Purpose of the policy
At Gulbenkian we are committed to protecting your personal information and being transparent with you about how we use it.
In order to provide a good service to our patrons we collect contact data and a history of how you have interacted with us, for example if you have been to an event or donated.
This policy is to give you a clear explanation about how we collect and use this information, and how we work with third parties to deliver our service. In particular:
• What information we may collect about you
• How we use that information
• In what situations we may disclose your details to third parties
• Information on how we keep your personal information secure, how we maintain it, and your rights to be able to access it.
Who we are
Gulbenkian is a department of the University of Kent. As part of the University we have exempt charitable status in accordance with the Charities Act. We fundraise for support, receiving funding from Arts Council England, as well as other trusts and foundations and donations from private individuals.
Why we need your data and how we use it
At Gulbenkian we record and store your personal data responsibly. We need your data for a number of reasons:
• To deliver good service – So we can complete your purchase, to deliver tickets, to contact you about the event you are attending, and to ask for feedback afterwards.
• To stay in touch – and keep you up to date with events and latest news from Gulbenkian (you can say no to these at any time).
• For research – we use information we hold on you to help put together a picture of our audiences overall, where our audiences come from, who we are attracting, and which parts of our programme are doing better than others.
Information we collect
We collect information in a variety of ways:
Information you give us
When you buy a ticket, register on our website or make a donation we will ask for and store contact details, such as name, email address, postal address and telephone number. We also record details of your purchases and/or donations. These are held electronically in our Box Office system, Patronbase.
Any credit or debit card details you give us are not held on our system. These are entered directly into the University’s WPM payment portal. If you pay by phone or in person, our card machines produce a receipt which we keep in a secure location in accordance with legal requirements.
Information about your interactions with us
In addition to purchases and donations, we record in our Box Office System how and when we communicate with you. Digitally we collect information on how you interact with us. For example we record how you interact with our website and if you open specific links in our emails.
Sensitive personal data
Data protection law recognises that certain categories of personal information are more sensitive such as health information, race, religious beliefs and political opinions. We do not normally have need to collect this information unless there is a clear need to do so, for example dietary requirements if you are joining a course. Any sensitive information collected will be held securely and only for as long as required for a specific reason.
There are three bases under which we may legally process your data:
When you make a purchase or a donation, you are entering into a contract with us. In order to deliver the contract we need to store and process your information. For example, we may need to contact you to send tickets, or if the show is cancelled.
Legitimate business interests
In certain situations we collect and process personal information that are in our legitimate organisational interests. We would only do this if there is no overriding prejudice to you in doing this.
• we will hold your information in our Box Office System for up to 5 years to enable us to analyse trends and construct reports for funders.
• we may hold contact information for and send information to funders, stakeholders, schools, groups or industry contacts.
• we may also use legitimate interest legal basis to contact you with information on future events at Gulbenkian which previous purchases indicate you would be interested in. For example, we may contact previous attenders to our family programme.
With your explicit consent
In any circumstances where the two basis above are not appropriate, we will instead ask for your explicit consent before using personal information.
We aim to communicate with you about the work we do in ways that you find timely, relevant and respectful. To do this we use the data that we have stored about you, such as previous events you have booked for.
We use legitimate business interest as the legal basis for communicating with you by post or email. In the case of both post and email communications you will have the opportunity to opt out of any communications when you first register with us, and then provide an opt-out link with every digital communication we send for then.
We may also contact you about our work by telephone, however we will always get explicit consent from you before doing this. Please note that this does not apply to telephone calls we may need to make related to your purchase (eg if an event is cancelled for example).
Other processing activities
In addition to marketing communications, we also process personal information in the following ways that are within our legitimate organisational interest.
• In order to improve the website, we may analyse information about how you use it and the content you interact with.
• We use information about you to build a picture of our audience, including segmentation profiling, geographical mapping and patterns of attendance.
• We may analyse data we hold about you to identify and prevent fraud.
There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:
• We store your information on our Box Office System, Patronbase. They have access to your data, but do not use it and you can find their security policy here (add link).
• We work with Audience Agency and Purple Seven analytics companies, both of which access our database and amalgamate audience data to produce reports we use to understand a report on our performance.
• We provide postcode information on audiences to companies whose performance you have attended, but independent of any other contact information. We may also provide full contact information, but only if you give explicit consent before doing so.
• Please note that as we for part of the University, we may share your details with other departments if you are attending an event at Gulbenkian run by them. We may also process your information with other University data sets (eg Sport Centre membership, student lists, staff lists and fundraising lists) to understand more about your wider involvement with the University.
Your debit and credit card details
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).
Storing and maintaining your personal information
We store your personal information for at least 5 years, to allow us to connect any future purchases on the system back to your one single record. This helps us to provide good future service to you, and for us to better understand the preferences and booking patterns of our audiences.
You can access and amend your personal details at any time online, or by contacting our Tickets and Information team.
We put in place safeguards to keep your personal information as secure as possible, and we ensure that any third parties we use for processing your information do the same.
You have a right to request a copy of the personal information that we hold about you and to have any inaccuracies in the data corrected. Please use the contact details below if you would like to exercise this right.
Gulbenkian, Universty of Kent, Canterbury, CT2 7NB