Privacy Policy

Introduction

The Montrose Playhouse is a company registered in the United Kingdom. We are committed to protecting your privacy. We will only use the information that we collect about you lawfully in accordance with GDPR.

We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect. Developing a better understanding of our customers through their personal data allows us to complete transactions, improve our level of service, and make our programming and other offers even better in future. How we handle your data is governed by this privacy policy.

This website is operated on The Montrose Playhouse’s behalf by INDY Cinema Group (INDY), who also provide the Point of Sale (POS) technology we use to process all ticket sales, memberships, and other customer transactions. When you provide your data through this site, the data will be processed in INDY POS by INDY Cinema Group but The Montrose Playhouse remains in control of the data. The Montrose Playhouse is the “data controller”, and INDY Cinema Group is our “data processor”.

The Montrose Playhouse and INDY have signed a data processing agreement to govern how they handle your data, ensuring that INDY adhere to the terms of our policy and to any other relevant policies or instructions The Montrose Playhouse may give them. INDY maintain strict GDPR compliance across their business and also maintain their own general privacy policy, which we encourage you to read. [link]

Changes to this Policy

We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly. Please periodically review the Privacy Policy, as your continued use of this site indicates your agreement with any changes that we make.

Data Controller

The Montrose Playhouse’s Chief Data Protection Officer is Matthew Buchanan, manager@montroseplayhouse.co.uk

How we collect information about you

 – When you give information to us directly.

When you purchase tickets, memberships or other products from us, we need to collect information about you to process the transaction and fulfil your order. This information may include, but is not limited to, details such as your name, your address, your email address, your phone number and your credit/debit card details.

 – When we collect information as you use our website.

Like most websites, we use “cookies” on montroseplayhouse.co.uk to help us make our site as useful as possible, and for user authentication.

Please refer to our Cookies Policy for more information. [link].

What personal data we collect and how we use it

We use the information we collect about you to process your transactions and to provide a personalised service and it may include your:

  • Full Name
  • Postcode
  • Telephone number
  • Email address
  • Age
  • Photograph (optional)
  • Transaction History
  • Browsing data (e.g. what movies you have looked at or added to your favourites list; data about email deliverability, views, and clicks; etc.)
  • Association with other customers (if you buy a joint membership)
  • Any other information volunteered by yourself to The Montrose Playhouse

When you complete a transaction with us, we may use your data as follows:

  • To provide you with the show tickets, products or information you bought/asked for.
  • To administer your ticket purchase or purchase of other products.
  • To understand how you prefer to be contacted.
  • To keep a record of our relationship with you.
  • To contact you if there are any important changes to your booking.
  • To understand how to improve our services, products or information.
  • To tell you about changes in our services or new services, events and offers you may find of interest.
  • To sign you up to mailing lists that you’ve opted in to.
  • To tell you about upcoming programming, offers, or other news.
  • To analyse your interests and preferences so as to provide you with information relevant to you.  

Some special considerations apply around marketing communications:

  • We will contact you for marketing purposes only if you give us your permission to send you this kind of communication.
  • If you do allow us to send you marketing communications, then we will give you as much control as reasonably possible about what channels you’d like to be contacted on (e.g. email, SMS, etc.).

Third parties

In order to process a transaction or deliver information to you, INDY (working on The Montrose Playhouse’s behalf) may pass your personal data and card details to third party service providers or partners. Such providers and partners are not under our control and we therefore encourage you to consult their own privacy policies.

We (and INDY) will only ever share your data with third parties whom we believe to be fully compliant with GDPR and who also meet our own privacy standards, and we will only do so for purposes that you would reasonably expect in connection with the services we are providing to you.

  • Card or other payment details will only be used for the purpose of handling an individual transaction. We can only complete the transactions you initiate by using a payment processor. Our payment processor for all credit or debit card transactions made through INDY POS is Stripe. You may refer to Stripe’s own privacy policy here:

https://stripe.com/en-gb/privacy

  • INDY Cinema Group use Amazon Web Services (AWS) on The Montrose Playhouse’s behalf to host the servers, sessions, database and images that comprise INDY POS and power this website. AWS are fully GDPR compliant and their Data Processing Addendum (https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf) is included in the terms of service that govern our use of their products, here:

https://aws.amazon.com/service-terms/

  • INDY Cinema Group use Customer.io on The Montrose Playhouse’s behalf to process both transactional and marketing communications. We can only complete the transactions you initiate by sending you transactional communications, and you may additionally permit us to send you other information for marketing purposes. We use Customer.io to manage all these communications. Their own privacy policy is here:
  • INDY Cinema Group use imgIX on The Montrose Playhouse’s behalf for image management and to optimise delivery of images to this website. This includes any image you provide to us, whether of yourself or any other subject. You are not required to provide a photograph of yourself, but if you do, we will use imgIX to store it. imgIX are fully GDPR compliant and committed to EU–US and Swiss–US Privacy Shield Frameworks. Their own privacy policy is here:

https://imgix.com/privacy

Only The Montrose Playhouse employees, relevant INDY employees, and approved clients/suppliers we may appoint from time to time, and who need the information to perform a specific job, are granted access to personally identifying information collected on this website. We will not share any details with any other third parties without your agreement, unless required or allowed by law. Where we appoint an external party to analyse or process data, any such arrangements will be governed by a formal agreement between The Montrose Playhouse and that organisation, to protect the security of your data.

How we keep your data safe

We encourage you to read INDY Cinema Group’s data security statement regarding their POS system. [link]

Staff Responsibilities

All staff are responsible for:

Data Security- All staff are responsible for ensuring that:

a. any personal data that they hold is kept securely;

b. personal information is not disclosed either orally or in writing, or via web pages or by any other means, accidentally or otherwise, to any unauthorised third party. Staff should note that unauthorised disclosure will usually be a disciplinary matter, and may be considered gross misconduct in some cases. Personal information should be kept in a locked filing cabinet, drawer, or safe. If it is computerised, it must be coded, encrypted or password-protected both on a local hard drive and on a network drive that is regularly backed up. If a copy is kept on removable storage media, that media must itself be kept in a locked filing cabinet, drawer, or safe.

Our Data Retention Policy

We will retain your personal data for a period of 2 years, or until you withdraw your consent for us to do so, whichever comes first.

Shortly before the end of the specified retention time-frame, we will contact you to ask if you’d like your information to be retained longer, so that you can continue hearing from us if you wish to. 

If by the end of the specified retention time-frame you have not asked us to continue holding your data, we will permanently erase your personally identifying data. We may retain fully anonymised transaction data for historical analysis.

The retention time-frame for personal data stored in technical back-up copies of INDY POS is 21 days. Access to backup copies is strictly limited. All other technical processes relating to the POS system are fully anonymous.

[If you’d like to know more about our data retention policies and procedures, we encourage you to read our full Data Retention Policy [link]. ]

Your rights

You have a right to ask us to:

  • stop processing your personal data
  • update the data we hold about you
  • supply a copy of the information we hold about you
  • delete the data we hold about you

If you want to see what information we hold, withdraw consent, object to processing, request rectification/erasure or data portability, or submit a Subject Access Request, please contact The Montrose Playhouse’s’s Venue Manager on manager@montroseplayhouse.co.uk  . If we do hold information about you we will:

            •          give you a description of it;

            •          tell you why we are holding it;

            •          tell you whom it could be disclosed to; and

            •          let you have a copy of the information in an intelligible form.

Our Lawful Basis for Collecting and Processing Your Personal Data

When you complete a transaction with The Montrose Playhouse, we collect and process your data under one of the following legal bases:

Contractual:

When you buy a ticket or membership from us, you enter into a contract with us.

Legitimate interest:

When you enter into a contract with us by buying a ticket, pass, or other product, we have a legitimate interest in handling your personal data in order to complete the transaction, perform business analysis, and send appropriate communications.

Consent:

You may opt in to receive communications beyond what is necessary for transactional reasons; in particular, marketing communications.

Information Handled Outside the UK

All personal data handled on this site and in INDY Cinema Group’s POS system are stored within the UK, with the following exception:

  • We share data with Customer.io for the purpose of managing customer communications. This data is restricted to Customer.io’s GDPR compliant server installation inside the EU.
  • We use imgIX to optimise storage and web delivery of images. Photographs managed through imgIX may be transferred to secure non-UK and non-EU locations.

Links to Other Websites

This privacy policy does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

To Lodge a Complaint

We aim to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this seriously.

If you want to make a complaint about the way we have processed your personal information, you can contact the ICO: http://www.ico.org.uk/concerns

Enquiries

Should you have any questions regarding our privacy policy or the ways in which we process your personal data, please contact us at via email at manager@montroseplayhouse.co.uk or write to us at:

The Montrose Playhouse

The Mall

Montrose

DD10 8NN