Fair Processing Notice / Privacy Policy

Published: 12 May 2020

Introduction

This notice describes your rights as a visitor or customer of The Old Town Hall. It provides information about your rights relating to your personal information along with how we collect, use and share your data.

This privacy notice is to inform you how we collect, use and disclose your personal data.
The Old Town Hall is committed to abiding by all laws and this includes the EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

By using our website and attending our venue you consent to our collection and use of your Information as described in this notice. If we change our notice, policy and/or procedures, we will post those changes on our website to keep you aware of what Information we collect, how we use it and under what circumstances we may disclose it. Your continued use of the website or attendance at our venue after this notice has been amended shall be deemed to be your continued acceptance of this notice, as amended. We encourage you to bookmark this Web page and review this notice regularly.

This notice contains links to more information on many of the topics listed and further external links if you wish to read further detail about personal data management. External links from these pages are not under the control of The Old Town Hall and whilst we have attempted to provide known safe links to the information you may seek, you click on these links at your own risk.

Who We Are

The Old Town Hall is part of Dacorum Borough Council and provides entertainment and access to arts and culture through its two performance spaces.

If you need to enquire further about how we use your personal data you may contact the Legal Team at foi@dacorum.gov.uk or write to us at: Legal Governance (Corporate & Contracted Services) Department, Dacorum Borough Council, The Forum, Marlowes, Hemel Hempstead HP1 1DN.

What Is Personal Information?

Personal information or personal data is data which identifies a person (you) from the information provided or if combined with other information that we may have access to.

You can find out more about the legal definitions of personal data here.

In summary, personal data is (but not limited to):

• Name and address
• Mobile phone
• Date of birth
• Email address
• Bank account details
• An IP address
• Online identifiers (I.e. user log on)

In addition, there are “special categories” of personal data which means that the data, in law, is considered more sensitive, such as:

• Personal data related to your health
• Genetic data
• Religious beliefs

Click here for a more complete list of this type of special category data.

In the event that we need to collect personal data that falls into special categories, we will inform you at the time of collection why we require it. We will only use this type of information about you for the specific purpose for which it has been collected. If we wish to use the information for any other purposes, we will ask for your permission to do so unless there is a legal requirement for us to process your personal data.

What Personal Information Do We Collect?

When you visit and use our website or attend events at our venue you may provide us with, or we may collect, your information such as your address, email address and other personal information that is required to provide you with a quality service.

We may collect your information in a number of ways.

Information You Provide to Us Directly

We collect and maintain information that you provide to us during your use of our website, box office (phone or in person) or attendance at events.

• When you register on our website to purchase tickets or receive an e-newsletter or press release or sign up to membership plans, you may provide us with certain information including your name, email address, screen name, password, demographic information and some financial details;
• When you create an account you may add to your profile by providing Information about your interests and access requirements;
• If you sign up to receive an e-newsletter, enter a contest or participate in social networking activities, you may provide us with contact information (e.g., email, telephone and/or or physical address); or
• You may provide us with Information in the course of email, customer support interactions and surveys.

You have control over the information you provide to us, but you must understand that if you choose not to share some details with us, it may stop you from gaining access to a service or limit features that you can use on our website and the information we are able to send to you.

You may provide your information to us via a number of routes.

The information you provide to us, may come from but not limited to:

• Information you have provided whilst registering for, or buying a product
• Forms on the website or on paper which you have completed
• Information provided over the telephone
• Information you have provided via email/postal correspondence with us
• Personal Information we get from other sources

Usually we will collect information you have provided, but sometimes we get your personal information from third parties who provide us with the information of people who have provided consent for their information to be shared, or from someone who believes you may be interested in hearing from us (word of mouth). We will always use such information responsibly and in accordance with your rights under law, and you will always be able to stop further contact from us if we contact you about offers and events.

We may get your information from third parties, where your consent is provided or there is a valid legal obligation for obtaining it, from:

• Marketing companies, platforms and agencies – who provide lists of people with whom we may make contact to interest them in our products
• Financial institutions who provide information related to credit and payments
• From supporters and members whom you know and who believe you may be interested in hearing from us.

Where your personal data is used by us, and you have a choice e.g. receiving direct marketing, you will always be afforded the option of stopping further contact, “unsubscribe”, and controlling, or reviewing these consent options to your own satisfaction.

We only use personal data gathered from other sources if it is legal to do so, and always with the intention of being responsible with that information. We may use such information to verify other information about you, for example to verify your email address to send you tickets or information which you have requested. If, however you believe that we have misused your personal data, please contact us and we will resolve your problem as swiftly as we can.

Information We Collect Through Our Website

When you use our website, information may be collected by us through our use of cookies, pixels, beacons, log file and other technologies. This information allows us to deliver more helpful information, services and advertisements. Our Cookie policy will give you more details. Scroll to the bottom of this page to see this policy.

Children under 13

Our Services are not directed to persons under 13 and we do not intentionally collect any information on children under 13 years of age. If you become aware that your child has provided us with personal information without your consent, please contact us at foi@dacorum.gov.uk.

We will undertake to delete any details of such users where a parent or guardian has notified us that any such details have been obtained.

What We Use Your Personal Information For

The main reasons we collect information are to provide a service you have requested, to keep you up to date with news and events, to personalise your communications, or to contact you if we need to obtain or provide additional information (e.g. cast changes, travel disruption). The information we collect about our audiences also helps us understand how we can best meet their needs.

We will use your personal information to fulfil any contract we have with you, which will usually be when you order tickets from us and have the expectation that we will use your information to ensure you receive the right tickets at the right time.

Typically, we will use your information as necessary and as appropriate for our business purposes, including but not limited to:

• administer your account where you have opened an account with us;
• register you and provide you access to the website;
• respond to enquiries or requests that you direct to us;
• fulfil your requests for tickets, e-newsletters or products we sell;
• send communications and administrative emails about the website, or our events;
• send service messages to request feedback on customer experience
• personalise and better tailor the features, performance and support of the website for your use;
• analyse, benchmark and conduct research on user data and user interactions with the website and our venue.
• based on the frequency of your visits and other personal information you provide, we may promote our membership schemes to you or ask you for additional philanthropic support for our work
• respond to applicants for job vacancies
• our need to comply with a legal or regulatory obligation; or
• our legitimate interests where it does not impact your rights and freedoms and is proportionate.

Specifically, we use the information we collect from you in the following ways:

To manage your booking or purchase with us. We will use your personal information to:

• fulfil ticket, merchandise, donation and membership requests (on the basis of performing our contract with you);
• process payments (on the basis of performing our contract with you). Please note that The Old Town Hall does not store any Credit Card or other payment information once the transaction has been completed;
• provide good customer service at the theatre or by phone (on the basis of performing our contract with you or on the basis of our legitimate interests to provide you with customer service); and
• contact you with important information relating to your booking or purchase, such as confirming your order, reminding you of an upcoming performance you’ve booked for or letting you know about cast changes, travel disruption or changes to event times that may affect your visit (on the basis of performing our contract with you or on the basis of our legitimate interests to provide you with service information).

To send you marketing communications. We will use your personal information to:

• keep you up-to-date with news, offers, talks and events, products and information, and let you know about opportunities to support our work at The Old Town Hall and in schools and communities across the UK (where you have provided your consent or on the basis of our legitimate interests to provide you with marketing communications where we may lawfully do so, is proportionate and has a minimal privacy impact). You can tailor your preferences at any time by logging into the website and visiting the My Account section;
• send information by post about how you can support The Old Town Hall (on the basis of our legitimate business interests to seek support); and
• provide you with special assistance, if required (where you have provided your consent for the Old Town Hall to process sensitive information about your health).

To personalise your experience (on the basis of your consent or our legitimate interests to present you with the right kinds of products and services). We will use your personal information to:

• help us target our marketing communications so that they’re more relevant to you. You can opt-out of personalised communications by selecting 'Remove profiling' in the Contact preferences section of your account: login and visit My Account;
• keep track of your interests and preferences so that we can contact you with information that is relevant to you;
• show you advertising on such Social Media platforms such as Facebook and Instagram or via other third-party advertising that may appear on other websites you use. You can opt-out of targeted advertising (please note that you may not see fewer ads, but they will be less relevant to your interests);
• help make the experience of using our website better and to personalise the service you receive from us – this means we will remember your previous visits and track the pages on our website that you visit; and
• understand your interests and personalise communications to you. For more information, please see our Cookie Policy.

To conduct research (on the basis of our legitimate interests where it is proportionate to do so to improve our products, services and customer service). We will use your personal information to:

• classify our audiences into groups or segments, using information from bookings and digital interactions, and publicly available information. We do this to better understand our audience and tailor messaging accordingly;
• measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective;
• undertake audience research via an online or telephone survey or in person. Participation in these is entirely voluntary, so you can choose whether or not to disclose any information requested. We will make it clear whether your response to surveys is anonymous or not and, should you provide any further information, The Old Town Hall will inform you how it will be used;
• analyse and continually improve the services we offer, including our artistic programme, our website and our other products;
• help us run the test version of our website that we use internally to pilot new features and ensure the smooth running of our web services; and
• help diagnose and manage the website, to audit the geographical make-up of users, and to establish how they have arrived at the website.

To ensure security and protect our business interests. In certain circumstances, we use your information to ensure the security of our services, buildings, and people, including to protect against, investigate and deter fraud, unauthorised or illegal activities, systems testing, maintenance and development (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so).

To comply with our legal obligations. In certain circumstances, we will need to use your information to comply with our legal obligations, for example to comply with any court orders or subpoenas, carry out due diligence in accordance with statutory regulations or keep our database accurate and relevant, for example, using National Change of Address (on the basis of our complying with a legal obligation).

Legitimate Interests

Where we refer to using your information on the basis of our ‘legitimate interests’, we mean our legitimate business interests in conducting and managing our business or our relationship with you, including the legitimate interests we have in:

• personalising, enhancing, modifying or otherwise improving the services and/or communications that we provide to you;
• detecting and preventing fraud and operating a safe and lawful business;
• improving security and optimisation of our network, sites and services; and
• providing you with customer service.

Where we use your information for our legitimate interests, we make sure that we take into account any potential impact and proportionality that such use may have on you. Our legitimate interests don’t automatically override yours and we won’t use your information if we believe your interests should override ours unless we have other grounds to do so (such as your consent or a legal obligation).

Who Do We Share Your Personal Data With?

There are some organisations with which we work where we must share your personal details to provide the services you require.

We may disclose your personal information if we are under a duty to disclose or share your information to comply with any legal obligation or in order to enforce or apply or fulfil our terms and conditions and other agreements or protect the rights, property, or safety of our customers, our group companies or others. This includes exchanging information with other companies and organisations for fraud protection and credit risk reduction.

Where your personal data must be shared for us to provide you with a service, then we make sure that our partners have the right controls in place to use your information responsibly and under our control.

Partners who may see your information include:

• Promoters / Artist Management / Agents
• The Audience Agency
• DotDigital
• Printing and Courier companies
• Catering suppliers
• Recruitment software for applicant tracking
• Medical partners – in the event of an accident or incident you are involved in
• Payment providers (which take your bank card details and process payments)

It is important for us that you understand who your information may be shared with and the seriousness with which we respect the confidentiality of your personal data. If you have questions about such uses of your personal data, we will be happy to tell you more.

We may also share your information with third parties involved in promotions or competitions you may enter who may be the suppliers of prizes and to properly and fairly administer such promotions.

We will not share your personal data unless there is a valid legal reason or need to do so.

Storage and Security of Personal Information

Your personal information is kept secure at all times and we use the latest technology to ensure that all our data is kept confidential, especially personal information that we hold.

Your information may be kept in a number of places, all of which comply with data protection requirements. We use cloud providers and online application providers to help us run our business and information we manage may be transferred and store to destinations outside of the UK and Europe. All reasonable steps are taken to ensure that your personal information is managed and secured appropriately, at all times. Confidentiality agreements, contracts and sharing agreements are all documents we use to ensure that partners, suppliers and third parties are all managing your personal data responsibly, transparently, fairly and within the law.

All transfers of personal information regardless of destination will comply with the law, at all times.

How Long We Keep Your Personal Information For

We will keep your personal data for a length of time that is in line with our need to identify you and to provide goods or services to you. If you are a customer, then we will keep personal information about you for our legitimate business purposes, such as ensuring we can identify you in the case of a complaint, to identify payments and within our finance systems for auditing and accounting purposes. We will also keep the personal information you have provided for marketing purposes for a period of time that allows us to contact you with offers, if you have agreed to be contacted, and to ensure that we do not contact you inadvertently if you have refused marketing contact.

We will only keep your personal data for as long as there is a legitimate requirement to do so and in accordance with legal obligations for some purposes. For more details on our retention policy click here

How Do I Request What Information You Hold on Me?

You have the right to request a copy of the Information that we hold about you. We may require additional verification depending on the nature of your request.

Please email foi@dacorum.gov.uk or write to us at: Legal Governance (Corporate & Contracted Services) Department, Dacorum Borough Council, The Forum, Marlowes, Hemel Hempstead HP1 1DN.

If any of the Information that we hold about you is incorrect, you can either contact us via the details on the website, change the details yourself in the “My Account” section of the website or contact our admin team on 01442 228090 who will update your details as soon as practically possible.

Membership Schemes

If you sign up to any of our Membership schemes, we may use your personal information (including your name, contact details, booking and transaction history) to fulfil your orders, provide customer service, marketing, membership benefits and for our own analysis purposes so that we can find new supporters and offer benefits that are right for you. We may share your personal information with other organisations for these purposes, with your consent. We require that such organisations meet our standards for handling data, and that it is only used for the agreed purpose. We will not otherwise share your personal information as a member with any third-party organisations.

What Are Your Rights?

Under data protection legislation from the UK and Europe, you have rights over how your personal data is used. The main rights related to your personal data are listed below, but there are others which you may like to find out more about by looking up the Data Protection Act 2018 or the General Data Protection Regulation on the ICO website here

The right of transparency (right to be informed)

You have a right to be informed about the collection and use of your personal data. We have an obligation to be transparent and provide you with this information freely and that it is easily understood. This notice serves to provide information on collection and use of personal data, and you may contact us if you want to know more about any aspect of how we handle your personal information. More information on this right is available here.

The right of access to your information

You have a right to have access to the information we hold about you and to verify that we are using your personal data lawfully. If asked we will provide confirmation of what personal data we hold, provide a copy of the data, and inform you of any other rights you may have. You can find out more about what you are entitled to request by clicking here.

If you would like to make such a request, please see the section above titled “How do I request what information you hold on me?”

The right of rectification

You have the right to have any information held about you which is inaccurate to be rectified. If you believe that we have inaccurate information, for example a misspelt name, then please contact us and we will do our utmost to sort it for you. More about rectification here.

The right to be forgotten (the right to erasure)

You have, subject to certain conditions being met, the right to be forgotten. Where we can, we will remove all your details from our systems subject to being able to do so reasonably, and where no other legal or legitimate reason exists to keep your personal data. For example, if you owe money to us via an account, we would expect this to be cleared before we considered erasure of your details. Please look here for more information on this right.

The right to restrict processing of your personal data

In some cases, you may require us to hold your data but not process it, this may be relevant if you believe inaccuracies have not been corrected and further processing would cause issues for you as an individual. More information on this right can be found here.

The right to data portability

Personal data portability, means that on request we will give you the information we hold about you in a form that can easily be used by other systems. This is most likely to be a spreadsheet file so that you may pass this information on to other organisations with which you would like to share the data. It may not always be possible to give you everything about you in this format, but we will always strive to provide what we can for you.

Click here for more information.

The right to object

You have a right to object to how personal data about you are processed, in some instances. You may object to us processing your personal data for our “legitimate interests”, to stop direct marketing and processing your personal data for research or statistical purposes.

Whilst we do have legitimate interests under which we process data and we do send marketing messages out to those that want them, we do not undertake research or statistical reporting.

Unless we can demonstrate compelling reasons for continuing to process your personal data, which we will explain to you, if relevant, when you object, then we will always endeavour to comply with your wishes.

You may find out more about this right, here.

The right to stop automated individual decision making, including profiling
Should we wish to carry out any automated decision making or profiling of you, using your personal data, then we will abide by the law and only do this where it is necessary to do so, or we have your consent.

Any decisions made automatically about you will be made obvious to you, where they have a direct effect on you. You will always have the ability to contact us and query these activities and request that they stop or have human intervention.

We aim to be transparent and open about this type of data processing so that you can feel assured that your data is safe, kept confidential and always used lawfully and fairly.

Details about this right can be found here.

The right to complain

You have a right to complain to the regulator in the country in which you reside or where you believe any misuse of your data has taken place. The UK Information Commissioner’s Office can be contacted directly if you believe that we have failed to address your concerns.

Their information may be found at www.ico.org.uk.

Data Protection Officer

Our Data Protection Officer for the purposes of Articles 37 to 39 of the General Data Protection Regulation is the Information Security Team Leader (Legal Governance). You can contact them by emailing foi@dacorum.gov.uk or calling 01442 228538.

Changes to this Privacy Policy and your duty to inform us of changes

We may make changes to this Privacy Policy from time to time. We will post any changes to our website, and we may notify you of any material changes by e-mail.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us by updating your profile account information or contacting us via the contact details at the top of this Privacy Policy.