The Dukes Theatre
Privacy Statement


  1. Introduction

Our Privacy Statement is here to give you details of the kind of personal data we collect about you whenever you interact with us, as well as how we store it and how we keep it safe.

There is a lot of information in this policy but we think it’s important that you understand it.  If you have any questions, you’re welcome to contact us to find out more.

Sometimes we might need to update this statement so you can come back and check it any time, but if we make any significant changes we will let you know.

  1. What is The Dukes Theatre

The Dukes Theatre is a charitable organisation made up of a number of different departments, including our theatre, cinema, creative learning and fundraising areas. For the purposes of this statement ‘we’, ‘us’ and ‘the theatre’ will mean The Dukes Theatre and all of our departments.

  1. The legal bases we rely on

The law on data protection allows for several different reasons a company might collect or process your data. These are outlined below:


In some situations we can collect and process your data with your consent: for example, when you opt-in to receive email, telephone or postal marketing from us.

When we collect your data we’ll make it clear how your data is going to be used so that you are giving informed consent.

Contractual obligations

Sometimes we will need to collect your personal data to fulfil our contractual obligations. For example, if you buy a ticket and ask for it to be posted to you, we’ll ask for your home address.

Legal compliance

If we have to by law, we might need to collect and process your data.

For example, we can pass on details of people involved in fraud to law enforcement organisations.

Legitimate interest

In some situations, we need your personal data to pursue the legitimate interests of The Dukes, as a charity, in a reasonable way, so long as it does not impact your rights, freedoms or interests.

For example, when you opt-in to receive email communications from us or buy a ticket to one of our events or activities, we may send you information about our charitable fundraising activities to give you the chance to support us in a different way.

We will also use your ticket booking records to send you personalised offers that you might be interested in. We might also use your address details to send you direct marketing via post to tell you about events or activities we think you could be interested in.

  1. When do we collect personal data?

We collect personal data from you during all of the following interactions:

  • When you book a ticket or register for an account with us over the phone, in person or on our website.
  • When you engage with us on social media.
  • When you become a Dukes Supporter or make a donation to us (including through Virgin Money Giving).
  • When you (or your child) participate in any of our artist development or creative learning opportunities or programmes.
  • When you volunteer for us at any of our events or venues.
  • When you make a purchase in our café bar using electronic payment.
  • When you complete a survey or enter a prize draw.
  • When you contact us with a query, compliment or complaint by any method.
  • When you leave us feedback on any of our events or take part in video vox pops.
  • When you complete any paperwork for us (for example, if you have an accident at one of our events.)
  • When you visit our venue(s) in an area where there is CCTV in place, your face may be recorded.
  1. What sort of personal data do we collect?

We collect different kinds of personal data from different interactions with you including:

  • Through your customer account we will collect your name, data of birth, email, gender, postal address, phone number, the orders you have made and any memberships you hold with us. We will also keep an encrypted record of your password for your own security.
  • Details of your interactions with our box office team. For example, if you call us to discuss your bookings or account we might retain a record of some details of that conversation.
  • Details of your interactions with our fundraising team. For example, your specific philanthropic interests and connections.
  • Details of your booking preferences and what kind of events you attend that we organise. For example, if you often come to comedy shows.
  • Details of your visits to our website, including which site you come from to get to ours.
  • Information gathered through the use of cookies in your web browser.
  • Payment card information.
  • Your bank details if you have given them to us to set up a standing order.
  • Your comments, compliments or complaints about any of our events, shows or activities.
  • Your image might be recorded on our CCTV system when you visit our venue(s).
  • Your social media username if you interact with us on social media spaces to allow us to respond to you.
  • Your emergency contact information if necessary. For example, if you take part in our creative learning activities or volunteer with us.
  • Details of any medical conditions that you think we should be aware of if you are participating in our creative learning activities or volunteer with us.


  1. How and why do we use your personal data?

We use your data to get a better understanding of what you like and dislike and we combine the data we hold about you in order to make recommendations to you that we think you will like, as well as to invite you to take part in activities or support us an organisation.

Data law allows us to do this through our legitimate interest because we want to understand our customers and provide the best experience possible to them.

It is possible for you to remove your consent at any time (see section 14), but if you do so we might not be able to let you know about things you might be interested in. For example, if you withdraw your consent for direct marketing, we won’t be able to tell you about shows or activities coming up that we think you’ll like.

Below are some ways we’ll use your data and why, with specific examples:

  • To process any bookings or donations that you make online, in person or over the phone. If we don’t collect your data, we won’t be able to make your booking or process your donation.
  • To respond to any comments, compliments or complaints made either online, in person or over the phone. We would be unable to respond to you and investigate what you’ve told us (if necessary) if we didn’t collect your data.
  • To protect our staff, volunteers, customers and materials we operate CCTV in some areas of our venue(s) which may record your face. We do this under our legitimate interest.
  • To process your membership benefits and set up your standing order.
  • To process your donations including any Gift Aid claims.
  1. Combining your personal data for direct marketing or fundraising

To help us understand you as a customer and to assist us in making relevant recommendations to you, as well as develop our activities to meet your needs, we sometimes combine the data detailed above. Sometimes we might supplement your data with other anonymised data to help us do this in order to deepen our understanding of what you like and dislike, so that we can do more of what you enjoy and ensure that you know about it.

We may use profiling and screening techniques to analyse your personal data and create a profile of your interests and preferences. In doing so we may make use of additional publicly accessible information about you, including where you live, your age, and other information and measures of wealth, where it is available from external sources such as public registers. This helps us to understand more about the people who support us so that we can make appropriate approaches to those who may be able and willing to support us as a charity.

  1. How we protect your personal data

We place a very high value on data security and all of our staff and volunteers are fully briefed on everything outlined in this statement. To ensure that your personal data is protected we use the following measures:

  • Only the staff and volunteers who need to access your data are able to do so.
  • Our website is secured with HTTPS encryption.
  • Data held on our systems is always password protected.
  • All paper records held on our premises are secured in locked storage areas.

We also regularly review our data processes and procedures to ensure that all security measures are robust and effective.

  1. How we handle the data of under 16s

Where under 16s take part in our Creative Learning activities we always get parental consent and ensure that the young person understands how their data will be used and stored. Our Creative Learning team will explain the implications of the consent that has been given and are able to answer any questions which young people might have.

In line with GDPR, we do not allow under 13s to give their own consent to use our online services. We state clearly on our website that under 13s are not allowed to register for an account with us, and that they should ask their parent or guardian to make any bookings on their behalf. Where we discover that an under 13 has registered with us, we will permanently delete their account unless we have a legal obligation to retain their data, in which case we will make every effort to contact the parent or guardian to obtain consent.

  1. How long will we keep your personal data?

When we collect personal data, we only ever keep it for as long as it is necessary and for the purpose it was collected. At the end of that period it will be deleted or anonymised.

Some examples of data retention periods:

  • Ticket bookings – we keep your data for at least five years to comply with our legal and contractual obligations.
  • Inactive accounts – if you have an account with us but haven’t booked any tickets for over five years your account will be marked as inactive. If you haven’t made a booking for over eight years your account and data will be erased.
  1. Who do we share your personal data with?

Sometimes we share your data with trusted third-party organisations who we work with regularly. For example, we might share your data with our mailing house to send you information through the post.

Here is the policy we apply to those organisations to keep your data safe and secure:

  • We only share the specific information they need to carry out their service.
  • They are only able to use your information for the services we have contractually agreed with them.
  • We work with them to ensure your data is kept secure and is respected at all times.
  • If we stop using their services or your data is no longer needed by them, it is deleted or made anonymous.

Examples of the kind of third-party companies we might share your data with include:

  • ICT and box office providers
  • Direct marketing companies who help us to send you information

Sharing your anonymised data with third-parties:

Sometimes in order to help us understand our audience and customers better, and to satisfy the needs of our funders, we might share your anonymised data with third-parties. The kind of data we might share might include postcode, date of birth, age, gender, ethnicity, sexual orientation and other demographic data. This data will always be anonymised. The kinds of organisations we might share this with include:

  • Touring companies.
  • Funders (including Lancaster City Council and Arts Council England).
  • The Audience Agency.

Sharing your data with third-parties for their own purposes:

We will only share your personal data with third-party organisations to use for their own purposes with your express permission or when we have a legal obligation to do so.

Here are some examples of when we might do this:

  • When you give your consent to receive direct marketing materials from one of our partners. In this instance we will always name the partner organisation you are giving your consent to have your data shared with.
  • When there is a fraud management issue we may share information with law enforcement bodies.
  • If we receive a request from the police, regulatory, government or other law enforcement body, we may share your information on receipt of a valid request to do so. All requests of this nature will be assessed on a case by case basis with your privacy kept in mind.

For more information please contact our Data Protection Officer.

  1. Where your personal data may be processed

Sometimes we might need to share your data with third-party processors who are based outside the European Economic Area (EEA). For example, when we use MailChimp to send email communications to you.

To ensure your data security, we only use processors who we are confident meet the same standards of protection as exist in the EEA. If you would like to receive more information about this, please contact our Data Protection Officer.

  1. What are your rights over your personal data?

You have a number of rights about your personal data which are detailed below:

  • To see a copy of the personal data we hold about you (this is usually free of charge).
  • To correct personal data which is incorrect, incomplete or out of date.
  • That we stop using your personal data for direct marketing (through specific channels or all channels).
  • That we stop any content-based processing of your personal data once you remove your consent.
  • To have one of our staff review any automated processing of your data (where no human has been involved in the processing).

To ask for a copy of your personal data please contact our Box Office Manager via or write to Box Office Manager, The Dukes Theatre, Moor Lane, Lancaster, LA1 1QE. Please note that we cannot take requests for personal data over the phone. If you want to update your personal data please use your online account or, if you don’t have an account with us, contact our Box Office Manager using the details above. We will respond to all requests within 21 days.

If we choose not to carry out your request, we will explain the reasons why.

  1. How can you stop the use of your personal data for direct marketing?

There are a number of ways you can ask us to stop using your personal data for direct marketing. These are listed below:

  • All of our email marketing materials contain an unsubscribe link which you can use any time. When you use the unsubscribe link you will no longer receive any further direct marketing by email.
  • If you receive something through the post from us and want to stop us sending you anything else you can call us on 01524 598500, email us at or write to Box Office Manager, The Dukes Theatre, Moor Lane, Lancaster, LA1 1QE.
  • To update your preferences for either email, postal or telephone marketing you can also login to your account through our website and let us know that you no longer want to receive marketing materials via a particular channel.

Please note that you may still receive materials for a short amount of time after you have unsubscribed, contacted us or updated your preferences online while we update our systems. You may also still continue to receive information which is related to bookings you have made which are not related to marketing.

  1. Contacting the Regulator

If you feel that your data has not been handled correctly or are unhappy with our response to any requests you have made of us, you can contact the Information Commissioner’s Office.

You can contact them by phone on 0303 123 1113.

Or you can visit their website at

  1. Any questions?

We hope that this statement has helped you to understand how we handle and protect your personal data, as well as your rights over it.

If you have any questions or you feel anything contained in this statement is unclear, please contact us using any of the methods below.

Write to Data Protection Officer, The Dukes Theatre, Moor Lane, Lancaster, LA1