The Royal Shakespeare Company ("we") are committed to protecting and respecting your privacy in accordance with the Data Protection Act 2018 (DPA 2018), UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

The purpose of this policy (together with our terms of use and any other documents referred to in it) is to set out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. 

Please revisit this document on a regular basis to see any updates or changes to our privacy policy.

Who we are

The Royal Shakespeare Company (RSC) is incorporated under Royal Charter and is a charity registered in England & Wales (Registered Charity Number 212481). 

Our principal charitable objectives laid down in the Royal Charter are to conserve, advance and disseminate the dramatic heritage of Shakespeare and to advance and improve the dramatic art, both in the United Kingdom and throughout the world.  We are charged with producing and presenting dramatic performances of all kinds, and with teaching and training and other educational activities.  These objectives are achieved by the production of plays by Shakespeare and by other classic playwrights and by the commissioning and production of new plays, which are presented in our theatres in Stratford-upon-Avon, in London, on tour, and broadcast to cinemas and schools throughout the United Kingdom and the rest of the world; and by educational activities in schools, colleges and for the community at large. 

Our purpose is to create the finest experience of Shakespeare in performance, shared with the widest audience in Stratford-upon-Avon, London, across the UK and around the world.

RSC Enterprise Limited (Company Number 2360172) is a 100% owned subsidiary of The Royal Shakespeare Company and carries out a range of commercial trading activities to generate income for the RSC.

By visiting www.rsc.org.uk you are accepting and consenting to the practices described in this policy.

For the purpose of the UK GDPR the data controller is The Royal Shakespeare Company of the Royal Shakespeare Theatre, Waterside, Stratford-upon-Avon, Warwickshire, CV37 6BB. (ICO registration Z5023810).

CONTACT US

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to gdpr@rsc.org.uk.

What information do we collect?

We only collect the information that is necessary to carry out normal business operations, to provide any good or services you’ve asked for, and to keep you updated about our current and future activities. Examples of the type of personal information that we collect includes:

• name, title, date of birth and gender
• sensitive personal data, such as information about race, ethnicity and sexual orientation (you have the right not to provide us with this information)
• contact details including postal address, email, phone numbers
• if you are a teacher with whom we have professional relationship, name and address of school/college, type of school/college, teacher name, teacher email, subject and key stage taught
• transaction history, including financial and credit card information
• access requirements to enable us to determine if you require wheelchair access, audio description, BSL interpretation, or any other access requirement
• image and likeness (as captured on our CCTV cameras and in photographs and videos we may use for promotional purposes)
• technical information gathered when you visit our website; including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• information about your visit to our website; including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
• other background personal information you may provide to us (for example when you correspond with us).

How do we collect your information?

You give us your information when you:

• buy a ticket, make a purchase from our shop, or buy something online
• create or update your MyRSC account on our website
• sign up to receive marketing communications from us
• sign up for one of our events or workshops
• make a donation
• join one of our Membership or Patrons schemes
• apply for a job
• hire a costume from RSC Costume Hire 
• enter a competition, promotion or survey
• communicate with us by phone, email or otherwise.

We also keep your details when you create or update your MyRSC account on our website or sign up to receive marketing communications from us. 

Cookies

We receive and store certain details whenever you use the RSC website. A cookie records on your device information relating to your internet activity (such as whether you have visited our website before). The cookies we use on our website don't collect personally identifiable information about you and we won't disclose information stored in cookies that we place on your device to third parties. The cookies we send to your device only relate to your use of our website; they don't have any other effect on your device.

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For more information on the cookies we use and the purposes for which we use them see our Cookie policy.

What we use your personal information for

We will only collect the personal data that we need and use it on relevant lawful purposes as permitted by the current data protection legislation (UK GDPR, DPA 2018, and PECR).

We will use this information:

• to carry out our obligations arising from any contracts between us and to provide you with the information, products and services that you request from us;
• to provide you with information about other goods and services we offer;
• to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you. We will only contact you by electronic means if you have consented to this. If you have registered for a MyRSC account, you can quickly and easily make changes to your contact information, how you’d like to hear from us, and what you’d like to be kept up-to-date about.
• to analyse your information and carry out a segmentation. This is used to better understand customer behaviour and, where your consent is given, to inform you of the productions and services we believe are of most interest to you. If you do not wish us to use your data in this way, please email segmentation@rsc.org.uk and we will stop the behavioural segmentation of your data. You will still receive emails from us if you have requested to do so but these may be less targeted to you based on your past bookings.
• to notify you about changes to our service;
• to ensure that content from our site is presented in the most effective manner for you and for your device.
• to send you invitations to take part in research surveys, research discussion groups or interviews to give your opinions about our productions and services (whether or not you have agreed to receive other communications). Some of these may be carried out by market research agencies working for the RSC. You can choose to stop receiving email invitations to take part in surveys at any time by emailing survey@rsc.org.uk
• to undertake academic research from time to time. Data Protection laws allow us to use personal data for research with appropriate safeguards in place under the lawful basis of public task. For each individual research project, participants are provided with an information sheet, which explains in more detail the kind of information that will be collected, how this will be done and the purpose of the research.
• to conduct desktop research and fundraising activities to promote the interests of the Royal Shakespeare Company as a charity;
• to administer membership records, patrons’ records and giving schemes;
• to manage our volunteers and ambassadors.
• to ensure that our fundraising resources are used in the most effective and efficient manner and that any communications we may send you about fundraising are appropriate.
• to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to improve our site to ensure that content is presented in the most effective manner for you and for your computer;
• to allow you to participate in interactive features of our service, when you choose to do so;
• as part of our efforts to keep our site safe and secure;
• to measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you;
• to make suggestions and recommendations to you and other users of our site about goods or services that may interest you or them;
• to ensure that our fundraising resources are used in the most effective and efficient manner and that any communications we may send you about fundraising are appropriate.

Information we receive from other sources

We may combine this information with information you give to us and information we collect about you. To make sure you only receive fundraising communications which are relevant, we may undertake research to help us better understand our supporters and to contact appropriate people who may be able to support us further. This may take the form of internal profiling, screening and ranking or segmentation exercises carried out in-house. In doing so we will make use of additional publicly-available information about you.       

As part of the academic research we undertake, we may receive personal data from third party partners involved in our research projects. When this occurs, we ensure that appropriate safeguards and data sharing agreements are in place.

As part of our fundraising, we may to seek to supplement booking information with qualified information such as business network information, personal connections and other publicly-available information pertaining to: age, place of residence, wealth, career, interests and public donations to other organisations.

We achieve this by using resources to assist us in our fundraising, including the Internet for general searches, newspaper articles, the electoral roll, property and housing marketing websites, official company websites, and those of charities and other arts organisations.  We may also consult third party sources and information providers who collate publicly available information about you.

We may use publicly-sourced images to help identify individuals who attend our fundraising events.

We occasionally use the event marketing and promotion platform Eventbrite for selected activities. If, when booking, you provide Eventbrite with your consent to share your data with us, we will receive that data. 

We make every endeavour to ensure the information we hold about you is accurate and therefore may use publicly available information to keep the database accurate and relevant.

USE OF SENSITIVE PERSONAL DATA

Some of the information that you give us, due to its nature, has more potential to cause harm if not handled correctly.

The UK GDPR recognises that certain categories of personal information are more sensitive. These are known as “Special Category Data".

Such information shall only be collected after having obtained your explicit consent. We sometimes request sensitive personal data in our customer surveys, in order to assist us with our diversity monitoring, which we are required to report on as part of our funding. This data is not obligatory to provide, is analysed anonymously, and not linked to individual customer records.

Special category data we may collect about you include: racial and ethnic origin, political beliefs, religious or philosophical beliefs, trade union membership, health, and sexual orientation.

OUR BASIS FOR PROCESSING YOUR PERSONAL INFORMATION AND WHAT WE USE IT FOR

We aim to be clear when we collect your data and not to do anything you wouldn’t reasonably expect.

We may process your personal data because it is necessary for the performance of a contract. For example, if you make a purchase, sign up for an event, book an Education workshop, or book a table in our restaurant.

We may process personal data because it is in our legitimate interests to do so. Examples of these may be:

• to share information about our organisation or invite to stakeholder events with representatives from government; individuals within other arts organisations; and other interested parties
• we may use your personal information to understand your reasons for donating to us, to better understand your interests,
• to tailor our communications to you and/or to give you the best experience at our events. We may also collect information about how you use our services (including our website) to analyse our customer base and improve our processes.  
• The RSC also records and uses film, photographs and audio for promotional purposes on its website, social media accounts and other formats under a legitimate interests’ basis for processing where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use).

We may also process your personal data (including sensitive personal data) where:

• it is necessary for medical purposes (for example, in a medical emergency)
• it is necessary to protect your or another person’s vital interests
• we have your consent to do so (for example to monitor the diversity of our visitors to the RSC).

We will also ask for your consent to provide you with information about productions, offers, and other services which may be of interest to you (apart from where it is appropriate for us to rely on our legitimate interests to do so). Other activities relate to tours, events, exhibitions, education work, fundraising, Membership and Patrons schemes, as well as our shops, restaurants and cafés

GIVING YOU CONTROL

• We try to make it as easy as possible for you to tell us how you want to hear from us (by logging onto our website and updating your preferences in the “MyRSC” section) or by telling our Box Office team over the phone or in person. You can opt out of these marketing communications at any time - every email sent to you will include details on how to unsubscribe.
• If you have opted out of marketing communications, we may still get in touch with you. For example, we may email you to give you important information about the events you’ve booked or to tell you about any changes.
• Our site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.  Please check these policies before you submit any personal data to these websites.
• We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you, including geo-demographic information and measures of affluence when it is available from external sources to help us do this effectively. This helps us understand the background of the people who support us and helps us to make appropriate requests for gifts to supporters who may be able and willing to give more than they already do. We may also use your personal information to detect and reduce fraud and credit risk. You can also register with the fundraising preference service – fundraisingregulator.org.uk/the-fundraising-preference-service/for-public
• We use CCTV recording equipment in and around our premises for monitoring and security purposes. CCTV cameras operate on all public access points and in the ‘front of house’ public areas of the Royal Shakespeare Theatre, such as the foyers and bars. They do not operate in private areas such as toilets. We display signs to alert our visitors to the use of CCTV cameras and if you do not want to be photographed/filmed gives instructions on how you can make staff aware.

SHARING YOUR PERSONAL INFORMATION

We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We will not share any personal details with any other third parties without your agreement, unless required in order to fulfil our contract with you, or allowed by law.

Instances where we may share your personal information with selected third parties include:

• Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you. In general, the third-party providers used by us to fulfil our contract with you will only collect, use and disclose your information to the extent necessary to allow them to perform the services they provide to us. These providers include our ticketing and events systems provider, and our email and mail distribution services. We have agreements in place with each to ensure that your data is secure at all times, and cannot be accessed or used for any other purpose.
• Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.
• Social media sites for the purposes of data analytics and targeted advertising.
• Analytics and search engine providers that assist us in the improvement and optimisation of our site.
• Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.

We may disclose your personal information to third parties:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If the Royal Shakespeare Company or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply terms of use or terms and conditions of supply and other agreements; or to protect the rights, property, or safety of The Royal Shakespeare Company, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
• Please note that Sensitive Personal Data will not be shared with third parties without your consent.  

WHERE WE STORE YOUR PERSONAL DATA

• Your personal data will be securely held and processed on the RSC’s systems or systems managed by suppliers on behalf of the RSC. We maintain a customer relationship management (CRM) system to manage our activities in ticketing, marketing, relationship management of our customers and stakeholders, and fundraising to hold contact details and a record of your interactions with us such as ticket purchases, donations, memberships, queries, complaints and attendance at special events.
• We always seek to hold your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.
• Any payment transactions will be encrypted.
• Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
• The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

HOW LONG DO WE KEEP YOUR DATA?

• We will keep your information only for as long as is reasonably necessary for the purposes set out in this Privacy Policy and to fulfil our legal obligations. We will not keep more information than we need. When we no longer require the information, it will be securely destroyed.
• The retention period will vary according to the purpose, for example for a financial transaction such as a ticket purchase, we may keep your data for up to seven years from the date of your last transaction to comply with HMRC requirements.
• For information retained within our Collection, we adhere to the Museums’ standard Spectrum 5 guidelines as part of our accreditation status, this demands that we keep hard copies of paperwork which contains personal data.  This includes acquisition, loans and movements paperwork and the personal data will include name, address, telephone number and email address of donors.  There may be additional personal information such as letters or scrapbooks forming part of a donation.  This information is also stored in our electronic database MODES, this is only accessible internally on a secure area of the RSC network by a limited number of Collections staff. 

To request specific information about how long we keep your personal data please email gdpr@rsc.org.uk.

YOUR RIGHTS

Under data protection law, you have the following rights:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to exercise any of the rights set out above, please contact us using the contact details found at the beginning of the policy.

This privacy policy was updated in January 2023.