Thursford Collection and Thursford Enterprises Ltd – Data Protection Statement
Thursford Collection’s Commitment
Thursford Collection is committed to processing all personal data in a responsible and secure way that meets the requirements set out in the General Data Protection Regulation (GDPR). To do this we make use of appropriate technology to keep your data secure and follow documented procedures to ensure that our staff and any third parties we use, understand them so that we can process your personal data safely and responsibly.
Thursford Collection as the Data Controller
Thursford Collection is the data controller when we determine the purpose for which your data is collected. When you submit your personal data to us, it becomes the responsibility of the Thursford Collection. If anyone has any concerns regarding the handling of their personal data or who may wish to exercise their rights, they should contact the Privacy Officer (PO) in the first instance using the following contact details shown below:
Why we have prepared this statement
We have prepared this statement to be as clear as possible as to how we process or intend to process any personal data you give us. We also explain the procedures we adhere to in order to protect your privacy. One of these procedures is to issue you with an appropriate Privacy Notice at the time we collect your personal data, or as soon as is practical to do so.
This sets out:
- What information we collect about you and why we collect it
- How that information is used
- How you can exercise your rights, such as accessing and updating the information
Why we collect your personal data and how we justify it in law
Thursford Collection will need to collect personal data for a variety of reasons depending on the relationship you have with us. In all instances, we will process your personal data using one of the lawful conditions as follows:
- Using your consent, given prior to any processing;
- To meet our contractual obligation;
- To comply with our legal obligations;
- When acting in your vital interests;
- When processing is necessary for tasks in the public interest; or
- For the purposes of our legitimate interests, where we asses that this action does not over-ride your rights and freedoms as they affect the use of your personal data.
In all cases we will respect our legal obligations that any personal data we collect shall be:
- Processed fairly, lawfully and transparently;
- Collected for a specified, explicit and legitimate purposes;
- Adequate, relevant and limited to what is necessary (and no more);
- Accurate and, where necessary kept up to date;
- Kept for no longer than is necessary; and
- Processed in a manner that ensures appropriate security.
Where the personal data is processed and stored
All personal data that we collect or generate in hard copy form is processed, stored and eventually destroyed on the premises of Thursford Collection. Other (non-paper) based data is gathered and processed by our Office IT system in our main office in Thursford and the ticketing accounts are processed by a third-party located in the UK. All of our back up servers are situated in the EEA.
What happens when you want to buy show or museum tickets online
For online bookings, we use the services of a third-party ticketing system called ENTA managed by Best Union. When you buy tickets, you create a contract between us and this will be our lawful basis against which we will process your personal data. The contract also comes with terms and conditions which can be viewed separately.
If you are ordering tickets for the first time, you will be asked to select the performance of choice, including seat locations, and then you will be asked to create a customer profile (your personal account) for the purposes of administering your booking. This helps us to provide you with a much better service experience should you wish to make further bookings. If the information you have registered changes, we ask that you update it directly in your profile. Alternatively, you can contact us and we will do this for you without undue delay.
Unless you instruct us to the contrary, we will retain your profile on our booking system for three years. If you don’t make a further booking, we will remove your details from our operational system after three years. None of this affects your rights and if you have any concerns we ask that you contact the Privacy Officer using firstname.lastname@example.org in the first instance.
If you want to delete your profile, you can do this yourself at any time or you can ask us to do this for you. Please note, if you have any outstanding bookings, we will need to retain the minimum level of personal data to fulfil our contractual obligations. Once the event for which you have booked tickets is over, we will delete your information in accordance with the Privacy Notice issued to you.
If you do not want to create a profile online, we cannot proceed with the booking online but that is not a problem; just call us directly on 01328 878477 and we will make your booking over the phone having taken some essential details.
As far as making a booking and the use of personal data, our processing will involve:
- Collecting/ confirming the personal details of the head of party or ‘booker’;
- If children are being booked to use Santa’s Magical Journey into Christmas, we will ask you for their first name, age and gender. This will only be collected with your explicit consent and will only be used for the purposes of arranging an appropriate gift to be given to each child as they pass through the venue hall;
- Using anonymised versions of your data for the purposes of statistical analysis which forms part of our marketing strategy; and
- Possibly contacting you with important information that is relevant to your visit, such as local road conditions that impact your journey planning.
How long we keep your personal information relating to your event or booking
Once your event has finished, unless otherwise stated, Thursford Collection will:
- Delete any details of children provided by you within one month; and
- Retain any correspondence, including email exchanges we have had with you, up to 2 months after the end of the forthcoming or current Christmas show season. This enables us to handle any follow-up queries within a reasonable period, but thereafter such correspondence is deleted or destroyed.
Exceptions to the above will be made if you have made a query or complaint about any aspect of our service offering. In this case, we will retain your personal data for 6 months after the date that the matter has been resolved, for the purposes of confirming the validity of any remedial activity.
Thereafter, we will delete or destroy your personal information in accordance with our data retention policy, the relevant elements as they apply to you are provided above.
What happens to information relating to general enquiries
If you intend to use the website to make an enquiry, we will ask you to read this statement beforehand. If you call us, you will be notified that your call will be recorded and monitored for quality purposes. In order for us to deal with any queries regarding any bookings made or concerns about the way your enquiry was handled, we have a legitimate interest to keep all recordings for 12 months, after which the recordings are deleted. In all instances, we will look after any personal data you give us over the phone or via the website, in accordance with current data protection laws and this statement.
What happens if you have asked to receive our email newsletter
If you intend to sign up for our email newsletter, we will ask you to read this statement beforehand. We will process your personal data for the purposes of keeping in touch with your by email about our latest news and offers. We will continue to process this data unless you withdraw your consent, which you can do at any time, either via your online account or by calling us on 01328 878477.
How we process the personal data of other non-customers
Thursford Collection has a lawful basis to collect and process the personal data of many other individuals other than those wanting to book tickets. We have to look after the personal data of our employees, seasonal contract staff, those that attend auditions and those wanting to book our function room, among others. For all such individuals, we issue a purpose written Privacy Notice at the time we collect the personal data which sets out:
- What information we collect about you, why we collect it and for how long we keep it;
- How that information is used; and
- How you can exercise your rights, such as accessing and updating the information.
Use of on-site CCTV
Thursford Collection uses an extensive CCTV operation to enhance the security of the site which, in turn, enhances the safety of the staff, performers and the visitors. Operation of the CCTV is controlled, and images are stored on a series of hard drives which are over-written over time. This action effectively deletes the images recorded between two and five months previously, depending on the time of year and the camera position in use.
Under certain circumstances, Thursford Collection will have a legitimate interest or a legal obligation to retain selected footage for the purposes of assisting with legitimate investigations (or similar activities); such content will be stored for up to seven years, after which it will be destroyed, unless there are over-riding reasons to retain it for longer.
What we will not do with your personal data
Thursford Collection will not pass your personal data to any third-party unless we are legally obliged to do so. We will not engage you in any direct marketing activity or contact you unless you have requested to be kept informed of future events or to be provided with details of future offers relating to our on-site activities only.
When we might ask you for your consent
We will ask you for your consent to send you our newsletter and similar marketing material. With everything we send you in this regard, we will remind you that you can unsubscribe from this service at any time.
Change of purpose of processing
If the purpose for which we have collected your data changes, we will contact you with the relevant information and take further appropriate action. If necessary, we will re-issue you with a new Privacy Notice.
If the basis of processing relies on your consent, we will not act upon any change of purpose until we have re-established your consent. If you choose not to respond, then we take it that you have not given us your consent against the new purpose.
Information about your rights
The GDPR puts much greater emphasis on transparency of processing and accountability by all parties involved in handling your personal data. It also extends the rights of individuals in respect of their personal data. It should be noted that these are restricted in so much that they do not necessarily apply in all situations. For convenience, the rights are listed below.
- Right to be informed;
- The right to access;
- Right to rectification;
- Right to erasure (‘right to be forgotten’);
- Right to restrict processing;
- Right to data portability;
- Right to object to processing; and
- Rights related to automated decision making and profiling
In addition, a user has the right to lodge a complaint against Thursford Collection. As we are based in the UK, complaints should be lodged with the UK Government’s Information Commissioner’s Office (ico.org.uk)
If you have concerns or queries about the processing of your personal data
If you have concerns or queries regarding the handling of your personal data and/or you wish to exercise your rights, we ask that you contact the Privacy Officer. We will respond in the first instance to confirm the nature of the enquiry and provide a schedule for a full response, as required. If you are making a data subject access request, we may ask you for further information or documentation so that we can verify your identity before providing you with the information you have requested.
If you prefer not to contact us, you may take your concern or complaint directly to the ICO. For more information please visit the ICO website using https://ico.org.uk.
|Version||Date||Prepared by||Approved by|
|0.1||15/05/2018||CJ International Services Ltd||n/a|
|0.2||16/05/2018||CJ International Services Ltd||n/a|
|0.3||17/05/2018||CJ International Services Ltd||n/a|
|1.0||18/05/2018||CJ International Services Ltd||P. Vincent|
|1.1||06/06/2018||P. Vincent||G. Cushing|