Punchdrunk Enrichment takes your privacy seriously. We promise to respect any personal data you share with us and keep it safe.

This policy explains who we are, what information we collect, how and why we use it, how it is stored, how we fundraise, which partners we work with, and your rights with regards any information you share with us.

We promise to use the information we collect about you in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act (DPA), and the Privacy and Electronic Communications Regulations (PECR). We aim to be clear when we handle your personal data, and not do anything you would not reasonably expect.

By visiting www.punchdrunkenrichment.org.uk you are accepting and consenting to the practices described in this policy.

This privacy policy applies to our website visitors, customers, participants, supporters, visitors to our venue and office , job / paid opportunity applicants, community contacts, suppliers, and industry contacts.

Please read this information carefully, as by providing your data to us you acknowledge you have read this policy and understand we will process your data in accordance with its terms.

Who we are

Punchdrunk Enrichment, Unit 22 Watkin Road, Wembley, England, HA9 0NL is a charity registered in England and Wales (Charity number 1113741), and a company limited by guarantee (Company number 04547069) with a voluntary Board of Trustees.

Our wholly owned subsidiary is Punchdrunk Enrichment Productions Limited a registered company in England and Wales (Company number 07397742).

Punchdrunk Enrichment is the data controller (ICO Registration ZB554755).

For this policy, “we”, “us”, and “our” refers to Punchdrunk Enrichment.

Contact us

We welcome questions, comments, and requests about this privacy policy.

Email: data@punchdrunkenrichment.org.uk

Write to: Data Protection, Unit 22 Watkin Road, Wembley, England, HA9 0NL

Call: (0)20 7655 0940

Your personal data

What data do we collect?

We only collect information that is necessary to carry out normal business operations, to provide any goods or services you have asked for, to keep you updated about our current and future work, and to deliver our charitable objectives.

This is not an exhaustive list, and we may keep different types of information for different individuals based on the service we are providing.

Information we hold about you might include:

title, first name, and last name
your preferred pronouns
contact details including organisation/company name and job title (if appropriate), postal address, country of residence, email address, and telephone number(s)
if you are a teacher with whom we have professional relationship, your professional email, the name, address and telephone number of school/college, the type of school/college, and the subject and key stage taught
if you are a young person, we may collect the contact details (including name, address, email address and telephone number) of your parent/guardian
if you are a contractor, we may ask for details about your professional accreditation/qualifications
if you are a participant, we may collect the contact details (including name, address, email address and telephone number) of your emergency contact
if you are on site and an incident occurs, we will collect your name, address, email address and telephone number
if you are a job applicant, we may ask for details about your experience and qualifications
date of birth and age
transaction history, including billing and payment card information (including last four digits)
booking, transaction, and donation history
bank details (e.g., for invoicing purposes if you are a supplier)
Credit and Debit Card Details - we securely hold card details if you have provided them to us for the purpose of processing a regular donation
communications preferences
access requirements (for you or your party)
health, allergy, and dietary requirements (for you or your party) related to your booking / event attendance
qualitative opinions or attitudes about our services and programme through surveys
any other information you provide to us by email, letter, telephone, social media, via our websites, or in person
image and likeness (as captured on our CCTV cameras and in photographs and videos we may use for promotional purposes)
technical information gathered when you visit our website; including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform
information that is publicly available including social media handle

Sensitive personal data

Any data about children, disability, medical need, religion, political affiliation, sexuality, or ethnicity is treated as sensitive, and we take steps to ensure that any such information is only collected where necessary. We only collect sensitive data where we have gained your explicit consent, for example where you inform us about any access needs when making a booking or attending an event. It is subject to enhanced security measures, used only for the purposes agreed, and erased when no longer necessary.

As recorded above, this includes health information such as access needs (e.g., wheelchair access, audio description, BSL interpretation, captioned or any other access requirement) or allergy/dietary requirements.

We may ask for other sensitive personal information specific to a job or paid opportunity you are applying for, such as gender and ethnicity.

To help us with our diversity monitoring, we sometimes request sensitive personal data in our audience surveys. This data is optional to provide, is analysed anonymously, and not linked to individual customer records.

Online information

We receive and store certain details whenever you use our website. Your IP (internet protocol) address is automatically anonymised. We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements, and how best to tell our audiences about events and information they might be interested in. For more information see our Cookie Policy.

We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any later actions online, such as buying a ticket.

We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests. Depending on your settings or the privacy policies on social media and messaging services like Facebook, Instagram, LinkedIn, or X, you might give third parties (like Punchdrunk Enrichment) permission to access information from those accounts or services.

We use online tracking and analysis services such as Google Analytics to find out how our website is being used, which campaigning activities are working best, and how we can improve customer experience.

For certain marketing campaigns, you may receive personalised online advertising after visiting our website. For example, we work with agencies to create relevant advertising for future events, and this might be displayed based on your device’s IP address. Many of these online adverts allow a facility to opt-out completely or refine your preferences to make advertising more relevant to you.

How we collect your data

You give us personal information when you:
visit our website
buy a ticket, book a masterclass, or buy something from our website
create or update your Punchdrunk Enrichment Account on our website
sign up to receive marketing communications from us
sign up to one of our events
participate in a project
donate
join our Keyholder scheme or become a corporate partner
hire our venue
apply for a job or paid opportunity with us
supply goods or services to us
enter a competition, promotion, or survey
communicate with us by post, email, telephone, social media, via our websites, or in person

Data received from third parties

Your information may be shared with us by other organisations and websites but only when you have given your consent to hear from us. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

Why we collect your personal data and how we use it

Developing a good understanding of visitors, participants, ticket-buyers, and supporters through personal data allows us to make better business decisions enabling us to operate, market our services, and fundraise more efficiently. We believe this will help us reach our goal of ensuring everyone is welcome at Punchdrunk Enrichment.

We will use your information for the purposes listed below using one of the following lawful bases: performance of a contract; where we need to comply with a legal obligation; or when exercising our legitimate interests or those of a third-party.

Contract

To inform you of any change to or provide additional information about a booking, visit or membership.
To send you a gift (such as a gift voucher or membership) bought by another person.
To process payments

Legal Obligation

To ensure compliance with policies, procedures, and laws.
If we are requested by the police or a regulatory or government authority investigating illegal activities to provide information concerning your activities whilst using the network, we shall do so.
Similarly, we will disclose your personal information as part of a transaction whereby our company or business assets are transferred to a third party or if we are compelled to do so by law.

Legitimate Interests

We use legitimate interest to mange how we communicate with audiences.

Communicating with you about products or events that we believe may be of interest, including future shows, fundraising and our masterclass programme
Record who has given money or services to us so that we can tell them how their money has helped us and others, and to claim Gift Aid where possible.
Manage our organisation effectively and continually improve what we do.
Inform future programming of events including a better understanding of specific locations and tailoring work to specific audiences.
We conduct surveys and promotions and may request information from you as part of these. Participation in these is entirely voluntary and you therefore have a choice whether to disclose any information which might be required. We reserve the right to keep a record of survey data on our database.
To enable us to fundraise effectively because we are a charity.
To maintain the security of property and individuals using CCTV footage.
We will sometimes tell you about work from others, but we will not pass information we hold about you to them – unless you explicitly give us your permission.

Fundraising

As a registered charity we will use personal data to support fundraising activity and further Punchdrunk Enrichment’s charitable aims. This activity is undertaken to augment, update, and validate the data we hold and includes research based on publicly available information (such as that published on websites, via social media, The Charity Commission and Honours lists).

We are committed to fundraising best practice and abide by the Fundraising Regulator’s key principles and behaviours of a fundraising organisation: to be legal, open, honest, and respectful. We will follow relevant laws and regulations, including the Proceeds of Crime Act, Data Protection, Tax and Gift Aid legislation, and Charity Commission guidance. We will ensure that our fundraising communications are relevant to their audience and provide appropriate opportunities for people to support our work, should this form of engagement be of interest.

Sharing your data with third parties

Unless you give us your consent, we will only share your personal data with a third party where:

we are obliged or permitted by law to disclose it;
we need to use the services of ‘data processors’ to fulfil our contract with you; or
to support analysis and research for Punchdrunk Enrichment or the Arts Sector.

We have data processing agreements in place with each third party we share data with to ensure that your data is always secure and cannot be accessed or used for any other purpose.

We will not sell your personal data to any agencies or companies.

Instances where we may share your personal information with selected third parties include:

Contract: Business partners, suppliers, and sub-contractors for the performance of any contract we enter with them or you. In general, any third-party providers used by us to fulfil our contract with you will only collect, use, and disclose your information to the extent necessary to allow them to perform the services they provide to us, for example, our ticketing system Ticketsolve, To process a transaction, including a donation, your personal Information and card details may be passed to Stripe. Card details will only be used for the purpose of handling an individual transaction and cannot be accessed by Punchdrunk Enrichment past the initial transaction.

Legitimate interests: We may make data available to approved suppliers for analysis and research purposes, for example identifying sales trends, assessing campaign effectiveness, postcode mapping etc. This helps us with reporting and with our strategic planning, helping us apply our resources more intelligently. We use Google Analytics 4 to measure the performance of our website. All data is automatically anonymised. Anonymised website user information is shared with Google Signals.

How long we keep your data

We will keep your information for as long as is necessary to provide you with the services you have requested or require from us or to fulfil our contract with you, unless:

we must keep it to comply with applicable laws or evidence compliance with such applicable laws;

there is an outstanding issue, claim or dispute requiring us to keep such information until the issue, claim or dispute is resolved; or

the information must be kept for our legitimate business interests, such as fraud prevention and enhancing users’ safety and security.

We keep website analytics data for a maximum of 14 months.

We regularly review email and paper correspondence and minimise our storage through archiving and destruction of out-of-date materials. We will store data in our ticketing system for a maximum of ten years after your last transaction or communication with us.

We have considered the nature, relevance and volume of this data, the potential risks, and the purposes for which we process your data. We have also considered legal requirements including financial (e.g. Gift Aid declaration and reporting timescales).

For suppliers, we store data in our financial systems for seven years.

How we keep your data safe

We take every precaution to protect your information. We store all personal data on a server in a secure environment. Only employees and approved contractors/developers are given access to personally identifiable information. This will only be from time to time and only when they need to do a specific job or task.

We hold regular security reviews to ensure that the site is safe and secure for your protection.

Giving you control

Your individual rights

Under data protection law, you have rights including:

Your right of access: you have the right to ask us for copies of your personal information.
Your right to rectification: you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure: you have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing: you have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing: you have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
Your right related to automated decision-making including profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Where you have provided your consent to the collection, processing, and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us as set out at the beginning of this Privacy Policy. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to.

How to update your details

You can set and update your personal contact information and interest preferences at any time, by logging in to your account, emailing data@punchdrunkenrichment.org.uk or calling the Box Office on (0)20 7655 0940.

Each email we send has a link to unsubscribe. Alternatively, you can contact us via the details set out at the beginning of this Privacy Policy.

Unless you ask us not to, we will tell you about news, events, offers and opportunities to get involved with supporting Punchdrunk Enrichment.

If you are a supplier, you can update any of the business information we hold about you by contacting finance@punchdrunkenrichment.org.uk

How to request a copy of your data

If you wish to make a subject access request (SAR), please email data@punchdrunkenrichment.org.uk

Whilst you do not have to complete it, we will ask you to complete a SAR form. We will try to respond to all legitimate requests within 30 days. Occasionally it may take us longer if your request is particularly complex or if you have made several requests in which case, we will keep you notified and updated. We will need specific details and proof of identification. This is a free service though we reserve the right to charge for reasonable administrative costs if your request is clearly unfounded, repetitive, or excessive.

How to make a complaint

If you wish to make a complaint about how we are using your data, please email data@punchdrunkenrichment.org.uk

Where you take the view that your personal data is processed in a way that does not comply with the UK GDPR, you have a specific right to lodge a complaint with the relevant supervisory authority. The supervisory authority will then inform you of the progress and outcome of your complaint. The supervisory authority in the UK is the Information Commissioner’s Office (ICO).

If you are unhappy with how we are processing your personal data, you have the right to complaint to the ICO. You can contact them at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

https://ico.org.uk/concerns/

You also have the right to complain to the Fundraising Regulator. You can contact them at:

Fundraising Regulator

Eagle House

167 City Road

London

EC1V 1AW

Helpline number: 0300 999 3407

https://www.fundraisingregulator.org.uk/complaints/make-complaint

Changes to this policy

We may change or update this Privacy Policy from time to time. Any significant changes will be communicated on our website or by contacting you directly.

Updated July 2024