ENO Breathe Privacy Notice

1. Our privacy commitment to you

Here at English National Opera (ENO), we are committed to protecting your privacy. ENO will always process data in a lawful and fair manner, and this notice is an important part of our commitment to keeping you fully informed about how we will use your information.

We do everything we can to keep your information secure and use it only for the purposes outlined in this Privacy Notice.
This Privacy Notice supplements other notices and privacy policies that we may provide to you from time to time and is not intended to override them including, by way of example, our website privacy notice. It is important that you read this Privacy Notice together with any other privacy policy, notice or fair processing policy we may provide on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your personal information.

2. Our details

For the purposes of the Data Protection Act 2018 (and related laws), we, English National Opera, are the controller of the processing of your personal information described in this Privacy Notice. This means we decide why and how your personal information is processed. It also means that we are responsible to you under law for that processing.

Our details are as follows:

• English National Opera is a registered charitable company limited by guarantee incorporated in England and Wales (company number 00426792). We are registered as a charity in England and Wales under registered charity number 257210.
• ENO is registered with the Information Commissioner’s Office (ICO) under registration number ZB279509.

3. How to contact us

Once you have read this Privacy Notice, if you have any questions on how we protect your privacy or deal with your personal information we can be contacted as follows:

Contact: Data Privacy Manager
Address: London Coliseum, St. Martin’s Lane, London, WC2N 4ES
Telephone: 020 7836 0111
Email: [email protected]

4. How we collect your information

This Privacy Notice applies whenever you express an interest or participate in the ENO Breathe programme.
We collect your personal information in different ways, including:

• Information you provide to us, where you:
  • express an interest in participating in the ENO Breathe programme;
  • complete a patient sign-up form to participate in the ENO Breathe programme;
  • sign up to our mailing list or newsletters in order to receive emails and other communications from us;
  • complete a survey – we currently undertake the following surveys: a pre-programme survey; end of programme survey; and, 3/6/12 month follow-up surveys;
  • provide feedback to us;
  • participate in ENO Breathe group sessions held on virtual meeting platforms (such as Zoom);
  • access and use the ENO Breathe programme via our website or other digital platforms, including submitting information through online forms or interacting with self-service elements of the programme offered online; or
  • get in touch with us by email, phone or by post about the ENO Breathe programme.
•  Information from third parties sources:
  • We may occasionally gather your personal information from other third parties such as external organisations that you have given your permission to. We feel it is important that you understand exactly who these third parties are and when this will happen, so please see What kind of information do we collect? in the section below for more details.

5. What kind of information do we collect?

5.1. Information obtained directly from you
We collect different kinds of information depending on how, where and when it was gathered. We will collect information directly from you which may include your:

• Identity information: which may include your full name, title, and date of birth;
• Contact information: which may include your address, telephone number (whether fixed line or mobile), and email address;
• Preference information: responses to surveys that you choose to participate in, your contact details to participate in follow up research and demographic information about you (should you choose to provide this); and
• Marketing and communications information: your preferences in receiving marketing from us and our third parties and your communication preferences.

In addition to the above, we collect special category data about you. This includes:

• Health information (including your respiratory conditions and other related medical history, and access requirements) which we require to deliver the ENO Breathe programme and to comply with our legal obligations. We process this special category data on the basis of your explicit consent under Article 9(2)(a) of UK GDPR, which you provide when participating in the ENO Breathe programme or attending an ENO event or production we run;
• Biometric information such as your likeness or voice if you participate in a virtual group meeting – for example, as part of a group Zoom session. We process this special category data on the basis of your explicit consent under Article 9(2)(a) of UK GDPR, which you provide when you choose to enable your camera or microphone during sessions.
• Information about your racial and ethnic origin, which we may use to better understand the people we are reaching and promote equality and fairness among participant communities. We process this special category data on the basis of Article 9(2)(g) of UK GDPR (substantial public interest), relying on the condition set out in Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018 (equality of opportunity or treatment).
• Sessions recording information, including contributions where you participate in virtual group sessions (for example, via Zoom). These sessions may be recorded for internal monitoring and evaluation purposes. To the extent that such recordings capture biometric data (such as your voice or likeness), we process this on the basis of your explicit consent under Article 9(2)(a) of UK GDPR, as described above.
• Unique identifier: with effect from 1 October 2026 if you join the ENO Breathe programme on or after that date, or if you are an existing participant who agrees to join a research programme on or after that date, we may assign you a unique identifier. This identifier allows us to track outcomes and share relevant data with participating NHS Trusts and research institutions without directly identifying you. The identifier itself does not contain your name or other directly identifying information. Where this processing involves health data, we rely on Article 9(2)(j) of UK GDPR (processing necessary for scientific research purposes in the public interest), together with the required safeguards.

We do not process information about criminal convictions.

5.2. If you fail to provide us with your personal information

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to deliver the ENO Breathe programme). In this case, we may have to stop a delivery of the ENO Breathe programme but we will notify you if this is the case at the time.

Occasionally there may be instances when you can choose not to give us particular details. This is your right, but please remember that choosing to restrict the kind of information you offer us will limit our ability to tailor our services to you individually.

5.3. Information obtained from third parties

We may receive personal information from third parties, including participating NHS Trusts, research institutions and other ENO Breathe partners, where you have given your consent. This may include:

• Contact information (such as your name, telephone number and email address) provided by a participating NHS Trust, which we use solely for the purpose of making initial contact with you about the ENO Breathe programme. We will not use such contact information for any other purpose without your consent.
• Health and referral information provided by a referring NHS Trust or research body, which we use to assess your suitability for the ENO Breathe programme and, where applicable, to facilitate your participation in research activities. Such information may include details of your relevant medical history, any access requirements, and information about the research programme to which you have been referred.

If we receive personal information about you from a third party (for example, an NHS Trust, research institution or other organisation) or from a public source, we will, where appropriate, let you know who we received it from within a month of such receipt.

6. What we use your information for

Any information we collect about you will be used in a proportionate, targeted way. This means we will not gather more information from you than is necessary for the purpose for which it was collected. The way we collect your personal information will determine the purposes we use it for.

The table below sets out how we use your information:

7. Marketing

We will provide you with choices regarding certain personal information uses, particularly around marketing and advertising.

7.1. Marketing communications from us
We may use your Identity, Contact and Marketing and Communications information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
You will receive marketing communications from us if you have requested information from us and you have not opted out of receiving that marketing.

7.2. Third-party marketing
We will get your express opt-in consent before we share your personal information with any third party for marketing purposes.

7.3. Opting out
You can ask us or third parties to stop sending you marketing messages at any time by:

• following the opt-out links or ‘unsubscribe’ option on any marketing message sent to you;
• updating your contact preferences on your account with us (where applicable);
• emailing, [email protected] or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of our delivery of the ENO Breathe programme.

If you have asked us not to contact you, we may need to retain your name and contact details to put you on a suppression list (this is a record of people who have withdrawn their consent and ensures we do not get in touch with you if you have chosen to do this).

7.4. How we will contact you
Where you have provided an email address or a mobile number, we will contact you by email, SMS message or post unless you let us know your particular preference.

8. Your information and third parties

8.1. Sharing your information with third parties
We will never sell your information to any third party. We will not share your details with other charities, arts organisations, producers or other third parties for marketing purposes except where you have expressly agreed to hear from other organisations.
We may share your personal information with third parties, from time to time, as set out below:

• with the NHS service which referred you to the ENO Breathe programme – for example, if we need further information to assess your suitability for the ENO Breathe programme. In these cases, we actively seek your consent to name you in our correspondence with the relevant service;
• with our ENO Breathe programme partners, Imperial College Healthcare Trust, Greater Manchester Combined Authority and NHS Greater Manchester on a controller basis, and any such sharing is subject to your consent;
• with our appointed evaluators and researchers of the ENO Breathe programme, such as Imperial College and the University of Manchester, on a controller basis. We will anonymise your data before sharing it with our evaluator and it will, in turn, conduct periodic analysis and write up findings in regular impact reports (all data contained within these reports is anonymised) that are shared with our steering group and NHS partners;
• with participating Specialist NHS Trusts services, using your unique identifier (where applicable), to share outcome data and support clinical research without directly identifying you.
• with other ENO Group companies, such as London Coliseum Limited, on a joint controller basis, for the purpose of group administration, the administration of events and activities, marketing and support;
• with trusted third party service providers, acting as processors, who provide IT and administration services, such as Salesforce and Microsoft Azure. Where we use such trusted third parties, we require them to adhere to appropriate controls to protect personal information;
• with our professional advisers, acting as processor or controller, including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services;
• with funders and partners such as Arts Council England, as controller, where there is a legitimate interest to do so – for example, sharing postcode data or survey information;
• with third parties such as the Charity Commission, the ICO and HMRC, acting as controller, where it is required by law or regulation; and
• with other third parties, where we have your permission to do so in accordance with this Privacy Notice.

We may share personal information with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this Privacy Notice.

8.2. International transfers
Currently, we do use some tools or third party services which process data outside the United Kingdom (UK) and European Economic Area (EEA) (such as Zoom, which is based in the US). Where we share your personal information with third parties located outside of the UK or EEA we comply with the requirements for international data transfers and always require suppliers to ensure adequate protection for personal data by stipulating this in our contracts with them.

9. Retaining your personal information

We will keep your personal information only for as long as necessary to fulfil the purposes for which it was collected, as described in this Privacy Notice. The retention periods we apply depend on the type of information:

• Registration and contact information: retained for up to 3 years following your last participation in the ENO Breathe programme, after which it is securely deleted (although contact information wil be retained after this if you have subscribed to our mailing list and only deleted when you tell us you want to unsubscribe).
• Survey data: retained in identifiable form for up to 3 years, after which it is either deleted or anonymised for statistics and research purposes.
• Health information: retained for up to 3 years following your last participation, unless a longer period is required by law or for the establishment, exercise, or defence of legal claims.
• Biometric information and session recordings: retained for internal monitoring and evaluation purposes and securely deleted once no longer required, unless you have consented to longer retention.
• Information about racial and ethnic origin: anonymised as soon as reasonably practicable and retained in anonymised form for research and equality monitoring purposes.
• Research programme participants: if you take part in a research programme on or after 1 January 2027, your personal data will be retained for a minimum of 3 years from the date your participation in the research programme ends. This extended retention period is necessary to support the integrity and reproducibility of clinical research, and to comply with applicable NHS and research governance requirements. We process your special category data for research purposes on the basis of Article 9(2)(j) of UK GDPR (processing necessary for scientific research purposes in the public interest), with appropriate safeguards as required by section 19 of the Data Protection Act 2018.

For more information on our retention practices, please contact us as detailed in section 3 (How to contact us).

10. Security

We store your personal information on secure, password-protected systems and restrict access to authorised personnel only. This includes data stored on secure online platforms used to administer the ENO Breathe programme, deliver surveys, and facilitate virtual sessions (for example, via Zoom).

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will do our best to protect your personal information. However, we cannot guarantee the security of your personal information transmitted to our site before it reaches us, and any transmission is therefore at your own risk. Once we have received your personal information, we use strict procedures and security features to prevent unauthorised access.

11. Your rights

Under applicable data protection laws, you have a right to:

• ask for a copy of the personal information we hold about you.
• request that we correct personal information we hold about you.
• make a complaint to us about how we use your personal information (see Section 12 (Complaints) below for details of our complaints procedure and how to escalate a complaint to the Information Commissioner’s Office (ICO)).
• request that we delete the personal information we hold about you if: you think that our purposes for processing the personal information no longer apply; or have withdrawn your consent to our using it and your consent was our lawful basis for processing it; where you consider that our legitimate interests in processing your information do not or no longer apply; and if you think we have processed your personal information unlawfully.
• withdraw your consent at any time, where we are relying on your consent to processing your personal information, for example, you can request that we stop using your personal information for marketing purposes.
• request restriction of how we process your personal information, which allows you to suspend our use of your personal information if you: want to ensure the accuracy of your personal information; want to establish the lawfulness of our use of your data but do not want us to delete it; want us to retain your personal information beyond the point we require it for the purpose we obtained it for; you have requested that we stop processing your personal information whilst our legitimate interests are balanced against your individual interests.
• request that we transfer your personal information to a third party, in a structured, commonly used, machine readable format.

If you wish to exercise any of the rights set above, please contact us as detailed in section 3 (How to contact us).
You can find more details about how your data is regulated by visiting https://ico.org.uk/for-the-public.

12. Complaints

You have the right to make a complaint to us if you consider that, in connection with your personal information, there has been an infringement of UK data protection law. This includes complaints about how we have collected, used, stored or handled your personal information, or how we have responded to a request you have made to exercise your data protection rights.
You may submit a complaint to our Data Protection Manager by email at [email protected] or by letter addressed to the Data Protection Manager, English National Opera and London Coliseum Limited, London Coliseum, St Martin’s Lane, London, WC2N 4ES. We will accept complaints made through any channel.

We will acknowledge receipt of your complaint within 30 days of receiving it.

We will then take appropriate steps to respond to your complaint without undue delay, including making enquiries into the subject matter of your complaint to the extent appropriate and keeping you informed about the progress of our investigation.
Once our investigation is complete, we will inform you of the outcome of your complaint without undue delay, including the steps we have taken to address your concerns and the reasons for our conclusions.

If you are not satisfied with our response, or if you consider that we have not addressed your complaint adequately, you have the right to lodge a complaint with the ICO. or by telephone on 0303 123 1113.

13. Future amendments to this Privacy Notice

We may make changes to this Privacy Notice where we consider it appropriate, for example, to comply with any applicable legislative or regulatory requirements, so please ensure you check this page from time to time. We will always do our best to notify you of any changes by getting in touch via email, if you have provided an email address to us.

3 August 2026