Privacy Notice     

Content  

1. Who we are 
2. Purpose of policy 
3. Legal basis for collecting data
4. What data do we collect, when do we collect it and how do we process it?

4.1 Browsing our website 

4.2 Buying tickets on our website, over the phone or in person 

4.3 Naming a seat on our website, over the phone or in person 

4.4 Buying a membership on our website, over the phone or in person 

4.5 Donating to us 

4.6 Keeping you informed about HFC shows, our activities, events and redevelopment   

4.7 Surveys & analysis 

4.8 Visiting the theatre – CCTV, Photos & Videos 

4.9  Fundraising Activity and Communications 

4.10 Third Parties Data Processing 

4.11 Other processing activities 

5. Your debit and credit card information 
6. Security of your personal information
7. Children
8. Cookies

9 . Your rights to your personal information  

10. Contact details and further information 
11. Who we are 
    Hall for Cornwall (HfC) is a charity and receives funding from Arts Council England, Cornwall Council, the European Regional Development Fund, HM Treasury, Cornwall and Isles of Scilly Local Enterprise Partnership and National Heritage Lottery Fund, as well as from various trusts, foundations and individual donors and supporters. Our registered charity number in England and Wales is 1053028 and we are also registered as a company in England and Wales under registration number 3101443.
     
    2. Purpose of policy 
    We are committed to protecting your personal information and being transparent about information we hold about you. We want to stay in touch and develop the relationship we have with you.  Using personal information allows us to develop a better understanding of our audiences and, in turn, provides you with relevant and timely information about the work that we do – both on and off our stage. 
     
    This privacy policy explains how we collect, use, process and share your personal data and your rights in relation to the personal data we securely hold.  

HFC is the data controller for your personal data and is subject to the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation (GDPR)  and the Privacy and Electronic Communications Regulations (PECR). We use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains: 
 
• What information we collect about you. 
• How we may use that information. 
• In what situations we may disclose your details to third parties. 
• Our use of cookies to improve your use of our website. 
• Information about how we keep your personal information secure, how we maintain it and your rights to be able to access it.
 
3. Legal basis for collecting data
The law on data protection sets out a number of different reasons for which a company may collect and process your personal data, including: 

Consent
In specific situations, we collect and process your data with your consent. You can withdraw your consent at any time.
For example: when you create a customer account and tick a box to receive communications on fundraising.
When collecting your personal data, we’ll always make clear to you which data is necessary in connection with a particular service. 

Contractual obligations
In certain circumstances, we need your personal data to comply with our contractual obligations.
For example, if you purchase tickets, we’ll collect your address details if you want us to send tickets to you by post, and phone and email details to contact you if performances are cancelled. 

Legal obligation
If the law requires us to, we may need to collect and process your data.  
For example, we may pass on details of people involved in fraud or other criminal activity affecting Hall for Cornwall to law enforcement. 

Legitimate interest
In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests. 
For example, we may use your address details to send you direct marketing information by post to tell you about shows or events.
  

4. What data do we collect, when do we collect it and how do we process it?
   Across different areas of the business we collect, process, hold and share the following types of personal data for the following purposes unless you ask us not to.
    
   4.1 Browsing our website
   If you browse our website, we may analyse information about how you use the website, and the content and pages that you interact with, in order to improve the relevance and interest of the content on it.
    
   Every time someone visits our web site a log file is generated on our computer. The log file records the time and date of your visit, the files that were requested, your IP (Internet Protocol) address, the referrer URL (if provided) and the browser version. We collect this information to help us diagnose problems and administer our systems and to audit the geographical make-up of users and how they have arrived at our site; that is, from what other sites visitors have arrived (this information being obtained from the referrer URL).  We do not normally link IP addresses to anything personally identifiable, which means that you remain anonymous throughout your visit even though an IP address is personal data. 

We would only attempt to use IP addresses to identify a user when we feel it is necessary to protect our services and other users on the site or are legally required to by law enforcement agencies.
 
4.2  Buying tickets on our website, over the phone or in person
When you buy a ticket on our website, in person or over the phone, you are required to create an account on our ticket system (Spektrix) and we store the following personal information:
  

• Contact details including name, postal & billing address, email address & phone number 
• Credit card details – when you choose to store payment card details, we will only store the first 6 and last 4 digits and expiry date of your card, the rest of your card data is encrypted and we do not have access to it. 

We store this information so that we can fulfil our contractual obligations with you, for example, sending you theatre tickets you have purchased, processing instalment payments, processing any pre-orders for ice-creams or programmes or being able to call or email you should a show be cancelled.  

Spektrix take care of secure payment processing and authorisation, through Opayo (formerly Sage Pay) – their privacy notice can be read at this link https://www.opayo.co.uk/policies/privacy-policy 

Maintaining your personal information when you buy a ticket
When you want to buy tickets from us again, you can use your existing account by logging in and using the email address and password created by you. This makes buying tickets easier and quicker. 

Only you have details of your password, and we do not have access to it, although we give you the option of storing it. If you forget it, you can reset it by clicking the Forgotten Your Password link and you will receive a reset link by email.
 
If you continue to purchase tickets from us, we will store your personal information so that on subsequent purchases we are able to link them back to a single unique record that we hold for you on our system. This record may also hold the following information about you:
  

• Any correspondence or complaints you may make over the phone, in writing, on email or via social media private message platforms. 
• Purchase history. 
• Event attendance, including shows, workshops, presentations and networking events. 

We hold this information to pursue our legitimate interests and ensure that any requests from you are actioned or business and service improvements made as a result of your comments, and that HFC has a log of your interactions with us. We may also use your purchase history and previous attendances at shows or workshops, alongside any preferences you tell us about, to send you targeted and relevant communications (see section 4.6). Any correspondence or complaints held against the file are removed after three years.
 
If there are aspects of your record that are inaccurate or that you would like to remove, you can usually do this by logging into the My Account section on our website. Alternatively, please use the contact details at the end of this policy and we will happily amend your details, in line with your wishes. If you decide not to use our services any further and notify us either in writing, by email or over the phone, we can close and deactivate your account. In this instance, and should you object to the processing of your personal data, we can safely dispose of such information retaining a core set of personal data (name, address and customer account no) and will add you to a ‘Do Not Contact’ list to ensure we do not contact you again.
 
Inactive accounts data processing 
If an account remains inactive for five years (meaning no transactions made for five years), the account is closed and marked inactive on our system. Unless requested otherwise, we will retain your personal information & ticketing history for a period up to ten years should we want to analyse historical audience information anonymously for legitimate reasons for business planning, such as increase/decrease of ticket sales over historical periods of time or where audiences visited us from.  

4.3 Naming a seat on our website, over the phone or in person 

When you make a contribution to naming a seat on our website, in person or over the phone, you are required to create an account on our ticket system (Spektrix) and store the following personal information you give us: 

• Contact details including name, postal & billing address, email address & phone number 
• Credit card details – when you choose to store payment card details, we will only store the first 6 and last 4 digits and expiry date of your card, the rest of your card data is encrypted and we do not have access to it. 

We store this information so that we can fulfil our contractual obligations with you, for example, sending you a certificate for the seat you have named, processing instalment payments and inviting you to a ‘meet your seat’ ceremony ahead of our reopening. 

4.4 Buying a membership on our website, over the phone or in person
When you buy a membership on our website, in person or over the phone, you are required to create an account on our ticket system (Spektrix) and store the following personal information you give us:
  

• Contact details including name, postal & billing address, email address & phone number 
• Credit card details – when you choose to store payment card details, we will only store the first 6 and last 4 digits and expiry date of your card, the rest of your card data is encrypted and we do not have access to it. 

We store this information so that we can fulfil our contractual obligations with you, for example, sending you a welcome letter and membership card or processing payments by instalment. We will also use this information to send annual renewal information, and use any communication preferences you have told us about to send you monthly members newsletters which will keep you informed about exclusive member news or benefits, such as ticket offers or priority booking access to shows, which directly relate to the membership offer or level signed up to. You can choose not to receive these communications at any time, although this does mean that you will not be kept informed about direct benefits of the schemes. 

When you sign up to a membership or donate to our Name a Seat campaign and opt to pay in instalments using Continuous Payment Authority with your debt or credit card, we will only store the first 6 and last 4 digits and expiry date of your card, the rest of your card data is encrypted and we do not have access to it.
 
Should you opt to gift aid your membership where it is eligible to do so, we will keep a copy of your declaration against your customer record and keep any hard copies ( for example, a hard copy of the membership form filled in). We are required to keep all Gift Aid declarations for the duration of your membership and for a period of up to 7 years after membership ceases. 

Maintaining your personal information with our membership scheme
When you want to buy tickets from us again, you can use your existing account, by logging in and using the email address and password created by you. This makes buying tickets easier and quicker. Only you have details of your password, and we do not have access to it, although we give you the option of storing it. If you forget it, you can reset it by clicking the Forgotten Your Password link and we will send you a reset link by email.
 
If you continue to purchase tickets from us, we will store your personal information so that on subsequent purchases we are able to link them back to a single unique record that we hold for you on our system. This record may also hold the following information about you:
 
• Any correspondence or complaints you may make over the phone, in writing, on email or via social media private message platforms are kept for three years and then removed.
• Purchase history
• Event attendance, including shows, workshops, presentations and networking opportunities
 
We hold this information to pursue our legitimate interests and ensure that any requests from you are actioned or business and service improvements made as a result of your comments, and that HFC has a log of your interactions with us. 
 
The membership scheme is an annual scheme and if you choose not to renew, we won’t send you any further membership communications, but will keep your account open so that you can continue to purchase tickets from us.
 
If there are aspects of your record that are inaccurate or that you would like to remove, you can usually do this by logging into the My Account section of our website.  

Alternatively, please use the contact details at the end of this policy and we will happily amend your details, in line with your wishes. If you decide not to use our services any further and notify us either in writing, by email or over the phone, we can close and deactivate your account. In this instance, and should you object to the processing of your personal information, we can safely dispose of such information retaining a core set of personal data (name, address and customer account no) and add you to a ‘Do Not Contact’ list to ensure we do not contact you again. 
 
Inactive accounts data processing 
If an account remains inactive for five years (meaning transactions made for five years), the account is closed and marked inactive on our system. Unless requested otherwise, we will retain your personal information & ticketing history for up to ten years should we want to analyse historical audience information anonymously for legitimate business reasons around business planning, such as increase/decrease of ticket sales over historical periods of time or which shows were popular in any given season. 
 
4.5 Donating to us
If you donate to Hall for Cornwall, either with a one-off donation or regularly, we will create an account on our ticket system (Spektrix) and store the following personal information you give us: 

• Contact details including name, postal & billing address, email address & phone number  
• Credit card details – when you choose to store payment card details, we will only store the first 6 and last 4 digits and expiry date of your card, the rest of your card data is encrypted and we do not have access to it. 

• Gift Aid (if you opt to include Gift Aid as part of a donation)  
• Where you have given us your permission, we will use your information to thank you for donating to us, tell you how your money may be spent and claim Gift Aid where you’ve told us you’re eligible. In order to develop our relationship with you, we may invite you to events or send you further information about our aims and how you may support these.  

Should you choose to pay by instalments using Continuous Payment Authority for a seat donation in our Name a Seat campaign, your card details will be encrypted and staff will only have access to the first 6 and last 4 digits and expiry date. By choosing to pay in instalments you are agreeing for Hall for Cornwall to take 10 regular monthly payment using the payment card details provided. After you have paid the first instalment; 9 further payments will be taken on or near to the same date each month dependant on weekends and bank holidays. The payment will show on your bank statement as Hall for Cornwall. It is your responsibility to notify Hall for Cornwall of any change to your payment card details which could cause the payment to fail. Please call our box office on 01872 262466 to update your card details.
 
Where eligible, should you opt to Gift Aid your membership, we will send you a form to fill in, sign and return as a declaration of your wishes. This form is scanned and held online against your customer record plus a hard copy is securely kept for 7 years in line with HMRC requirements.
   

4.6 Keeping you informed about HFC, our activities, events and redevelopment  
We want to tell you about the work that we do on our stage and in the community, our redevelopment and the other venues or shows that we sell for across Cornwall. To do this, we use data that you have given us, such as what events you have booked for in the past and any communication or show preferences you have told us about. You can update your preferences at any time by visiting the My Account section online, calling our Box Office on 01872 262466 or by emailing [email protected]  
 
When you have bought a ticket, workshop or event from us, we will send you information about future shows, workshops & events associated with Hall for Cornwall because we think that you will be interested in and like receiving this information and this is a legitimate activity for our organisation. You can opt out of receiving emails when you create your account or at any time using the unsubscribe link in all emails or via the My Account  section online.  If you receive information by post, you can cancel this at any time by email, phone or via My Account online.
 
For any accounts created where tickets have not yet been purchased (for example if you have chosen to sign up to our newsletter and created an account), we will use consent as a legal basis for any communications by post and/or email and use the preferences that you have told us are how you would like to receive information.
 
We will send you fundraising information only where you have specifically consented to receiving it.
 
We will pass on your details to other companies or venues of shows that you have purchased tickets for only if you have given us your permission.
 
4.7 Surveys & analysis
From time to time we may conduct pre- or post-show surveys, either for ourselves or on behalf of visiting companies, and use this feedback to improve the experiences that we offer. If you choose to take part in research, we’ll tell you when you start what data will be collected, why and how it will be used. All the research we conduct is optional and you can choose not to take part.  

Typically, we will collect the answers to the survey questions, your email address, and a score. This information will be associated with your customer ticket booking account and the performance that you attended.  We use this information to improve our services and to follow-up on any comments.  This means that we may contact you about your feedback and this is a legitimate interest for us. 

This analysis allows us to make smarter and more informed business decisions around areas such as programming, setting ticket prices and targeting certain audiences with relevant marketing communications.
 

We may also use your information to one of our funders, such as Arts Council England or Cornwall Council. For example, we may analyse customer buying habits or look at where people visited from for certain shows and what price they paid.  

As a recipient of Arts Council and National Portfolio Organisation (NPO) funding, we use CWC https://culturecounts.cc/ as a Processor to power some surveys and participant communications with you. We have signed a legally-binding agreement with NPO and ACE confirming it will only collect and store information about you according to our instructions, based on how we use their self-serve platform. CWC has taken steps to minimise the amount of data it can see or access when processing on our behalf and to make sure its appropriately secured. For further information, read the CWC privacy notice here. 

During the pandemic, we have participated in a COVID-19 Sector Benchmark research study with Purple 7 and TRG Arts to look at real time intelligence on the impact of Covid 19 and arts attendance. It is intended that this work will give us anonymous insights into customer behaviour to inform future planning. We have a signed a legally binding agreement with Purple 7 confirming that any customer data collected is used solely for the purposes of this benchmarking with all data shared anonymised and aggregated. Purple Seven’s data security and processes are fully GDPR compliant and their privacy notice can be read here https://purplesevenanalytics.com/privacy/ 

4.8 Visiting the theatre – CCTV, Photos & Videos
When you visit our theatre, we have CCTV systems in operation for the security of both customers and staff. These systems may record your image during your visit. We undertake CCTV recording to protect our customers, premises and assets from crime and we do this on the basis of our legitimate business interests. Any footage taken is kept for a period of 28 days after which we securely delete it.  If we discover any criminal activity or alleged criminal activity through our use of CCTV, fraud monitoring and suspicious transaction monitoring, we will process this data for the purposes of preventing or detecting unlawful acts. 
 
Occasionally, we may want to promote or seek archive footage of our shows, events or theatre by the use of photographs and videos taken of our audiences. We will always ensure you are aware in advance when we are doing this and give you the option of not participating or being involved. We will always tell people of its intended use and will seek additional permissions if wider usage and distribution of such materials are intended.
 
4.9 Fundraising Activity and Communications
Hall For Cornwall is registered with the Fundraising Regulator and an organisational member of the Institute of Fundraising. Our Fundraising Complaint policy can be read here.
 
When you create an account with HFC, we ask if you are interested in hearing about fundraising news by post or email. Where we have received your permission, we may invite you to support our work by making a donation, buying a raffle ticket or getting involved in community fundraising activities. 
 
Under legitimate interest, we look at information in the public domain (such as Companies House, business social media sites such as LinkedIn and public records of donations to other organisations) to ascertain whether a person may be interested in supporting the Hall for Cornwall. Based upon this information, we may invite you to an event or to meet with us to discuss any support that you may wish to give. 
 
We like to keep track of our prospective and current supporters by keeping your data in a secure database rather than in loose notes or bits of paper on our desks. We feel that this is a legitimate activity for us but you can object to us processing your data in this way. If you do object, we will delete all data except for your name, email and number to ensure that we do not contact you again. This is also a legitimate activity for us.
 
HFC does not carry out any external wealth screening.
 
4.10 Who we share your data with
We disclose your data to others, when required, as noted below:
 
Visiting Companies/ Promoters/ Venues that we sell for 
 We will always ask for your consent before sharing your personal data. Please rest assured that these organisations have signed an agreement with us that ensures that they will protect your personal data. For information on how these organisations will process your data, please see the visiting companies/promoters/venues own Privacy Notices.

Tracking pixels for third parties
Occasionally we work with visiting companies, promoters and their service providers to add tracking pixels to our website so they can see how their marketing efforts are performing. We will list these explicitly below:

• For The Woman in Black we have added tracking pixels on the show page and the purchase page so the producers can see how their marketing campaign is performing and to retarget and further target audiences.
• For And Then There Were None we have added tracking pixels on the show page and the purchase page so the producers can see how their marketing campaign is performing and to retarget and further target audiences.
• For Jesus Christ Superstar we have added a tracking pixels on the show page and the purchase page so the producers can see how their marketing campaign is performing and to retarget and further target audiences.

Service Providers
With the following service providers, we always ensure that secure systems and processes are in place to safeguard your personal data and that contractual agreements are in place that clearly state the responsibilities of both parties around safeguarding your data.
  

• Mailing house, who are sent data to mail you brochures or mailings. 
• A data insights system which analyses buying habits to inform on business planning recovery as a result of Covid19. 
• A data insights system which provides data reports (anonymised) to Arts Council England & wider industry benchmarking on theatre attendance. 
• Ticketing system software provider. 
• Email service provider to send out emails on our behalf. 

• Cloud service providers 
• Software providers 
• Payment processing provider 
• Web developer when contact forms are collected on our behalf 

Law Enforcement 

If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we may need to provide your personal data. 

4.11 Other processing activities 
We also process personal information in the following ways that are within our legitimate organisational interests to constantly improve the service, products or relevance of what we offer.
 
Social Media
Hall for Cornwall has business pages on Facebook, Twitter, Instagram and LinkedIn. Whilst we post pictures, comments and videos to these sites, we do not process any personal information from these accounts as any sign-ups or ‘follows’ are subject to the privacy policies of the individual social media channel. When you send us a message via Messenger or as a comment on a post, you are giving us your personal data by consent as the sending of the message is a clear affirmative action of consent. After receiving your message, we may attempt to link your details to our own systems, so that we can resolve complaints or queries swiftly and with a positive outcome.
 
 5. Your debit and credit card information 
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely. All payment details are encrypted using industry standard technologies and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard here https://www.pcisecuritystandards.org/pci_security/ 

We optionally allow you to store your card details for use in a future transaction. This is carried out in compliance with PCI-DSS and in a way where none of our staff members are able to see your full card details at any time. Staff members using our ticketing system only have access to the first 6 and last four digits and expiry date of your card.
 
6. Security of your personal information 
We know how much data security matters to all our customers. With this in mind, we will treat your data with the utmost care and take all appropriate steps to protect it.  

Spektrix, our ticketing provider, provides robust security and privacy procedures that carefully consider data protection across its platform and services and we have a signed contract with them that outlines security and privacy related audits, certifications, technical and physical controls applicable to the Spektrix multi-tenant SaaS platform. 

Access to your personal data is password-protected, and sensitive data (such as payment card information) is secured by SSL encryption.
 
We will not transfer, process or store your data anywhere that is outside of the European Economic Area. 

7. Children

We take the protection of children and their personal data very seriously. For this reason, as we are unable to verify parental consent, no one under the age of 18 is permitted to use our website or services. Children under the age of 18 must ask their parents or an adult to make website bookings for them.  

 
8. Cookies 

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. Hall for Cornwall uses a cookie compliance solution called OneTrust & stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for the use of each category. The cookie has a normal lifespan of one year, so that returning visitors to the site will have their preferences remembered. It contains no information that can identify the site visitor. 

Hall for Cornwall’s website currently uses the following cookies: 

NAME	DESCRIPTION	TYPE
_fbp	Used by Facebook to deliver a series of advertisement from third party advertisers.	Targeting
fr		Targeting
CookieDetection		Necessary
__cf_bm	Support Cloudflare Bot Management.	Necessary
cf_ob_info	CloudFlare & used to improve page load times – does not contain any user identification information.	Necessary
OptanonConsent	Cookie compliance solution from OneTrust & stores information about the categories of cookies the site uses and whether visitors have given or withdrawn consent for the use of each category.  It contains no information that can identify the site visitor.	Necessary
_ga	Used to distinguish users by Google Analytics – for aggregate statistical purposes. Type of data processed: IP addresses with “masking IP” feature, which imposes on the system the darkening of the last 8 digits of the IP address of the user / visitor before any type of processing is performed.	Performance
_gid	Used to distinguish users by Google Analytics – third-party analytics cookies: google analytics for statistical purposes. Type of data processed: IP addresses with “masking IP” feature, which imposes on the system the darkening of the last 8 digits of the IP address of the user / visitor before any type of processing is performed.	Performance
__cfduid	Cookie associated with sites using CloudFlare, used to speed up page load times. It does not contain any user identification information.	Necessary
OptanonAlertBoxClosed	Cookie set by website using certain versions of the cookie law compliance solution from OneTrust.  It is set after visitors have seen a cookie information notice and in some cases only when they actively close the notice down.  It enables the website not to show the message more than once to a user. The cookie has a one year lifespan and contains no personal information.	Necessary
YSC	YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.	Targeting
test_cookie	This domain is owned by Doubleclick (Google) of which the main business activity is real time bidding advertising exchange to disaplay targeted advertising.	Targeting
SessionId		Necessary
_gat_UA-140466614-1	Cookie set by Google Analytics, used to limit the amount of data recorded by Google on high traffic volume websites.	Performance
cf_use_ob	CloudFlare.  It is used to improve page load times and to override any security restrictions based on the visitors IP address.  It does not contain any user identification information.	Necessary
PHPSESSID	PHP session cookie associated with embedded content from this domain.	Necessary
_fbp	Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers.	Targeting
VISITOR_INFO1_LIVE	This cookie is used as a unique identifier to track viewing of videos.	Targeting
st_samesite		Social Media
CONSENT	YouTube is a Google owned platform for hosting and sharing videos. YouTube collects user data through videos embedded in websites, which is aggregated with profile data from other Google services in order to display targeted advertising to web visitors across a broad range of their own and other websites.	Targeting

 These cookies enable us to collect anonymous information about how our site is used, what pages are visited and how long is spent on each page. The information collected is used by us to improve the website and to provide broad statistical data to some stakeholders (for example in reports to funders such as Arts Council England) or for general anonymous benchmarking with other similar organisations.     

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. Some cookies are essential in helping you to move around the website and purchase tickets, as well as enabling you to log in and access your account pages. 

A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. 

Google Analytics Cookies 
These cookies are used to collect information about how visitors use our site. The cookies collect information in an anonymous form, so we don’t know who is using our site. We use the information on how people use our website to compile reports and to help us improve the site. You can go to http://www.google.com/analytics/learn/privacy.html to find out more about Google Analytics cookies and how to opt-out of them.  

Third party and targeting Cookies 
Occasionally we use retargeting cookies to collect information about your browsing habits which allow us to show you adverts while you are browsing other sites on the internet.  Third party cookies may be placed on a user’s device which remembers that you have visited certain websites. They are set by us or by carefully selected third parties.  They help us to understand the performance of our marketing activities and improve the relevance of the adverts that you see. These cookies can track your visits, but they don’t know who you are even if you are logged into your account. 

Managing Cookies 
You can stop Cookies being used on your device by activating the setting on your browser that allows you to block the deployment of all or some Cookies. You can choose to accept or decline cookies although declining may prevent you from taking full advantage of the website. 

Please visit www.allaboutcookies.org to find out how. Please note, if you use your browser settings to block Cookies you may not be able to access all or parts of our site.  

For more information about cookies and how to opt-out, visit any of the following industry bodies. 

Digital Advertising Alliance - https://digitaladvertisingalliance.org/ 

Network Advertising Initiative - https://www.networkadvertising.org/
 
9. Your rights to your personal information 
You can amend the personal information held on your customer account by logging into the My Account section on our website and amending or updating or by contacting our Box Office.
 
Your rights
You have rights in respect of our processing of your personal data which are:
  

• To access to your personal data and information about our processing of it.  You also have the right to request a copy of your personal data (but we will need to remove information about other people). 
• To rectify incorrect personal data that we are processing. 
• To request that we erase your personal data if: 

• we no longer need it; 

• if we are processing your personal data by consent and you withdraw that consent; 
• if we no longer have a legitimate ground to process your personal data; or 
• we are processing your personal data unlawfully 

• To object to our processing if it is by legitimate interest. 
• To restrict our processing if it was by legitimate interest. 

• To request that your personal data be transferred from us to another company if we were processing your data under a contract or with your consent and the processing is carried out automated means.  

 
If you want to exercise any of these rights, please contact us.
 
If you have any questions or concerns, please email [email protected] as most matters can be resolved informally in the first instance. 
 
You also have the right to lodge a complaint about our processing via the UK’s Information Commissioner’s Office
 
10. Contact details and further information 
Please do get in touch with us if you have any questions about any aspect of this privacy notice. Email [email protected], call 01872 262466 or write to Data Protection Officer, Hall For Cornwall, Back Quay TR1 2LL.
 
If you have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner’s Office at ico.org.uk/concerns.
 
Hall For Cornwall’s Data Protection Officer is Kristy Gouldsmith and she can be contacted at [email protected]
 
This policy was last updated October 2023