Data Protection

Data Protection

The Shaftesbury Theatre is registered with the Information Commissioner’s Office (IOC). The Data Controller is the Chief Executive. Below we set out how we manage data obtained from the public.

The Shaftesbury Theatre uses data for the following purposes:

• Recruitment of staff – deleted 12 months from appointment of post
• Management of employees contract administration, payroll, Health and Safety, Human Resource management – deleted 6 years after termination of contract
• Customer booking information used for administration of their visit – deleted 3 years after attendance
• Customer data for marketing purposes. Customers opt into this function – deleted 3 years after last attendance.

You can request that your data is deleted once you have finished using our services, normally after seeing a show. The Theatre will only deny this should it have a legal duty to retain the information.

Close Circuit Television

The Shaftesbury Theatre uses a surveillance camera system to assist in providing customer and staff safety and to aid the Theatre and law enforcement authorities to prevent and investigate unlawful acts.

The surveillance camera system records the activities of those entering the Theatre and in the immediate vicinity of the building. It is only viewed by nominated trained staff. Recordings are not shared with third parties excepting the Police, law enforcement authorities and the West End Theatre security network operated by the Society of London Theatres. The system is installed and maintained by a certified contractor and is reviewed annually.

The surveillance camera system is managed by the Theatre General Manager. For further information concerning its operation and the information that is held by the system please contact us by writing or through the Theatre’s website using enquiry@shaftesburytheatre.com.

Surveillance cameras operate throughout the building and on the exterior. They record activities as people approach and interact with the Theatre, its staff and other members of the public. Images are held electronically and are viewed by nominated staff in secure locations. All data is deleted 28 days after recording unless it is the subject of investigation, in which case a secure copy of the data will be held by the Theatre General Manager.

The Theatre has clear policies for the operation and engagement of the surveillance camera system and all relevant staff receive training.

Access to stored images is restricted to nominated staff who shall view them when investigating suspected criminal activity, complaints or for dispute resolution. All images are considered suitable for evidence in a court of law. Disclosure of images will only take place when it is necessary for such a purpose or law enforcement.

The Theatre reviews and audits the systems on an annual basis to comply with legal requirements and its own policies and standards. Reports of these reviews are available on request. 

Data Subject access

The Shaftesbury Theatre holds personal data about its staff, customers and contractors. This code of practice acknowledges our obligations to provide access to data, and sets out how we deal with requests.

Anyone can make a Subject Access Request (SAR). It must be a written request, except in exceptional circumstances, by or on your behalf for the information that we hold about you. The Theatre will not charge for responding to requests.

Requests may be made through our website, by using the form provided. The completed form gives us the information needed to deal with your request. It does not need to be used but its use will help us. Please be as detailed as possible to avoid unnecessary searches and to speed up the process. By providing a phone number or email we will be able to contact you should we need clarification.

You are entitled to be:

• told whether any personal data about you is being processed;
• given a description of the data, the reasons why it is processed, and whether it will be given to any other organisations or people;
• given a copy of the personal data; and
• given details of the source of the data (where this is available).

A request will be dealt with within 28 calendar days.

The Theatre will:

• not respond to an oral request, other than in exceptional circumstances;
• carry out any checks necessary to be satisfied about your identity;
• prefer email requests but also accept requests by post, Facebook or Twitter. In all instances please be clear that you are asking for your own personal data.
• respond to all requests either by email or post to ensure confidentiality.

You do not need to tell us of the reason for your request but, it may help us find relevant information.  You may make a request via a third party, a professional advisor acting on your behalf or simply someone else acting for you. We will need to be satisfied that the person is entitled to act on your behalf and reserve the right to send responses directly to you.

Children have the right to make a request, even if the child is too young to understand the implications; their personal data is theirs and does not belong to anyone else, such as a parent or guardian. The Theatre considers a child mature enough to understand their rights once beyond the age of 11. If we are confident that the child understands their rights, we shall respond to them rather than the parent.

The Theatre will acknowledge receipt of your request by an email or letter, advising of the date by which we will respond. If there is a delay we will contact you to explain the reason and the expected date of response.

As a general note, we are only obliged to provide personal data controlled by us.

We will not be able to comply with a request if to do so would mean disclosing information about another individual who can be identified from that information, unless the other individual has consented to the disclosure and/or it is reasonable in the circumstances to comply with the request without consent.

There is no limit on the number of personal data requests you can make, however, we can reserve our position when:

• requests are made at unreasonable intervals
• the nature of the data is particularly sensitive.
• the processing is likely to cause detriment (harm).
• information is unlikely to have changed between requests,

If we decide not to provide information we will provide clear reasons.

Data subject access and deletion information can be found here.