indirectly, from the information, which may include a name, identification number, location data, online identifier, or one or more factors specific to the individual's physical, physiological, genetic, mental, economic, cultural, or social identity.

5. Categories of Personal Data We Process

We collect personal information directly from you when you engage with us, and the data we gather varies based on the experiences or services you access. Commonly, we collect your name, contact information, address, and access requirements when you:

Request information;
Subscribe to our mailing list;
Send us an email;
Reserve a ticket for an event;
Fill out a pre-booking form;
Participate in an online survey;
Utilize digital tools during an event; and/or

To protect minors (under 16) participating in our programs, provide facilities and access equipment, and for equality monitoring purposes, we may collect additional information. If special category data is needed, we will seek explicit consent.

We may collect information in person, over the phone, via our website, social media, mobile devices, or from correspondence you send to us. The types of personal data we process depend on the purpose, and we strive to process only the minimum amount of personal data necessary for the relevant purpose. You should not assume we hold personal data in all identified categories for every individual whose data we process. Occasionally, we may gather personal data in other categories for the purposes described. We will specify the categories and reasons for using your personal data before requesting your explicit consent on a case-by-case basis.

6. Under what circumstances do we share your personal data?

We pledge to take all reasonable measures to secure your information and will only share it with partners, suppliers, or professional agents working on our behalf, such as when an event is conducted in collaboration with them. We will share your personal information with these partners and their subcontractors for the purpose of delivering a service you have requested or subscribed to. We will only share information with them if we are confident in their ability to protect it, and have a contract in place that ensures this.

We will disclose your information only to companies that act as 'data processors' on our behalf, some of which may be outside the Portugal
We will share your details for marketing purposes only if you have explicitly consented to do so. We will never sell your personal information to any third-party organization.
We may need to disclose your information if required by law enforcement, regulatory bodies, or legal advisors.
We will only share your data under other circumstances if we have your explicit and informed consent.

Some third-party organizations collect information on our behalf and for their own use. We may receive your personal details from other organizations for marketing or monitoring purposes, provided you have consented to this information being shared. These organizations have their own data protection and privacy policies, and your consent should be considered in reference to both policies.

We may also utilize other companies to deliver experiences or services and process your personal data on our behalf, including sending postal mail, making phone calls, sending emails, sending SMS messages, processing card payments, and analyzing our supporter information as outlined above. This helps us offer you communications tailored to your interests. In some instances, our suppliers may use software that analyzes publicly available information to build a profile about you based on the factors outlined in the 'Targeting our communications and researching our supporters' section.

7. Additional information on our direct marketing approach

You can express your preferences regarding receiving direct marketing from us. Each time we contact you, you will be given the option to indicate that you no longer wish to receive our direct marketing materials. Upon receiving proper notification from you, we will take measures to cease using your information for this purpose.

8. Utilizing your information

We employ your data, both personal and anonymous, in the following ways:

Delivering requested experiences or services;
Communicating with you;
Determining if you've completed a pre-booking form for certain events;
Sharing marketing materials;
Gaining audience insights, improving existing experiences, or developing new ones;
Raising awareness of our work and ways you can support it;
Assessing the efficacy of our digital marketing; and/or
Contributing to scientific research.

8.1 Providing a booked experience

We offer various experiences and services for which you've provided information to us.

We also utilize information to manage your participation in a project or event.

8.2 Communication

We communicate with you in numerous ways. We use information you've given to:

Contact you by phone, text, email, and/or mail about our activities, promotions, and events according to your preferences;
Send service emails, such as confirmations, time changes, or cancellations;
Request your response to surveys;
Notify you about events or projects that may interest you, if you've opted in;
Respond to inquiries, comments, compliments, or complaints, keeping a record for potential follow-ups, disputes, or investigations;
Notify you of significant policy changes that may affect you;
Invite you to engage with us in new ways; and/or
Update you on a program for which you've registered.

8.3 Sharing marketing materials

We may share marketing materials with you, including information about our activities, news, events, and ways to get involved, as long as you have consented.

You can update your preferences or opt-out at any time. Use the contact details section or the unsubscribe link in our e-newsletters.

We retain your personal information for as long as necessary, reviewed every 4 years. If requested, we will either keep basic information on a suppression list to avoid future unwanted contact or delete your information entirely.

8.4 Audience Insights and experience improvement

We research and analyze our audiences, such as event attendees and project participants, to better understand them and improve our communications.

We also analyze our experiences, services, and projects to improve performance and create better experiences for you.

8.5 Communications targeting and supporter research

We aim to send efficient, effective messages. To determine the recipient, content, and timing, we engage in:

Email analysis – We track sent emails to gauge response rates and identify messages that resonate with specific groups, logging interactions such as email opening, deletion, and link clicks; and
Segmentation – By analyzing information like postcodes and regular interaction, we can tailor appropriate communications.

9. Retention of personal data

We retain your personal data for as long as necessary for the specific purpose or purposes for which it is held.

Your data is always stored securely.

We use Customer Relationship Management systems and access is strictly controlled by those who require it for their job.

Some data, such as sensitive information or data related to minors, has additional controls and is only visible to staff members with a valid reason to access it. We also protect your personal information through various means, including secure servers, firewalls, and SSL encryption.

Right to Data Portability: You have the right to obtain and reuse your personal information for your own purposes, transferring it from one environment to another. This right applies only to personal data provided by an individual, where the processing is based on their consent or the performance of a contract, and when that processing is done using automated means. To discuss this right, please use the contact details provided in this privacy notice.

Right to Object: You have the right to object to:

processing based on legitimate interests or performance of a task in the public interest and/or exercise of official authority;
processing your information for scientific and historical research and statistics; and
direct marketing.

Any objection must be based on grounds related to your particular situation. To exercise your right to object, please use the contact details provided in this privacy notice.

10. Photography and Film Usage

AlphaWave Mind ART may want to record a project or event for archiving, marketing, publicity, or other materials and communications in any medium. When photography and film are used in the public domain, signs will be displayed to inform the public that recordings are being made. In cases where photography and filming occur in a closed event (e.g., a workshop setting), explicit consent will be obtained from participants, accompanied by a clear explanation of the purpose of the photography and filming and where it will be used.

11. Legal Basis for Contacting You and Using Your Personal Information

When you sign up for a newsletter or opt-in to our communications through our forms (e.g., email subscription) or in person/over the phone, you are giving your consent for us to send you marketing materials using the methods you have chosen (e.g., email or phone call). We will never send you information by email or SMS without your consent, and you can withdraw your consent at any time.

If you have provided us with your postal or telephone contact details but haven't specifically opted-in to receive our communications (for example, event marketing or making a donation by post), we will carry out an assessment to determine if it would be fair and reasonable to use them to send marketing information to you without your explicit consent. This is called a 'legitimate interests assessment'. You can opt-out of our marketing communications at any time if you don't want to receive them.

We will ensure we have a legal basis to use your personal information for the other purposes mentioned in this policy (usually with your consent, following a legitimate interests assessment, or because the use of your data is necessary to comply with a legal obligation).

13. CCTV

CCTV is in use to view and record audience members in and around the Alpha Wave Mind ART experience in order to maintain a safe environment for staff and audiences, help respond to health issues, capture images for research purposes, and assist in the effective resolution of any disputes. Alpha Wave Mind ART recognizes that the images of individuals recorded by CCTV cameras are personal data that must be processed in accordance with data protection legislation and has registered its use of CCTV with the Information Commissioner.

Camera locations are chosen to minimize viewing of spaces not relevant to participation in the project. CCTV systems will not be used to record sound.

Images are monitored by authorized personnel and contractors who have been given appropriate training to ensure they understand and observe the legal requirements related to the processing of relevant data. We will provide signage at the venue to remind you that CCTV is in operation.

We will ensure that data gathered from CCTV cameras is stored in a way that maintains its integrity and security. This may include encrypting the data, where it is possible to do so.

Given the large amount of data generated by CCTV systems, we may store video footage using a cloud computing system. We will take all reasonable steps to ensure that any cloud service provider maintains the security of our information, in accordance with industry standards.

We may engage data processors to process data on our behalf. We will ensure reasonable contractual safeguards are in place to protect the security and integrity of the data.

We may share data with our research organizations, in accordance with written data sharing agreements.

Data from CCTV cameras will not be retained indefinitely but will be permanently deleted once there is no reason to retain the recorded information. Exactly how long images will be retained for will vary according to the purpose for which they are being recorded. For example, where images are being recorded for the monitoring of participants' health, data will be kept long enough only for incidents to come to light. Any CCTV recordings may be retained for research purposes for the full period of the research project. In all other cases, recorded images will be kept for no longer than 30 days. We will maintain a comprehensive log of when data is deleted.

At the end of their useful life, all images stored in whatever format will be erased permanently and securely. Any physical matter such as tapes or discs will be disposed of as confidential waste. Any still photographs and hard copy prints will be disposed of as confidential waste.

In other appropriate circumstances, we may allow law enforcement agencies to view or remove CCTV footage where this is required in the detection or prosecution of crime.

No images from CCTV will ever be posted online or disclosed to the media.

Data subjects may make a request for disclosure of their personal information, and this may include CCTV images (data subject access request). A data subject access request is subject to the statutory conditions from time to time in place and should be made in writing.

14. What are your rights regarding the personal data that we process, and how can you exercise them?

You have several rights that you can exercise in relation to the personal data we process about you. You do not have to pay to exercise your rights (apart from a reasonable fee if a request for access is clearly unfounded or excessive, but we agree to fulfill it anyway). We may sometimes need to request specific information from you to help us confirm your identity and ensure your authority to exercise these rights.

Right of Access: You can request access to the personal data we hold about you free of charge. Typically, we will provide it within one month of receipt of your request unless an exemption applies. You can request access to your personal data using the contact details provided in this privacy notice.

Right to be Informed: You have the right to be informed about how we obtain your personal information, how we use, retain, and store it, and who we share it with. This privacy notice provides that information and also informs you of your rights under the relevant laws.

Right to Rectification: If we hold personal data about you that is inaccurate or incomplete, you have the right to ask us to correct it. You can request that we correct your personal data using the contact details in this privacy notice. We will respond within one month unless the request is complex.

Right to Request Erasure: Under certain circumstances, you have the right to ask us to delete your personal data to prevent its continued processing when there is no justification for us to retain it. The circumstances most likely to apply are:

when retaining your personal data is no longer necessary concerning the purpose for which we originally collected and processed it; and
when you withdraw your consent for us to hold your personal data if we are relying on your consent to hold it.

Right to Restrict Processing: Under specific circumstances, you have the right to ask us to restrict the processing of your personal data. This may apply in cases where:

you are contesting the accuracy of your personal data while we are verifying its accuracy;
your information has been unlawfully processed, and you oppose its erasure and have requested a restriction instead; or
we no longer require your personal data, but you need it to establish, exercise, or defend a legal claim and do not want us to delete it.

You can ask us to restrict the processing of your personal data using the contact details in this privacy notice.

17. Date of last update and changes

We last reviewed this privacy notice in April 2023. We keep this privacy policy under regular review and update it if any of the information in it changes.

‍