How we use the data we collect
Who we are and who is collecting it?
The information that we collect, process, hold and share
Why we collect and use this information
How we collect and use this information
The legal basis on which we use this information
Children
Web Browser Cookies
Not providing this information
Storing this information
Retention periods
Who we share personal information with and how this will affect you
Your rights
Right to lodge a complaint
How to access your personal information
Updates

Please also see our Engagement Privacy Notice

How we use the data we collect

Bristol Old Vic is committed to protecting you and your family's personal information when you are using any of our services. We want the services we provide to be safe and enjoyable environments for our audiences, customers and visitors. This Privacy Notice relates to our use of any personal information we collect from you via the following services:

our website
social media
our emails to you
your visit to Bristol Old Vic

It also relates to our use of any personal information you provide to us by phone, SMS, email, in letters and other written correspondence, and in person.

In order to provide you with access to book tickets with us and stay in touch with us about what we're doing, we need to collect information about you.

This Privacy and Cookies Policy explains the following:

what information Bristol Old Vic may collect about you;
how Bristol Old Vic will use information we collect about you;
when Bristol Old Vic uses your details to contact you;
when Bristol Old Vic will disclose your details to anyone else;
your choices and rights regarding the personal information you provide to us;
the use of Cookies on our website and how you can reject Cookies.

Bristol Old Vic is committed to safeguarding your personal information. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 1998 and the General Data Protection Regulation 2018. No website can be completely secure; if you have any concerns that your customer account could have been compromised, e.g. someone could have discovered your password, please get in touch straight away by contacting the Box Office.

Our website contains hyperlinks to websites owned and operated by third parties. These third party websites have their own privacy policies, and are also likely to use Cookies, and we therefore urge you to review them. They will govern the use of personal information you submit when visiting these websites, which may also be collected by Cookies. We do not accept any responsibility or liability for the privacy practices of such third party websites and your use of such websites is at your own risk.

Who we are and who is collecting it?

Bristol Old Vic & Theatre Royal Trust Ltd (referred to throughout this document as “Bristol Old Vic”) is the oldest continually running theatre in the UK. Our mission is to create pioneering twenty-first century theatre in partnership with the people of our energetic city; inspired by the history and magical design of the most beautiful playhouse in the country.

Bristol Old Vic is a charity, Charity no. 228235, Company no. 756007.

Bristol Old Vic also runs Bristol Old Vic (Trading) Ltd (04130983) and Bristol Old Vic Production Company Limited (09349396), and Bristol Old Vic Film Limited (13387162 - previously Bristol Old Vic Touching the Void Limited) which are all wholly owned subsidiaries. Information is shared feely between these three companies.

We aim to be entirely upfront and open about the customer data that we use. Collecting this data makes it easy for you to book shows and events, keep up to date with our activities, and engage with us in other ways like our Young Company activities or supporting our continued future. We do not obtain any personal data that we think would be likely to cause individuals to object to or complain about, but we are always open to discuss with you any of the information we hold.

It is possible that Bristol Old Vic may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties. Data provided by Users will, where it is relevant to any division so transferred, be transferred along with that division and the new owner or newly controlling party will, under the terms of this Policy, be permitted to use the Data for the purposes for which it was supplied by you. In the event that any Data submitted by Users will be transferred in such a manner, you will be contacted in advance and informed of the changes. When contacted you will be given the choice to have your Data deleted or withheld from the new owner or controller.

The information that we collect, process, hold and share

Personal Information
- Full Name and Title
- Email Address
- Phone Numbers and Mobile Number
- Date of Birth
- Delivery Address
- Billing Address
- Access requirements
- Genre Preferences
- Membership Level
- Purchase History
- Donation History and Pledges
- Gift Aid status
- Employer
- Gender
Marketing Preferences including for Third Parties
Card Details (for purchases and for your Card Wallet)
Bank Details (for Direct Debits)
Email and Newsletter records including emails sent, emails opened by you, and links opened by you
Publicly Accessible Profile Information from the internet including Facebook, Instagram and Twitter
Images of you when you visit the Theatre (CCTV or as a member of the audience or theatre user for promotional or business use)
Anonymised Information
- IP address
- Operating system
- Cookies
  - Craft: CraftSessionId EU_MSG
  - Google Analytics: __utma __utmb __utmc __utmz __utmx __utmxx __ga __gat
  - Cloudflare: __cfduid
  - Spektrix: ASP.NET__SessionId, bristololdvic, best-seat-choice
  - __gco
  - __gid

Why we collect and use this information

We use your data for these specific purposes, unless you ask us not to:

To enable you to book and pay for tickets via our website, over the telephone and in person by setting up a customer account in your name.
To issue invoices, credit notes and refunds according to the booking terms and conditions.
To enable you to purchase and watch live broadcast and on demand video content.
To enable you to donate to us with a single payment or regular direct debit agreement.
To thank you for donating to us and telling you how your money will be spent.
To store saved shopping carts as you navigate around the website (cookies).
To enable us to contact you to provide important information in advance of your booked event, such as details of the location of the event or if the event has been cancelled.
To allow you to enquire about our Restaurant and Bar.
To allow you to enquire about our Wedding and Events services; book your event and keep in touch with you about all the necessary arrangements before and after the event date.

Formally we justify the above processing as Contract Purposes, see definition in section “The legal basis on which we use this information”.

To enable us to call you with details of how you can support us, or of specific offers or events that may be of interest.
To enable us to text you with offers or details of upcoming shows and events.
To enable us to email you about how you can support us.
To enable us to store information about access requirements to allow you to access concession prices, specific seats and receive assistance as required.
To enable us to store information regarding allergies for catered events.
To share your personal information with other organisations who would like to contact you.
To identify recurring visitors and to analyse their browsing habits within the Web Site (cookies)
To store saved shopping carts as you navigate around the website (cookies)
To produce and exploit audio-visual programmes for commercial purposes including recordings of audience members. “Programme” includes not just the finished programme but all rushes, clips and unused material.

Formally we justify the above processing as Explicit Consent, see definition in section “The legal basis on which we use this information”.

To enable us to email you with our upcoming shows and events at Bristol Old Vic.
To drive evaluation and statistics of the services and events we provide, to improve them for the future and report them to our funders like Arts Council England and Bristol City Council.
To enable us to recommend to you similar products and services (shows, events and merchandise) available at Bristol Old Vic.
To email you before a visit with information to enhance your visit.
To text you before a visit with links to information to enhance your visit.
To analyse the data we hold about you in order to identify and prevent fraud.
To analyse the way in which our website is used and the content and links that you interact with, to improve our website services.
To analyse the way in which our emails to you are received by you, and the content and links that you interact with, to improve our communications with you.
To analyse the data we hold about you to ensure that the content and timing of our communications to you are as relevant as possible.
To maintain notes of our customers according to customer booking and donation history, and other personal customer account data that you provide us, as well as publicly available internet research for the purposes of our marketing communications to you, and to enable us to communicate in a relevant way with you, but not to make any automated decisions based on profiling of any consequence to you whatsoever.
To identify people on our system who may be interested in becoming a member, supporting the charity or increasing their support, based on their ticket purchasing and donation history.
To enable us to email you with a survey after seeing a show to evaluate the success of an event and improve the theatre’s programme and facilities.
To enable us to call you with details of how you can support us, or of specific offers or events that may be of interest, providing you are not registered on the Telephone Preference Service (TPS).
For storing CCTV images of people within the premises for security
To share anonymised information with our funders and industry bodies in support of the cultural industry.
To invite and issue complimentary tickets to industry and press contacts.
To help us investigate complaints, legal claims or important incidents.
On occasion, for promoting our shows and events or for archival or reference purposes, by the use of photographs and videos taken of our audiences and theatre-users.

Formally we justify the above processing as Legitimate Business Interests, see definition in section “The legal basis on which we use this information”.

How we collect and use this information

Bristol Old Vic is the data controller for all the data we store. Bristol Old Vic (Trading) Ltd, Bristol Old Vic Production Company Limited and Bristol Old Vic Film Limited are joint data controllers. We use Data Processors to help us collect, process, and safely store the data that we obtain.

We use our website to sign you up to our E-Newsletter database and for receiving enquiries regarding Restaurant, Wedding and Event services. Our website is provided by Supercool.
We use Spektrix Ltd to process our Box Office ticketing system, and to report on your order history, donation history, membership status, eligibility to access video content, and to show trends in sales patterns.
We use TicketCo to process your bookings for some of our live stream and on demand digital content, broadcast/host the content and check your eligibility to watch.
We use Dot Digital to send e-newsletters, press night invitations and keep in touch via email.
We use Illuminate and Indigo to collect post show survey responses.
We use Illuminate to report anonymised data to Arts Council England.
We use crowdEngage to text you before your visit.
We use RSM 2000 to process direct debit payments.
We use DONR to process donations you may make via text message.
We use CAF to receive and process UK donations made online, and via cheque and CAF charity vouchers.
We use CAF America to receive donations from US-based overseas taxpayers.
We use Amazon Smile to receive donations you may make whilst shopping using Amazon Smile.
We use Aleno, Qikserve and Aloha to manage our restaurant and bar reservations, ordering and payments.
We may use other similar services provided by other parties, but which do not adversely affect your rights on the terms of this notice.
We do not use any services that include automated decision making of any significance to the individual. The consequences of being subjected to the automated profiling systems that we have in place is limited to specific marketing or fundraising campaigns directed at specific customer types based on their purchase and donation history or post code area. This will not override your marketing preferences which can be updated at any time within your customer account on the website or by contacting box office.
We may also share pseudonymised data with Meta, to help us to identify customers who are similar to our audiences, target the adverts that we serve, and ensure they are relevant to new and existing customers. Pseudonymising the data (replacing personal identifiers with placeholder values) ensures the data shared is protected.

The legal basis on which we use this information

There are three legal bases under which we may process your data.

Contract Purposes
When you make a purchase from us or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your data.

Explicit Consent
When appropriate, we will ask you for your explicit consent before using your personal information in that specific situation. We will update your consent periodically. You have the right to withdraw consent at any time, and this can be done via your Customer Account on the website or by contacting our Box Office on tickets@bristololdvic.org.uk.

Legitimate Business Interests
We collect and process your personal information for purposes that are in our legitimate organisational interests. We do this carefully, and in a way that we believe there is no overriding prejudice to you by using your personal information in this way. You have the right to object, amongst other rights explained later in this document.

Children

We take the protection of children and their personal data very seriously. For this reason, as we are unable to verify parental consent, no-one under the age of 13 is allowed to use our website or services. Children under the age of 13 must ask their parents or an adult to make bookings for them. For our Engagement department, when we ask you for additional personal information, this may be for children as well. We therefore provide you with an additional Privacy Notice at this point so that you are informed about what information we will be asking for and how we will be using it.

Web Browser Cookies

Bristol Old Vic may set and access Cookies on your computer. A Cookie is a small file that resides on your computer's hard drive and often contains a unique identifier and is accessible only by the website that placed it there, not any other sites. You may restrict your internet browser's use of Cookies.

You may delete Cookies, however you may lose any information that enables you to access the website more quickly.
You can choose to enable or disable Cookies in your web browser. By default, your browser will accept Cookies, however this can be altered.
For further details please consult the help menu in your browser. Disabling Cookies may prevent you from using the full range of services available on the website.

Collecting this information

Whilst the majority of the personal information you provide to us is mandatory, some of it is provided to us on a voluntary basis, and we will make this clear to you when we collect the data from you by marking the 'Required' fields. Anything that does not say 'Required' next to it is voluntary.

Not providing information

You may access certain areas of the website without providing any data at all. However, to use all services and systems available on the website you may be required to submit customer account information or other data.

You do not have to provide us with all the information we may ask you for. It is up to you.

Any information that we ask for other than those listed below is entirely voluntary. Not providing any of the voluntary information will not preclude you from any of the products or services we offer or effect you in any other way.

In order to sign up to our eNewsletter or create a customer account, we only require:

First Name
Last Name
Email Address

Once a customer account has been created, we need to store the following information on your account:

Purchase History
Membership Level
Donation History
Gift Aid declaration

In order to book and pay for tickets, we only require:

Your customer account details, and –
Phone Number
Billing Address
Card Type
Card Number (our staff members are not able to see your full card number)
Expiry Date
Start Date (only if required by your bank)
Issue Code (only if required by your bank)
Security Code (we never store your 3 or 4 digit security code)

All debit and credit card information is processed securely, and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). We optionally allow you to store your card details for use in a future transaction. This is carried out in compliance with PCI-DSS.

For our Restaurant, Wedding and Event services, we need your personal data in order to provide a quotation, and a contractual agreement when you make a booking. If you do not provide your Personal Data we will be unable to create a quotation or agreement and you will not be able to book your event with us.

Storing this information

We store your personal data securely using suitable physical, electronic and managerial procedures to safeguard and secure all and any customer data and personal information. We will ensure that any third parties we use for processing your personal data do the same. We limit internal access to your personal data to only those who require it, and provide all our staff with Data Protection and Information Security training. We ensure that high standards of security and protection are met by abiding by our Data Protection Policies and Procedures, and these are governed by the Senior Management Team and the Board of Trustees.

Under the Bristol Old Vic’s Confidentiality Code of Conduct, all our staff are required to protect your information, and inform you of how your information will be used. This includes, in most circumstances, allowing you to decide if and how your information can be shared. Everyone working for Bristol Old Vic is subject to the duty of confidentiality. Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.

Whenever your information is stored online, we have a data sharing agreement with the data processor which states the requirements of high level security for your personal data. Should there be a breach of this data, they are obliged to inform us immediately and we will then inform you if it is necessary under Data Protection guidance. It is your right to be informed.

When we do send you information, we do so securely and are committed to reporting any breaches of data during its transit. Whenever possible all information that identifies you will be removed.

We will not transfer, process or store your data anywhere that is outside of the European Economic Area.

Retention periods

We will only retain information for as long as necessary. Records are maintained in line with our retention schedule which determines the length of time records should be kept. We are bound by law to retain certain financial records, and these circumstances override our other retention periods.

We will ask you to check and update your contact preferences periodically so that we know our database is up to date. You can withdraw your consent, or make changes to your contact preferences at any time.

We actively maintain customer data, including communications with you, previous records or ticket, donations, membership status and other purchase histories to allow you to sign in to your account even if you have not booked with us for a while, and to continue to allow you to update and make changes to your marketing preferences. This also allows us to look up your customer account if you book with our box office staff. You are also able to view your previous orders when you log in to your customer account on our website. If your account has had no activity for some time, before it has gone 6 years with no activity, it will be made inactive from our database, thereby restricting access to the information, but it is stored indefinitely such that for any subsequent enquiry or activity you make we are able to link back to a single unique record that we hold for you on our system.
We retain personal data for our Restaurant, Wedding and Event services for 5 years.
We retain CCTV for no longer than 30 days by default. If downloaded for investigating an incident, CCTV is stored for no longer than 6 months.
We retain Cookies information for 5 years.
Google Analytics retains some data that can identify you as a returning user to our website. This data is purged after a maximum of 26 months after your last visit.
We retain any complaints, queries or written communications with you for 5 years.
We retain images and video recordings for promotional and commercial purposes indefinitely.

Where the data retention period varies from that outlined above, you will be notified at the point of collection.

When personal data is no longer required by the organisation, it is deleted or securely destroyed.

You have the right to request we remove the information we store about you. Please contact us, and we will be happy to discuss this with you. Any objections you make to any processing of your data will be stored against a record on our system so that we can comply with your request.

Your rights

You have the right to:

object to processing of personal data that is likely to cause, or is causing, damage or distress;
object to the processing of your data where Bristol Old Vic is relying on its legitimate interest as the legal grounds for processing;
prevent processing of your personal data;
port your data using an open format document, like a .csv Excel document;
object to decisions being taken by automated means;
in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
claim compensation for damages caused by a breach of the Data Protection regulations

Right to lodge a complaint

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner's Office at ico.org.uk/concerns.

How to access your personal information (Subject Access)

You have the right to see the information that Bristol Old Vic holds about you, and why we hold it. You also have the right to rectify any inaccurate information we hold about you. Requests must be made in writing (not verbally). You will need to provide:

Full name, address, email address, phone number, customer ID, so that your identity can be verified against our records and your information located
Copy of Photographic ID
An indication of what information you are requesting to enable us to locate this in an efficient manner

A request for information must be made with the appropriate person:

Edward Preece, Head of People.

Email: dataprotection@bristololdvic.org.uk | Address: Bristol Old Vic, King St, Bristol, BS1 4ED | Tel: 0117 949 3993

There is no fee for Subject Access Requests. Bristol Old Vic reserves the right in certain situations to refuse the request, otherwise we will comply within one calendar month.

The request's response will cover the following detail;

Any personal data that is being processed
A description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people
A copy of the information comprising the data; and details of the source of the data

If you require Subject Access Requests or our response to them in braille or any other format please contact us and we will happily arrange this as quickly as possible.

Updates

This document was last reviewed in July 2024 by: Rebecca Molloy, Business Intelligence Analyst.

The following updates were made:

Moved “To produce and exploit audio-visual programmes for commercial purposes…” to consent.
Updated list of data processors in “How we collect and use this information” section.
Updated retention period information for CCTV images.
Clarified wording for right to request removal of information.
Changed contact person for data protection.

Privacy Notice