The Royal Lyceum Theatre company Ltd PRIVACY POLICY

Updated: 23 May 2018

PURPOSE OF THIS PRIVACY POLICY

At The Lyceum we are committed to protecting your personal information and to being transparent about the information we hold about you. Using personal information allows us to develop a better understanding of our patrons, and in turn to provide you with relevant and timely information about the work that we do, both on and off stage.

Personal information also helps us as a charity to engage with current and potential donors. The purpose of this policy is to give you a clear explanation about how we collect and process your personal information through your use of our website, including any data you may provide through this website and when you sign up to our newsletter, purchase a ticket, participate in a Take Part activity or make a donation.

It is important that you read this privacy policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using your personal information. This privacy policy supplements our other policies and is not intended to override them.

We will use the information that we collect about you in accordance with:

• The Data Protection Act 1998
• The Privacy and Electronic Communications (EC Directive) Regulations 2003
• The EU General Data Protection Regulation (Regulation EU 2016/679), (‘GDPR’) which becomes effective from 25 May 2018

This policy explains:

1. Who we are
2. What information we may collect about you
3. How we collect your data
4. How we may use your information (including our use of Cookies to improve your use of our website)
5. What situations we may disclose your details to third parties
6. How we keep your personal information secure
7. Retaining and maintaining your data
8. Your legal rights
9. Notification of changes to our privacy policy
10. Contact details and further information

If you have any questions, please contact us using the contact details at the end of this policy.

For our terms and conditions of sale, please click here

• You can also download our privacy policy as a pdf here

1. WHO WE ARE
The Royal Lyceum Theatre Company Ltd is Scotland’s leading producing theatre.

We are registered in Scotland as a private company limited by guarantee under registration number SC062065 and we are a registered Scottish Charity (number SC010509) dedicated to promoting and advancing education, appreciation and understanding of the performing arts, especially theatre.

We receive less than one third of our income from statutory bodies including Creative Scotland and City of Edinburgh Council. The rest of our income comes from ticket sales and from donations from various trusts, foundations, corporations and individual donors and supporters.

Our trading company; Lyceum Theatre Trading Ltd. is a private limited company registered in Scotland number SC125708

2. INFORMATION WE MAY COLLECT ABOUT YOU
Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, i.e. anonymous data.

We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender, photo and video images of you
  
• Contact Data includes billing address, delivery address, email address and telephone numbers and in some instances the name of your school and contact details about your next of kin
  
• Relational Data information you give us about family members, individuals or organisations you are connected to
  
• Financial Data includes bank account and payment card details
  
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us
  
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website or access our free public WiFi
  
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
  
• Usage Data includes information about how you use our website, products and services
  
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. This also includes us making a note of conversations we have had with you in person and/or communications you sent to The Lyceum. This helps us to manage our relationship with you and ensures you only receive communications from us that are relevant and timely
  
• Special Category Data when providing services for children and vulnerable adults we may request medical information and emergency contact details; this is classed as Special Category Data. We use this data to ensure that staff are aware of any specific needs of participants and so we can quickly contact relevant people in the case of an emergency

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy

If you fail to provide personal information
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a ticket). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

3. HOW WE COLLECT YOUR DATA
We collect different information about you in a number of ways:

When you give us information directly:

• Creating an account on our website,
• Signing up to our mailing list
• Buying tickets, make a donation or purchase a membership
• Joining programmes or courses
• Signing up to our newsletter
• Requesting marketing materials
• Completing a survey
• Applying for a position, paid or voluntary
• Giving us feedback by telephone, electronically, by post or in person
• Contacting us on one of our online platforms such as Twitter, Facebook and others
• Giving your consent for filming and/or photography at one of our participatory workshops or events

Then we will store the personal information you give to us such as your name, email address, postal address, telephone number and card details. We will also keep a record of your purchases and donations

Information about your interactions with us
As you interact with our website, or mention us on social media sites we may automatically collect Technical Data about your equipment, browsing actions and patterns.

When we send you a mailing we store a record of this, and in the case of emails we keep a record of which ones you have opened and which links you have clicked on. We collect this personal data by using cookies and other similar technologies.

When you visit us

• We have closed circuit television on the site. These cameras record activity for your, and our, security 24 hours a day.
  
• At some performances and events we may take photographs or record film for archive, publicity or marketing purposes. We will always place signage in the area if there is a photographer or filmmaker present. At participant based classes or workshops we will always seek your consent. At public events such as performances, audience members may request to not be included in any images or film by speaking to a member of staff.
  
• If you have an accident while on the premises we will record your contact information and details of your injury for HSE purposes. We may also record your contact details in connection to other queries you may have while on site.
  
• If you visit the backstage area of the theatre, we may record your personal details to monitor who is on the premises.

Information from third parties

We occasionally receive information about you from third parties as set out below:

• Analytics providers such as Google
• Advertising networks such as Facebook
• Search information providers such as Google AdWords
• Third party research companies to provide general information about you, compiled using publicly available data.

4. HOW WE MAY USE YOUR INFORMATION
We will only use your personal information when the law allows us to.Most commonly, we will use your personal information in the following circumstances:

• To fulfil our contract with you
  When you make a purchase from us or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your data. For example we may need to post your tickets to you or contact you by email or telephone in the case of cancellation of a show, or in the case of problems with your payment.
• For our legitimate business interests
  Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• To meet our legal obligations
  Where we need to comply with a legal or regulatory obligation, for example proving Gift Aid status to HMRC
• With your explicit consent
  Where we have your explicit consent for a specific use of your personal information.Generally we do not rely on consent as a legal basis for processing your personal information and you have the right to withdraw consent to marketing at any time by contacting us. You will find the relevant contact details at the end of this policy.

Purposes for which we will use your personal information

We have set out below, in a table format, a description of all the ways we plan to use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Please note that we may process your personal information for more than one lawful ground depending on the specific purpose for which we are using your information. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing communications
We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful, and never excessive. To do this, we use data that we have stored about you, such as which events you have booked for in the past, as well as any contact preferences you may have told us about.

We use our legitimate organisational interest as the legal basis for communications by post and email. In the case of postal mailings, you may opt out of receiving these at any time using the contact details at the end of this policy or by updating your contact preferences in your online account with us.

In the case of email, we will give you an opportunity to opt out of receiving electronic communications during your first purchase with us. If you do not opt out, we will provide you with an option to unsubscribe in every email that we send you subsequently. Alternatively, you can use the contact details at the end of this policy or update your contact preferences in your online account with us.

As part of our service to you, we may contact you by email or telephone to provide essential information related to your purchase and visit.

Fundraising communications
The Royal Lyceum Theatre Company is a registered charity. Under our legitimate organisational interest, we may contact you by post, or occasionally by telephone, to seek your support for our philanthropic priorities. You are able to opt out at any time by using the contact details at the end of this policy or by updating your contact preferences in your online account with us.

Additionally, and only if you have given your consent, we may contact you by email to seek your financial support.

Other processing activities
We may use profiling techniques or third-party wealth screening and insight companies to provide us with information about you that will help us to communicate in a relevant way with you, in particular when we are approaching you about potential philanthropic support. Such information is compiled using publicly available data about you.

If you make a donation or become a member of one of our philanthropic membership schemes, we may ask if you would like your name to be credited in publicity materials and donor attribution boards displayed in public areas at The Lyceum.

We may conduct further research or use profiling or wealth screening techniques to ensure communications are relevant and timely and to provide an improved experience for our supporters. Profiling also allows us to target our resources effectively. We do this because it allows us to raise more funds, sooner, and more cost-effectively than we otherwise would.

When building a profile we may analyse geographic, demographic and other information relating to you in order to understand your interests and preferences. In doing this we may use third party sources. We build a profile using the information you have given us and publicly available information. Data gathered from this research is stored as Personal and Special Category Data.

You can opt out of your data being used for this purpose by contacting: dataprotection@lyceum.org.uk

You have the right to object to any of this processing at any time. If you wish to do this, please use the contact details at the end of this policy.

Use of ‘Cookies’
Our website uses something called cookies. A cookie is a small text file of letters and numbers that gets put onto your computer when you visit a website. This allows the site to distinguish you from other users. A cookie isn't a computer programme, can't read files on your computer, can't carry viruses and can't install malware onto your computer.

At The Lyceum we use essential cookies to keep track of what you have in your basket, process transactions and to remember you when you return to our site. We also use non-essential cookies to track how you use our site for analytical purposes and to monitor digital advertising.

If you do not wish to enable cookies, you will still be able to browse the site but you will not be able to login or purchase tickets.

For more information please visit this page which explains the cookies we use on our site and what they do.

5. DISCLOSURE OF YOUR DETAILS TO THIRD PARTIES

There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:

• To our own subsidiary Lyceum Theatre Trading Ltd. when it is necessary for them to be able to provide you with products or services that you’ve requested such as interval drinks
  
• To our service providers who process data on our behalf and on our instructions (for example our ticketing system software provider). We require all third parties to respect the privacy of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions
  
• Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies)
  
• To specific, named visiting companies whose performances you have attended
  
• When you book for a performance that is produced or co-produced by a company other than The Lyceum, we may ask if you wish to opt-in to receive information directly from them. If you choose to do this we will inform you once this information has been passed on and the company in question will then contact you to give you the option to opt-out. Conversely, on occasion we may obtain your details from a third party that you have given permission to share your details. If we contact you based on this, we will always state where this information comes from in the first communication and give you a clear opt-out option
  
• On occasion, The Lyceum may act as a ticket agent to sell tickets on behalf of another company, organisation or promoter. These third parties do not have access to our systems, however we may share basic contact information with them to enable them to administer your purchase. Where we are selling on behalf of another company we will make this clear to you when booking
  
• We may share anonymised personal information with other organisations, particularly the audience development agency Culture Republic , who use this to analyse our audience development programmes, ticket sales and self-generated funding to understand the impact of the public investment made in The Lyceum.

We will always ask for your consent to pass on your personal details to other arts organsiations.

We do not sell personal details to third parties for any purpose.

6. SECURITY OF YOUR PERSONAL INFORMATION

Your debit and credit card information
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard (https://www.pcisecuritystandards.org/pci_security/). We give the option for you to store your card details safely for use in future transactions. This is carried out in compliance with PCI-DSS and in a way where none of our staff members can see your full card number. We never store your 3 or 4-digit security code.

Security of your personal information
We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We have processes in place and carry out regular reviews of who has access to data to ensure that your information is only accessible to appropriately trained staff and contractors

We will ensure that any third parties we use for processing your personal information do the same and that they will only process your personal information on our instructions. The third parties will also be subject to a duty of confidentiality.

We will not transfer, process or store your data anywhere that is outside of the European Economic Area, unless we have a contractual agreement in place that provides an equivalent standard to GDPR.

If legally required we may disclose your information to the police, regulatory bodies or legal advisors. We will only share your data in other circumstances with your consent.

If there is a breach of data that is likely to have a detrimental effect on individuals (for example, result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage), CFT will notify the Information Commissioners Office within 72 hours of becoming aware of the breach. Any individuals affected will also be notified within this timeframe.

Special Category Data
Special Category Data may be asked for in certain instances; this includes your bank details (if you set up a regular payment), ethnicity, gender identity, medical information and next of kin.

This information is available to a restricted number of staff for whom it is deemed necessary. It is used to process some transactions, in the case of an emergency, or aggregated and anonymised for monitoring and reporting as required by public funding bodies.

Paper files with Personal and Special Category Data are kept to a minimum and are stored securely when not in use.

Children’s Data
We collect and store data for under 16s who participate in our learning, education and participation (LEAP) activities, which includes Special Category Data. Where possible and when appropriate, we obtain consent from the parent/carer of the child before collecting this data. This information is available to a restricted number of staff for whom it is deemed necessary. When the young person reaches 16, consent is sought from the individual.

We understand that people aged under 16 may use this website. To request to see our safeguarding policy, please contact us using the contact details at the end of this policy.

7. RETAINING AND MAINTAINING YOUR DATA

We may store your personal information indefinitely such that for any subsequent purchases you make we are able to link them back to a single unique record that we hold for you on our system. Please let us know when your details change so we can make sure that our information is current. However, we do have other processes in place to ensure that we keep our records up to date:

• If we find a record on our system that matches another one and we are sure it is the same person, we may merge the two accounts so we have all your information in the same place
  
• Images and film taken of public and participants may be used for up to ten years for marketing and publicity purposes by The Lyceum. After this point it will either be deleted, or if deemed to be of historical and public interest, added to our archive
  
• We will deactivate your account if there has been no purchase/donation/participation or a membership with an expiry date in the last 10 years and will delete any Special Category Data
  
• We will remove the postal contact preferences if no purchase/ donation/ membership has been made on your account for 5 years
  
• We will remove the email marketing contact preferences if emails are not opened for 1 year
  
• We will remove the telephone contact preferences if no purchase/ donation/ membership has been made on your account for 3 years
  
• If you apply for a job at The Lyceum and your application is unsuccessful, we delete/destroy the application 6 months after the closing date
  
• If you apply for Work Experience, or to be a volunteer at The Lyceum and your application is unsuccessful, we delete/destroy the application 6 months after receipt
  
• If you have participated in a TAKE PART event/class or have been a member of The Lyceum Youth Theatre (LYT) we remove all Special Category Data 1 year after the event or class, or once you cease to be a member of LYT
  
• Any paper documents to support a membership will be destroyed when the membership expires, or when the membership is cancelled
  
• CCTV records are kept for a maximum of thirty-five days before being deleted.

If there are aspects of your record that are inaccurate or that you would like to remove, you can usually do this by logging in to your account through our website. Alternatively please use the contact details at the end of this policy.

8. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal information, as follows:-

Request access to your personal information
You have a right to request a copy of the personal information that we hold about you. Please use the contact details at the end of this policy if you would like to exercise this right, or any of the rights listed below. If you are a European citizen and consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, i.e. the Information Commissioner’s Office.

Request correction of your personal information
You have the right to request that we correct the personal information we hold about you, although we may need to verify the accuracy of the new information you provide to us.

Request erasure of your personal information
You have the right to request that we delete or remove personal information where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request for erasure if there are specific legal reasons- which will be notified to you at the time of your request.

Object to processing of your personal information
You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Any objections you make to any processing of your data may be stored against your record on our system to ensure that we can comply with your requests.

Request restriction of processing your personal information
You have the right to request that we suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request transfer of your personal information
You have the right to request that the personal information we hold about you is transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent
In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Please also note the following:-

No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

9. NOTIFICATION OF CHANGES TO OUR PRIVACY POLICY

This privacy policy may change from time to time. We will always communicate any changes to our patrons and supporters where we have accurate contact details and where they would expect to receive communications from The Lyceum. Please visit this section of our website periodically in order to keep up to date with changes in our privacy policy.

10. CONTACT DETAILS AND FURTHER INFORMATION

Please get in touch with us if you have any questions about any aspect of this privacy policy, and in particular if you would like to object to any processing of your personal information that we carry out for our legitimate organisational interests.

Please also contact us if you have any questions about the information we hold about you, or to change your contact preferences with us:

Alternatively, please email dataprotection@lyceum.org.uk

Call us: 0131 248 4848

Write to us:

Data Protection Query
Royal Lyceum Theatre Company
Grindlay Street
Edinburgh
EH3 9AX

Privacy policy effective from 23 May 2018.
We keep this Policy under regular review.
If you would like to review our archived Privacy Policies, please contact us at the address above.