Privacy Policy

Privacy Policy

The Corn Exchange, Newbury will always store your personal details securely. We’ll use your details to provide the service that you have requested, and communicate with you in the way(s) that you have actively agreed to. Your data may also be used for analysis purposes, for reporting to our funders, to help us provide the best service possible and to contact you about a booking you have made. We will never pass your details on to anyone else without your explicit consent.  You are free to change your mind at any time by changing your contact preferences online, or by emailing admin@cornexchangenew.co.uk

Contact details

Corn Exchange (Newbury) Trust, Corn Exchange, Market Place, Newbury RG14 5BD

Tel 01635 582666 Email admin@cornexchangenew.co.uk

What data we collect from you

We collect information you provide when processing your bookings or donations; when you create an account with us; when you complete an enquiry form or contact us; or when you sign up to our Access scheme.  

The type of information we collect may include:

• Your name
• Postal address
• Telephone number
• E-mail address
• Your booking history
• Your donation history
• Billing information
• Any access or support needs
• Your preferences for how we communicate with you
• If you work at a school, care setting or support agency and we have a professional relationship with you we may hold details of your professional e-mail address, the name, address and phone number of the organisation you work for, the type of organisation you work for and the areas or subjects in which you work
• If you are a young person attending our youth theatre or other activities, we may hold contact details for your parent or guardian, including name, address, phone number and e-mail address
• If you apply for a job with us we may hold details of your experience and qualifications
• Date of birth or age
• Any health, allergy or dietary requirements related to your booking
• Your opinions if you complete a survey
• Any other information you provide by letter, e-mail, telephone, social media, via our website or in person
• Image and likenesses, captured on CCTV or in photographs or video used for promotional or archive purposes

We may also use cookies to collect information about how visitors who have subscribed to our email lists are using the website. This data is not anonymised and we use the information to help improve our email communications and target specifically-tailored messages for our email subscribers.

Our website uses cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about users of the site with our social media, advertising and analytics partners who may combine it with other information that has been provided to them or that they’ve collected from the use of their services. The law state that we can store cookies on a device if they are strictly necessary for the operation of our site. For all other types of cookies we need the user’s permission. Users can change or withdraw their consent at any time from the Cookie Declaration on our website. More information can be found here: https://cornexchangenew.com/cookie-policy
 

You can go to https://policies.google.com/technologies/cookies to find out more about Google Analytics cookies and how to opt-out of them. 

What data we collect from third parties 

In some circumstances, we also receive information about you from third parties that provide us with data to help us understand how we can provide the best experience for our audiences and how to best connect with you. This includes performing regular gone away and deceased record matching, to ensure that we best utilise the charity’s limited resources.

If you book through a third party ticketing agency we receive your personal data from them in order to administer bookings. We will not use this personal data for any other purposes, unless you give us consent to do so.

How we use your data

• We will use your telephone number and/or email address to contact you about your booking – e.g. to send you your e-tickets, to inform you of a cancelled performance, a significant change to the line-up, any pre-show information that enables a smoother/better visit, changes to workshops or classes, or for post-show evaluation questions to help us improve what we do and provide feedback to our funders.
• We will contact our Members and Companions by email in order to administrate their member benefits, such as sending newsletters, offers and sending your digital membership card.
• We will use your email address to send you direct marketing, if you have opted in to receive emails about future performances, events, workshops and our activity. This will include sending you information about future shows and performances based on your booking history, so that you only receive information that is likely to be of interest to you.
• We will use your email address to send you communications about our fundraising activities, including fundraising appeals, fundraising events, legacy fundraising, only if you have opted in to receive information about our fundraising programmes.
• We will use your banking details to process payments and donations you have made to us through our booking system. This system does not store credit/debit card details unless you choose to store them for future purchases. Our staff are not able to see your full card number and your security code is not stored. When we receive standing order mandates for donations or memberships we send the original mandate straight to your bank, and hold a copy, securely, for admin purposes. We will also use your personal data to claim Gift Aid, if applicable.
• We will use anonymised postcode information for data profiling to give us a sense of the cultural habits of our bookers in order to inform our decision making process.
• If you apply for a job with us we will hold contact details, information and experience and qualifications and any access requirements. 
• If you request to go on our digs/accommodation list, we will store your name, address and contact details, along with information about the accommodation you are offering. This will be shared with cast members and visiting companies for the purposes of booking accommodation. We will contact you on an annual basis to make sure your details are up to date and you can request to be removed at any time. 
• We will acknowledge donors in the way in which they would prefer to be thanked, as agreed following a donation. Donors can be acknowledged as anonymous if they would prefer. 

Legal basis under the GDPR by which we process your data

• We will process personal data where this is necessary for the performance of a contract with you, if you are a supplier, artist or member of staff.

Consent:

• We will only process your email address to send you direct marketing if we have your consent.
• We will only process your personal data to send you information about our fundraising programmes, if we have your consent.
• We will only pass on your details and booking history to other relevant arts organisations (i.e. companies whose performances you have previously attended), including Newbury Spring Festival, if we have your consent.
• We will only process children’s data (under 14s) if we have parental consent, for the purposes of running youth classes and children’s workshops, in line with our safeguarding policy.

Legitimate interests: 

• We will use your personal information to administrate your booking or to contact you in the event of changes to a booking you have made, e.g. to let you know about a cancelled performance.
• We will use the information you provide relating to your access requirements in order to best support your visit to us.
• We will process your personal data for the purposes of internal reporting and analysis because we believe it is necessary for our legitimate organisational interests in creating better events, better communications, and a better website. 
• We may use your address to mail you marketing, fundraising and membership information, and to send you administrative mail, including thank yous for donations.
• When you give us your personal information in connection with making a donation, we will also use this information (never your financial information) for internal reporting and analysis. 
• We may share demographic information, but never personal information, with funders, such as Arts Council England, their appointed data analysis companies, and other sector support agencies such as the Audience Agency and Purple Seven.
• We have conducted a legitimate interest assessment to ensure that this processing isn’t overridden by your rights or interests. We employ safeguards, such as formal Data Protection and Data Retention policies, to protect your privacy. 
• Sometimes it may be necessary to process your data for us to comply with our financial obligations, like when we send Gift Aid information to HMRC.

To opt out of any of the above processing, please contact us.

Analysis and profiling

We may use data profiling, such as audience segmentation by postcode or previous booking history, to inform our decision making. 

To ensure that our limited resources are used efficiently, we may analyse your personal data and create a profile of your interests and preferences. In doing so we may make use of additional information about you, including where you live, your age and measures of wealth, when it is available from external sources such as public registers, online (including information you have made public on social media) or the electoral roll. We may use third party suppliers to undertake these activities on our behalf. This helps us understand a bit more about the people who support us so that we can make appropriate requests to those who may be able and willing to give more than they already do, enabling us to raise funds sooner and in a more tailored way than we otherwise would.

We use this information to target our direct marketing and fundraising—there are no other consequences of this profiling. To opt out of profiling or wealth screening, please contact us.

You are under no legal requirement to provide your personal data 

You are not required to provide personal data to us.  However, your failure to do so may affect our ability to provide the services you request – for instance, letting you know about changes or cancellations to a show or workshop you have booked for. We will not be liable for compensation in the event that we are not able to contact you regarding a performance that has been changed or cancelled.

Data Subject Rights 

Under the GDPR you, as the data subject, have the following rights:

• You have the right to ask us for a copy of the data we hold about you.
• You have the right to ask us to correct any data we hold about you.
• You have the right to ask us to delete the data we hold about you.
• You have the right to ask us to stop processing your data.
• You have the right to ask us to provide you with your data in a common, machine readable format.
• You have the right to restrict the processing of your data to specific purposes, i.e. you can object to receiving direct marketing or fundraising communications.
• You have the right not to be subject to automated decision taking, including profiling.
• You have the right to withdraw your consent at any time.
• You have the right to make a complaint to the Information Commissioner’s Office - https://ico.org.uk/

We will not charge you for a copy of the data we hold about you and will respond to requests within 1 month. If your request is clearly excessive or unfounded, we reserve the right to be able to charge you for our reasonable administrative costs. 

You can review and amend your preferences at any time by logging into your online account here.  If any of the information we have is wrong, let us know and we’ll correct it.

Sharing your data  

• We will never sell your personal data to another organisation. 
• With your consent we may share your personal data to relevant arts organisations.
• We may disclose your personal data if required by law or to enforce our legal right.
• We may disclose your data to our affiliated organisations and subsidiaries, and to service providers who render services to us or you on our behalf, including but not limited to our ticketing system provider, our e-mail distribution service, mailing houses and payment processors, (all of which are contractually obligated to act only on our instructions and in accordance with applicable laws, including GDPR), which includes Payroll services for staff.

How long we will hold your data 

• We will hold your personal data for as long as you hold an active account with the Corn Exchange. If you have an inactive account we will hold your data for a maximum of 5 years before gaining further consent, unless instructed differently by you.
• We will review our criteria for determining our retention period regularly.

How we secure your data

We will collect, process and store your data safely and securely. Spektrix, our Box Office system, operates to the highest levels of digital and physical security.  Its servers are located in a tier IV data centre in the UK with 24/7 onsite security and tightly restricted access control.  Our system operates under the highest standards of card security and is Level 1 PCI compliant.

Spektrix, our ticketing system service provider may transfer of provide access to data to its affiliate Spektrix Inc, based in the United States in order to provide technical support services and the transfer is made in accordance to Data Protection Laws. Spektrix Ltd (its UK entity) and Spektrix Inc (its US entity) have entered into recognised EU Standard Contractual Clauses and UK International Data Transfer Agreements which ensure lawful transfers of person data to non-EU/EEA countries.

All of our staff are trained in current Data Protection regulations and are required to abide by our Data Protection Policy.

This Privacy Policy is available on our website and Front of House.  An electronic copy can also be requested by emailing admin@cornexhangenew.co.uk or by telephoning 01635 582666.

We will notify constituents of any changes to this policy by email.

We are registered with the Fundraising Regulator and agree to ensure that our fundraising is legal, open, honest and respectful.  We abide by the Fundraising Code of Practice.

Version 2 Approved by Board July 2024

To be reviewed: July 2026