About this policy
The Queen's Hall (Edinburgh) Ltd ("The Queen's Hall", "we", "us" and "our") takes your privacy seriously. This policy explains what personal information we collect, why we collect it, how long we keep it and what your rights are.
It covers information we collect when you use our website, buy tickets through our Box Office, or contact us in any way.
We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
The Queen's Hall (Edinburgh) Ltd is the data controller for your information. We are a Scottish Charity (No. SC012294) and a company limited by guarantee (Company No. 64372).
What information we collect
Information you give us
- When you use our website, for example through our online forms: your name, email address and phone number.
- When you book with our Box Office: your name, email address, phone number and postal address, along with any other details you choose to give us so we can deliver your booking.
Information we collect automatically
When you use our website, we collect information through cookies and similar technologies. This can include your device's IP address, the website you came from, which pages you visited and when. For more details, see our cookie policy.
Card details
Card payments are handled by our payment provider, Opayo. We do not store your full card details.
How we use your information and why
The law only allows us to use your information when we have a valid reason, known as a lawful basis. The list below sets out what we use your information for and the lawful basis for each use.
- Setting up your customer record in our ticketing system (Spektrix), processing bookings and sending your tickets. Lawful basis: contract. We need it to provide the service you have asked for.
- Keeping records of ticket sales for accounting and tax purposes. Lawful basis: legal obligation. The law requires us to keep these records.
- Sending you essential information about an event you have booked for, such as timings, changes, access details or cancellations. Lawful basis: legitimate interests. You need this information to attend.
- Responding to your enquiries and providing customer service. Lawful basis: legitimate interests, or contract where it relates to a booking.
- Asking for feedback through genuine surveys about an event you attended. Lawful basis: legitimate interests, to improve our events and services.
- Sending you marketing emails about our events, offers and news. Lawful basis: consent. We only do this if you have opted in.
- Sending you marketing by post. Lawful basis: legitimate interests (see the marketing section below).
- Sharing a scrambled version of your email address with Meta and Google to find new audiences similar to ours. Lawful basis: legitimate interests, to reach new audiences. We do not use this to target adverts at you, and you can object at any time.
- Preventing fraud and keeping our website and systems secure. Lawful basis: legitimate interests.
- Running and improving our website, including troubleshooting, performance and statistical analysis. Lawful basis: legitimate interests.
Legitimate interests
When we rely on legitimate interests, we weigh our interests against any effect on you and your rights. We will not use your information where the impact on you outweighs our interests. You have the right to object to any use of your information based on legitimate interests (see "Your rights" below).
Marketing
We will only send you marketing emails, such as our newsletter and information about upcoming events and offers, if you have opted in. You can opt in when you book or by signing up to our newsletter.
Every marketing email includes an unsubscribe link. You can also change your preferences at any time on your account's Manage Preferences page or by contacting us.
Emails giving essential information about an event you have booked for are not marketing. We will send these even if you have not opted in to marketing.
Post
We may send you our brochure or other information about our events by post, relying on legitimate interests. You can ask us to stop at any time by contacting us, and we will not send you postal marketing again.
Business contacts
If we deal with you in a professional capacity, for example as a promoter, hirer or partner organisation, we may email you at your work address about our events and services, relying on legitimate interests. You can ask us to stop at any time.
Online advertising
To help us reach new audiences, we may share a scrambled (hashed) version of your email address with Meta (Facebook and Instagram) and Google. Hashing turns your email address into a code. Meta and Google match these codes to their own users and use the results to find other people with similar interests, who may then see our adverts.
We use this only to find new audiences. We do not use it to target adverts at you. We rely on legitimate interests for this, and you can object at any time by contacting us. If you do, we will leave you out of any future lists.
Who we share your information with
We never sell or rent your personal information.
Other organisations we work with (data controllers)
We share information with the organisations below only where there is a legitimate reason, for example when we sell tickets on each other's behalf or work together on a concert, project or subscription series. We only share information connected to that particular event, project or series, and we have data sharing agreements with each of them.
- Scottish Chamber Orchestra
- New Town Concerts Society
- Edinburgh International Festival
- Scottish Ensemble
- Dunedin Consort
Service providers who work for us (data processors)
These organisations handle information only on our instructions, and we make sure their security is at least as strong as our own.
- Spektrix: online Box Office and ticketing system
- Opayo: online card payments
- Dimensions: mailing house for our brochure, postal campaigns and membership mailings
- DotDigital: email sending
- SurveyMonkey: online surveys
- The Audience Agency (Audience Finder): cultural audience research
- Meta (Facebook and Instagram): using hashed (scrambled) customer lists to find new audiences similar to ours
- Google: using hashed (scrambled) customer lists to find new audiences similar to ours
Public authorities
We may have to disclose your information in response to valid requests from public authorities, such as the police.
Transfers outside the UK
Some of our service providers may store or process information outside the UK, including Spektrix, DotDigital, SurveyMonkey, Meta and Google. This may include countries in the European Economic Area, Canada and the United States.
When this happens, we make sure your information is protected to the standard UK law requires. This means the country has been approved by the UK Government as having adequate protection, or appropriate safeguards are in place, such as the UK's approved contract terms for international data transfers.
How long we keep your information
We only keep your information for as long as we need it for the purposes set out in this policy.
- Records of ticket sales: we are legally required to keep records of ticket sales for accounting purposes, and we will delete them once that period ends.
- Your marketing email preferences: until you unsubscribe or ask us to delete them. We may keep your email address on a suppression list so we never send you marketing again.
- Your customer account and contact details: while your account is active, and for a reasonable period after your last booking.
- Survey responses: for as long as we need them to review and improve our events.
If you ask us to delete your information, we will do so unless the law requires us to keep it. Where we must keep it, we will tell you what we are keeping and why.
Security
We use appropriate technical and organisational measures to protect your information from loss, misuse, unauthorised access, disclosure, alteration and destruction. No organisation can guarantee complete security, but we review our measures regularly.
Children
We do not knowingly collect personal information from anyone under 16. If you are under 16, please do not buy tickets or send us your personal information. If we learn that we have collected information from a child, we will delete it as quickly as possible. If you think a child under 16 has given us their information, please contact us.
Links to other websites
Our website may link to other websites. This policy does not cover those websites, and we are not responsible for how they handle your information. Please read their privacy policies.
Your rights
You have the right to:
- ask for a copy of the information we hold about you (a subject access request)
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to limit how we use your information
- object to us using your information based on legitimate interests, including for postal marketing
- ask for a copy of information you gave us in a format you can pass to another organisation
- withdraw your consent to marketing emails at any time
How to make a request
Contact us using the details below. Please give as much detail as you can about what you are asking for.
We will only ask for proof of identity if we are not sure the request is from you. We will respond within one month of receiving your request. If your request is complex, we may need up to two further months, and we will tell you within the first month if so.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make significant changes, we will put a notice on our website and, where the law requires it, let you know by email.
How to contact us
If you have any questions about this policy or how we use your information, please contact:
Marketing Manager The Queen's Hall 85–89 Clerk Street Edinburgh EH8 9JG
Email: info@queenshalledinburgh.org