The Montrose Playhouse is a company registered in the United Kingdom. We are committed to protecting your privacy. We will only use the information that we collect about you lawfully in accordance with GDPR.
This website is operated on The Montrose Playhouse’s behalf by INDY Cinema Group (INDY), who also provide the Point of Sale (POS) technology we use to process all ticket sales, memberships, and other customer transactions. When you provide your data through this site, the data will be processed in INDY POS by INDY Cinema Group but The Montrose Playhouse remains in control of the data. The Montrose Playhouse is the “data controller”, and INDY Cinema Group is our “data processor”.
Changes to this Policy
The Montrose Playhouse’s Chief Data Protection Officer is Matthew Buchanan, firstname.lastname@example.org
How we collect information about you
– When you give information to us directly.
When you purchase tickets, memberships or other products from us, we need to collect information about you to process the transaction and fulfil your order. This information may include, but is not limited to, details such as your name, your address, your email address, your phone number and your credit/debit card details.
– When we collect information as you use our website.
Like most websites, we use “cookies” on montroseplayhouse.co.uk to help us make our site as useful as possible, and for user authentication.
Please refer to our Cookies Policy for more information. [link].
What personal data we collect and how we use it
We use the information we collect about you to process your transactions and to provide a personalised service and it may include your:
- Full Name
- Telephone number
- Email address
- Photograph (optional)
- Transaction History
- Browsing data (e.g. what movies you have looked at or added to your favourites list; data about email deliverability, views, and clicks; etc.)
- Association with other customers (if you buy a joint membership)
- Any other information volunteered by yourself to The Montrose Playhouse
When you complete a transaction with us, we may use your data as follows:
- To provide you with the show tickets, products or information you bought/asked for.
- To administer your ticket purchase or purchase of other products.
- To understand how you prefer to be contacted.
- To keep a record of our relationship with you.
- To contact you if there are any important changes to your booking.
- To understand how to improve our services, products or information.
- To tell you about changes in our services or new services, events and offers you may find of interest.
- To sign you up to mailing lists that you’ve opted in to.
- To tell you about upcoming programming, offers, or other news.
- To analyse your interests and preferences so as to provide you with information relevant to you.
Some special considerations apply around marketing communications:
- We will contact you for marketing purposes only if you give us your permission to send you this kind of communication.
- If you do allow us to send you marketing communications, then we will give you as much control as reasonably possible about what channels you’d like to be contacted on (e.g. email, SMS, etc.).
In order to process a transaction or deliver information to you, INDY (working on The Montrose Playhouse’s behalf) may pass your personal data and card details to third party service providers or partners. Such providers and partners are not under our control and we therefore encourage you to consult their own privacy policies.
We (and INDY) will only ever share your data with third parties whom we believe to be fully compliant with GDPR and who also meet our own privacy standards, and we will only do so for purposes that you would reasonably expect in connection with the services we are providing to you.
- INDY Cinema Group use Amazon Web Services (AWS) on The Montrose Playhouse’s behalf to host the servers, sessions, database and images that comprise INDY POS and power this website. AWS are fully GDPR compliant and their Data Processing Addendum (https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf) is included in the terms of service that govern our use of their products, here:
Only The Montrose Playhouse employees, relevant INDY employees, and approved clients/suppliers we may appoint from time to time, and who need the information to perform a specific job, are granted access to personally identifying information collected on this website. We will not share any details with any other third parties without your agreement, unless required or allowed by law. Where we appoint an external party to analyse or process data, any such arrangements will be governed by a formal agreement between The Montrose Playhouse and that organisation, to protect the security of your data.
How we keep your data safe
We encourage you to read INDY Cinema Group’s data security statement regarding their POS system. [link]
All staff are responsible for:
Data Security- All staff are responsible for ensuring that:
a. any personal data that they hold is kept securely;
b. personal information is not disclosed either orally or in writing, or via web pages or by any other means, accidentally or otherwise, to any unauthorised third party. Staff should note that unauthorised disclosure will usually be a disciplinary matter, and may be considered gross misconduct in some cases. Personal information should be kept in a locked filing cabinet, drawer, or safe. If it is computerised, it must be coded, encrypted or password-protected both on a local hard drive and on a network drive that is regularly backed up. If a copy is kept on removable storage media, that media must itself be kept in a locked filing cabinet, drawer, or safe.
Our Data Retention Policy
We will retain your personal data for a period of 2 years, or until you withdraw your consent for us to do so, whichever comes first.
Shortly before the end of the specified retention time-frame, we will contact you to ask if you’d like your information to be retained longer, so that you can continue hearing from us if you wish to.
If by the end of the specified retention time-frame you have not asked us to continue holding your data, we will permanently erase your personally identifying data. We may retain fully anonymised transaction data for historical analysis.
The retention time-frame for personal data stored in technical back-up copies of INDY POS is 21 days. Access to backup copies is strictly limited. All other technical processes relating to the POS system are fully anonymous.[If you’d like to know more about our data retention policies and procedures, we encourage you to read our full Data Retention Policy [link]. ]
You have a right to ask us to:
- stop processing your personal data
- update the data we hold about you
- supply a copy of the information we hold about you
- delete the data we hold about you
If you want to see what information we hold, withdraw consent, object to processing, request rectification/erasure or data portability, or submit a Subject Access Request, please contact The Montrose Playhouse’s’s Venue Manager on email@example.com . If we do hold information about you we will:
• give you a description of it;
• tell you why we are holding it;
• tell you whom it could be disclosed to; and
• let you have a copy of the information in an intelligible form.
Our Lawful Basis for Collecting and Processing Your Personal Data
When you complete a transaction with The Montrose Playhouse, we collect and process your data under one of the following legal bases:
When you buy a ticket or membership from us, you enter into a contract with us.
When you enter into a contract with us by buying a ticket, pass, or other product, we have a legitimate interest in handling your personal data in order to complete the transaction, perform business analysis, and send appropriate communications.
You may opt in to receive communications beyond what is necessary for transactional reasons; in particular, marketing communications.
Information Handled Outside the UK
All personal data handled on this site and in INDY Cinema Group’s POS system are stored within the UK, with the following exception:
- We share data with Customer.io for the purpose of managing customer communications. This data is restricted to Customer.io’s GDPR compliant server installation inside the EU.
- We use imgIX to optimise storage and web delivery of images. Photographs managed through imgIX may be transferred to secure non-UK and non-EU locations.
Links to Other Websites
To Lodge a Complaint
We aim to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this seriously.
If you want to make a complaint about the way we have processed your personal information, you can contact the ICO: http://www.ico.org.uk/concerns
The Montrose Playhouse