At the Drayton Arms Theatre we take your privacy seriously and we respect your privacy and data protection rights.
Please take time to read this privacy notice in full, together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, to ensure that you understand and are happy with how we collect and process your personal data.
This privacy notice supplements the other notices and is not intended to override them.
Who are we?
The Drayton Arms Theatre is a trading name for The Drayton Arms, 153 Old Brompton Road, London, SW5 0LJ. The Drayton Arms is operated and managed by Mitchells & Butlers Leisure Retail Limited (company number 01001181 with its registered office at 27 Fleet Street, Birmingham B3 1JP). Further details can be found at www.mbplc.com.
Why do we need personal data?
When you use our websites or social media channels we collect technical information about your visit to ensure you are receiving the best possible service and the information is displayed in the most accessible format for your device. Upon confirmation of your consent we also use your name and email address to keep you informed of our upcoming productions in our e-mailing list.
What data do we collect?
e-mailing list - If you have given us your consent to join our email marketing list and receive updates on future productions we will collect the following identity data;
- First Name
- Email address.
technical data - In order to ensure you receive the most accessible version of our website and the best performance we collect the following information for diagnostic purposes;
- Internet protocol (IP) address
- Browser type and version
- Browser plug-in types and versions
- Operating system and platform and other technology on the devices you use to access this website.
box office data - In the interests of transparency we feel it is necessary to display the list of data in which the ticketing provider (TicketSource) is processing and the theatre company is controlling whe you are purchasing tickets;
- First and last name
- Position (for business events where you have selected to record this information)
- Employer (for business events where you have selected to record this information)
- Contact information (address, email, phone)
- IP address
- Payment details (payment details are encrypted when sending for processing and are only partially stored within the TicketSource system inline with our Payment Card Industry Data Security Standards compliance
How do we collect data?
e-mailing list - We collect data for our e-mailing list via a GDPR compliant signup form with MailChimp.
How do we use your data?
technical data - We use the information collected from our website to monitor the health and status of our website. To identify areas of our website that could be improved or streamlined.
box office data - All theatre companies are contracted to give the Drayton Arms Theatre access to your data under the lawful basis of legitimate interest on the grounds of safety and security of our venue. We are required to access a list of attendees for each performance in order to provide a Front of House service to allow access into the theatre. This information is destroyed as soon as the performance has finished unless we are required to keep it for a safety or security concern. I.e. A theft were to take place in the theatre whilst the performance was in progress.
How do we protect your data?
e-mailing list - All our data for our e-mailing list is stored within our secure MailChimp account. We use complex passwords and this is also further secured with two-factor authentication. Access is strictly limited to theatre staff only. No access is given to our e-mailing list by any of the theatre companies who hire the theatre.
technical data- All our technical data is stored within our encrypted database using complex passwords. To increase this protection access is only granted to trained staff and passwords are regularly cycled.
How long do we retain your data?
e-mailing list - We retain your data for our e-mailing list as long as you choose to still receive communications from us. In the event you unsubscribe from our mailing list your data is instantly removed from our lists and you will only be able to resubscribe by signing up again through our website link. On a yearly basis we will review our e-mailing list and if we discover that you have not opened any of our emails since the last review date we will also remove your data from our e-mailing list and assume you no longer wish to hear from us. In this instance we may send you one final reminder email to ask if you wish to remain on our e-mailing list.
technical data - We retain technical data for the operation of our website for two years to allow us to compare visitis to our websites on a year on year period.
Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of the rights set out above, please contact us by email: email@example.com
You have the rights to:
- Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. To do this, sign into your account on our website. You can also amend these details and preferences when booking a ticket over the phone, or in person.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests.
In order to make certain services available to you, we may need to share your personal data with some of our service providers, for example the processing of a telephone booking to purchase a ticket to an upcoming show. The Drayton Arms Theatre only allow our service providers to handle your personal data when we have confirmed that they apply appropriate data protection and security controls. We will never sell or rent our customer data to other organisations for marketing purposes.
If you have any concerns, or would like more details about how we process your personal data, you can contact us using firstname.lastname@example.org
Our full details are:
Data Protection Officer
27 Fleet Street, Birmingham B3 1JP
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the supervisory authority for data protection issues in the UK (phone: 0303 123 1113 or at www.ico.org.uk/concerns). However, we would appreciate the chance to deal with your concerns before you approach the ICO, so please feel free to contact us in the first instance.