Privacy and Cookies Statement ("Privacy Statement")

1. We, Theatre@41 Ltd, operate this Privacy Statement because we are committed to safeguarding the privacy of those using our services (including but not limited to the Site defined below) and the confidentiality of any information that we collect about you. This Privacy Statement sets out how we will use any personal information that we may obtain from you in connection with our services (including but not limited to the Site). If we change any of the terms of this Privacy Statement we will post the revised statement on the Site behind the "Privacy and Cookies Statement" link at the bottom of each page.
2. The Theatre@41 website (home page https://www.41monkgate.co.uk/) ("the Site") is operated by Theatre@41 Ltd.
3. Whenever you submit your information to us in connection with our services or your use of the Site, whether it be by using the Site, by email, over the telephone or in person, you acknowledge that we will collect and use such information in accordance with the terms of this Privacy Statement and, if you opt in when requested by us, are consenting to be added to our mailing list. Please see section 4 below for further information if you no longer wish to receive such mailings from us.
4. You have the right to lodge a complaint with the Information Commissioner's Office ("ICO") if you have any concerns with regard to the way in which we process your personal data. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
5. Please note that if you apply to us to become a trustee or a volunteer we will collect additional information from you in connection with such an application. Such information will be processed in accordance with our separate Trustee and Volunteer Data Protection Statement.
6. You warrant that any information you supply to us is accurate and up to date (whether or not the information is about you), that you will inform us if any information that you provide us with requires updating, and that if you submit a third party's details to us (including but not limited to via the Site) you have that third party's permission or an alternative legal basis to do so.

1. We are Theatre@41 Ltd (registered company number 03940894; registered charity number 1082962). Our registered office and address for correspondence is at 41 Monkgate, York, YO31 7PB.
2. We are committed to ensuring that all personal information we hold is treated properly and in accordance with applicable data protection legislation. We are registered as a data controller with the Information Commissioner's Office and our ICO registration number is ZA783923. In accordance with applicable data protection legislation, we are required to explain to you how we will treat any personal data which we collect from you.

1. It is possible to visit and browse some sections of the Site without being required to tell us who you are or reveal any information about you (e.g. if you do not log in to the Site).
2. We may keep a record of any information that you post or upload using the Site, or if you contact us, we may keep a copy of that correspondence. We may also keep details of your use of the Site, including, but not limited to, traffic data, location data and other communication data, and the resources that you access and download using the Site. We will use this information for our legitimate interests in the following ways:
  1. to develop our systems and services and ensure that content from the Site is presented in the most effective manner for you and for your computer/device;
  2. to provide you with information or services that you request from us;
  3. to carry out our obligations arising from any contracts entered into between us;
  4. to monitor your compliance with the terms and conditions applicable to any contracts entered into between us;
  5. to allow you to participate in interactive features of the Site;
  6. to notify you about changes to our services and/or the Site; and
  7. to create anonymised reports based on your usage of the Site.
3. If you register to become a member with us, purchase tickets, or enter into an agreement with us to hire one of our event spaces we will specifically ask you for consent to communicate with you by email, we will use your name, contact details, bank account details and payment card details where necessary for the performance of any contract between us (for example, to take payment from you of our annual membership fee/hire fee, to set up any agreed direct debits and to issue any refunds that may become payable). Where you are paying by card, you will be redirected to the website of our payment services provider Stripe in order to make your payment (we do not store any card details on our servers). After the payment has been completed you will be redirected back to the Site. Please note that Stripe may collect personal information from you which will be used in accordance with Stipe's own privacy policy. (which you should read). More information regarding Stripe can be accessed via the following URL: https://stripe.com/en-gb/. We are not liable for the practices of Stripe in respect of your personal information.
4. We will also, where you register to become a member with us, use your contact details to contact you in relation to your membership (including but not limited to inviting you to our annual general meeting and to send you your monthly membership newsletter). Such information will be processed on the basis that it is necessary for the performance of our membership agreement with you.
5. We will also, where you hire an event space from us, use your personal information to contact you in relation to, and to administer, our related hire agreement with you. Such information will be processed on the basis that it is necessary in our legitimate interests. This will involve relevant personal data being handled by our trustees, but your contact details may also be handled by those of our technical volunteers involved in arranging relevant support.
6. In the event that you provide us with feedback regarding the Site or our services, we may disclose that feedback to our suppliers and to other users of the Site and our services where it is in our legitimate interests to do so in order to improve the services that we provide. This includes any information that you provide to us if you report a problem with the Site or our services.
7. Where you have given consent under 3.3, we will use your information to inform you of forthcoming shows, special offers, promotions, new products, new services, fundraising activities changes to the site and any other activity we consider is of legitimate organisational interest via post, telephone, email, SMS or other appropriate means. If you subscribe to our mailing list but subsequently decide that you no longer wish to receive such mailings please see section 4 below.
8. If you correspond with us (e.g. using email), we may retain the content of your correspondence together with your contact details and our responses where necessary for our and your legitimate interests in order that we can appropriately manage your relationship with us, to reply to your correspondence and for training and quality purposes. This may include us recording and monitoring our telephone calls with you for such purposes.
9. Where we need to collect personal data in connection with any services which you request or order from us and you fail to provide that data when requested, we may not be able to provide such services or perform any related contract that we have or are trying to enter into with you.
10. We may disclose personal data about you:
  1. with performing companies, using our theatre, whose performances you have attended;
  2. with third parties who are directly involved in dealing with any request, enquiry, complaint or other correspondence submitted by you or in the performance of any contract between us and you;
  3. with third parties who are processing your information on our behalf for specified purposes in accordance with our instructions;
  4. with third parties who are providing us with professional advice where necessary for our legitimate interests in obtaining such advice and permitted by law;
  5. where we are legally required to do so;
  6. in connection with criminal investigations, legal proceedings or prospective legal proceedings where necessary for our related legitimate interests and where permitted by law;
  7. where necessary for our legitimate interests and permitted by law in establishing, exercising or defending our legal rights (including providing information to others for the purposes of fraud prevention) and protecting the rights, property or safety of Theatre@41 Ltd, our trustees, volunteers, members, customers, suppliers or others; and
  8. where we have stated or informed you otherwise (e.g. in this Privacy Statement or on the Site).
11. We may also disclose your personal information to third parties in the event that we propose to dispose of or acquire any business or assets (in which case we may disclose your personal information to the prospective acquirer or seller of such business or assets and/or their professional advisors) or if we or substantially all of our assets are proposed to be acquired by a third party. Any such disclosure will be made where necessary for the legitimate interests of us and/or the third party in respect of the proposed transaction; however we will not transfer your personal information to any such third party unless we are satisfied that they are able to provide an adequate level of protection in respect of your personal information.
12. Except as provided in this Privacy Statement, we will not provide or disclose your information to third parties without your express consent for any purpose (including but not limited to direct marketing). We do not sell personal information under any circumstances.

1. You can ask that such information is no longer sent to you by emailing us at marketing@41monkgate.co.uk or writing to us at Theatre@41 Ltd, 41 Monkgate, York, YO31 7PB, clicking on the appropriate link in the footer of any of our marketing emails or by following the instructions in any related SMS message. Any such withdrawal of consent will not affect the lawfulness of our processing based on your consent before you withdrew it.

1. We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know that information. However, the Internet is global and no data transmitted via the Internet can be guaranteed by us to be completely secure during transmission. We cannot guarantee the security of any information that you disclose online and we will not be responsible for any breach of security unless this is due to our negligence or wilful default. It is possible that the information you provide to us will be temporarily transferred via a route outside the European Economic Area as it passes between us.
2. In certain circumstances we may use the services of a supplier outside the European Economic Area (EEA) for purposes referred to in this Privacy Statement (for example, we use the services of Mailchimp to store our email newsletter database and send electronic communications, and we use Stripe for processing payments). This may involve your personal information being processed by the relevant supplier on our behalf or on the supplier's own behalf outside of the EEA. If we do this, we will require the relevant supplier to put in place appropriate technical and organisational data protection security measures (for example, as part of our contract with the relevant supplier).
3. We have put in place procedures to deal with any suspected data security breach and will notify you and/or any applicable regulator of a suspected breach where we are legally required to do so.

1. You have a legal right to see a copy of the personal information that we keep about you and to correct any inaccuracies, subject to certain exemptions. In some circumstances you may also have the right to:
  1. request that we erase any personal information held about you;
  2. restrict our processing of your personal information (for example, to ask to suspend the processing of personal information to establish its accuracy or the reasons for processing it);
  3. data portability (i.e. to request the transfer of personal information to a third party); and
  4. object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party).
2. Requests of the nature set out in section 6.1 above should be made in writing to the Information Compliance Officer, Theatre@41 Ltd, 41 Monkgate, York, YO31 7PB or via email at chair@41monkgate.co.uk. Please contact the same address if you have any reason to believe that information we hold about you is inaccurate. We will respond to your request as soon as possible and, in any event, within one month from the date of receiving the request. Please note that we may, where legally permitted, reject any such request or limit the scope of our response (e.g. if, in the circumstances, the right does not apply to you).
3. In accordance with applicable data protection legislation, we follow security procedures in the storage and disclosure of your information. We may therefore request proof of your identity before disclosing certain information to you or complying with any other request of or a nature described in section 6.1 above.
4. You will not generally have to pay a fee to exercise any of your rights described in section 6.1 above. However, we may charge a reasonable fee if you make a request to see a copy of your personal information which is clearly unfounded or excessive. Alternatively we may refuse to comply with your request in such circumstances.

1. Any personal information held by us in relation to any of the purposes described in this Privacy Statement will be retained by us for as long as we need it to fulfil the purpose(s) for which it was collected. Further details of our specific retention periods are available upon request.
2. For example, if you have consented to receiving any of our newsletters, your preferences in that regard will be retained by us unless and until:
  1. we cease producing our newsletter; or
  2. you withdraw your consent,
    following which we will destroy or suppress such personal data without delay so that you no longer receive our newsletter.
3. Save for any contact preferences suppressed under section 7.2 above, your information will be securely destroyed at the end of the relevant retention period described or otherwise referred to in this section 7.
4. Whilst taking into consideration our legal obligations, we will on an ongoing basis: review the length of time that we retain personal data for; consider the purpose or purposes for which we hold the personal data in deciding whether (and for how long) to retain it for; securely delete personal data that is no longer needed for such purpose or purposes; and update, archive or securely delete information if it goes out of date.

The Site uses "cookies" to ensure that you receive the best possible visitor experience. Cookies are small files which are sent by a web server to an individual's computer which are then stored on that computer's hard drive. A cookie contains text, and is like an identification card which can only be translated by the server it originated from.
Cookies cannot tell us information such as your email address, which we can only collect where you or your employer tells us, for example if you provide your details in a capture form.

The Site uses the following cookies for the following purposes:

Cookie	Name	Description (including purpose, the duration of the cookie, and (if applicable) details of any third party access to the cookie data)
Strictly Necessary
First Party	ForceFlashSite	When viewing a mobile site (old mobile under m.domain.com) it will force the server to display the non-mobile version and avoid redirecting to the mobile site Session
First Party	HS	Security Session
First Party	smSession	Identifies logged in members. Persistent (Two days or two weeks)
First Party	XSRF-TOKEN	Security Session
Functionality
	svSession	Identifies unique visitors and tracks a visitor’s sessions on a site Persistent (two years)
	SSR-caching	Indicates how a site was rendered. Session
	SmSession	Identifies logged in site members Persistent (Two weeks)
Functionality
Third Party	TS*	Security: Session
Third Party	TS01*******	Security: Session
Third Party	TSxxxxxxxx (where x is replaced with a random series of numbers and letters)	Security: Session
Third Party	TSxxxxxxxx_d (where x is replaced with a random series of numbers and letters)	Security: Session

Most internet browsers allow you to prevent cookies being stored on your computer. Alternatively you may be able to configure your browser to accept all cookies or to notify you when a cookie is offered by our server. You may also be able to delete all cookies currently stored on your web browser.
The cookies detailed above will (save for any 'strictly necessary' cookies) only be used where you have given consent to their use and you may withdraw your consent at any time to such cookies by altering your cookies preferences accordingly in the cookie settings area of the Site.
Some parts of the Site require certain 'strictly necessary' cookies to be enabled in order to function correctly (which we use as necessary for our legitimate interests in ensuring that the Site functions correctly). Therefore unless you change your browser settings you will automatically accept such cookies from the Site.
We may also collect information about where you are on the Internet (e.g. the URL you came from, IP address, and domain types like .co.uk and .com), your browser type, the country where your computer is located, the parts of the Site that were viewed during your visit and any search terms that you entered using the Site. We may collect this information even if you are not registered with us, and will use it for our legitimate interests in administering and improving the Site, for internal operations (including troubleshooting, data analysis, testing, research, statistical and survey purposes) and as part of our efforts to keep the Site safe and secure.
We do not use cookies to market or promote the interests of any third party.
For further information about cookies and how they are used, please visit www.aboutcookies.org.

1. We may amend this Privacy Statement from time to time. You are bound by any changes we make to this Privacy Statement with effect from the date of the change. If we make any substantial changes to the way in which we use your personal information collected in connection with our services or the Site we will notify you (e.g. by posting a notice on the homepage for the Site). You can view the current version of our Privacy Statement at any time by clicking on the "Privacy and Cookies Statement" link on the bottom of each page of the Site.

1. The Site contains links to other websites which are outside our control and are not covered by this Privacy Statement (including JustGiving, which you will be referred to where you wish to make a charitable donation to Theatre@41). If you access other websites using the links provided, the operators of those websites will be the controller of any information that you provide to them and will assume corresponding responsibilities under applicable data protection legislation. Such information will be subject to the third party's privacy policy, which you should read. We are not liable for the privacy policies or practices of such third parties in respect of your personal information.
2. You acknowledge that any information that you post using our social media facilities (such as Facebook and Twitter) will be viewable by anybody who visits those websites and that such information is also subject to the relevant provider's privacy policy. You are advised to consult each such privacy policy to see how they will use your data.
3. You acknowledge that any content that you post using our social media facilities will be considered non-confidential and non-proprietary, and that we have the right to monitor, remove, use, copy, distribute and disclose to third parties any such content for any purpose permitted by law.
4. You acknowledge that we will cooperate with any person, law enforcement authority or court order requesting or directing us to disclose the identity of anyone posting or sending material using any of our social media facilities in breach of any law (whether civil or criminal) or the legal rights of any party (including but not limited to intellectual property rights and rights to privacy).