Our Privacy Notice
The University of Nottingham is registered as a Data Controller under the Data Protection Act 1998 (registration No. Z5654762 – https://ico.org.uk/ESDWebPages/Entry/Z5654762). The University of Nottingham, University Park, Nottingham, NG7 2RD, is committed to protecting your personal data and informing you of your rights in relation to that data. It’s your information, it’s personal, and we respect that. Accordingly, the University will process your personal data in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and this privacy notice is issued in accordance with the GDPR Articles 13 and 14.
This policy explains:
- why we collect your personal data;
- the legal basis for processing your personal data under GDPR;
- what personal data we collect and where we get this information from;
- how long we keep your personal data for;
- who we share your personal data with;
- how we keep your personal data secure;
- your rights as a data subject and how you can check and update any of your personal data.
- Show more details
We have appointed a Data Protection Officer. His postal address is:
Data Protection Officer,
A5, Trent Building,
University of Nottingham,
Or he can be emailed at email@example.com
One of our responsibilities as a data controller is to be transparent in our processing of your personal data and therefore tell you about the different ways in which we collect and use your personal data. We also want to maintain the trust and confidence of every one of our audience members and supporters, as well as each visitor who uses the Nottingham Lakeside Arts website.
Why we collect your personal data
We may need to gather and use information about you for a number of reasons. Here are the main ones:
• To provide a service you have requested (e.g. booking tickets).
• Contact you if we need to obtain or provide additional information (e.g. changes to events).
• Provide you with information on upcoming events, exhibitions and/or opportunities to donate to Nottingham Lakeside Arts, so long as you have consented to these communications (e.g. emailing about upcoming events).
• To improve our programming and customer service by better understanding our audience’s needs (e.g. retaining customer service issues to ensure mistakes aren’t repeated).
The law also requires us to acquire and keep certain information. Occasionally this information is anonymised so you can't be identified.
The legal basis for processing your personal data under GDPR
Under the General Data Protection Regulation, we must establish a legal basis for processing your personal data and communicate this to you. All data processed under the terms of this notice is classified as non-sensitive personal data, as such we typically rely on three legal basis for processing your personal data, which vary depending on what we’re using it for. These are:
1. To perform or take steps to enter into a contract;
2. Your consent;
3. Legitimate interests pursued by the University (except where such interests are overridden by your interests, rights or freedoms).
- Show more details
Specifically, we use your information in the following ways:
To carry out our business and to provide a service or carry out a contract with you:
• To fulfil ticket, merchandise, donation and membership requests.
• Process payments. Please note that Nottingham Lakeside Arts does not store any Credit Card or other payment information once the transaction has been completed and we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).
• Provide the best possible customer services and to help us with internal administration.
• Undertake due diligence in accordance with our Gift Acceptance Policy
• Contact you with important information relating to your booking or purchase, such as confirming your order, reminding you of an upcoming performance you’ve booked for or letting you know about changes or building works that may affect your visit.
Where we have your consent:
• Send you updates about what’s on, ticket offers and news or about supporting us.
• Contact you about a specific genre or topic that you’ve requested to hear more on such as exhibitions, family events or other projects.
• Share your details with other arts organisations (e.g. Nevill Holt Opera) whose work you will have booked for through Nottingham Lakeside Arts. You will always be able to opt out of their communications by contacting them directly.
Where we have justifiable reason (including legal obligation and legitimate interest):
• Learn about your interests and preferences so that we can contact you with information that is relevant to you.
• Help us target our marketing communications and adverts so that they’re more relevant to you.
• For classifying our audience into groups or segments, using booking, publicly available, and purchased geo-demographic profile information. These segments help us to understand our audience better and ensure we’re sending relevant messages to each group.
• Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective.
• Undertake consumer research: we may contact you to ask you to participate in consumer research either via an online or telephone survey or in person. You are under no obligation to participate in research and, should you provide any further information, Nottingham Lakeside Arts will inform you how any further information will be used.
• Analyse and continually improve the services we offer including our artistic output, our website and our other products.
• To keep our database accurate and relevant.
• Detect and reduce fraud and credit risk.
In all of the above cases we will always keep your rights and interests at the forefront to ensure they are not overridden by our own.
Data protection law recognises that certain categories of personal information are more sensitive, such as health information, race, religious beliefs and political opinions. We do not usually collect this type of information about our patrons unless there is a clear reason for doing so. For example, we sometimes request and process data relating to pre-existing medical conditions for workshops for 18s and under. This is so we are informed and able to act appropriately when a child or young person is under our supervision. We will always obtain explicit consent to process when obtaining this information.
What personal data we collect and where we get this information from
Generally, we collect your information when you decide to interact with us. This could include purchasing tickets online, over the phone or in person or it could be when you sign up to receive emails from us. Whenever we do so we will always explain why we are requesting this information, and under what circumstances and how your information will be processed.
- Show more details
We collect information in a number of ways which are listed below:
- When you create an account at www.lakesidearts.org.uk. Your account allows you do the following:
- Buy tickets for events
- Make a donation
- Register for special and genre interest lists (e.g. dance productions, exhibition private views, talks and lectures)
- Use the Lakeside app to book tickets for events.
- Contact us by phone to book tickets.
- Book tickets in person at the box office.
- Contact us by post or email (e.g. application or donation forms). Complete a form during a visit to Lakeside.
The type of information we collect depends on where and when it is gathered and in what context.
When you create an account with us, register on our website, purchase tickets online, in person or by phone, or make a donation we need to collect information from you in order to provide the service you are requesting. We may collect:
- Prefix and name
- Email address
- Age (for workshops for 18s and under only)
- Contact phone number(s)
- Payment card details (we will not hold payment information for any longer than it takes to process your transaction)
- Information required to preocess a donation (including any Gift Aid claims)
- Delivery address(s)
- Billing address
When visiting our website we may collect the following information:
- Automatically populated IP address: a public IP address is a unique number which allows a computer, group of computers or other internet connected device to browse the internet. The log file records the time and date of your visit, the pages that were requested, the referring website (if provided) and your internet browser version. This information is collected to help diagnose and manage the website, to audit the geographical make-up of users, and to establish how they have arrived at the website.
Information we obtain independently from you:
Third Party Organisations
We may combine information you have given to us with this additional information available from external sources. This will only be done when you give permission to the relevant third party organizations to share the data they hold on you, or if the data is already publicly available.
From time to time we may screen our database against recognized data hygiene file such as National Change of Address file and cleanse our file or correct inaccurate data. We may also update inaccurate data if the information is available.
Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you may give us permission to access information from those accounts or services.
Information available publicly
We may include information found in places such as Companies House and information that has been published in articles/ newspapers.
How long we keep your personal data for
We will only retain your personal data for as long as is reasonably necessary to fulfil the purposes set out in this privacy notice, including for the purposes of satisfying any legal, accounting, or reporting requirements. We will not keep more information than we need. The retention period will vary according to the purpose, for example if purchasing a ticket only, we will typically keep your data for up to six years from the date of your last transaction whereas if you have pledged a legacy to us, we will hold your details until notified by your executors. Our records retention schedule is available online.
If you ask us to stop sending direct marketing communications to you, we will keep the minimum amount of information (e.g. name, address or email address) to ensure we adhere with such requests.
Who we share your personal data with
We may share your personal data, including your sensitive personal data, between colleagues and departments who have received appropriate training and legitimately need access to that information in order to carry out their normal duties to support and facilitate your relationship with us.
Personal data collected when you purchased tickets or signed up to receive communications from us is securely stored in the Ticketing Network East Midlands (TNEM) database. TNEM is a limited company and consortium, the members of which are Dance4, Nottingham Lakeside Arts, Nottingham Playhouse, and Nottingham Theatre Royal & Royal Concert Hall. All four consortium members have access to your basic contact information, under strictly controlled conditions. No sensitive information collected by us is made visible to other TNEM partners. Information about your interactions with us is only shared with another TNEM consortium member if they are also the co-organiser of a particular activity to which that data is relevant or as part of joint analysis on patterns of engagement in arts and culture in Nottingham in order to improve the cultural offer in the city. None of the member organisations will use your personal data without a legal basis for doing so.
We will never share, sell, rent or trade your personal information to any third parties for marketing purposes without your prior consent.
Some of our service providers may have access to your data in order to perform services on our behalf – payment processing is a good example of this. We enter into an agreement with anyone who provides a service for us to ensure that they meet our standards for data security. They will not use your data for anything other than the clearly defined purpose relating to the service that they are providing.
- Show more details
We may share your details with:
- Service providers who work on our behalf for the performance of any contract we enter into with them or you (e.g. payment processing, printers and mailing houses, marketing agencies, database services, website hosting or email delivery service).
- Named third party organisations if you ticked the relevant opt-in box when you purchased tickets. In these instances, we may supply your personal information to that specific organisation only.
- Third party data services, for example Experian, who help us to segment and understand our audience by providing additional information so that we can send the most relevant and targeted communications possible.
- Where required to do so (for example, if required to do so by the ‘know your donor’ principles under charity law or a court order), or when requested by the police or a regulatory or government authority investigating illegal activities.
Transfers of and access to your data outside of Europe
We regularly transfer personal data to companies based in the United States of America. These are as follows:
- POP Inc, a company which owns and operates the WordFly software which sends email communications to you on our behalf. POP Inc’s servers are based in the United States and the company are members of the EU-U.S.Privacy Shield Framework, a binding legal instrument under European law which can be used as a legal basis for transferring personal data to the US.
- Jacobson Consulting Applications (JCA), a company which processes data to provide us with anonymised statistics which are used to evaluate our services. JCA are based in the United States, however servers used for this work are within the EU.
- Lynch2 owns and operates the Mail2 software which send email communications to you on our behalf. Lynch2 partners with the Canadian company Campaigner. Canada’s Personal Information Protection and Electronic Documents Act is certified by the EU as sufficient to enable the transfer of personal data to the country.
- Tessitura Network own and develop the software that we, as a member of Ticketing Network East Midlands, use to administer our box office and ticketing systems. Tessitura do not hold any of your data, however they will on occasion have access to it when assisting with the maintenance and development of our systems.
How we keep your personal data secure
We are committed to protecting the personal information you entrust to us. We adopt robust and appropriate technologies and policies, so the information we have about you is protected from unauthorised access and improper use.
- Show more details
As part of the services offered to you through the Nottingham Lakeside Arts website and box office, the personal information you provide may be transferred to organisations in the USA as outlined in the ‘who we share your personal data with’ section above. The USA has weaker data protection laws than that of the EEA and therefore we will ensure that only organisations who are a part of the EU Privacy Shield initiative will handle your personal information. More details on this certification can be found at www.privacyshield.gov/welcome.
Despite all our precautions, no data transmission over the internet is 100% secure. So, we cannot guarantee the security of any information which you disclose to us and so wish to draw your attention to the fact that you do so at your own risk.
Your rights as a data subject
You have the following rights in relation to your personal data processed by us:
- Show more details
Right to be informed
We will ensure you have sufficient information to ensure that you're happy about how and why we're handling your personal data, and that you know how to enforce your rights. We provide information in the form of privacy notices. You can read all of our privacy notices online.
Right of access / right to data portability
You have a right to see all the information we hold about you. Where data is held electronically in a structured form, such as in a database, you have a right to receive that data in a common electronic format that allows you to supply that data to a third party – this is called "data portability". To make a request for your own information please see our Data Protection website.
Right of rectification
If we're holding data about you that is incorrect, you have the right to have it corrected. If you have any concern about the accuracy of your personal data, please let us know using the below contact details.
Right to erasure
You can ask that we delete your data and where this is appropriate we will take reasonable steps to do so. If you would like us to remove the personal information we hold about you, please contact us using the below contact details.
Right to restrict processing
If you think there's a problem with the accuracy of the data we hold about you, or we're using data about you unlawfully, you can request that any current processing is suspended until a resolution is agreed. Please email any related request to our box office team using the below contact details.
Right to object
You have a right to opt out of direct marketing. You have a right to object to how we use your data if we do so on the basis of "legitimate interests" or "in the performance of a task in the public interest" or "exercise of official authority" (a privacy notice will clearly state to you if this is the case). Unless we can show a compelling case why our use of data is justified, we have to stop using your data in the way that you've objected to. If you wish to object to us processing your data, please let us know using the below contact details.
Checking and updating your personal data
You should find it easy to access and amend the personal information that we hold on you, or request that we stop contacting you. It’s your data and we want to make sure you feel in control of it.
If you have an online account with us, you can amend your personal details and email contact preferences at any time. Simply sign in on the website and access your account, or, if you prefer, you can contact us by phoning, emailing, or writing using our contact details below. Every email we send to you will include details on how to change your communications preferences or unsubscribe from future communications.
By email: firstname.lastname@example.org
By phone: +44 (0)115 846 7777
By post: Nottingham Lakeside Arts, University Park, Nottingham, NG7 2RD