GDPR-Privacy Policy

Visiting us

GDPR-Privacy Policy


Bromsgrove Community Arts is committed to protecting your personal information, being transparent about what data we hold and giving you control over how we use it.

The purpose of this Privacy Policy is to give you a clear explanation about how we use the information we collect from you.

If you have registered to use the Artrix website, you can quickly and easily make changes to your contact information, how you’d like to hear from us, and what you’d like to be kept up-to-date about.

Artrix Arts Centre has appointed a Data Protection Officer (DPO) responsible for ensuring GDPR compliance. The DPO can be contacted at the email address below.


About us:

We are a charity registered in England, charity number 1204923, You can contact us as shown below:

FAO: Data Protection Officer,
Address: Artrix, School Drive, Bromsgrove, Worcestershire, B60 1AX


How do we collect your personal information?

We collect your information when you interact with us. This could include booking tickets online, by phone, or in person, or ordering an item from our online shop. It could also be when you sign up to receive updates from us by email and other digital channels. We also monitor how audiences use our websites to help us understand how they could be improved.

We collect personal information when you:

  • Buy tickets, vouchers or food and drink packages
  • Receive an email or SMS receipt for bar purchase
  • Make a donation
  • Register for special interest lists e.g. cinema broadcasts, family events, teachers’ information or our Access List.
  • Make a reservation or order drinks or by any other method, such as at our reception.
  • Contact us by phone to book tickets, or buy, reserve or hire items.
  • Book tickets.
  • Contact us by post or email, e.g. application forms for Memberships or our Access List.
  • Visit our website
  • Take part in research we carry out via an online or telephone survey, or in person.
  • Contact us by email
  • If you are involved in an incident that relates to our premises or business, we may collect information from you for incident reporting and investigation purposes and in order to meet our health and safety obligations.


From time to time, we may also get data about you from third parties. For more information, see ‘Information we receive from third parties’ below.


What information do we collect about you?

We only collect the information that’s necessary to carry on our business, operate our premises safely (including to reduce the spread of coronavirus), provide the particular product or service you’ve requested and to keep you informed. There are occasions when you can choose not to give us certain information, but this may mean that we cannot provide you with certain products or services and that our communications are less relevant and personalised. For example, you may not hear about an event that we think would appeal to you.

The type of information we collect depends on where and when it is gathered.


Information we obtain directly from you:

When you create an account with us, register on our websites, purchase tickets or other items from us, use our video on demand services, enter a prize draw, participate in research, ask us for information or make an applicatio) either online, by post, email or phone, we need to collect information from you in order to provide the service or information you are requesting or to process your application.


We collect the following information in the registration and booking process:
 Prefix and name
 Email address
 Contact phone number(s)
 Payment card details
 Delivery address(es)
 Billing address


If you are using our services in your capacity as a teacher we collect:
 Name of institution
 Location of institution
 Type of institution
 Key stages and subject


When you make a reservation for our bar, we collect:
 Prefix and name
 Contact phone number
 Email address


If you are applying for a place on a course or workshop, we collect:
 Prefix and name
 Contact phone number
 Email address
 Date of birth

We may also collect:
 Whether you receive state benefits such as income support.

This information, recorded for monitoring purposes, is anonymised once places on the course have been confirmed.


If you are booking an appointment at Artrix, we collect:
 Prefix and name
 Contact phone number
 Email address


If you have specific needs, such as a disability, we collect:
Details of how we can best support your future visits; for example, a preference for seats on an aisle, or with a clear view of captioning units.



If you take part in research we carry out via an online or telephone survey or in person, we collect:
 Email address
 Contact telephone number
 Job title and place of work
 Your responses to the questions we ask or the topics we discuss


When you visit our websites we may collect the following information:
 Automatically populated IP address. A public IP address is a unique number which allows a computer, group of computers or other internet-connected device to browse the internet. The log file records the time and date of your visit, the pages that were requested, the referring website (if provided) and your internet browser version.

Cookies. For further information about Cookies and how the Artrix uses them, please read the cookie policies for each of our websites, please read our Cookie Policy here.

If you contact us with feedback online, by email, by phone or in person:
We keep a record of the correspondence on our database to help us improve our customer service.


Prize draws:

If you enter one of our prize draws, we collect:
 Email address
 Contact telephone number
Age or date of birth

If you win a prize, we may also collect:
 Bank account details
 Postal address


When you visit our premises:

We use CCTV recording equipment in and around our premises for monitoring and security purposes. CCTV cameras operate on all public access points and in the ‘front of house’ public areas of the Artrix, such as terraces, bars and foyers. They do not operate in private areas such as washrooms.


Information we receive from third parties:

In certain circumstances, your information will be shared with us by third parties. For example:

Arts organisations: we collect personal information from other arts organisations that the Artrix works with.

Service providers: we collect personal information from our website developers, IT support providers, payment services providers, restaurant and bar booking service agents and agents who sell tickets on our behalf. For donors, we sometimes use service providers to verify source of funds as required by law.

Publicly available sources: we combine information you have given to us with information available from external sources. This will only be done when you give permission to the relevant third-party organisations to share with us the data they hold on you, or if the data is already publicly available, or if we are required by law or requested by the police or a regulatory or government authority investigating potentially illegal activities. From time to time we screen our database against recognised data sources such as National Change of Address to check and update the data we hold.

Social media plugins: we may use social media plugins from the following service providers who are based both inside and outside the UKFacebook; WhatsApp; and Twitter. Such plugins allow you to register with us using your social media account, and you will be aware when this is happening. By providing your social media account details you are authorising that third party to share with us certain information about you.

Employers and referees: if you are a job applicant we may contact your recruiters, current and former employers and/or referees, who may be based inside or outside the EU, to provide information about you and your application.

We might also receive information about you from third parties if you have indicated to such third parties that you would like to hear from us.


Why do we collect this information, and what do we do with it?

The main reasons we collect information are to provide a service you have requested, to keep you up to date with news and events, to personalise your communications, or to contact you if we need to obtain or provide additional information (e.g. cast changes, travel disruption). The information we collect about our audiences also helps us understand how we can best meet their needs.

We will use your information for the purposes listed below on the basis of:

  • Our performance of our contract with you and the provision of our services to you;
  • Your consent (where we request it);
  • Our need to comply with a legal or regulatory obligation; or
  • Our legitimate interests


Specifically, we use the information we collect from you in the following ways:


To manage your booking or purchase with us, we will use your personal information to:

  • Fulfil ticket, video on demand services, merchandise, donation and membership requests (on the basis of performing our contract with you);
  • Process payments (on the basis of performing our contract with you). Please note that the Artrix does not store any Credit Card or other payment information once the transaction has been completed unless you have asked us to store your card details for future bookings;
  • Provide good customer service at the theatre, by phone, or by email (on the basis of performing our contract with you or on the basis of our legitimate interests to provide you with customer service); and
  • Contact you with important information relating to your booking or purchase, such as confirming your order, reminding you of an upcoming performance you’ve booked for or letting you know about cast changes, safety procedures, travel disruption or changes to event times that may affect your visit (on the basis of performing our contract with you or on the basis of our legitimate interests to provide you with service information).


To send you marketing communications, we will use your personal information to:

  • Keep you up-to-date with news, offers, talks and events, products and information, and let you know about opportunities to support our work (where you have provided your consent or on the basis of our legitimate interests to provide you with marketing communications where we may lawfully do so). You can tailor your preferences at any time by logging into:
  • Send information by post about how you can support the Artrix (on the basis of our legitimate business interests to seek support); and
  • Send marketing information to companies and organisations about ways to support us (on the basis of our legitimate business interests to promote the Artrix); and
  • Provide you with special assistance, if required (on the basis of our legitimate interests to provide you with assistance or where you have provided your consent when you have provided sensitive information about your health).


To personalise your experience (on the basis of our legitimate interests to present you with the right kinds of products and services), we will use your personal information to:

  • Help us target our marketing communications so that they’re more relevant to you. You can opt-out of personalised communications by logging into:
  • Keep track of your interests and preferences so that we can contact you with information that is relevant to you. You can opt-out of this by logging into:
  • Show you advertising on such Social Media platforms such as Facebook and Instagram or via other third-party advertising that may appear on other websites you use. You can opt-out of targeted advertising here (please note that you may not see fewer ads, but they will be less relevant to your interests);
  • Help make the experience of using our websites better and to personalise the service you receive from us – this means we will remember your previous visits and track the pages on our websites that you visit; and
  • Understand your interests and personalise communications to you.


For more information on the websites, please see the Cookie Policy


To conduct research (on the basis of our legitimate interests to improve our products, services and customer service), we will use your personal information to:

  • Classify our audiences into groups or segments, using information from bookings and digital interactions, and publicly available information. We do this to better understand our audience and tailor messaging accordingly;
  • Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective;
  • Undertake audience research via an online or telephone survey or in person. Participation in these is entirely voluntary, so you can choose whether or not to disclose any information requested. We will make it clear whether your response to surveys is anonymous or not and, should you provide any further information, the Artrix will inform you how it will be used;
  • Analyse and continually improve the services we offer, including our artistic programme, our websites and our other products;
  • Help us run the test versions of our websites that we use internally to pilot new features and ensure the smooth running of our web services; and
  • Help diagnose and manage our websites, to audit the geographical make-up of users, and to establish how they have arrived at our websites.


To ensure safety and security of our premises and protect our business interests.

In certain circumstances, we use your information to ensure the safety and security of our services, buildings, and people, including to protect against, investigate and deter fraud, incidents or accidents related to our premises or business, unauthorised or illegal activities, systems testing, maintenance and development (on the basis of our legitimate interests to operate a safe and lawful business or where we have a legal obligation to do so).


To comply with our legal obligations. In certain circumstances, we will need to use your information to comply with our legal obligations, for example to comply with any court orders or subpoenas, carry out due diligence in accordance with statutory regulations or keep our database accurate and relevant, for example, using National Change of Address (on the basis of our complying with a legal obligation).


To identify individuals for memberships and philanthropic support (on the basis of our legitimate interests to seek support, promote fundraising or legacy campaigns by post to a select number of our supporters, and issue invitations to some of our fundraising events). We explain this further below.


We are a registered charity (no 1204923) and rely heavily on voluntary contributions from our audience and other funders for our work in the community. Based on the frequency of visits and purchasing patterns, we may promote our memberships to you or ask you for additional support for our work.


For a small number of people, we may use basic research tools to estimate potential interest in other membership levels or in supporting us further. This helps us understand the background of the people who may choose to support us and helps us to make appropriate requests for gifts to those who may be able and willing to give.


 This research may include information we hold (for example, payment methods and postcodes) and publicly available information.


In some cases, we may carry out initial research on potential higher-level donors prior to requesting consent on the basis of our legitimate interests to seek potential supporters. This information will also help us to meet our obligations to protect the charity from financial fraud and risk.

In addition to general use of the internet for research we make use of company, director and shareholder information from publicly available, officially registered information providers, such as the organisations in the table below.


Information we gather:


Examples of sources for this information:

  • Donations made to other organisations.
  • Google, charity and arts organisations’ annual reports, donor boards.
  • Employment and directorships current and past.
  • Google, Companies House, Who’s Who, and social media.
  • Property prices.
  • Mouse Price, Zoopla and Rightmove.
  • Charity Commission, New Trust Update,
  • Family details (not including minors) or the confirmation of a person’s middle initial – usually to confirm an individual is who we think they are.
  • com.
  • Other publicly available information.
  • Factiva; Sunday Times Rich List, Financial Times.


We may also use publicly sourced images to help identify individuals who attend our special events.


For the purposes of credit risk reduction or fraud prevention. When you apply to pay for a membership by direct debit, our service provider, Bottomline, checks that the name and account details you have provided match an open and existing bank account.



Legitimate interests

We may also use your information to further the legitimate interests of others, such as other partner organisations we work with or the general public.

Where we rely on legitimate interests to use your information for our legitimate interests, we make sure that we take into account any potential impact that such use may have on you. Our legitimate interests don’t automatically override yours and we won’t use your information if we believe your interests should override ours unless we have other grounds to do so (such as your consent or a legal obligation). If you have any concerns about our processing, please refer to the ‘How can you manage your personal information?’ section below.


Where do we keep your information?

We’re committed to protecting your personal information. We adopt robust and appropriate technologies and policies to protect it from unauthorised access and improper use. In addition, whenever we transfer your personal data out of the European Economic Area (EEA), we ensure a similar degree of protection is afforded to it as it would have in the EEA.


How long do we keep your information for?

We will keep your information only for as long as is reasonably necessary for the purposes set out in this Privacy Policy and to fulfil our legal obligations. We will not keep more information than we need.


Is your information shared with any third parties?

The Artrix will never share, sell, rent or trade your personal information with or to any third parties for marketing purposes without your prior consent. We will ask for your consent to share personal information with arts organisations who have collaborated with us on shows you have seen.

Some of our service providers may have access to your data in order to perform services on our behalf. This could include:

  • A payment process provider;
  • Our telephone ticket sales service provider;
  • A third party venue where you are attending a performance that is not taking place at our premises so that you can receive any specific venue information you need before you attend the performance;
  • Our catering providers; or
  • Where we require a third party to advise us (such as legal advisors).


We make sure anyone who provides a service for the Artrix enters into an agreement with us and meets our standards for data security. They will not use your data for anything other than the clearly defined purpose relating to the service or advice that they are providing.

We may disclose personal information to appropriate third parties to assist in anti-fraud checks and investigations.


How can you manage your personal information?

You can access and amend the personal information that we hold for you, or request that we stop contacting you at any time.


Or you can contact us by phoning, emailing, or writing using our contact details set out at the top of this Privacy Policy.


You have certain rights in respect of the information that we hold about you, including:


The right to be informed of the ways in which we use your information, as we seek to do in this Privacy Policy;


The right to ask us not to process your personal data for marketing purposes;


The right to request that we correct or rectify any information that we hold about you which is out of date or incorrect;


In addition to your right to lodge a complaint about us to the UK Information Commissioner’s Office (, you can lodge;


  • a complaint with the relevant authority in your country of work or residence;
  • the right to withdraw your consent for our use of your information in reliance on your consent (refer to ‘Why do we collect this information, and what do we do with it?’ above to see when we are relying on your consent), which you can do by contacting us using the contact details at the top of this Privacy Policy;
  • the right to object to us using your information on the basis of our legitimate interests (refer to ‘Why do we collect this information, and what do we do with it?’ above to see when we are relying on our legitimate interests) (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground;
  • the right to receive a copy of any information we hold about you in connection with the performance of our contract with you or on the basis of your consent (or request that we transfer this to another service provider) in a structured, commonly-used, machine-readable format, in certain circumstances; and
  • the right to ask us to limit or cease processing or erase information we hold about you in certain circumstances.


How to exercise your rights:

You may exercise your rights above by contacting us using the contact details at the top of this Privacy Policy and we will comply with your requests unless we have a lawful reason not to do so.

Every email we send to you will include details on how to change your communications preferences or unsubscribe from future communications.


You can find out how to manage your cookie settings:

You can opt-out of targeted advertising here. Please remember that you may still see the same number of adverts, but they will be adverts that appear as standard and less relevant to you.


What we need from you to process your requests

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.


You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will try to respond to all legitimate requests within one month.


Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.


Please note that we may need to retain certain information for our own record-keeping and research purposes. We may also need to send you service-related communications relating to your website user accounts even when you have requested not to receive marketing communications.


Are you under 18?

If you are under 18, please ensure that you obtain your parent/guardian’s consent beforehand whenever you provide personal information to our website. If you don’t have that consent, you must not provide personal information to us.



Changes to this Privacy Policy and your duty to inform us of changes.


We may make changes to this Privacy Policy from time to time. We will post any changes to our websites, and we may notify you of any material changes by e-mail.


It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us by updating your profile account information or contacting us via the contact details at the top of this Privacy Policy.


This Privacy Policy was last updated on 1st March 2024