Privacy Policy

The Mill Arts Centre – Privacy Notice

1. Introduction

The Mill Arts Centre Trust (“we”, “us”, “our”) is committed to protecting your personal information and being transparent about how we use it. This privacy policy explains what data we collect, how we use it, your rights, and how we keep your information secure.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy applies to:

ticket buyers
workshop participants
donors and supporters
website visitors
mailing list subscribers
anyone interacting with The Mill Arts Centre

2. Who we are

The Mill Arts Centre Trust is a Charitable Incorporated Organisation registered in England and Wales. Charity number: 1165998 Registered address: The Mill Arts Centre, Spiceball Park Road, Banbury, OX16 5QE

Email: CSA@themillartscentre.co.uk

Postal: Box Office, The Mill Arts Centre, Spiceball Park Road, Banbury, OX16 5QE

3. The data we collect

We collect the following categories of personal data:

Information you provide directly

Name
Email address
Postal address
Telephone number
Payment information (processed securely; we never store full card numbers or security codes)
Ticket purchase history, bookings, donations
Account login details
Communication preferences

Information we collect automatically

Website usage data (pages visited, links clicked, device type, IP address)
Cookie data (see section 10)
Email engagement (opens, clicks)

Information from third parties

Ticketing partners or agencies (where you have booked our events elsewhere)
Publicly available sources (e.g., Companies House for donor due diligence)
Social media platforms (if you interact with us there)

Sensitive data

We do not routinely collect sensitive data. Where workshop or event participation requires us to know about access needs or health information, we will only collect this with your explicit consent.

Children’s data

We may collect information about children participating in classes or workshops. This is always done:

with parental/guardian consent
with enhanced safeguarding measures
with strict access controls

4. How we use your data

We use your personal information to:

Provide services

Process ticket purchases and workshop bookings
Contact you about changes, cancellations, or essential updates
Manage your account and purchase history

Communicate with you

Send marketing emails (with your consent)
Send postal marketing (legitimate interest, with opt‑out)
Provide fundraising information (consent or soft opt‑in)

Improve our services

Analyse attendance patterns
Improve our website and digital communications
Understand audience demographics and interests

Fundraising and donor stewardship

Process donations
Conduct due diligence on major gifts
Tailor fundraising communications (with consent or soft opt‑in)

Legal and administrative purposes

Comply with financial, tax, and charity regulations
Prevent fraud
Maintain security

5. Our lawful bases for processing

We rely on the following lawful bases under UK GDPR:

Contract

To deliver services you purchase or request (e.g., tickets, workshops).

Consent

email marketing
storing sensitive data
optional cookies. You can withdraw consent at any time.

Legitimate interests

email marketing (where soft opt-in applies) about performances or services that are similar to those you have seen/used in the past
postal marketing
audience analysis
fraud prevention
website improvement

We balance these interests against your rights.

Legal obligation

financial record‑keeping
reporting to regulators
safeguarding children and vulnerable adults

6. Marketing communications

Email marketing

We will only send you marketing emails if:

you have opted in, or
you purchased tickets and we are using the soft opt‑in for similar events, with a clear opt‑out at purchase.

Every email includes an unsubscribe link.

Postal marketing (legitimate interest)

You may receive postal updates unless you opt out.

Telephone marketing

We will only call you for marketing purposes with your explicit consent. Operational calls (e.g., event changes) do not require consent.

7. Profiling and automated decision‑making

We analyse:

your booking history
your engagement with emails
your interests

This helps us tailor communications and improve your experience. You can object to profiling at any time.

We do not envisage using automated decision making that has legal or significant effects.

8. Sharing your data

We may share your data with:

Service providers

Such as:

ticketing system providers
email platforms
payment processors
website analytics tools

These providers act under our instructions and must verify comliance with UK GDPR.

Visiting companies

If you attend a performance by a visiting company and we wish to share your details with them, we will ask for your explicit consent.

Legal or regulatory bodies

Where required by law.

We never sell your data.

9. International transfers

Some service providers may store data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as:

UK adequacy regulations
International Data Transfer Agreements (IDTAs)
Standard Contractual Clauses (SCCs)

10. Cookies and tracking

We use cookies to:

make our website function
keep track of your basket
understand how visitors use our site

Essential cookies

Required for the website to function. These do not require consent.

Analytics and marketing cookies

Used only with your consent. You can manage your cookie settings at any time via our cookie banner.

11. Data retention

We retain data only as long as necessary:

Ticketing and donation records: 6 years (legal requirement)
Customer accounts: 2 years of inactivity, then anonymised
Email marketing data: until you unsubscribe
Children’s data: retained only as required for safeguarding and legal compliance

We never keep personal data “indefinitely”.