Our Privacy policy 


May 2018


About this Policy 

Riwayat aims to change the perceptions about Pakistan through the excellent presentation of Pakistan’s arts and its culture. We give a foothold for artists and designers to showcase their craft in the west and to grow their businesses. 


When doing this, we process personal data about people who are interested to attend our events. We are committed to protecting your privacy and take this responsibility very seriously. We therefore take care to safeguard it. 


This notice outlines what data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights. If you have any questions about this policy please contact us.


Our promise to you

You are important to us and we value every contribution. In whichever way you choose to support us, we want you to have choice and control over the information we have about you. 


We therefore commit: 

•    To ask, listen to and act on your wishes so that you value your relationship with and communications from us 

•    To not put undue pressure on you to join in our events. 

•    To make it clear and easy for you to choose how to hear from us. 

•    To protect your information. Any details you share with us will be used by us only for our own purposes. We will never give, sell or rent your information to others. 


Why we collect your data 

We collect personal data to provide you with services, communicate with you, send you information that you have requested and to administer donations. 


Depending on how you interact with us, we may process data for the following reasons:

•    Visitors to our website

•    Supporters and partners

•    Individuals who make enquiries or raise complaints

•    Guests at our events

•    Individuals we work with and provide services to

•    Individuals that help us deliver our vision


Information we collect 

We may record the following personal information:

1.    your full name

2.    contact details – including your postal address, telephone number and email address

3.    where you work and your job title

4.    your purchase history with us

5.    photographs, video or audio recordings

6.    other information that you share with us though letters, conversations, surveys or publicly available sources


For those who model with us we also collect personal data about you including your measurements and age. We only record this data where we have your explicit consent unless we are permitted to do so in other circumstances under GDPR laws. 



We would love to keep you up to date with news of our events. We use a range of marketing channels to contact supporters including our website, post and email. 


We use an online provider, Mailchimp, to process our supporter communications and Eventbrite to administer our ticket sales. Every email we send has an opt-out facility included. We will also send you marketing by ‘point of sale’, on the basis of it being within our legitimate interests to do so, unless you opt out. 


We send the following marketing materials: 

1.    Updates about our work in general – including newsletters, magazines, and other publications informing you about our work

2.    Events – including details of sponsored activities or tickets sales 

3.    Volunteering – information about how you can give your time or using your influence to progress our abjectives

4.    Professional services – including details of any training events and publications


If you tell us you do not wish to receive marketing communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us. 


Occasional we check for out of date data by checking it against publicly available records such as deceased records to help us minimise wasted expenditure.


Administrative communications

In addition to the marketing communications that you receive from us we may also communicate with you by post, telephone, and email in relation to administrative and transactional matters. There may also be other occasions where we need to contact you about a payment and occasionally after you have opted out of hearing from us. 


Research and analysis 

We may choose to carry out checks on sponsors or partners to comply with our duties in respect of anti-money laundering legislation and the prevention of fraud. 


Social media

Depending on your settings or the privacy policies for social media messaging services like Facebook, Twitter, and Instagram, you may receive targeted advertisements through our use of social media audience tools. We do not share your data with these social media sites that could stop you receiving these advertisements. 


If you receive an email, open it, don’t open it, select a link and/or browse our website, MailChimp collects this information to ensure that the information we send to people is received and relevant. 

When we’re seeing what people do online like this, we’re using cookies. We may use cookies to tailor your browsing experience and ensure we show you more relevant information. If you don’t want cookies, you can set your browser to notify you when you receive one then decline it.

Professional contacts 

We collect data about professional contacts and partners with whom we work, or to whom we provide professional services. Personal data collected in this way will be processed in accordance with this policy. 


We may send our professional partners information and updates about our work. Such contacts can opt out of receiving this information at any time.  


Our legal basis for processing personal data 

The law allows for six ways to process personal data. When we use your personal information, we will always consider if it is fair and within your reasonable expectations to do so and that it is not unduly intrusive. 


Disclosure of your personal data 

We will not share any of your personal data to any third party – except where: 

1.    the transfer is to a secure data processor, which carries out operations on our behalf

2.    we are required to do so by law

3.    it is necessary to protect the interests of an individual

4.    we have obtained your consent


Security of your personal data 

We use appropriate precautions to protect your personal data.


Use of data processors 

We occasionally may use a third-party supplier to manage mailings, conduct research surveys or storage of your personal information on our behalf in accordance with GDPR. 


Transfers of data outside of the European Economic Area 

We use DropBox, which is a multi-tenant cloud service, for our internal office use. This means that internal documents and information generated by us are stored in cloud services hosted within the European Economic Area (EEA).


However, in limited cases, we may use data processors that process and/or store data outside of the EEA, for example, payment processors such as paypal. In these cases, we will take reasonable steps to ensure that your data is protected. 


Retention of your data 

The length of time that data will be kept may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under. Typically donor and service user’s data would be retained for seven years and recruitment data for 12 months


If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.


Your rights 

You have many rights under GDPR. These include: 

  • 1. Right of Access: you have the right know what information we hold about you and to ask, in writing, to see your records.
  • 2. Right to be informed: you have the right to be informed how your personal data will be used. 
  • 3. Right to withdraw consent: where we process your data based on your consent you can withdraw that consent at any time. 
  • 4. Right to object: You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so.
  • 5. Right to restrict processing: you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
  • 6. Right of erasure: you have the right to be forgotten 
  • 7. Right of rectification: you have the right to ask for our records to be updated. 
  • 8. Right to data portability: you have the right to request that the data is transferred from one service provider to another. 



If you have any complaints about the way in which we have used your data, please get in touch with us and we would be happy to help and discuss your concerns. In addition, you are also entitled to make a complaint to the Information Commissioner’s Office.


Contact Us 

If you have any questions about this policy, would like more information, or want to exercise any of the rights set out above, you can get in touch with us by email on ask@riwayat.org.




  • 1. References to 'we' or 'us' are to Riwayat Ltd, a limited business in the UK and a SMC-Private Limited Company in Pakistan. 
  • 2. Version/May 2018
  • 3. For example, Facebook’s ‘Custom’ and ‘Lookalike’ Audiences’ programmes enable us to display adverts to our existing supporters when they visit Facebook, or other people who have similar interests or characteristics to our supporters.
  • 4. The law allows for six ways to process personal data. 1. Consent – The person has consented to you keeping or using their data. 2.Contractual – Keeping or using someone’s personal data is required to fulfil a contract between them and your organisation.3. Legal Obligation – Your organisation needs to keep or use personal data in order to comply with the law. 4. Vital Interests – Keeping or using someone’s personal data is necessary to protect the vital interest of them or somebody else. 5. Public Task – Your organisation needs to keep or use someone’s personal data to perform a task that is in the public interest. 6. Legitimate Interests – It is in your organisation’s and the person’s legitimate interests for your organisation to keep or use their personal data.
  • 5. We will supply any information you ask for that we hold about you as soon as possible, but this may take up to 30 days. We will not charge you for this other than in exceptional circumstances. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you.

Riwayat Events (SMC-PRIVATE) Ltd Pakistan  

Limited Company No 0111572

11A, Street 38, F-8/1, Islamabad, Pakistan


Riwayat UK

UK Limited Company No 7636399 

60 Merritt Gardens, Surrey KT9 2GY United Kingdom