Privacy Policy

Last updated: 22 July 2026

The Royal Lyceum Theatre Company Limited (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, purchase tickets, make donations, become a member, contact us, or otherwise engage with our services. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

1. Who We Are

The Royal Lyceum Theatre Company Limited is registered in Scotland as a private company limited by guarantee (SC062065) and as a charity (SC010509). Registered office: 30B Grindlay Street, Edinburgh, EH3 9AX, United Kingdom. Email: dataprotection@lyceum.org.uk. For the purposes of data protection law, The Royal Lyceum Theatre Company Limited is the data controller of your personal information.

2. Personal Information We Collect

We may collect and process the following categories of personal information. Information you provide directly includes your name, postal address, email address, telephone number, date of birth, account login details, membership information, donation history, communication preferences, contact form submissions, and customer service enquiries. 

Ticketing and transaction information may include booking history, seat preferences, event attendance history, payment confirmation details, and refund or exchange records. 

Payment card details are processed securely by third-party payment providers and are not stored by us. 

Where you apply for our Access Pass or request accessibility support, we may collect limited information relating to disabilities, access requirements, seating requirements, and other accessibility needs. This data is treated as special category personal data and is processed with additional safeguards. When you use our website, we may automatically collect technical information including your IP address, browser type and version, device information, operating system, website usage data, and cookie or tracking data.

If you contact us with feedback online, by email, by phone or in person:

We keep a record of the correspondence on our database to help us improve our customer service.

3. How We Collect Information

We collect information when you visit our website, create an account, purchase tickets, become a member, make a donation, sign up for newsletters, complete a contact form, apply for an Access Pass, contact our staff, engage with us on social media, or accept cookies and tracking technologies. We may also receive information from trusted third-party service providers who support our operations.

4. How We Use Your Information

We use your personal information to process ticket sales, memberships and donations, manage your online account, deliver customer support, send booking confirmations and service communications, provide accessibility support, administer memberships and benefits, improve our website and services, analyse audience engagement and trends, send marketing communications where permitted, comply with legal and regulatory obligations, and protect against fraud and misuse.

5. Lawful Basis for Processing

Under UK GDPR, we rely on one or more lawful bases for processing your data. Contract applies where processing is necessary to sell tickets, manage memberships, process donations, or deliver services you request. Legitimate interests applies where processing is necessary for improving services, understanding audience behaviour, planning programming, preventing fraud, and ensuring operational security. We ensure these interests do not override your rights. Consent is relied upon for email marketing where required, certain cookies and tracking technologies, and processing certain accessibility data where appropriate. You may withdraw consent at any time. Legal obligation applies where processing is necessary to comply with financial reporting obligations, charity law, tax requirements, or law enforcement requests. Where we process disability or accessibility data, we do so under lawful conditions that permit processing of special category data, including explicit consent or substantial public interest where applicable.

6. Marketing Communications

We may send you information about upcoming productions, events, membership offers, fundraising campaigns, news, and updates. We will only send marketing communications where you have consented or where we are otherwise legally permitted to do so. You can unsubscribe at any time by clicking the unsubscribe link in emails, updating your account preferences, or contacting dataprotection@lyceum.org.uk.

Where we (or a third party) carry out any filming, including interviews, or filming/photography of talks, or events in our venues. Where our areas are going to be used for filming or photography, we will flag this in advance with clear signage or otherwise make you aware so that you can avoid being filmed or photographed. We take great care to protect the rights of children and do not use the personal information of anyone under 18 years old in such materials without the explicit consent of their parent or legal guardian. We may, however, use images where children are incidentally pictured (for example, as part of a crowd).

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to ensure website functionality, remember preferences and login details, process transactions and ticket bookings, measure website performance, understand visitor behaviour, improve user experience, and support marketing and advertising campaigns. We use tools including Google Analytics, Meta Pixel, Dotdigital, and Spektrix. Where required by law, we obtain your consent before placing non-essential cookies or tracking technologies on your device. For more detailed information about the cookies we use, including how to manage your preferences, please see our Cookie Policy at https://lyceum.org.uk/cookie-policy.

8. Third-Party Service Providers

We use trusted third-party providers to help deliver services, including Spektrix for ticketing, CRM and customer accounts, Dotdigital for email marketing and communications, Google Analytics for website analytics, and Meta Pixel for advertising and campaign measurement. These providers process data on our behalf under contractual safeguards.

The Lyceum will never share, sell, rent or trade your personal information with or to any third parties for marketing purposes without your prior consent. We will ask for your consent to share personal information with arts organisations, co-producers and visiting companies who have collaborated with us on shows you have seen for the purposes of marketing.[LJ1] 

9. Sharing Your Information

We do not sell your personal information. We may share personal data with technology providers, payment processors, research agencies, delivery and mailing providers, professional advisers, regulators, and authorities where legally required.[LJ2]  Information is shared only where necessary and with appropriate safeguards.

10. International Transfers

Some third-party providers may store or process data outside the United Kingdom. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including UK adequacy regulations, international data transfer agreements, standard contractual clauses, or equivalent legal protections.

11. Data Retention

We keep personal information only for as long as necessary for the purposes described in this policy, including delivering services, meeting legal obligations, resolving disputes, and maintaining business records. Retention periods vary depending on the type of data and purpose of processing. When information is no longer required, it is securely deleted or anonymised.

12. Your Rights

Under UK GDPR, you have the right to access your personal data, correct inaccurate data, request deletion of your data, restrict processing, object to processing, request data portability, and withdraw consent where processing is based on consent. To exercise your rights, contact dataprotection@lyceum.org.uk. We may request proof of identity before responding.

13. Complaints

If you are unhappy with how we use your data, please contact us first so we can address your concerns. You also have the right to complain to the Information Commissioner’s Office (ICO) via https://ico.org.uk.

14. Security and CCTV

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, and disclosure. These measures include secure systems, access controls, encryption where appropriate, and staff training.

CCTV operates in and around parts of our theatre premises for the purposes of public safety, staff safety, crime prevention and detection, protecting property and assets, and assisting in incident investigations. CCTV footage may capture images of visitors, audience members, staff, contractors, and other individuals entering or using our premises. Recorded footage is securely stored and accessed only by authorised personnel or trusted security providers where necessary. We may share CCTV footage with law enforcement, insurers, legal advisers, or regulatory authorities where required or permitted by law. Footage is retained only for as long as reasonably necessary for security and investigative purposes, after which it is securely deleted unless required for an active investigation or legal proceedings. No system can be completely secure, but we continuously review and improve our security practices.

15. Children

Our services are intended for the general public. We do not knowingly collect personal information from children without appropriate safeguards or parental involvement where required.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. Any updates will be published on this page with a revised “Last updated” date.