Privacy and Cookies Policy

McMillan Theatre – Privacy Notice

Last updated: July 2026

1. Who we are (Data Controller)
McMillan Theatre – part of the University Centre Somerset College Group

Bath Road, Bridgwater, Somerset, TA6 4PZ

ICO Registration Number: Z4677243

Email: dpo@ucscollegegroup.ac.uk

 

2. What personal data we collect
Depending on how you interact with us, we may collect:

·       Identity and contact information – name, title, postal address, telephone number(s), email address; date of birth (e.g., for age-restricted events or child workshops)

·       Ticketing and payment information – Ticket purchase history; payment transaction details (processed securely through our payment provider); Theatre account information (login, preferences)

·       Workshop information – Enrolment forms including emergency contacts and medical information needed to ensure safety during workshops

·       Security information – CCTV recordings inside and outside theatre premises

·       Website and device data – Cookies and analytics data (details below)

·       Photography and videography – Images or video captured during events, performances or outreach work (where applicable and clearly signposted)

 

We only collect data that is necessary for our activities and we ask you to keep your information up to date.

 

3. How we collect your data
We collect your information directly from you when you:

·       Purchase tickets

·       Create or update a theatre account

·       Contact us by phone, email, website or in person

·       Enrol in a workshop

·       Visit the theatre (CCTV)

 

We may also receive limited data from:

·       Email marketing platforms (where you have provided consent)

·       Payment service providers

We do not buy or sell personal data.

 

4. Purposes of processing and lawful bases
We process your data for a number of purposes on different lawful bases as set out below:

Purpose
Data involved
Lawful basis
Ticket purchase and event administration
Contact details, ticket history, payment details
Contract necessity
Theatre account management
Account login, preferences
Contract necessity
Payment processing
Payment information
Contract necessity & legal obligation (financial regulations)
Workshops & safeguarding
Medical details, emergency contacts
Vital interests / explicit consent / safeguarding obligations
CCTV for security
Video footage
Legitimate interests (premises security)
Direct marketing (email/post)
Contact details, preferences
Consent or legitimate interests (for existing customers)
Customer service
Contact details, correspondence
Legitimate interests
Legal compliance
Any relevant information
Legal obligation
Website analytics
Cookies, device data
Consent (non-essential cookies)
 

5. Who we share your data with
We do not sell your data. However, to operate our services we share data with trusted providers acting under written contracts, including:

·       Spektrix – our ticketing system processor (data stored securely)

·       Payment processors (e.g., Stripe/WorldPay)

·       Email and SMS communication tools

·       IT service providers supporting our systems

·       The College Group (for security, financial, or operational purposes)

 

We may also disclose information to:

·       Police or authorities where required by law

·       Emergency services where vital interests apply

 

6. International transfers
If any service provider stores or processes data outside the UK, we ensure appropriate safeguards, such as UK adequacy decisions or ICO-approved Standard Contractual Clauses.

 

7. How long we keep your personal data
We keep personal data only for as long as necessary, typically:

·       Ticketing records: 7 years (financial/legal requirements)

·       Theatre account data: for as long as your account is active

·       Workshop enrolment forms: kept until the end of the workshop period then securely destroyed

·       CCTV footage: 21 days unless needed for an incident

·       Marketing data: until you withdraw consent or object

 

A full retention schedule is available on request.

 

8. Cookies and website tracking
Our website uses cookies to:

·       Enable essential site functionality

·       Analyse site usage and improve services

·       Support marketing (where you consent)

 

You can manage cookie preferences at any time via our cookie banner or browser settings.

 

9. Children and vulnerable individuals
Where activities involve under-18s:

·       We obtain parental/guardian consent where required

·       We apply additional safeguarding measures

·       Only essential data is collected and retained for the minimum duration necessary

 

10. Your data protection rights
You have the following rights:

·       To be informed about how we use your data

·       To access your data

·       To correct inaccurate data

·       To request erasure (in certain circumstances)

·       To restrict processing

·       To object, including to direct marketing (absolute right)

·       To data portability

·       Not to be subject to decisions based solely on automated processing (we do not use these)

 

We will respond within one month. Requests are generally free unless manifestly excessive.

 

11. How to exercise your rights
Contact the Data Protection Officer:

Email: dpo@ucscollegegroup.ac.uk

 

12. How to complain
If you are unhappy with how your data is handled, please contact us first.

You also have the right to complain to:

 

Information Commissioner www.ico.org.uk

 

13. How we keep your data secure
We use a combination of technical and organisational measures, including:

·       Secure ticketing and payment systems

·       Access controls and staff authorisation

·       Encryption and secure storage

·       Locked physical storage for paper forms (as stated in original notice)

·       Regular audits and staff training

 

14. Updates to this notice
We may update this privacy notice from time to time. The latest version will always be available on our website and marked with the date above.