Calico Libraries

1. Who we are

Calico Projects is a registered CIO charity (charity number 1180229), also known as Calico Libraries. We run four community libraries in the London Borough of Lewisham: Forest Hill, Manor House, Sydenham and Crofton Park, in partnership with Lewisham Library & Information Service and Lewisham Council.

We are the Data Controller for the personal data we collect through our websites and services.

 

2. How to contact us about your data

Our Data Protection Officer (DPO) is responsible for overseeing questions about this privacy notice. If you have any questions, including any requests to exercise your legal rights, please contact:

 

Data Protection Officer: Simon R N Higgs, CEO

Address: Calico Projects, Manor House, 34 Old Road, Lewisham, London SE13 5SY

Email: contact@calicoprojects.com

Telephone: 020 8463 0420

 

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

 

3. What personal data we collect and why

Website contact forms

When you contact us via our website contact forms, we collect your name, email address and the contents of your message. We use this to respond to your enquiry. Our legal basis is legitimate interests — it is in both our and your interest to be able to respond to enquiries effectively.

Volunteer applications

When you apply to volunteer with us, we collect your name, contact details, availability, relevant experience and, where required for certain roles, information about criminal convictions for DBS check purposes. We use this to assess your suitability and manage your volunteering relationship with us. Our legal basis is legitimate interests and, for DBS data, legal obligation.

Studio and room hire enquiries

When you enquire about or book a studio or community room, we collect your name, organisation (if applicable), contact details and payment information. We use this to process your booking and maintain our records. Our legal basis is the performance of a contract.

User surveys

If you complete one of our library user surveys (including those hosted via Google Forms), we collect the responses you choose to provide. Surveys are voluntary and may be anonymous. Where you provide personal data, our legal basis is legitimate interests — to improve our services.

Email communications and newsletters

If you have asked to receive updates from us, we will use your email address to send you relevant news, events and information about our libraries. Our legal basis is consent. You may unsubscribe from any email communication at any time by contacting us at contact@calicoprojects.com.

CCTV

CCTV cameras are in operation at all of our library and studio premises. Signage is displayed at all locations to inform visitors that CCTV is in use. CCTV is used solely for the prevention and detection of crime and is governed by the Data Protection Act 2018. Our legal basis is legitimate interests (security of our premises and the people within them). CCTV footage is retained for a maximum of 31 days unless it is needed in connection with a specific incident.

Employment and contractor records

If you apply for a job or work with us as a contractor, we will collect and process personal data about you as part of the recruitment and employment relationship. This is subject to a separate staff privacy notice available on request.

 

4. Cookies

Our websites use cookies — small text files placed on your device — to help them function and to understand how people use them. We use:

  • Essential cookies, which are necessary for the website to function and cannot be switched off.
  • Analytics cookies (e.g. Google Analytics), which help us understand how visitors interact with our site so we can improve it. These are only placed with your consent.

 

When you first visit our site, you will be asked to accept or decline non-essential cookies. You can change your cookie preferences at any time via the cookie settings link in our website footer, or by adjusting your browser settings.

 

5. Who we share your data with

We do not sell or rent your personal data to third parties. We may share your data with:

  • Lewisham Library & Information Service and Lewisham Council, where this is necessary as part of our service level agreements and partnership arrangements.
  • Emergency services or Lewisham Council’s antisocial behaviour team, where CCTV footage or other data is relevant to a specific incident.
  • Service providers who process data on our behalf (e.g. our website host, email platform, Google Forms), who are required to keep your data secure and may not use it for their own purposes.
  • Regulatory authorities, including the ICO or the police, where we are legally required to do so.

 

All data sharing with third parties is carried out under a written agreement. We never share personal data about service users or volunteers outside of Calico Projects except as described above.

 

6. How long we keep your data

We keep your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Our general retention periods are:

  • General enquiry and contact form data: 12 months from your last contact with us.
  • Volunteer records: For the duration of your volunteering and for 3 years afterwards, to allow us to provide references.
  • Studio and room hire records: 7 years, for financial and legal compliance purposes.
  • CCTV footage: Maximum 31 days, unless retained in connection with a specific incident.
  • Job applications (unsuccessful): 6 months from the date of decision.

 

At the end of the relevant retention period, your data will be securely deleted or anonymised.

 

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • The right to access — you can request a copy of the personal data we hold about you (known as a Subject Access Request).
  • The right to rectification — you can ask us to correct data that is inaccurate or incomplete.
  • The right to erasure — you can ask us to delete your personal data in certain circumstances.
  • The right to restrict processing — you can ask us to restrict how we use your data in certain circumstances.
  • The right to data portability — you can ask for your data to be transferred to you or another organisation in a machine-readable format, where applicable.
  • The right to object — you can object to us processing your data on the basis of legitimate interests.
  • The right to withdraw consent — where we rely on consent as our legal basis, you can withdraw it at any time.

 

To exercise any of these rights, please contact our Data Protection Officer using the details in section 2. We will respond to all requests within one month. There is no charge for making a request.

 

If you wish to make a Subject Access Request in relation to CCTV data, please write to: The Data Protection Officer, Calico Projects, Manor House, 34 Old Road, Lewisham SE13 5SY, or email contact@calicoprojects.com.

 

8. How we keep your data secure

We take the security of your personal data seriously. We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed without authorisation. These include:

  • Secure password protection on all computer systems, with passwords changed regularly.
  • Paper files containing personal data stored securely.
  • Restrictions on who can access personal data, based on the need to know.
  • Training for all staff and volunteers who handle personal data.

 

In the event of a personal data breach, we have procedures in place to notify you and the ICO where we are legally required to do so.

 

9. Our registration with the ICO

Calico Projects is registered as a data controller with the Information Commissioner’s Office (ICO). You can verify our registration on the ICO’s public register at www.ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.

 

10. Changes to this Privacy Notice

We review this privacy notice regularly and may update it from time to time. Any changes will be posted on our websites. We encourage you to check this page periodically to stay informed about how we protect your personal data.

This notice was last reviewed and updated in February 2026.

 

Calico Projects is a registered trading name of CIO Charity number 1180229.