Privacy Policy

The Leeds International Piano Competition (“we”, “us”, “the Competition”) is the data controller responsible for your personal data. 

• Registered charity number: 1073251 

• Registered company number: 3518157 (England and Wales) 

• 169B Woodhouse Lane, University of Leeds, LS2 3AR 

• ICO (Information Commissioner’s Office) registration number: ZA774826 

Data protection queries: [email protected] 

This notice explains how we collect, use, share and protect your personal data when you visit this website, attend our live events, enter or support the Competition, or join our mailing list. Most of the information we hold comes directly from you and, where required, with your consent. 

By attending an event organised by the Leeds International Piano Competition, you acknowledge that photography, audio and video recording may take place, and that your image, voice or name may be used, published or broadcast for purposes connected with the Competition and our broadcast channels and partners, which have recently included YouTube, BBC Radio 3, BBC Four, medici.tv, Amadeus.tv, mezzo.tv and ClassicFM. This may include use on our website, social media, in news coverage and in advertising. 

We rely on our legitimate interest in promoting the Competition as the legal basis for this recording, rather than consent, because attendance at a public performance event makes recording unavoidable. You retain your data protection rights in relation to this footage, including the right to object; where we are not legally or contractually required to retain footage (for example, for broadcast or archival purposes already agreed with a partner), we will consider objections on a case-by-case basis.

Competitors and Junior Members under 18: where a young person’s image or data is recorded, we ask a parent or guardian to confirm consent as part of the entry or membership process. Parents/guardians may contact us at any time to discuss how their child’s data is used. 

We process personal data under one of four legal bases: your consent, our legitimate interests as an arts charity, performance of a contract (for example, ticket or membership purchases), or a legal obligation (for example, financial record-keeping). We may use your information to: 

Our Junior Membership scheme is open to young people under 19. Where we collect data directly from someone under 13, we require verifiable parental consent before processing it, in line with UK GDPR’s protections for children’s information society services. Parents and guardians can review, amend or delete their child’s data at any time by contacting us. 

Mailing lists 

Where you provide an email address for our mailing lists, this is shared with Mailchimp and Beacon CRM to manage sends and supporter records. See Mailchimp’s privacy policy for details. We do not share your data with any other third party for marketing purposes. 

Legitimate interest 

As an arts charity, we may send you information by post about news, events, services, offers and opportunities to support the Competition, relying on our legitimate interest to do so. 

Donations 

You can donate securely via our join and support page. Transactions are encrypted and processed through our third-party provider, Beacon CRM. We retain donation and Gift Aid records for as long as required by HMRC and the Charity Commission (see the retention table in section 8). 

As with most websites, our hosting provider automatically logs technical information such as your IP address, browser type and the pages you visit, used to understand server usage and to aid detection in the event of a security incident. 

Comments 

Comments include the data shown in the comment form, plus your IP address and browser user-agent string, used for spam detection. An anonymised hash of your email address may be checked against the Gravatar service; see the Gravatar privacy policy. Once a comment is approved, any associated profile picture is publicly visible. 

Cookie consent 

When you first visit this site, you’re shown a cookie banner offering ‘Accept all’ and ‘Reject non-essential’ options with equal prominence, plus a link to manage preferences at any time. Non-essential cookies (analytics, embedded media) are only set once you’ve given consent. 

Analytics 

This site uses Google Analytics 4 (GA4) to understand visitor numbers and behaviour. See Google’s privacy policy for details. 

Embedded content 

Pages may include embedded content (videos, audio, images, social posts). Embedded content behaves as if you had visited the source site directly, and that site may set its own cookies and track your interaction, including if you’re logged into an account there. 

We don’t share personal data with third parties without a valid legal basis or your consent. Optional activities — commenting, donating, joining our mailing list — involve sharing as described above. 

Some of our processors store or process data outside the UK. Where this happens, we rely on safeguards such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with a UK Addendum, as required by UK GDPR: 

Registered site users can see, edit or delete their profile information at any time, except their username. Website administrators can also view and edit this information.

We follow the ICO’s guide to individual rights under UK GDPR. You have the following rights over your personal data: 

To exercise any of these rights, email [email protected]. We aim to respond within one calendar month. If you’re unhappy with how we’ve handled your personal data, please contact us in the first instance so we can look into it — we’ll acknowledge your complaint promptly and respond without undue delay. You’re also entitled to complain directly to the Information Commissioner’s Office at any time, whether or not you’ve raised the matter with us first.

Where a personal data breach is suspected or confirmed, Leeds International Piano Competition will: 

1. Contain the breach by taking immediate steps to prevent further unauthorised access, disclosure or loss of personal data. Where the breach relates to a third-party processor, liaise with that organisation to understand the incident and any containment measures already taken. 

1. Assess the breach, recording: 

• the date and time the organisation became aware of the incident; 

• the nature of the breach; 

• the categories and approximate volume of personal data involved; 

• the likely impact on individuals; 

• any immediate mitigating actions. 

1. Record the incident in the organisation’s Data Breach Register, including all decisions taken, actions completed and communications made. 

1. Notify the ICO without undue delay and, where required, within 72 hours of becoming aware of a reportable personal data breach. 

1. Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. 

1. Review the incident once resolved, identifying lessons learned and any improvements required to policies, procedures, contracts or technical and organisational 

We review this notice periodically and will update the date below when it changes. Material changes will be highlighted on this page. 

Questions about this notice can be sent to the Administrator at [email protected]. 

Data Security Notice — August 2026

We’re aware of a data security incident affecting Beacon, a database platform used by us and many other organisations to manage supporter records.

What happened

In early August 2026, Beacon told us that compromised login credentials had been used to gain unauthorised access to their systems, and that a copy of customer database back-ups — including ours — was likely downloaded, though this hasn’t been definitively confirmed. Beacon is investigating with independent cyber-security experts and law enforcement, and has found no evidence so far that any data has been shared or misused.

What this means

No payment card, bank, or Direct Debit details were affected — these are held securely and separately by our payment providers, Stripe and GoCardless, and were not part of this incident. We’ve assessed the data held in Beacon and, where we believe someone may be at meaningful risk, we are contacting them directly by email.

Verifying contact from us

If you’ve received an email from us referring to this incident, it is genuine. As a general precaution, please treat any unexpected email, call, or text asking you to confirm or update payment details with suspicion, and contact us directly using the details below if you’re ever unsure.

What we’ve done

We reported this to the Information Commissioner’s Office (ICO) as soon as we were told, and have reset the passwords and access credentials connected to our Beacon account. We remain in direct contact with Beacon as their investigation continues.

Questions

If you have any questions or concerns, please contact us at [email protected].