Privacy Policy

The Leeds International Piano Competition Ltd (“we”, “us”, “the Competition”) is the data controller responsible for your personal data. 

Data protection queries: [email protected]

This notice explains how we collect, use, share and protect your personal data. It’s organised by who you are — website visitor, subscriber, donor, audience member, competitor, juror, volunteer or job applicant — so you only need to open the sections that apply to you. Most of what we hold comes directly from you; where it doesn’t, we say so.

By attending an event organised by the Leeds International Piano Competition, you acknowledge that photography, audio and video recording may take place, and that your image, voice or name may be used, published or broadcast for purposes connected with the Competition and our broadcast channels and partners, which have recently included YouTube, BBC Radio 3, BBC Four, medici.tv, Amadeus.tv, mezzo.tv and ClassicFM. This may include use on our website, social media, in news coverage and in advertising.

We rely on our legitimate interest in promoting the Competition as the legal basis for this recording, rather than consent, because attendance at a public performance event makes recording unavoidable. You retain your data protection rights in relation to this footage, including the right to object; where we are not legally or contractually required to retain footage (for example, for broadcast or archival purposes already agreed with a partner), we will consider objections on a case-by-case basis.

Where a young person’s image or data is recorded, we ask a parent or guardian to confirm consent as part of the participation or membership process. Parents and guardians may contact us at any time to discuss how their child’s data is used.

We process personal data under one of four legal bases: your consent, our legitimate interests as an arts charity, performance of a contract (for example, ticket or membership purchases), or a legal obligation (for example, financial record-keeping). We may use your information to:

Our Junior Membership scheme is open to young people under 19. Where we collect data directly from someone under 13, we require verifiable parental consent before processing it, in line with UK GDPR’s protections for children’s information society services. Parents and guardians can review, amend or delete their child’s data at any time by contacting us. 

What we do with your email address, and how to unsubscribe

When you subscribe, we collect your name, email address and any preferences you tell us about. We rely on your consent to send you email news and marketing, and you can unsubscribe at any time using the link in every email or by contacting us.

Your details are held in Mailchimp, which sends our emails, and in Beacon CRM, our relationship database of supporters, trusts and foundations, partner organisations, collaborators and event guests. We don’t share them with anyone else for marketing. As an arts charity we may also write to you by post about news, events and ways to support us, relying on our legitimate interest; you can ask us to stop at any time.

Donations, Gift Aid, membership, legacies and how we research supporters

Thank you. When you give to the Competition — as a donor, Patron or Member, sponsor, or by leaving a gift in your will — we hold what we need to process your gift, thank you properly and keep in touch about the difference your support makes.

What we collect and why

We tell you about other ways to support the Competition by post under our legitimate interest. By email, we keep in touch about our work, events and ways to support us where you gave us your email address as a donor, member or supporter and didn’t opt out at the time. UK law allows charities to do this, known as the charitable ‘soft opt-in’. You can opt out when you give us your details, every email includes an easy way to unsubscribe, and you can tell us to stop at any time. We recognise you publicly as a supporter only where you’ve agreed.

Donor research

To keep our fundraising proportionate and relevant, we may research existing and potential supporters using information you’ve given us and publicly available sources such as Companies House, the Charity Commission register, published rich lists, company websites and press coverage. We rely on our legitimate interest in fundraising effectively; we don’t make automated decisions about you, and you can object at any time by emailing us, in which case we’ll stop and delete the research.

Our fundraising forms

When you give or join through one of our online forms, we’ll ask you to confirm you’ve read this notice before you submit, and to choose how you’d like to hear from us. You can change those choices at any time. Our fundraising is regulated by the Fundraising Regulator and follows the Code of Fundraising Practice; you can also stop fundraising contact from us through the Fundraising Preference Service.

Ticket bookings, access and dietary needs, and the jurors, artists, volunteers and partners we work with

Tickets for Competition rounds and most of our events are sold through Leeds Ticket Hub (leedstickethub.co.uk), Leeds City Council’s box office, which is the data controller for your booking under its own privacy notice. It shares with us what we need to run the event and, where you’ve agreed, to keep in touch afterwards.

Where we handle tickets or registrations ourselves — free community events, talks, supporter receptions — we collect your name, contact details, your booking and any access or dietary requirements. Access and dietary information can reveal health or religious details, so we use it only to make the event work for you, share it only with the venue or caterer, and delete it within a month. We use booking data to deliver the event (contract), tell you about practical changes (legitimate interest) and invite you to future events where you’ve agreed.

Performances and events are photographed, filmed and broadcast — see our media notice in section 3.

For jury members, guest artists, host families, volunteers and our contacts at partner organisations, venues, funders and suppliers, we hold contact details, biographies and photographs, fee and payment details, accommodation and catering arrangements, and dietary and access needs. We use these to plan and run the Competition and our year-round programme (contract or legitimate interest), to pay you (legal obligation) and to credit and promote the people we work with, which we agree with you.

Volunteers may be asked for emergency contact details and, for some roles, a DBS check; we record the outcome, not the certificate.

Applications, pre-selection, what we publish and broadcast, and how long we keep applicants’ details

When you apply, we collect what you give us on your application: name, date of birth, nationality, contact details, biography, training and performance history, repertoire, references, your application recording, a photograph, and a copy of your passport or identity document to confirm eligibility. If you apply for a financial assistance bursary, the information needed to assess it. The IDEA monitoring form we invite you to complete is anonymous and isn’t linked to your application.

How we use it

The Competition runs on a three-year cycle and applicants who don’t progress are often eligible next time, so we keep applicants’ details for six years after the application deadline to invite you to apply again; you can object at any time. Finalists’ and prize-winners’ core records — name, edition, repertoire, results and recordings — form part of the Competition’s permanent archive.

Cookies, analytics and what the website collects automatically

As with most websites, our hosting provider automatically logs technical information such as your IP address, browser type and the pages you visit, used to understand server usage and to aid detection in the event of a security incident.

Cookie consent

When you first visit this site, you’re shown a cookie banner offering ‘Accept all’ and ‘Reject non-essential’ options with equal prominence, plus a link to manage preferences at any time. Non-essential cookies (analytics, embedded media) are only set once you’ve given consent.

Logging in: session and ‘Remember Me’ cookies as standard for WordPress account

Publishing: an editorial cookie for logged-in contributors, no personal data, expires after 1 day

Analytics

This site uses Google Analytics 4 (GA4) to understand visitor numbers and behaviour. See Google’s privacy policy for details.

Embedded content

Pages may include embedded content (videos, audio, images, social posts). Embedded content behaves as if you had visited the source site directly, and that site may set its own cookies and track your interaction, including if you’re logged into an account there.

YouTube – Privacy policy

medici.tv – Privacy policy

X (Twitter) – Privacy policy

Instagram – Data policy

The organisations that process data for us, and the few we share it with

We don’t sell your data or share it for other organisations’ marketing. We share personal data only where we have a lawful basis, with:

Information we obtain from sources other than you: public records used in donor research (section 7), Leeds Ticket Hub (section 8), and referees and background checks in recruitment.

We follow the ICO’s guide to individual rights under UK GDPR. You have the following rights over your personal data:

To exercise any of these rights, email [email protected]. We aim to respond within one calendar month. If you’re unhappy with how we’ve handled your personal data, please contact us in the first instance so we can look into it — we’ll acknowledge your complaint within 30 days and respond without undue delay. You’re also entitled to complain directly to the Information Commissioner’s Office at any time, whether or not you’ve raised the matter with us first.

We take appropriate technical and organisational measures to protect your data: we hold it in secure, access-controlled cloud systems (principally Beacon CRM and Microsoft 365) protected by multi-factor authentication, with access limited to staff who need it; we keep personal data off personal devices and minimise local copies; our website runs on a secure, regularly patched server with TLS encryption; we never hold full payment-card or bank details ourselves; and we train staff and trustees in data protection, keep a documented breach protocol (section 17) and record any incident in our Incident Log.

We review this notice periodically and will update the date below when it changes. Material changes will be highlighted on this page.

Questions about this notice can be sent to the Administrator at [email protected].

Data Security Notice — August 2026

We’re aware of a data security incident affecting Beacon, a database platform used by us and many other organisations to manage supporter records.

What happened

In early August 2026, Beacon told us that compromised login credentials had been used to gain unauthorised access to their systems, and that a copy of customer database back-ups — including ours — was likely downloaded, though this hasn’t been definitively confirmed. Beacon is investigating with independent cyber-security experts and law enforcement, and has found no evidence so far that any data has been shared or misused.

What this means

No payment card, bank, or Direct Debit details were affected — these are held securely and separately by our payment providers, Stripe and GoCardless, and were not part of this incident. We’ve assessed the data held in Beacon and, where we believe someone may be at meaningful risk, we are contacting them directly by email.

Verifying contact from us

If you’ve received an email from us referring to this incident, it is genuine. As a general precaution, please treat any unexpected email, call, or text asking you to confirm or update payment details with suspicion, and contact us directly using the details below if you’re ever unsure.

What we’ve done

We reported this to the Information Commissioner’s Office (ICO) as soon as we were told, and have reset the passwords and access credentials connected to our Beacon account. We remain in direct contact with Beacon as their investigation continues.

Questions

If you have any questions or concerns, please contact us at [email protected].