Privacy Policy

How and when do we collect information about you?  

We collect your personal data directly from you, when you buy a ticket or sign up for one of our events. The information we collect includes the following: name, contact details, date of birth, age and transaction history (we only store your card number details if you consent). If you have signed up to our access scheme with Nimbus, your account will have a record of your access requirements in your customer record.   

How is the information used?  

We use this information to administer your ticket sale, provide you with tickets, correspond with you for any changes in event or conduct surveys for service improvement. We may use photographs for press releases, our website, social media or brochure.  

What is our lawful basis for processing this information? 

1. To process your information when you buy a ticket, sign up for a paid event or sign up to the mailing list, we rely on contractual obligation.

2. For processing your health information for providing reasonable adjustments, we rely on your explicit consent.

3. For processing your information if you have signed up for a free event, we rely on legitimate interest.

4. For any safeguarding information that we record, we rely on legitimate or vital interest, read with substantial public interest and conditions from the DPA.

5. For any photography that we process, we rely on legitimate interest. You can reach out to us if you would want us to not use your photos. For survey information, we rely on your explicit consent (if they are not anonymous).

Who do we share your data with? 

1. We may share personal information with other organisations, particularly Spektrix, The Audience Agency, TRG Arts and UK Theatre who use this to process tickets and to analyse ticket sales for national and regional research into patterns of Arts attendance in England. 

2. Your data may be shared with artistic companies only where you explicitly consent or with third-party venues (agency ticket sales) where necessary for admission.

3. To comply with our duty of care and safeguarding, we may need to pass some information raising safeguarding concern with the authorities. In such circumstances, we apply vital interest and legitimate interest as our lawful basis. Data subjects’ rights and other UK GDPR provisions may be restricted when concerning personal data processed in these circumstances. Exceptions and exemptions are applied on a case-by-case basis.

How we store your information and for how long? 

We retain the personal data of all customers unless they ask us to make their account inactive or delete the account. If you would like to know more about this, please contact us at the email address above. 

If you sign up for a membership with the theatre, we will collect your name, pronouns, date of birth, address, email address, phone number, and potentially parental information if you are below 18. We process this information to manage your membership and accommodate your needs. Our lawful basis for processing this information is legitimate interests and for special category data, it is explicit consent.

If you sign up for a workshop at our theatre, we will collect your name, pronouns, date of birth, address, email address, phone number, and potentially health information such as dietary requirements or adjustments and parental information if you are below 18. we will process your payment along with your individual access or medical requirement. This is processed on the basis of our contractual obligation. We retain the personal data of all members and workshop participants for a period in line with our retention policy. If you would like to know more about this, please contact us at the email address above. 

We do not share your information with any other parties.

(Job applicants and current and former employees, trustees, contractors, volunteers, work experience)

How and when do we collect information about you? 

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment/engagement with us. In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

What types of information is collected about you and who provides it? 

We keep several categories of personal data to carry out effective and efficient processes. Specifically, depending on your type of engagement with us, we may process the following types of data: 

1. Personal details such as name, address, phone numbers, marital status 

2. Name and contact details of your next of kin  

3. Footage of the organisation events where you may appear  

4. Information of any disability or other medical information you have disclosed   

5. Right to work documentation, National Insurance number, bank account details   

6. Information gathered via the recruitment process such as that included in a CV, cover letter or application form, references, details on your education and employment history etc  

7. Information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings) 

8. Your biography and picture for the website (if applicable).     

We may also process special category of data which include health information, sexual orientation, race, ethnic origin. We may also process criminal records information if the role involves DBS check. 

How is the information used? 

We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer/ trustee agreement, without which we would be unable to employ you or engage with you. Holding your personal data enables us to meet various administrative tasks, legal obligation or contractual/agreement obligation. We process information in relation to the DBS for our safe recruitment practices. 

What is our lawful basis for processing this information?

We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for employees, job applicants and freelancers. We mainly use ‘legitimate interest’ for volunteers, work experience candidates and trustees. We may also have legal obligation in order to process and share your data, for example we need to share salary information to HRMC or use some of your data to enrol a new employee on a pension scheme. 

We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the theatre. 

Some special categories of personal data, such as information about health or medical conditions is processed in order to carry out employment law obligations and for health and social care obligations (such as those in relation to colleagues with disabilities and for health and safety purposes). We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief on the basis of substantial public interest for the purposes of equal opportunities monitoring.

When processing criminal records (for example, in order to perform DBS check), the organisation relies on the lawful basis of legitimate interest and additional conditions of the UK GDPR and DPA 2018. 

Who do we share your data with?

Personal Data in relation to your salary is shared with HRMC as part of our legal obligation. Personal Data may be shared with third parties for the following reasons:

1. For the administration of payroll, pension, HR functions (for example the online holiday booking system), administering other employee benefits.

2. When sharing information with third parties, we have data sharing agreements, data processing agreements or contracts in place to ensure data is not compromised. These third parties implement appropriate technical and organisational measures to ensure the security of your data.

How long do we keep your data? 

We only keep your data for as long as we need it for. We will keep your data for a period of 7 years after your employment/engagement with us has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months after the position is filled.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period. 

Data is destroyed or deleted in a secure manner as soon as the retention date has passed.

Events:

We host many events in a year, and your personal information is collected when you register for an event with us. We may collect basic personal information, such as your name, email, phone number. We rely on legitimate interest to administer your registration for the event. When we collect other information such as dietary information, we rely on your explicit consent. If the event is ticketed, we rely on contractual obligation.

If you have attended an event with us previously, we may reach out to you to invite you for our future events. We rely on consent to send you emails.

Donations:

Your personal Information is provided by you via our website, through the ‘Big Ticket Appeal’, ‘Sponsor a seat’ or via legacies.   The information gathered may be name, email address, Gift Aid sign up, company name if donation made by an organisation, donation details, reasons to engage, postal address.

This information allows us to process your donation, and deal with any potential enquiry. We rely on our legitimate interest to process this data.  If you agree that we can claim Gift Aid on your donations we are legally required to keep a record of the claim and your Gift Aid declaration.  If you are donating using a third party, please also refer to the privacy notice published on their websites.

Fundraising and Marketing:

• We may reach out to you for fundraising, if you have previously engaged with us in an event, made a donation, or if we believe that you may be interested in engaging with our organisation. We may also send you marketing communications if you have signed up for marketing emails. We may also send you postal marketing.

• We rely your consent to send your email communications (except where this is a business email address, whereby we rely on legitimate interest).

• We may also use post as a mode of sending you marketing communications or make calls, relying on legitimate interest. If you would like us to not send such communications, please do reach out to us.

• If you would like to change your marketing preferences, you will be given the option to ‘opt-out’ of marketing communications about shows and events, and unless you do so we will continue to send you information of this kind by email. You can unsubscribe at any point, using the link on each email, or by contacting us. (Currently people opt in).

• You may also see our adverts on social media that are tailored to your interests. Depending on your settings and the privacy policies of platforms like Facebook, LinkedIn or Instagram, you may allow these services to share certain information with us.

• We may process your personal data obtained from publicly accessible sources such as Companies House, your biography on your work website or information that has been published in articles/ newspapers. This is only ever likely to be used for fundraising purposes, and you can object to the processing of your data in this manner by reaching out to us via the contact information provided above.

Use of CCTV 

Lichfield Garrick operates CCTV both inside and outside our buildings with the purpose of reducing the threat of crime generally, protecting Lichfield Garrick’s premises and helping to ensure the safety of all our staff, volunteers and visitors, consistent with respect for the individuals' privacy. The CCTV records picture only and is stored for 14 days. 

Your rights as a Data Subject

You have the following rights:

• ‘Right to be informed’, which means we will be completely clear and transparent about how we plan to use your personal information.

• ‘Right of access’, which means you can request details of the personal information we hold about you and how we use it. We will provide this within one month.

• ‘Right to rectification’, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect.

• ‘Right to restrict processing’, which means you can ask us to change, restrict or stop the way we are using your personal information.

• ‘Right to erasure’ (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records.

• ‘Right to object’, which means you can object to us using your personal information for marketing purposes.

• ‘Right to data portability’, which means you can obtain the personal information we hold about you and reuse it for your own purposes.

• ‘Right not to be subject to automated decision making’, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome.

• Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commissioner’s Office (ICO), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly.

International Data Transfers

Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).

Complaints procedure 

If you are unhappy with the way we process your data, please get in touch with the Data Protection Lead using the contact details mentioned above.

You can also make a complaint to the Information Commissioner’s Office (ICO), which regulates the use of information in the UK. They can be contacted at 0303 123 1113 or, you can write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.