Privacy Notice
THE PURPOSE OF THIS PRIVACY NOTICE
Under GDPR (General Data Protection Regulation) we are responsible for ensuring that:
• Your personal data is kept secure and is protected
• We are clear about the purposes we are using your data for
• Your data is used in appropriate way
• It is easy to withdraw consent or update your communication preferences at any time. It is also easy to give your consent at any time.
Using personal information helps us to better understand our customers and in turn to provide you with relevant and timely information about the work that we do – both on and off stage. As a charity, it also helps us to engage with potential donors and supporters.
This notice explains how we use your personal information in accordance with GDPR and all other applicable laws concerning the protection of personal information. This notice explains:
• What information we may collect about you
• How we may use that information
• When we use your details to contact you
• In what situations we may disclose your details to third parties
• How we keep your personal information secure, how we maintain it and your rights to be able to access it.
The personal information described in this notice is collected from you through the following channels:
• Your booking with Sherman Theatre (online, over the phone or in person)
• Our website
• Emails you receive from us
• Your visit to Sherman Theatre
• Letters and other written correspondence
• Other interactions with us by phone or in person.
Our website is one of the main places our customers interact with us and share their personal information. If you are concerned at any time that your online account may have been compromised, please contact the Box Office immediately. You will also find that there are links throughout our site to third party websites which are subject to their own privacy policies and may use cookies. We advise that you review their policies and cookies when you visit their sites but we do not take any responsibility for third party websites.
You can read our separate Cookies Policy in full below.
If you have any queries about this notice, please contact the Data Protection Officer at Sherman Theatre, Ed Newsome data.protection@shermantheatre.co.uk
WHO WE ARE
Sherman Cymru (which will be known throughout the remainder of this document as Sherman Theatre) is a charity and is funded by Arts Council Wales as well as by various trusts, foundations and individual donors and supporters. Our registered charity number in England and Wales is 1118364 and we are also registered as a company in England and Wales under registration number 06002090.
Our mission is to make and curate exciting theatre for Cardiff audiences. We develop and nurture the work of Welsh and Wales-based artists. We generate opportunities for the citizens of Cardiff to connect with theatre through relevant, inspiring and visionary engagement.
INFORMATION COLLECTION
We collect, process and hold various types of information:
Information you give us
For example, when you create an account on our website, buy tickets or make a donation, we will store personal information which will include some of the following:
• Full names and titles
• Postal addresses
• Email addresses
• Telephone Numbers (Mobile and Landlines)
• Name of a child (for Youth Theatre places booked by a parent or guardian)
• Date of birth
• Access requirements
• Any genre preferences or requests to be added to specific mailing lists
• Payment card details
• Information collected through surveys and questionnaires
• Information collected through cookies
Information about your interactions with us
When you visit our website, book to see a show, make a donation or receive a marketing communication from us we will make a record. This will include:
• Purchase History
• Donation History
• Gift Aid status
• Website visit history
• Emails sent, open and clicks (we keep a record of which emails we have sent you, which ones you have opened and which links you clicked)
• Mailings we have sent you
Sensitive personal data
Data Protection law recognises that certain categories of personal information are more sensitive, such as health information, race, religious beliefs and political opinions. We do not usually collect this type of information about our customers unless there is a clear reason for doing so. We do collect allergy information about Youth Theatre participants in the interest of their wellbeing during sessions.
HOW DO WE USE YOUR PERSONAL DATA?
Your personal data is used for certain legitimate business purposes which may include some, or all of the following (unless you ask us not to):
• Processing a booking and verifying payment through our website, over the phone or in person
• Setting up a customer account
• Enabling you to make a donation (either a one-off donation or an ongoing arrangement through our website) and to receive a thank you email.
• Using your data to ensure we can fulfil our contract of service with you
• Letting you know about a change to a performance, including a change of time or cancellation (in exceptional circumstances)
• Getting in touch with you with information about your visit to the theatre
• Sending you a post show survey by email to help us understand how we can improve the service we provide you with
• Storing your data on a secure system
• Ensuring that you are sent relevant marketing information about performances, events and products at Sherman Theatre by email, by post or by phone
• Sharing your data securely with a supplier to undertake direct mailing on our behalf
• Getting in touch with you to acknowledge and thank you for a donation you have made
• Managing data on secure spreadsheets independent of our Box Office system
• Suppressing (not using) your data after inactivity (6 years)
• Using anonymised data to help make our marketing communications more effective
• Using anonymised data so that we can report to our funders
• Segmenting your data to ensure you are sent relevant information
• Using bulk email sending software for our email marketing communications
• To contact you with details on how you may support our work through making a donation
• To enable you to pre-order food and drink from our Cafe Bar
• To pre-order any additional services or products we may offer as part of your visit to the theatre
• To monitor and analyse visits to our website through Cookies
• To use Cookies to re-target those who have visited our website with online advertising
• Photos of our audience in our auditoria may be used in our marketing and promotional activity
• Photos of Sherman Youth Theatre participants may be taken and used for documentary and marketing purposes
• Capturing and storing footage for security purposes
• To contact schools and colleges about relevant upcoming performances and projects
• To contact members of the press with invitations to press nights, press releases and story ideas and opportunities
• To invite funders, stakeholders and members of the theatre industry to guest nights
• To send funders, stakeholders and public representatives information about new and developments at Sherman Theatre which are in the public interest
• To manage relationships with potential funders and donors
• To contact Sherman 5 members with information on performances and the latest news by email and by post
• To manage the running of Sherman Youth Theatre programmes which includes contacting parents/guardians if there are changes to sessions etc
WHERE IS PERSONAL INFORMATION COLLECTED AND STORED?
Sherman Theatre is data controller for the data we collect and store. Data is collected and stored through the following systems and platforms:
• Through individuals signing up to emails and join our mailing list through our website. The sign up form is supplied by Spektrix
• Spektrix supplies our Box Office system which holds your accounts, purchase history, contact information, contact preferences and allows us to produce marketing reports and lists for marketing activity
• We use Mailchimp and Dot Digital to send marketing emails
• We use Surveymonkey to generate post show surveys
• Artifax is our room booking system
• Point One processes transactions at our Cafe Bar
• Opayo processes our Box Office payments
• A range of other services may be used
Your personal information will not be subjected to automated processing which would negatively impact on any individual.
LEGAL BASIS
There are three bases under which we may process your data:
Contract
When you buy tickets or other products from us or make a donation to us, you are entering into a contract with us. In order to perform this contract we need to process and store your data. The instances in which this legal basis will apply are:
• Processing a booking and verifying payment through our website, over the phone or in person
• Setting up a customer account
• Enabling you to make a donation (either a one-off donation or an ongoing arrangement through our website) and to receive a thank you email.
• Using your data to ensure we can fulfil our contract of service with you
• Letting you know about a change to a performance, including a change of time or cancellation (in exceptional circumstances)
• Getting in touch with you with advance information about your visit to the theatre
• Storing your data on a secure system
• Getting in touch with you to acknowledge and thank you for a donation you have made
• To enable you to pre-order food and drink from our Cafe Bar
• To pre-order any additional services or products we may offer as part of your visit to the theatre
Consent
We will ask for your consent before using your personal information in the following instances. You can withdraw your consent at any time and you can do this by logging into your account or calling the Box Office. The instances in which consent is the legal basis of our processing are:
• Ensuring that you are sent relevant marketing information about performances, events and products at Sherman Theatre by email, by post or by phone
• To contact you with details on how you may support our work through making a donation
• To take and use photos of Sherman Youth Theatre participants for documentary and marketing purposes
Legitimate business interests
In certain situations we collect and process your personal information for purposes that are in our legitimate organisational interests. We only do this if there is no overriding prejudice to you by using your personal information in this way. The situations in which we use legitimate interest as the legal basis for processing are as follows:
• Sending you a post show survey by email to help us understand how we can improve the service we provide you with
• Sharing your data securely with a supplier to undertake direct mailing on our behalf
• Managing data on secure spreadsheets independent of our Box Office system
• Suppressing (not using) your data after inactivity (6 years)
• Using anonymised data to help make our marketing communications more effective
• Using anonymised data so that we can report to our funders
• Segmenting your data to ensure you are sent relevant information
• Using bulk email sending software for our email marketing communications
• To take photos of our audience in our auditoria or in our public spaces for use in our marketing and promotional activity
• Capturing and storing footage for security purposes
• To contact schools and colleges about relevant upcoming performances and projects
• To contact members of the press with invitations to press nights, press releases and story ideas and opportunities
• To invite funders, stakeholders and members of the theatre industry to guest nights
• To send funders, stakeholders and public representatives information about new developments at Sherman Theatre which are in the public interest
• To manage relationships with potential funders and donors
• To contact Sherman 5 members with information on performances and the latest news by email and by post
• To manage the running of Sherman Youth Theatre programmes which includes contacting parents/guardians if there are changes to sessions etc
In all of the above cases we will always keep your rights and interests at the forefront to ensure they are not overridden by our own interests or fundamental rights and freedoms. You have the right to object to any processing at any time. If you wish to do this please use the contact details at the end of this policy. Please bear in mind that this may affect our ability to carry out tasks that are for your benefit.
THIRD PARTIES
In certain circumstances we may need to disclose your personal information to third parties. These circumstances are:
• To our own service providers who process data on our behalf and on our instructions (for example our Box Office System supplier). In these cases we require that these third parties comply strictly with our instructions and with data protection laws, for example around security of personal data.
• Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies).
• Please note that we will no longer share data with named visiting companies and therefore will no longer ask for your consent to do this.
COOKIES
We use a mixture of essential and non-essential cookies as part of the online booking process in order to ensure you have the best possible experience.
Essential Cookies In order to keep track of your order it is essential that we store a “session cookie” on your computer. This cookie will last for 24 hours.
Non-Essential Cookies We use a few non-essential cookies to customise your booking experience and help make it easier and more enjoyable for you. These extra cookies are used to store thinks like your login details so you will be automatically logged in each time you visit our site.
Before storing any of these cookies for the first time, we will alert you and ask your permission before proceeding. If you do not wish to store these cookies you will not be able to use that particular feature, but the rest of the site will continue to work correctly.
YOUR DEBIT AND CREDIT CARD DETAILS
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard here. (LINK)
We optionally allow you to store your card details for use in a future transaction. This is carried out in compliance with PCI-DSS and in a way where none of our staff members are able to see your full card number. We never store your 3 or 4 digit security code.
RETENTION OF YOUR PERSONAL INFORMATION
Your personal information will only be held for as long as necessary:
Accounts and booking records
If you have previously consented to receive marketing information but have not booked for a performance in the past three years, we will email to ask you to refresh your consent. If we do not hear from you within one month your record will be set to do not contact. After six years of inactivity on an account the record will be completely anonymised with only a record of the transaction being retained for our records. We will periodically check with you that your details and contact preferences are as you would like them.
E-list
If you sign up to receive emails from us, we will periodically check with you that you continue to wish to hear from us. The option to unsubscribe is on all of our email communications.
CCTV footage
We retain CCTV footage for 5 years.
Correspondence
We will hold any written communications from and with you for 6 years.
We delete and destroy all data records which no longer need to be held.
BBC COMEDY FESTIVAL BOOKERS
For performance of contract and to facilitate your booking, the name of each booker will be shared with the event organisers (BBC). Your details will be held until the end of the festival.
MAINTAINING YOUR PERSONAL INFORMATION
You can review the personal contact details we hold for you at any time by logging into your online account or by calling the Box Office. You can also update and change your details at any time this way.
SECURITY OF YOUR PERSONAL INFORMATION
The security of your personal information is of paramount importance. We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will ensure that any third parties we use for processing your personal information do the same.
ACCESS TO YOUR PERSONAL INFORMATION
You have a right to request a copy of the personal information that we hold about you and to have any inaccuracies in this data corrected. You may use the contact details at the end of this policy if you would like to exercise this right.
YOUR RIGHTS
Under the General Data Protection Regulations you have the following rights:
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.
If you have any queries regarding data protection please contact Ed Newsome, Data Protection Officer Email: data.protection@shermantheatre.co.uk. Address Sherman Theatre, Senghennydd Road, Cardiff, CF24 4YE.
CONTACT DETAILS AND FURTHER INFORMATION
Please get in touch with us if you have any questions about any aspect of this privacy policy, and in particular if you would like to object to any processing of your personal information that we carry out for our legitimate organisational interests. Please contact us in writing using the following addresses:
Sherman Theatre, Senghennydd Road, Cardiff, CF24 4YE data.protection@shermantheatre.co.uk
Any objections you make to any processing of your data will be stored against your record on our system so that we can comply with your requests.
This notice was last updated on 19 May 2023.