Engagement Privacy Notice

Please also see our standard Privacy Notice

How we use the data we collect

Bristol Old Vic is committed to protecting your  personal information when you are using any of our services. We want the services we provide to be safe and enjoyable environments for our audiences, customers and visitors. This Privacy Notice relates to our use of any personal information we collect from you via the following services:

  • Signing up to our Young Company / Adult Company / Bursary applications 
  • Registering with any of our Engagement Projects
  • our emails to you
  • your Young Company and Adut Company sessions at Bristol Old Vic 
  • working with us outside of Bristol Old Vic on Engagement Projects. 

It also relates to our use of any personal information you provide to us by phone, SMS, messenger apps (eg. WhatsApp), email, in letters and other written correspondence, and in person.

In order to provide you with access to our engagement offer, and to stay in touch with us about what we're doing, we need to collect information about you.

This Privacy and Cookies Policy explains the following:

  • what information Bristol Old Vic may collect about you
  • how Bristol Old Vic will use information we collect about you
  • when Bristol Old Vic uses your details to contact you
  • when Bristol Old Vic will disclose your details to anyone else
  • your choices and rights regarding the personal information you provide to us
  • the use of Cookies on our website and how you can reject Cookies.

Bristol Old Vic is committed to safeguarding your personal information. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 1998 and the General Data Protection Regulation 2018. No website can be completely secure; if you have any concerns that your data could have been compromised please get in touch straight away by contacting the Engagement department.

Our website contains hyperlinks to websites owned and operated by third parties. These third party websites have their own privacy policies, and are also likely to use Cookies, and we therefore urge you to review them. They will govern the use of personal information you submit when visiting these websites, which may also be collected by Cookies. We do not accept any responsibility or liability for the privacy practices of such third party websites and your use of such websites is at your own risk.

Who we are and who is collecting it?

Bristol Old Vic & Theatre Royal Trust Ltd (referred to throughout this document as "Bristol Old Vic") is the oldest continually running theatre in the UK. Our mission is to create pioneering twenty-first century theatre in partnership with the people of our energetic city; inspired by the history and magical design of the most beautiful playhouse in the country.

Bristol Old Vic is a charity, Charity no. 228235, Company no. 756007.

Bristol Old Vic also runs Bristol Old Vic (Trading) Ltd (04130983) and Bristol Old Vic Production Company Limited (09349396), and Bristol Old Vic Film Limited (13387162 - previously Bristol Old Vic Touching the Void Limited) which are all wholly owned subsidiaries. Information is shared feely between these three companies.

We aim to be entirely upfront and open about the customer data that we use. Collecting this data makes it possible for you to register with us for our Young Company, Adult Company and other Engagement Projects, keep up to date with our activities, and engage with us in other ways like supporting our continued future.  We do not obtain any personal data that we think would be likely to cause individuals to object to or complain about, but we are always open to discuss with you any of the information we hold.

It is possible that Bristol Old Vic may, from time to time, expand or reduce its business and this may involve the sale of certain divisions or the transfer of control of certain divisions to other parties. Data provided by Users will, where it is relevant to any division so transferred, be transferred along with that division and the new owner or newly controlling party will, under the terms of this Policy, be permitted to use the Data for the purposes for which it was supplied by you. In the event that any Data submitted by Users will be transferred in such a manner, you will be contacted in advance and informed of the changes. When contacted you will be given the choice to have your Data deleted or withheld from the new owner or controller.

Information that we collect, process, hold and share

  • Personal Information
    • Full Name
    • Full Name of Child
    • Full Name(s) of Parent(s)
    • Email Address
    • Phone Numbers and Mobile Number
    • School
    • Date of Birth
    • Delivery Address
    • Billing Address
    • Access requirements 
    • Genre Preferences
    • Membership Level
    • Purchase History 
    • Donation History and Pledges
    • Gift Aid status
    • Employer 
    • Gender
  • Sensitive Information
    • Medical Information
    • Access requirements
    • Ethnicity
    • Sexuality
  • Card Details (for purchases and for you Card Wallet)
  • Email and Newsletter records including emails sent, emails opened by you, and links opened by you
  • Publicly Accessible Profile Information from internet including Facebook, Instagram and Twitter 
  • Images and Videos of you when you visit the Theatre (CCTV or as a member of the audience for promotional use) or elsewhere for Engagement projects
  • Anonymised information
    • IP address
    • Operating system
    • Cookies
      • Craft: CraftSessionId EU_MSG
      • Google Analytics: __utma __utmb __utmc __utmz __utmx __utmxx __ga __gat
      • Cloudflare: __cfduid
      • Spektrix: ASP.NET__SessionId, bristololdvic, best-seat-choice
      • __gco
      • __gid

Why we collect and use this information

We use your data for these specific purposes: 

  • To enable you to book and pay for Young Company and Adult Company session terms via our website, over the telephone and in person by setting up a customer account in your name. 
  • To enable us to contact you to provide important information in advance of your Young Company or Adult Company session or Engagement Project, such as details of the location of the event or if the session has been cancelled. 

Formally we justify the above processing as Contract Purposes, see definition in section “The legal basis on which we use this information”.

  • To enable us to keep a register of attendance, and to have emergency contact information available to our session leaders if they require it whilst your Child is attending a session.

Formally we justify the above processing as Vital Interests, see definition in section “The legal basis on which we use this information”.

  • To share your personal information with other organisations who would like to contact you.
  • To identify recurring visitors and to analyse their browsing habits within the website (Cookies).
  • To store saved shopping carts as you navigate around the website (Cookies).

Formally we justify the above processing as Explicit Consent, see definition in section “The legal basis on which we use this information”.

  • To enable us to email you about similar products and services to the one you have registered for.
  • To enable us to email you with a survey after seeing a show or participating in an event to evaluate the success of a project, or to improve the theatre's programme and facilities.
  • To evaluate the services and events we provide, to improve them for the future; and report on them to our funders like Arts Council England and Bristol City Council. 
  • To identify people on our system who may be interested in becoming a member, or supporting the charity, based on their ticket purchasing patterns, place of residence, or donation history. 
  • On occasion, for promoting our shows and events or for archival or reference purposes, by the use of photographs and videos taken of our audiences and theatre-users. 
  • For storing CCTV images of people within the premises for security.
  • To help us investigate complaints, legal claims or important incidents.

Formally we justify the above processing as Legitimate Business Interests, see definition in section “The legal basis on which we use this information”.

How we collect and use this information

Bristol Old Vic is the data controller for all the data we store. Bristol Old Vic (Trading) Ltd, Bristol Old Vic Production Company Limited and Bristol Old Vic Film Limited are joint data controllers. We use Data Processors to help us collect, process, and safely store the data that we obtain.

  • We use our website to sign you up to our E-Newsletter database. Our website is provided by Supercool. 
  • We use Spektrix Ltd to process our Box Office ticketing system including Young Company and Adult Company session term purchases, and to report on your order history, donation history, membership status, and to show trends in sales patterns. 
  • We use Dot Digital to send you, Newsletters and keep in touch via email.
  • We use Upshot to store registration details of participants and details of projects engaged with. This information is used to report internally and to funders after being anonymised.
  • We use Illuminate to report anonymised data to Arts Council England.
  • We use WhatsApp for group updates on some projects.
  • We may use other similar services provided by other parties, but which do not adversely affect your rights on the terms of this notice. 
  • We do not use any services that include automated decision making of any significance to the individual. The consequences of being subjected to the automated profiling systems that we have in place is limited to specific marketing or fundraising campaigns directed at specific customer types based on their purchase and donation history or post code area. This will not override your marketing preferences which can be updated at any time within your customer account on the website or by contacting box office.
  • We may also share pseudonymised data with Meta, to help us to identify customers who are similar to our audiences, target the adverts that we serve, and ensure they are relevant to new and existing customers. Pseudonymising the data (replacing personal identifiers with placeholder values) ensures the data shared is protected.

The legal basis on which we use this information

There are four legal bases under which we may process your data.

Contract Purposes
When you make a purchase from us, including for Young Company and Adut Company session payments, or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your data. 

Vital Interests
In order to protect the vital interests of you or your child during engagement sessions or projects, we collect and use information. 

Explicit Consent
When appropriate, we will ask you for your explicit consent before using your personal information in that specific situation. We will update your consent periodically. You have the right to withdraw consent at any time, and this can be done via your Customer Account on the website or by contacting our Box Office.

Legitimate Business Interests
We collect and process your personal information for purposes that are in our legitimate organisational interests. We do this carefully, and in a way that we believe there is no overriding prejudice to you by using your personal information in this way. You have the right to object, amongst other rights explained later in this document.

Children

We take the protection of children and their personal data very seriously. For this reason, as we are unable to verify parental consent, no-one under the age of 13 is permitted by us to use our website or services. Children under the age of 13 must ask their parents or carers to make bookings/registrations/applications for them. The data we hold for Children under 13 will therefore be given only by the parent or guardian of the child. Anyone over the age of 13 may provide their own information.

Web Browser Cookies

Bristol Old Vic may set and access Cookies on your computer. A Cookie is a small file that resides on your computer’s hard drive and often contains an anonymous unique identifier and is accessible only by the website that placed it there, not any other sites. You may restrict your internet browser's use of Cookies.

  • You may delete Cookies, however you may lose any information that enables you to access the website more quickly.  
  • You can choose to enable or disable Cookies in your web browser. By default, your browser will accept Cookies, however this can be altered. 
  • For further details please consult the help menu in your browser. Disabling Cookies may prevent you from using the full range of services available on the website.

Collecting this information

Whilst the majority of the personal information you provide to us is mandatory, some of it is provided to us on a voluntary basis, and we will make this clear to you when we collect the data from you by marking the 'Required' fields. Anything that does not say 'Required' next to it is voluntary.

Not providing information

Any information that we ask for other than those listed below is entirely voluntary. Not providing any of the voluntary information will not preclude you from any of the products or services we offer or effect you in any other way. 

In order to register for the Young Company, we require:

  • Full Name of Child
  • Full Name(s) of Parent(s)
  • Emergency Contacts 
  • Email Address
  • Date of Birth of Child
  • Address
  • Phone Number

In order to register for the Adult Company, we require: 

  • Full Name 
  • Email Address
  • Address
  • Phone Number

In order to apply for Bursaries, we require: 

  • Full Name of Child
  • Full Name(s) of Parent(s)
  • Email Address
  • Address
  • Phone Number 
  • Emergency Contacts 

In order to register for Engagement Projects, we require: 

  • Full Name of Child
  • Full Name(s) of Parent(s)
  • Email Address
  • School
  • Date of Birth of Child
  • Address
  • Phone Number
  • Gender of Child

In order to sign up to our eNewsletter or create a customer account, we only require:

  • First Name
  • Last Name 
  • Email Address

Once a customer account has been created, we need to store the following information on your account: 

  • Purchase History 
  • Membership Level
  • Donation History
  • Gift Aid declaration

In order to book and pay for tickets (including Young Company and Adult Company sessions), we only require: 

  • Your customer account details, and – 
  • Phone Number
  • Billing Address
  • Card Type
  • Card Number (our staff members are not able to see your full card number)
  • Expiry Date
  • Start Date (only if required by your bank)
  • Issue Code (only if required by your bank) 
  • Security Code (we never store your 3 or 4 digit security code)

All debit and credit card information is processed securely, and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). We optionally allow you to store your card details for use in a future transaction. This is carried out in compliance with PCI-DSS.

Storing this information

We store your personal data securely using suitable physical, electronic and managerial procedures to safeguard and secure all and any customer data and personal information. We will ensure that any third parties we use for processing your personal data do the same. We limit internal access to your personal data to only those who require it, and provide all our staff with Data Protection and Information Security training. We ensure that high standards of security and protection are met by abiding by our Data Protection Policies and Procedures, and these are governed by the Senior Management Team and the Board of Trustees.

Under the Bristol Old Vic's Confidentiality Code of Conduct, all our staff are required to protect your information, and inform you of how your information will be used. This includes, in most circumstances, allowing you to decide if and how your information can be shared. Everyone working for Bristol Old Vic is subject to the duty of confidentiality. Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.

Whenever your information is stored online, we have a data sharing agreement with the data processor which states the requirements of high level security for your personal data. Should there be a breach of this data, they are obliged to inform us immediately and we will then inform you if it is necessary under Data Protection guidance. It is your right to be informed.

When we do send you information, we do so securely and are committed to reporting any breaches of data during its transit. Whenever possible all information that identifies you will be removed.

We will not transfer, process or store your data anywhere that is outside of the European Economic Area.

Retention periods

We will only retain information for as long as necessary. Records are maintained in line with our retention schedule which determines the length of time records should be kept. We are bound by law to retain certain financial records, and these circumstances override our other retention periods. 
We will ask you to check and update your contact preferences periodically so that we know our database is up to date. You can withdraw your consent, or make changes to your contact preferences at any time. 

  • We delete Sensitive Personal Information within 90 days of the end of the related activity ending. Any retained data after this point will have been anonymised.
  • We actively maintain customer data, including communications with you, previous records or ticket, donations, membership status and other purchase histories to allow you to sign in to your account even if you have not booked with us for a while, and to continue to allow you to update and make changes to your marketing preferences. This also allows us to look up your customer account if you book with our box office staff. You are also able to view your previous orders when you log in to your customer account on our website. If your account has had no activity for some time, before it has gone 6 years with no activity, it will be made inactive from our database, thereby restricting access to the information, but it is stored indefinitely such that for any subsequent enquiry or activity you make we are able to link back to a single unique record that we hold for you on our system. 
  • We retain CCTV for no longer than 30 days by default. If downloaded for investigating an incident CCTV is stored for no longer than 6 months.
  • We retain Cookies information for 5 years.
  • Google Analytics retains some data that can identify you as a returning user to the site. This data is purged after a maximum of 26 months after your last visit.
  • We retain any complaints, queries or written communications with you for 5 years.
  • We retain images and video recordings for promotional and commercial purposes indefinitely.

Where the data retention period varies from that outlined above, you will be notified at the point of collection.

When personal data is no longer required by the organisation, it is deleted or securely destroyed. 

You have the right to request we remove the information we store about you. Please contact us, and we will be happy to arrange this for you if you want us to. Any objections you make to any processing of your data will be stored against a record on our system so that we can comply with your request.

Who we share personal information with and how this will affect you

We do not sell any of your information for the purposes of marketing or fundraising. We do not share your personal information with third parties, unless you have given us specific consent to do so, or if we are required to do so in order to deliver a Box Office service at another venue, or due to our obligations to comply with current legislation and bank transactions, or our duty to comply with a Court Order.

However, we do employ the services of other party’s software and services in order to collect and store your personal information, for example we use Spektrix as our ticketing system software provider for booking tickets and creating customer accounts that can be accessed on our website. The providers of such services may have access to certain personal data provided by you. Any data used by such parties is used only to the extent required by them to perform the services that Bristol Old Vic requests. Any use for other purposes is strictly prohibited within a data sharing agreement between us and the provider. Furthermore, any data that is processed by third parties must be processed within the terms of this policy and in accordance with the United Kingdom Data Protection Act 1998 and General Data Protection Regulation 2018. 

Your rights

You have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress;
  • object to the processing of your data where Bristol Old Vic is relying on its legitimate interest as the legal grounds for processing;
  • prevent processing of your personal data;
  • port your data using an open format document, like a .csv Excel document;
  • object to decisions being taken by automated means;
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and
  • claim compensation for damages caused by a breach of the Data Protection regulations.

Right to lodge a complaint

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at ico.org.uk/concerns

How to access your personal information (Subject Access)

You have the right to see the information that Bristol Old Vic holds about you, and why we hold it. You also have the right to rectify any inaccurate information we hold about you. Requests must be made in writing (not verbally). You will need to provide:

  • Full name, address, email address, phone number, customer ID, so that your identity can be verified against our records and your information located.
  • Copy of Photographic ID
  • An indication of what information you are requesting to enable us to locate this in an efficient manner.

A request for information must be made with the appropriate person: 

Edward Preece (Head of People)

Email: dataprotection@bristololdvic.org.uk | Address: Bristol Old Vic, King St, Bristol, BS1 4ED | Tel: 0117 949 3993

There is no fee for Subject Access Requests. Bristol Old Vic reserves the right in certain situations to refuse the request, otherwise we will comply within 1 calendar month. 

The request's response will cover the following detail;

  • Any personal data that is being processed.
  • A description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people. 
  • A copy of the information comprising the data; and details of the source of the data 

If you require Subject Access Requests or our response to them in braille or any other format please contact us and we will happily arrange this as quickly as possible.

Updates

This document was last reviewed in July 2024 by: Rebecca Molloy, Business Intelligence Analyst.

  • Updated list of data processors in “How we collect and use this information” section.
  • Updated retention period information for CCTV images.
  • Changed contact person for data protection.