|Review Interval||Next review due|
|Every two years||July 2020|
Purpose of Policy
The Citizens Theatre is committed to protecting your personal information and being transparent about what information we hold about you.
Using personal information allows us to develop a better understanding of our patrons and supporters and in turn to provide you with relevant and timely information about the work that we do - both on and off stage. As a charity, it also helps us to engage with current potential donors and supporters.
The purpose of this policy is to give you a clear explanation about how we [and all of our subsidiaries] collect and use the information we collect from you directly and from third parties.
We use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:
Who We Are
The Citizens Theatre is theatre building and company based in Glasgow, UK. We are a charity and receive funding from our two main supporters, Creative Scotland and Glasgow City Council as well as various trusts, foundations and individual donors and supporters. Our registered charity number in Scotland is SC01337 and we are also registered as a company in Scotland under registration number SC022513.
We are registered as a data controller with the Information Commissioner’s Office and our ICO registration number is: Z9321265
Our registered office: Citizens Theatre, 119 Gorbals Street Glasgow G5 9DS
How we collect your data
We collect your information when you interact with us. This could include making purchases or donations or attending events. It could also be when you sign up to receive updates from us by email and other digital channels, or interacting with our social media channels. We also monitor how visitors use the website to help us understand how it could be improved.
We collect personal information when you:
- 1.Create an account at citz.co.uk, which allows you to:
- a.Buy tickets or places on classes
- b.Join as a member (e.g. Gorbals Card holder, Friends of the Citizens Theatre member)
- c.Make a donation
- d.Buy programmes, playtexts or merchandise related to shows you’re seeing
- 2.Contact us by phone to book tickets, make a donation, or buy merchandise.
- 3.Book tickets, make a donation or buy merchandise in person.
- 4.Contact us by post, e.g. application forms for Memberships or our Access List.
- 5.Visit our website.
- 6.If, as a teacher, you book a group to attend a performance or workshop or engage with a Citizens Learning activity.
- 7.Take part in a Citizens Learning activity or enrol a dependent on such an activity.
- 8.Attend an event by invitation, such as a guest night, gala event.
- 9.From time to time, we may also get data about you from third parties. For more information see the next section.
Information you give us
The information we hold about you or which we process which you provide us can include:
Prefix and name
Date of Birth
Contact phone number(s)
Payment card details (we do not store your card details but may ask for this information to process a purchase or booking)
We may also collect:
Whether you are in receipt of any state benefits
Information about any additional access requirements that you tell us about
We may also request and store relational data from you, for example when booking a place for a child or dependent at one of our drama classes, or if you are a carer, parent or guardian for a visitor or participant.
Information about your interactions with us
We will store information about your purchase and donation history with us, and we will use this to provide targeted communications to you with your consent, and for research and monitoring purposes.
We collect information about how you interact with our content and advertising. For example, we keep records of which emails you have opened, and the links that you have clicked on. We do this to provide you with a better service, and to better inform you of events that will be of interest to you.
We use CCTV recording equipment in and around our premises for the purposes of public and staff safety. We may provide this footage to law enforcement or other authorised bodies for the same purpose.
At some performances and events we may take photographs or record film for archive, marketing and publicity or reporting purposes. We will always display prominent signage where this activity takes place. At Citizens Learning events, we will always seek your permission. At public events such as performances, members of the public may request not to be included in images or film by speaking to any member of Citizens Theatre staff.
Information from third parties
We may receive information about you from a third party when you have given them consent to share your data with us (e.g. where Citizens Theatre presents an event at another venue). We will always make clear in our first communication where this data has been sourced from
We will receive information about you if you buy tickets for a Citizens Theatre event through another ticket seller (e.g. See Tickets, Glasgow Life / Tramway box office, itison.com or 5pm.com). We use this information in order to process your purchase and issue your ticket.
We receive information from analytics services such as Google and use this to monitor your use of our website and provide you with a better experience when you visit. We also us this information to provide you with targeted digital advertising about events that we think will be of interest to you.
When you interact with us via social media channels such as Facebook, Twitter, Youtube etc. we will collect this data and use this to monitor the effectiveness of these channels and provide you with targeted advertising about events that we think will be of interest to you. We only receive personal information that you share with us voluntarily and that is compatible with your privacy settings. To find out more about how these social media companies process your personal information, we recommend that you read their privacy policies.
Sensitive personal data
Certain categories of information are more sensitive, such as health information, race, religious beliefs and political opinions. We do not actively collect this type of data from the majority of customers. with the following exceptions:
We may request and process information about your disability or additional access needs which allow us to best support your visits to events.
Participants in Citizens Learning activities will be asked to provide medical information and emergency contact details
The processing of sensitive data noted above is necessary for our legitimate interest (delivering appropriate care to those in our charge).
The main reasons we collect and process information are to provide a service you have requested, to keep you up to date with news and events, to personalise your communications, or to contact you if we need to obtain or provide additional information (e.g. cast changes, travel disruption). The information we collect about our audiences also helps us understand how we can best meet their needs.
If you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a ticket). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
When you make a purchase from us or make a donation to us, you are entering into a contract with us. In order to perform this contract, we need to process and store your data. For example, we may need to contact you in case of a change or cancellation to a show, or to resolve problems with your payment.
Legitimate business interests
Where processing your data is necessary for our legitimate business interests (e.g. promotion of events at the Citizens Theatre, provide you with access support during your visit, reporting to funding bodies, or to raise funds) and your interests and fundamental rights do not override those interests.
To meet our legal obligations
Where we need to comply with a legal or regulatory obligation e.g. providing Gift Aid status to HMRC.
With your explicit consent
Where we have your explicit consent to process your information in that specific situation.
We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful and never excessive.
To do this, we use legitimate interest as the legal basis to process data that we have stored about you, such as what events you have booked for in the past and the type of tickets that you have purchased. In addition, we contact you only in line with the contact preferences which you have told us about at the time of creating your booking profile with us online, in person or over the phone.
If you wish to revoke your consent, you may opt out of receiving postal communications using the contact details given at the end of this policy. If you no longer wish to receive email communications from the Citizens Theatre, an option to unsubscribe is included in every email communication.
Please note that opting out of marketing communications by any methods does not mean that we will not contact you when required with information about a cancellation or change to an event you have booked for, or where we need to contact you about data we have held about you.
The Citizens Theatre is a registered charity and we rely on voluntary contributions from our audience and other funders for our work on stage, and in schools and communities across Glasgow and further afield.
What data we collect:
If you choose to support us by making a donation, joining a membership scheme or signing up to an event, we will collect your name and contact details as a minimum.
Personal data we collect may include your:
- postal address
- email address
- phone numbers
- date of birth
- whether you are a tax payer so that we can claim Gift Aid
Where appropriate, we may also ask your reason or personal experience for supporting us. We will never make this question mandatory, and will only make your answer public with your consent.
How we use your data
- Administer your donation including processing gift aid, sending thank you letters and other administrative communications;
- Keep a record of your relationship with us;
- Send you communications which you have requested and that may be of interest to you. These may include information about current campaigns, appeals or other fundraising activities;
- where it is in our legitimate interests to perform our functions, for example, processing donations or sending you administrative or marketing communications where our legitimate interest is to raise funds and to deliver our charitable purposes.
- From time to time will contact you by post, email, or phone to tell you about ways that you can support us and the work that we do. We will do this where you have previously given us consent to be contacted through your preferred channel, and will base these communications on your previous activities and purchase history with us. Based on the frequency of visits and purchasing patterns, we may promote our memberships to you, invite your to events or ask you for additional support for our work. This is done on the basis of our legitimate interest to raise funds for the work that we do.
- For a small number of people, we may use basic research tools to estimate potential interest in other membership levels or in supporting us further. This helps us understand the background of the people who may choose to support us and helps us to make appropriate requests for gifts to those who may be able and willing to give. This research may include information we hold (for example, payment methods and postcodes) and publicly-available information.
- In some cases, we will rely on legitimate interest for processing data of potential supporters. This means we may carry out initial research on potential higher level donors prior to requesting consent. This information will also help us to meet our obligations to protect the charity from financial fraud and risk.
- In addition to general use of the internet for research we make use of company, director and shareholder information from publicly available, officially registered information providers, such as the organisations in the table below.
|Information we gather||Examples of sources for this information|
|Donations made to other organisations||Google, charity and arts organisations’ annual reports, donor boards, FactaryPhi as well as Foundation Center and PRO iWave, for US supporters|
|Employment and directorships current and past||Google, Companies House, Who’s Who, and social media|
|Other publicly available information|
Factiva; Sunday Times Rich List, Financial Times
We may analyse your personal information to create a profile about your interests and preferences. This enables us to use our resources more effectively through tailoring our fundraising communications and requests and providing information that is relevant to you.
We may carry out targeted marketing and fundraising activities based on the information that we hold about you. We may also work with third party organisations who provide additional insight; this may include providing wealth screening information or general information about you that is publicly available.
From time to time we use Third Party Service providers to undertake work on our behalf to provide services to our customer. These service providers include fundraising agencies, market research companies and direct mailing companies. We may give relevant employees within these organisations access to your personal data so they can fulfil their service. We will disclose only the necessary personal data to deliver their service and our contract will require that they keep your data secure and not use this for their own purposes. We will only release your personal information to third parties for their own fundraising and direct marketing communications if we have been instructed to do so by you or if we are required to do so by law.
Other processing activities
We may analyse data we hold about you in order to identify and prevent fraud.
We will use information from bookings and digital interactions and from publicly available information to conduct research to better understand our audiences.
From time-to-time we will conduct surveys of audience members, service users and participants or other stakeholders. Completion of surveys is entirely voluntary, and you can choose whether or not to disclose any information requested. We will make it clear whether you response to surveys is anonymous or not. Surveying allows us to measure the effectiveness and quality of our services, and to monitor the use of our services for reporting internally and to external bodies.
We have detailed above how we receive information about you from third parties.
The Citizens Theatre will never buy or sell your personal details from any third parties for any reason.
We share data with service providers who process data on our behalf, such as our ticketing system software, in order to fulfil our contract with you. We do not allow these service providers to use your data for their own purposes.
The Citizens Theatre may act as a ticket agent to sell tickets on behalf of another company, organisation or promoter. These third parties do not have access to our systems, however we may share basic contact information with them to enable them to administer your purchase, or notify you about changes to a performance or event. Where we are selling on behalf of another company we will make this clear to you when booking.
You will be asked at time of purchase for your permission for your contact data to be shared with partner organisations involved with productions that you are buying tickets for. We have data sharing agreements in place with all of these partners, requiring them to comply with current UK and EU legislation when processing your data. This information is only supplied with your explicit consent.
We will also from time to time share your data with a data processor or service provider, such as a mailing fulfilment centre or our ticketing service provider. In these instances, we require that the data processor complies strictly with our instructions and data protection policies and that your information is only held for as long as is necessary for the activity to be carried out.
We may also have a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies.)
Cookies are small pieces of information that are stored by your browser on your device's hard drive. They make it possible for us to provide our online ticketing service and track visitor statistics, such as returning visitors. We use this information to allow us to process your purchase, and to improve your experience of visiting our website.
We never collect sensitive information, and do not sell any of the data we collect.
Your credit and debit card information
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard here
We give the option for you to store your card details safely for use in future transactions. This is carried out in compliance with PCI-DSS and in a way where none of our staff members can see your full card number. We never store your 3 or 4-digit security code.
Maintaining your personal information
We may store your personal information indefinitely such that for any subsequent purchases you make we are able to link them back to a single unique record that we hold for you on our system. If there are aspects of your record that are inaccurate or that you would like to remove or change, you can do this by visiting https://uk.patronbase.com/_Citz/Productions, logging in and selecting ‘Edit your details’. Alternatively you can contact us using the information at the end of this policy.
Any objections that you make to any processing of your data will be stored against your record so that we can comply with your request.
Security of your personal information
We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We have processes in place and carry out regular reviews of who has access to data to ensure that your information is only accessible to appropriately trained staff and contractors
We will ensure that any third parties we use for processing your personal information do the same and that they will only process your personal information on our instructions. The third parties will also be subject to a duty of confidentiality.
We will not transfer, process or store your data anywhere that is outside of the European Economic Area, unless we have a contractual agreement in place that provides an equivalent standard to GDPR.
Your rights to your personal information
If you are a European citizen and consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.
Request access to your personal information
You have a right to request a copy of the personal information that we hold about you and to have any inaccuracies in this data corrected.
Request transfer of your personal information
You have the right to request that the personal information we hold about you is transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Request erasure of your personal informationYou have the right to request that we delete or remove personal information where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request for erasure if there are specific legal reasons- which will be notified to you at the time of your request.
Right to withdraw consent
In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If you wish to exercise any of the above rights, please use the contact details at the end of this policy. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Contact details and further information
If you have nay questions regarding this policy, to make changes to the information we hold about you, or to object to any processing of your personal information, please contact us at the details below:
By post: Data Protection
119 Gorbals Street
By email: firstname.lastname@example.org
Changes can be made to your account with us online by visiting https://uk.patronbase.com/_Citz/Productions and signing in to your account.
Read our Terms and Conditions here.