1. Information we collect about you

“Personal information” is information that does or can be used to identify you, either alone (e.g. your name) or when combined with other information. Personal information does not include data where identifying features have been removed, e.g. anonymous data.

We collect your personal information in different ways, such as:

• when you create an account, or send us an email, and provide us with your name, address, telephone number, postal address, email address;
  
• if you make a purchase with us, we may collect certain financial information, such as debit or credit card information;
  
• if you post, display and/or publish content on this Website, we collect the content you have contributed; and
  
• when you enter any password-protected area of our Services, it will recognize who you are and will collect whatever personal information you submit.

We may collect the following categories of personal information about you and share that information with our third-party service providers, as identified in the table below. Any information collected about you from our Services may be associated with other information that WhatsOnStage may have on you.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal information under data protection laws as this information does not directly or indirectly identify you. For example, we may anonymize your Profile Data and aggregate your Profile Data with the profiles of other users for statistical analysis, trend analysis, and to improve our products, services and marketing activities. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this policy.

We do not collect any “sensitive” data or Special Categories of Personal Information about you (including details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

2. How we collect your personal information

We collect personal information about you in the following ways:

Information you give us

We collect personal information you give us, such as your name, email address, postal address and telephone number, when you:

• purchase any ticket or other product or service from our Services;
  
  
• join any of our Theatre Clubs or sign up for our newsletter or other promotional materials;
  
  
• provide feedback or make any enquiry or complaint.
  
  

Information we receive from third parties

We may receive personal information about you from third parties, including but not limited to:

• analytics providers such as Google Analytics (aggregated data only);
  
  
• when someone purchases a gift certificate for you or refers you for a Theatre Club membership;
  
  
• business partners such as third-party payment providers or other websites that we have integrated with.

As you interact with our Website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. For further details on cookies, see below.

3. How we use your personal information

We use your personal information in accordance with applicable data protection laws. Most commonly, we will use your personal information:

• when you purchase a ticket or other product or service from us and we need the personal information to perform the contract with you;
  
  
• where it is necessary for our legitimate interests, or those of a third party, and your interests and fundamental rights do not override those interests;
  
  
• where we need to comply with a legal or regulatory obligation; and
  
  
• where we have your consent to using your personal information.

4. Purpose for which we use your personal information

We have set out in the table below a description of how we may use your personal information, and which of the legal bases we rely on to do so. Where we rely on the basis of legitimate interest, we have also identified what our legitimate interests are.

Marketing communications

We aim to communicate with you about our Services in ways that you find relevant, timely, respectful, and never excessive. To do this, we may use your Identity, Contact, Technical, Profile and/or Marketing and Communications Data to send you newsletters that you have consented to receive.

We will provide you with an option to unsubscribe from receiving our direct marketing in every newsletter and marketing communication we send you. You can also contact us to help you update your email preferences (see Contacting Us section below).

As part of our service to you, we may contact you by email or telephone to provide essential information related to your account, purchase and visit.

5. Disclosure of your personal information to third parties

We never monetize your personal information. As explained in this policy, we may disclose your personal information to our service providers who process data on our behalf and on our instructions. For example, your Financial Data is provided to the Theatre Club’s payment processor. Your personal information may also be provided to others who assist us with certain functions such as online queue management systems, transaction processing, website support and maintenance, promotional and marketing services, business and sales analysis.

We require all service providers to respect the privacy of your personal information and to handle it in accordance with the law. We do not allow our service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

We may share your personal information with the following parties:

• our business partners that operate venues and sponsor events;
  
  
• our business partners that offer related products and services to you. For example, when you purchase a ticket;
  
  
• any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries;
  
  
• we are under a duty to disclose your personal information in order to comply with any legal obligation;
  
  
• in the context of a legal transaction such as a merger, acquisition or other legal proceeding.

We do not monetize your personal information and we do not share your personal information except as described in this policy.

6. Personal information of children

We do not target our Services to children. You must be 16 years of age to use this Website or any of our Services. We do not knowingly collect personal information from children under the age of 16.

7. International transfers

The personal information we collect about you may be transferred outside the jurisdiction in which you are situated and may become subject to the laws of the receiving jurisdiction, which may differ from the laws of your jurisdiction. By using our Services, you consent to the transfer of your personal information outside of your jurisdiction for the purpose of storing your personal information or processing it. The personal information we receive may be transferred to and stored outside the United Kingdom / European Union, EEA for purposes of processing by us and by third party service providers that work for WhatsOnStage. These locations include the United States of America and Canada.

Where your personal information is transferred to and stored in a country not determined by the European Commission as providing adequate levels of protection for personal information, we take steps to provide appropriate safeguards to protect your personal information, including:

• entering into standard contractual clauses approved by the European Commission, obliging recipients to protect your personal information as permitted under Article 46(2)(c) of the GDPR;
  
  
• under the EU-U.S. Privacy Shield Framework (where we transfer personal information to the U.S.), which enables U.S. businesses to self-certify as a means of complying with EU data protection laws.

In the absence of an adequacy decision or of appropriate safeguards as referenced above, we will only transfer personal data to a location outside the EEA where one of the following applies (as permitted under Article 49 of the GDPR)):

• the transfer is necessary for the performance of our contractual engagement with you;
• the transfer is necessary for the establishment, exercise or defense of legal claims; or
• you have provided explicit consent to the transfer.

If you would like to learn more about our transfer practices, please contact us at [email protected].

8. Security of your personal information

WhatsOnStage takes appropriate technical, physical and organizational security measures to protect personal information in our custody and control against unauthorized access, use, modification and disclosure, and accidental loss, destruction and damage. Unfortunately, no method of transmission over the Internet, or method of electronic storage, is one hundred percent secure. Therefore, while we strive to use commercially acceptable means to protect personal information, we cannot guarantee its absolute security.

In addition, we aim to protect your personal information with all of our service providers by contractually requiring them to maintain adequate data security processes and by limiting them to process your personal information on our instructions only.

Your debit and credit card information

If you use a credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely. For WhatsOnStage Theatre Club memberships our payment service provider will store your card details safely for use in future transactions. This is carried out in a way where none of our staff members can see your full card number. We do not store your 3 or 4-digit security code.

Third-party links

Our Website may contain links to other sites that WhatsOnStage does not own or operate. Except as provided in this privacy policy, we will not give any of your personal information to these third parties without your consent. We provide links to third-party websites as a convenience.

These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices and terms of use, which we recommend you read carefully. We do not have any control over such websites, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use or disclose, secure and otherwise treat your personal information.

Internal data protection policies

WhatsOnStage staff are not allowed to put personal data on memory sticks or other such storage devices to protect against accidental loss.

Any WhatsOnStage staff member that has access to personal data on their mobile phones must ensure that said phone is password protected and that in the event of loss, that data can be deleted remotely.

All WhatsOnStage laptops are encrypted so that personal data cannot be accessed by third parties in the event of theft or loss.

WhatsOnStage has a policy in place to ensure that once an employee leaves the company, they no longer have access to personal data via any means including electronic.

9. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal regulatory, tax, accounting, or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Financial Data is not retained after your transaction is completed.

10. Your legal rights

Depending on certain considerations such as your residence, you may have the following rights to your personal information:

1. Right to request access to your personal information

   You have a right to request a copy of the personal information that we hold about you. We may refuse to comply with a subject access request if the request is manifestly unfounded, excessive or repetitive in nature.

   To request a copy of the personal information we have collected about you, or to request that your information be deleted, please contact us by clicking here: Request to Access/Delete.

   You may authorize an agent to submit a request on your behalf. If an authorized agent will be submitting a request for you, please contact us at [email protected] or toll-free at +44 (800) 3689466. We will aim to complete requests as soon as reasonably practicable and consistent with any applicable laws. Please note that we are required to verify your identity and, where applicable, that your agent has been properly authorized to request information on your behalf and this may take additional time to fulfill your request.

2. Right to request erasure (deletion) of your personal information

   You have the right to request that we delete or remove personal information where there is no good reason for us continuing to process it. Note that deletion requests are subject to certain limitations, for example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, or to process transactions and facilitate customer requests.

   To request a copy of personal information we have collected about you, or to request that your information be deleted, please contact us by clicking here: Request to Access/Delete. You can also email us at [email protected] or toll-free at +44 (800) 3689466.

3. Right to request we transfer your personal information to you

   You have the right to request that the personal information we hold about you is transferred to you or to a third party. We will provide you, or the third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

4. Right to request correction of your personal information

   You have the right to request that we correct the personal information we hold about you, although we may need to verify the accuracy of the new information you provide us. We may refuse to comply with a request for rectification if the request is manifestly unfounded, excessive or repetitive in nature.

   If you have an account with us, you may also make certain changes directly through your account profile page.

5. Right to request restrictions on the processing of your personal information

   You have the right to request that we suspend the processing of your personal information in the following scenarios:

   • if you contest the accuracy of the personal information we hold about you and we are verifying the accuracy of that information;
     
     
   • where it has been determined that the processing of your personal information is unlawful but you do not want us to erase it;
     
     
   • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
     
     
   • you have objected to our use of your data under Article 21(1) of the GDPR but we need to verify whether we have overriding legitimate grounds to use it.

   We may refuse to comply with a request for restriction if the request is manifestly unfounded, excessive or repetitive in nature.

6. Right to object to the processing of your personal information

   In certain circumstances, you have the right to object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party). In this case, you must provide specific reasons for why you are object to the processing of your personal information.

   You have an absolute right to object to the processing of your personal data for direct marketing purposes. In some cases, we may seek to demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

7. Right to withdraw consent

   In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

8. Right to non-discrimination

   Exercising your right to privacy does not result in different treatment by us or different quantities or qualities of product or service that we offer. Where we request your personal information in exchange for a valuable product or service, we will let you know at the time of the exchange.

Exercising Your Rights

You may exercise any of these rights by emailing us at [email protected] or by calling us toll-free at +44 (800) 3689466. Please also note the following:

• No fee usually required

Typically, you will not have to pay a fee to access your personal information (or to exercise any of the other rights).

• What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

• Time limit to respond

We try to respond to all legitimate requests within five working days. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

11. Cookies and similar technologies

This Website makes use of “cookies”. Cookies are small data files commonly stored on your device when you browse and use websites. They help to make your online experience faster, and assist with things like personalization, reporting, and advertising. Cookies contain information allowing us to recognize when you are visiting this Website and to keep track of your preferences. Through the use of a cookie, we also may automatically collect information about your online activity on our site, such as the web pages you visit, the links you click, and the searches you conduct on our site. Cookies are stored in your computer’s browser or on your hard disk and can then be retrieved by this Website.

This Website uses two kinds of cookies:

• “session” cookies, which are deleted from your computer when you leave this Website and are used purely to help you to navigate around this Website; and
  
  
• “persistent” cookies, which remain on your computer so that this Website can recognize you when you return.

We also use third-party advertising companies to target and show you advertisements when you visit this Website. These third-party advertisers may send “cookies” to your computer or other device to gather information about your preferences to provide you with advertising that is more likely to relate to your interests.

You can opt-out from use of cookies that are not necessary. However, if you opt out of tracking, this may affect the quality of your browsing experience on our websites and the extent to which we can provide you with relevant and timely information.

To opt-out of tracking from Google’s advertising services, go to: https://www.google.com/ads/preferences/

If you want to delete any cookies that have already been sent to your computer or personal device, please refer to your web browser’s “Help” facility. In addition, most web browsers can be set to prevent you from receiving new cookies, notify you before accepting cookies or disable cookies altogether. Details about this can normally be found in the “Help” facility provided with your browser. Please note that if you disable cookies you may not be able to take advantage of some of this Website's interactive functionality.

Google Analytics

This website uses Google Analytics, a web analytics tool provided by Google, Inc. (“Google”) that helps website owners understand how visitors engage with their website. We can view a variety of reports about how visitors interact with our Website so we can improve it. Google Analytics collects information anonymously. Google uses cookies, and IP addresses, and it reports website trends without identifying individual visitors. For more information related to Google Analytics, click here: http://www.google.com/analytics/learn/privacy.html You can opt-out of Google Analytics by installing the Google Analytics Opt-out Browser Add-On. For information about and to install Google Analytics Opt-out Browser Add-on, click here: https://tools.google.com/dlpage/gaoptout?hl=en

Additionally, we use Google Analytics’ doubleclick cookie for tracking aggregate and non-personally identifiable demographics and interests data. This website describes how it works and how the user can opt-out: https://support.google.com/adsense/answer/1348695.

12. Complaints

Your privacy is very important to us. We want to hear from you if you have any questions or concerns about our privacy practices. We hope we can resolve any query or concern you raise about our use of your information. If you have questions or concerns about our use of your personal information, please send an email with the details of your question or concern to [email protected] or call us toll-free at +44 (800) 3689466.

We work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding your information that we cannot resolve with you directly.

If UK or European Union (EU) data protection laws apply to the processing of your information, you also have the right to complain to a supervisory authority in the UK or European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred.

13. Notification of changes to our privacy policy

This privacy policy may change from time to time. Any changes will be posted on this page with an updated revision date. We will always communicate any changes to our patrons and supporters where we have accurate contact details and where they would expect to receive communications from WhatsOnStage.

This privacy policy was last updated on March 19, 2020.

14. Contacting us

We want to hear from you. We have appointed responsibility for overseeing questions related to this privacy policy to a data privacy team. If you have any questions about this policy or our privacy practices, you may contact us at [email protected] or call us toll free at +44 (800) 3689466.