We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• to perform a contract with you, such as when you book a ticket for a production or other event, become a Bridlington Spa member or when we need to contact you with important information relating to your booking.

• to comply with a legal obligation, such as when you exercise your rights under data protection law or when we have to report to or respond to a request from government or law enforcement officials or to meet national security or law enforcement requirements or prevent illegal activity.

• based on your consent, for example when you have specifically consented to use of your information, for example to send you updates via email about what’s on, offers, new or about supporting us or sharing your details with any named partner organisation of Bridlington Spa where you’ve consented to this.

• based on your explicit consent (or as necessary for our legitimate interests in providing you with assistance or to comply with our legal obligations) when you provide us with information about your health to provide you with tailored services, such as a wheelchair accessible space, and to help us investigate any accident or incident that may take place at our venue or any Bridlington Spa event.

• as necessary for our legitimate interests in conducting our business and providing our services safely and securely in a suitable way which is tailored to your use and interests for the following purposes:

• To provide you with and improve our services

• To help us provide you with the best possible customer service and experience at Bridlington Spa

• To manage and administer our relationship with you, such as by keeping our database up to date, contacting you about administrative matters, responding to your complaints or feedback or processing payments or refunds

• To administer membership records

• To enable you to participate in research, a survey or a competition

• To ensure the security of our websites and other technology systems

• To learn about your interests and preferences so that we can tailor your experience with Bridlington Spa and provide you with information that is relevant to you

• To learn about our audience and classify our audience into groups or segments, using booking and publically available information, and ensure we are sending relevant messages to each group

• For the purpose of marketing our services, including sending marketing communications

• To use data analytics and research to improve the quality of the services we offer and define our marketing strategy

• To verify your identity for security purposes

• To help us ensure our customers are genuine and to prevent fraud

• For the management of our business, including keeping financial records, to pay suppliers and to charge, invoice or refund customers

• By using CCTV to prevent and detect crime and to keep people who visit and work at our venue safe and secure

• To record and investigate health and safety and other incidents which may happen at our venue or at any Bridlington Spa event

• To contact you about what’s on, membership, news and topics you’ve asked to hear more about

• For market research and statistical analysis and to analyse the use of our services so that we can improve your experience at Bridlington Spa

• To measure or understand the effectiveness of marketing information we provide to you and others, and to deliver relevant marketing information to you

• To ensure that content from our site is presented in the most effective manner for you and for your device

• To administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes

• To allow you to participate in interactive features of our site, when you choose to do so

• To conduct desktop research to promote the interests of Bridlington Spa, for example by alerting you to opportunities to becoming a member

Please note that we may process your personal information in reliance on more than one of the grounds listed above depending on the specific purpose for which we are using your data. We also use information to improve our services so that they are more appropriate to people’s requirements. We recognise that your personal information is important to you, and we take our responsibilities for ensuring that we collect and manage it proportionately, correctly and safely very seriously.

We collect and process the following information:

• Information you give us. You may give us information about yourself, for example, by filling in forms on our site or by corresponding with us by phone, email or otherwise or in person, for example, when you book a ticket at our box office. This includes information you provide when you register to use our site, subscribe to our service, search for a product, book a ticket for an event, participate in discussion boards or other social media functions on our site, participate in a competition, promotion or survey, and when you provide us with feedback or report a problem to us. The information you give us may include your name, address, email address, phone number, date of birth, payment card and bank account details, personal description, photograph, your access needs, your communications preferences and your ticketing, donation and membership history.
• Information we collect about you. With regard to each of your visits to our site we may automatically collect the following information:
  • Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, device, operating system and platform;
  • Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
• Information we receive from other sources. We work closely with third parties (including, for example, arts or other organisations that we partner with, ticket agents, sub-contractors in technical, payment and delivery services, advertising agencies, analytics providers, search information providers, fundraising and research agencies) and may receive information about you from them. Any data that we receive from these third parties you will have already given your permission to the relevant third party to share, or will be publicly available.
• Sensitive personal data. We may collect sensitive personal information about you such as information about your access requirements (e.g. needing a wheelchair space, an assistance dog, a personal assistant, assisted hearing or BSL interpretation) or, if you are participating in one of our workshops, information about any medical conditions that we need to know about to ensure your safety. We may request some sensitive data, such as data about race, sexual orientation or disabilities, in customer surveys, but it is analysed anonymously and it is up to you as to whether you provide it. We will only collect sensitive personal data with your explicit consent or where we have another lawful reason to collect it.
• Aggregate data. We will collect and aggregate on an anonymous basis information about you and your use of our services with information about other users of our services, such as statistical or demographic data, for analysis, reporting to our stakeholders (such as Arts Council England) and to better understand our customers. Our site may, from time to time, contain links to and from the websites of other organisations. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that this policy does not apply to those websites. Please check the privacy policies of those websites before you submit any personal data to these websites.

Cookies

Our site uses cookies, for example, to distinguish you from other users of our website, so that we can remember you and personalise your visit and to enable online transactions such as when you book a ticket. Cookies also help us to provide you with a good experience when you browse our site and allow us to improve our site.

We collect and lawfully process your personal information under the following:

• Personal information (such as full name, full residential address, telephone number, and email address)
• Location data (including postcode and telephone number)
• Financial data (credit and debit card details) needed to facilitate telephone purchases
• Characteristics (such as ethnicity, gender, disability).

We process personal data for the following reasons:

• GDPR Article 6(1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
• GDPR Article 6(1)(f) - processing in necessary for our legitimate business interests, or those of a third party, and these interests are not overridden by your interests or fundamental rights and freedoms in relation to the protection of your personal information.
• GDPR Article 9(2)(a) - the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

We may disclose your information to others, but only where this is necessary either to comply with our legal obligations or as permitted by Data Protection legislation.

We may share your personal information with:

• our trusted service providers, sub-contractors and agents that we may appoint to perform functions on our behalf and in accordance with our instructions, including payment services providers, ticketing services providers and their approved sub-processors, email communication providers, IT service providers, postal mailing providers, accountants, auditors and lawyers
• other venues or organisations with whom Bridlington Spa partners, but only if you have given consent
• social media sites for the purposes of data analytics and targeted advertising
• analytics and search engine providers that assist us in the improvement and optimisation of our site
• advertising agencies that we may employ and that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in YO15). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.

We require all organisations with whom we share your personal information to respect the security of your information and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes. We might also have to share your information if we have to by law or where we need to protect you or other people from harm. Other than as expressly set out in this Privacy Policy, we will not sell, rent, trade or distribute your personal information to third parties without your express consent or are required by law to do so.

Please note Sensitive personal data will not be shared with third parties without your consent, except in any anonymised format when we are required to report to Arts Council England or our other external partners.

We have retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law. Your information will be disposed of in a controlled and secure manner in accordance with the Council’s Records Management and Data Quality Policy. The Council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your case.

For information on how long your information will be held visit the retention page (East Riding of Yorkshire Council website).

The rights that you have depend upon the grounds on which we collected your information. All of the rights you could have are outlined on the data protection rights page (East Riding of Yorkshire Council website).

In most cases, people who have been involved with Bridlington Spa will be covered by the following rights:

• The right of access - you are entitled to see the information the service holds about you.
• The right to rectification – we will amend information accordingly, if any information that the service holds about you is incorrect.
• The right to restrict processing - you may wish to limit how we use your data.
• The right to object - in addition to the right to limit the use of your data, you also have a right to object to the use of your data for certain actions.
• The right to erasure / right to be forgotten – in certain circumstances, you may be able to ask for some of the information we hold to be deleted.

To exercise any of your above rights, please visit the data protection rights page (East Riding of Yorkshire Council website) for more information.

If you want to know more about how the Council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance. Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisation's information rights practices.

Information Commissioner’s Office (external website)