Privacy Policy

This Privacy Policy explains the following:

  • who we are;

  • what information The Plough Arts Centre may collect about you;

  • how The Plough Arts Centre will use information we collect about you;

  • when The Plough Arts Centre uses your details to contact you;

  • when The Plough Arts Centre will disclose your details to anyone else;

  • your choices and rights regarding the personal information you provide to us;

  • the use of Cookies on our website and how you can reject Cookies.

The Plough Arts Centre is committed to safeguarding your personal information. Whenever you provide such information, we are legally obliged to use your information in line with all laws concerning the protection of personal information, including the Data Protection Act 1998 and the General Data Protection Regulation 2018. No website can be completely secure; if you have any concerns that your customer account could have been compromised, e.g. someone could have discovered your password, please get in touch straight away by contacting the Box Office.

Who we are

The Plough Arts Centre provides exciting opportunities for all people to experience a wide and vibrant range of high quality arts events both as audience and participants. Through creative partnerships The Plough Arts Centre is a welcoming and dynamic venue for artistic expression and education, responsive to the needs of the local community and a beacon for the arts across North Devon - visible and valued throughout the South West.

The Plough Arts Centre is a charity, Charity no. 1093715, Company no. 4404875.

The Plough Arts Centre also runs The Plough Arts Centre (Trading) Ltd, a wholly owned trading subsidiary.

We aim to be entirely upfront and open about the customer data that we use. Collecting this data makes it easy for you to book shows and events, and keep up to date with our activities. We do not obtain any personal data that we think would be likely to cause individuals to object to or complain about, but we are always open to discuss with you any of the information we hold.

How we use the data we collect

The Plough Arts Centre is committed to protecting you and your family's personal information when you are using any of our services. We want the services we provide to be safe and enjoyable environments for our audiences, customers and visitors. This Privacy Notice relates to our use of any personal information we collect from you via the following services:

  • our website

  • social media

  • our emails to you

  • your visit to The Plough Arts Centre

  • It also relates to our use of any personal information you provide to us by phone, SMS, email, in letters and other written correspondence, and in person.

  • In order to provide you with access to book tickets with us and stay in touch with us about what we're doing, we need to collect information about you.

Our website contains hyperlinks to websites owned and operated by third parties. These third party websites have their own privacy policies, and are also likely to use Cookies, and we therefore urge you to review them. They will govern the use of personal information you submit when visiting these websites, which may also be collected by Cookies. We do not accept any responsibility or liability for the privacy practices of such third party websites and your use of such websites is at your own risk.

The information that we collect, process and hold

  • Full Name and Title

  • Email Address

  • Phone Numbers and Mobile Number

  • Date of Birth

  • Delivery Address

  • Billing Address

  • Access requirements

  • Genre Preferences

  • Membership Level

  • Purchase History

  • Donation History and Pledges

  • Gift Aid status

  • Marketing Preferences including for Third Parties

  • Email and Newsletter records including emails sent, emails opened by you, and links opened by you

  • Publicly Accessible Profile Information from the internet including Facebook, Instagram and Twitter

  • Images of you when you visit the Theatre (CCTV or as a member of the audience for promotional use)

  • Anonymised Information

  • IP address

  • Operating system

  • Cookie

Why we collect and use this information

We use your data for these specific purposes, unless you ask us not to:

  • To enable you to book and pay for tickets via our website, over the telephone and in person by setting up a customer account in your name.

  • To enable you to donate to us with a single payment or regular standing order agreement.

  • To enable us to contact you to provide important information in advance of your booked event, such as details of the location of the event or if the event has been cancelled.

  • To enable us to email you with a survey after seeing a show in order to evaluate the success of an event and improve the theatre’s programme and facilities.

  • To enable us to email you with our upcoming shows and events at The Plough Arts Centre, providing we have your consent to do so.

  • To enable us to call you with details of how you can support us, or of specific offers or events that may be of interest.

  • To evaluate the services and events we provide from anonymised data, in order to improve them for the future.

  • To analyse the way in which our website is used and the content and links that you interact with, in order to improve our website services.

  • To store saved shopping baskets as you navigate around the website.

  • To analyse the way in which our emails to you are received by you, and the content and links that you interact with, in order to improve our communications with you.

  • To analyse the data we hold about you to ensure that the content and timing of our communications to you are as relevant as possible.

  • To maintain notes of our customers according to customer booking and donation history, and other personal customer account data that you provide us, as well as publicly available internet research for the purposes of our marketing communications to you, and to enable us to communicate in a relevant way with you, but not to make any automated decisions based on profiling of any consequence to you whatsoever.

  • To identify recurring visitors and to analyse their browsing habits within the website (Cookies)

  • To identify people on our system who may be interested in becoming a member, supporting the charity or increasing their support, based on their ticket purchasing and donation history.

  • On occasion, for promoting our shows and events or for archival or reference purposes, by the use of photographs and videos taken of our audiences and theatre-users.

  • To help us investigate complaints, legal claims or important incidents

How we collect and use this information

The Plough Arts Centre is the data controller for all the data we store. We use Data Processors to help us collect, process, and safely store the data that we obtain.

  • We use our website to sign you up to our E-Newsletter database.

  • We use PatronBase UK to process our Box Office ticketing system, and to report on your order history, donation history, membership status, and to show trends in sales patterns.

  • We use MailChimp and Google Mail to send Newsletters and keep in touch via email.

  • We may use other similar services provided by other parties, but which do not adversely affect your rights on the terms of this notice.

We do not use any services that include automated decision making of any significance to the individual. The consequences of being subjected to the automated profiling systems that we have in place is limited to specific marketing or fundraising campaigns directed at specific customer types based on their purchase and donation history or post code area. This will not override your marketing preferences which can be updated at any time within your customer account on the website or by contacting box office.

About our Box Office ticketing system

PatronBase servers are located in Nottingham with backups in Leicester. The web servers are currently in Dublin but are soon moving to London.

Deleting/Anonymising:

When a full delete of a customer account is requested, the PatronBase system anonymises the record to preserve the sales history but removes all identifiers such as name, address, email, etc.

PatronBase Security of data at rest and transfer:

All equipment used for company purposes is password protected. Each Patronbase employee who is involved in running this software service on behalf of The Plough has a separate, private identity for accessing IT network services. Access to computer systems is forbidden for non-authorised personnel and each authorised personnel has to agree to the Information Security and Data Protection policies as part of their contract of employment.

The Patronbase data centre is proactively monitored with a 24/7 Network Operations centre and is ISO 27001/Cyber Essentials certified. Backups are encrypted onsite at the data centre and transmitted as encrypted data, over an encrypted VPN to a remote location.

The legal basis on which we use this information

There are three legal bases under which we may process your data.

  1. Contract Purposes

    • When you make a purchase from us or make a donation to us, you are entering into a contract with us. In order to fulfil this contract we need to process and store your data:

    • To confirm your booking by way of a confirmation email, sending your tickets to you in the post or by email, or to confirm your identity when collecting your tickets.

    • To enable us to contact you to provide important information in advance of your booked event, such as details of the location of the event or if the event has been cancelled.

    • To enable you to book and pay for tickets and merchandise via our website, over the telephone and in person by setting up a customer account in your name. We only store your card payment details for as long as it takes to authorise the transaction.

  2. Explicit Consent

When appropriate, we will ask you for your explicit consent before using your personal information in that specific situation. We will update your consent periodically. You have the right to withdraw consent at any time, and this can be done via your Customer Account on the website or by contacting our Box Office. We need this consent:

  • To enable us to contact you about how you can support us.
  • To thank you for donating to us.
  • To share your personal information with other organisations who would like to contact you, if you have provided your consent.
  1. Legitimate Business Interests

We collect and process your personal information for purposes that are in our legitimate organisational interests. We do this carefully, and in a way that we believe there is no overriding prejudice to you by using your personal information in this way. You have the right to object, amongst other rights explained later in this document.

Children

We take the protection of children and their personal data very seriously. For this reason, as we are unable to verify parental consent, no-one under the age of 18 is allowed to use our website or services. Children under the age of 18 must ask their parents or an adult to make bookings for them.

Web Browser Cookies

The Plough Arts Centre may set and access Cookies on your computer. A Cookie is a small file that resides on your computer's hard drive and often contains a unique identifier and is accessible only by the website that placed it there, not any other sites. You may restrict your internet browser's use of Cookies.

You may delete Cookies, however you may lose any information that enables you to access the website more quickly.

You can choose to enable or disable Cookies in your web browser. By default, your browser will accept Cookies, however this can be altered.

For further details please consult the help menu in your browser. Disabling Cookies may prevent you from using the full range of services available on the website.

Collecting this information

Whilst the majority of the personal information you provide to us is mandatory, some of it is provided to us on a voluntary basis, and we will make this clear to you when we collect the data from you by marking the 'Required' fields. Anything that does not say 'Required' next to it is voluntary.

Not providing information

You may access certain areas of the website without providing any data at all. However, to use all services and systems available on the website you may be required to submit customer account information or other data.

You do not have to provide us with all the information we may ask you for. It is up to you.

Any information that we ask for other than those listed below is entirely voluntary. Not providing any of the voluntary information will not preclude you from any of the products or services we offer or effect you in any other way.

In order to sign up to our eNewsletter, we only require :

Name and Email address

In order to create a customer account, we only require:

Name, Email Address, Phone Number, Billing Address

Once a customer account has been created, we need to store the following information on your account:

  • Purchase History

  • Membership Level

  • Donation History

  • Gift Aid declaration

In order to book and pay for tickets, we only require:

  • Your customer account details

  • Card Type

  • Card Number

  • Expiry Date

  • Start Date (only if required by your bank)

  • Issue Code (only if required by your bank)

  • Security Code (we never store your 3 or 4 digit security code)

All debit and credit card information is processed securely, and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).

Storing this information

We store your personal data securely using suitable physical, electronic and managerial procedures to safeguard and secure all and any customer data and personal information. We will ensure that any third parties we use for processing your personal data do the same. We limit internal access to your personal data to only those who require it, and provide all our staff with Data Protection and Information Security training. We ensure that high standards of security and protection are met by abiding by our Data Protection Policies and Procedures, and these are governed by the Senior Management Team and the Board of Trustees.

Our staff are required to protect your information, and inform you of how your information will be used and everyone working for The Plough Arts Centre is subject to the duty of confidentiality. Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.

Whenever your information is stored online, we have a data sharing agreement with the data processor which states the requirements of high level security for your personal data. Should there be a breach of this data, they are obliged to inform us immediately and we will then inform you if it is necessary under Data Protection guidance. It is your right to be informed.

When we do send you information, we do so securely and are committed to reporting any breaches of data during its transit. Whenever possible all information that identifies you will be removed. We will not transfer, process or store your data anywhere that is outside of the European Economic Area.

Retention periods

We will only retain information for as long as necessary. Records are maintained in line with our retention schedule which determines the length of time records should be kept. We are bound by law to retain certain financial records, and these circumstances override our other retention periods.

We will ask you to check and update your contact preferences periodically so that we know our database is up to date. You can withdraw your consent, or make changes to your contact preferences at any time.

We actively maintain customer data, including communications with you, previous records or ticket, donations, membership status and other purchase histories to allow you to sign in to your account even if you have not booked with us for a while, and to continue to allow you to update and make changes to your marketing preferences. This also allows us to look up your customer account if you book with our box office staff. You are also able to view your previous orders when you log in to your customer account on our website. If your account has had no activity for some time, it will be made inactive from our database, thereby restricting access to the information, but it is stored indefinitely such that for any subsequent enquiry or activity you make we are able to link back to a single unique record that we hold for you on our system.

When personal data is no longer required by the organisation, it is deleted or securely destroyed.

Right to request removal of data

You have the right to request we remove the information we store about you. Please contact us, and we will be happy to arrange this for you if you want us to. Any objections you make to any processing of your data will be stored against a record on our system so that we can comply with your request.

Who we share personal information with and how this will affect you

We do not sell any of your information for the purposes of marketing or fundraising. We do not share your personal information with third parties, unless you have given us specific consent to do so, or if we are required to do so in order to deliver a Box Office service at another venue, or due to our obligations to comply with current legislation and bank transactions, or our duty to comply with a Court Order.

However, we do employ the services of other party's software and services in order to collect and store your personal information, for example we use Patronbase, WeGotTickets, GrooVee Deals as our ticketing system software providers for booking tickets and creating customer accounts that can be accessed on our website. The providers of such services may have access to certain personal data provided by you. Any data used by such parties is used only to the extent required by them to perform the services that The Plough Arts Centre requests. Any use for other purposes is strictly prohibited within a data sharing agreement between us and the provider. Furthermore, any data that is processed by third parties must be processed within the terms of this policy and in accordance with the United Kingdom Data Protection Act 1998 and General Data Protection Regulation 2018.

Your rights

You have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress;

  • object to the processing of your data where The Plough Arts Centre is relying on its legitimate interest as the legal grounds for processing;

  • prevent processing of your personal data;

  • port your data using an open format document, like a .csv Excel document;

  • object to decisions being taken by automated means;

  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed; and

  • claim compensation for damages caused by a breach of the Data Protection regulations.

The person to contact regarding data protection at The Plough Arts Centre is Sean Harrison, Box Office Manager. Email: dataprotection@theploughartscentre.org.uk | Address: 9-11 Fore Street, Torrington EX38 8HQ | Tel: 01805624624

Right to lodge a complaint

If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner's Office at ico.org.uk/concerns.

How to access your personal information (Subject Access)

You have the right to see the information that The Plough Arts Centre holds about you, and why we hold it. You also have the right to rectify any inaccurate information we hold about you. Requests must be made in writing (not verbally). You will need to provide:

  • Full name, address, email address, phone number, customer ID, so that your identity can be verified against our records and your information located

  • Photographic ID

  • An indication of what information you are requesting to enable us to locate this in an efficient manner

A request for information must be made with the appropriate person: Sean Harrison, Box Office Manager. Email: dataprotection@theploughartscentre.org.uk | Address: 9-11 Fore Street, Torrington EX38 8HQ | Tel: 01805624624

There is no fee for Subject Access Requests. The Plough Arts Centre reserves the right in certain situations to refuse the request, otherwise we will comply within one calendar month.

The request's response will cover the following detail;

  • Any personal data that is being processed

  • A description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people

  • A copy of the information comprising the data; and details of the source of the data

If you require Subject Access Requests or our response to them in braille or any other format please contact us and we will happily arrange this as quickly as possible.

This document was last reviewed May 2018 by: Sean Harrison, Box Office Manager.