Privacy Policy
Last updated: [DATE OF PUBLICATION]
This privacy notice explains how Theatre Trips with Fiona collects, uses, shares and protects your personal information when you visit theatretripswithfiona.co.uk, book a trip, contact us or sign up to hear about future trips.
We are committed to protecting your privacy and to handling your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
Theatre Trips with Fiona ([LEGAL STATUS: e.g. "a sole trader" or "Theatre Trips with Fiona Ltd, registered in England and Wales, company number 00000000"]) is the "data controller" for the personal information described in this notice. That means we decide how and why your information is used.
- Website: https://theatretripswithfiona.co.uk
- Email: fiona@theatretripswithfiona.co.uk
- Telephone: 07989 293 954
- Postal address: [POSTAL ADDRESS FOR DATA PROTECTION ENQUIRIES]
- ICO registration number: [ICO REGISTRATION NUMBER, OR DELETE THIS LINE]
We are not required to appoint a Data Protection Officer. Fiona is responsible for data protection and can be reached using the details above.
2. Information we collect
2.1 Information you give us
| When you | We collect |
|---|---|
| Book a trip | Your name, email address, telephone number, billing address, the trip and ticket option chosen, the number of seats, your chosen pick-up point, the names of other people in your party where you provide them, and any notes you add to your booking. |
| Pay for a trip | Payment card or account details are entered directly with our payment provider. We receive confirmation of payment, the amount, the date and a partial card reference. We do not store your full card number. |
| Tell us about access or dietary needs | Details of mobility, accessibility, medical or dietary requirements you choose to share so that we can arrange suitable seating, coach access or venue assistance. This can include information about your health, which is treated as "special category" data (see section 4). |
| Give us an emergency contact | The name and telephone number of the person you nominate. Please make sure that person is happy for you to share their details with us. |
| Create an account on the site | Your name, email address, password (stored in encrypted form) and your order history. |
| Use the contact form or email or call us | Your first name, last name, email address and the content of your message, together with any further correspondence. |
| Sign up for trip announcements | Your name and email address, and a record of your consent. |
| Leave a review or testimonial | Your name, the town you travel from if you give it, your review, and a record of your consent to it being published. Reviews are only published where that consent has been given. |
2.2 Information we collect automatically
When you visit the website we and our service providers may collect your IP address, browser type and version, device type, operating system, the pages you view, the date and time of your visit and the site you arrived from. This is collected through cookies and similar technologies, described in section 6.
2.3 Information from other sources
We may receive information about you from our payment provider (to confirm a payment or a refund), from theatres and coach operators (for example about a cancelled performance affecting your booking), and from our website hosting and security providers.
3. How we use your information, and our lawful bases
We must have a lawful basis for using your personal information. Ours are set out below.
| Purpose | Lawful basis |
|---|---|
| Taking and managing your booking, allocating seats and pick-up points, issuing tickets and confirmations, and dealing with changes, cancellations and refunds | Performance of a contract with you |
| Taking payment and preventing fraudulent transactions | Performance of a contract, and our legitimate interests in protecting the business from fraud |
| Sharing passenger lists with coach operators and, where required, name lists with theatres | Performance of a contract with you |
| Answering your enquiries | Our legitimate interests in responding to people who contact us, or steps taken at your request before entering a contract |
| Sending you emails about upcoming trips | Your consent, or our legitimate interests where you have booked with us before and we are telling you about similar trips (the "soft opt-in" under PECR). You can opt out at any time. |
| Publishing a review or testimonial you have submitted | Your consent |
| Meeting accessibility, dietary or medical needs on a trip | Your explicit consent (see section 4) |
| Contacting an emergency contact if something happens on a trip | Protecting someone's vital interests, and our legitimate interests in passenger safety |
| Keeping the website secure, preventing spam and fixing faults | Our legitimate interests in running a safe and working website |
| Understanding how the website is used through analytics | Your consent, given through our cookie banner |
| Keeping accounting and tax records, and handling complaints or legal claims | Compliance with a legal obligation, and our legitimate interests in defending claims |
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and we have concluded that they are not. You can ask us for more detail about that assessment, and you have the right to object (see section 9).
4. Health, accessibility and dietary information
Information about your health, mobility or disability is "special category" personal data and is given extra protection by law. We only collect it where you choose to tell us, and only so that we can make your trip work for you: booking an accessible seat, arranging step-free access at a venue, letting the coach driver know that assistance is needed, or passing a dietary requirement to a venue where a meal is included.
We rely on your explicit consent to use this information, and we share it only with the coach operator or venue that needs it in order to make the arrangement. You can withdraw your consent at any time by contacting us, although we may then be unable to guarantee the arrangement you have asked for.
5. Who we share your information with
We never sell your personal information. We share it only where it is needed, with:
- Coach and transport operators we book for a trip, so that they have the passenger list, seat numbers, pick-up points and any assistance requirements.
- Theatres and venues, where the venue requires a name list, requires access arrangements to be notified in advance, or holds tickets for collection.
- Our payment provider, [PAYMENT PROVIDER, e.g. Stripe Payments UK Ltd and/or PayPal (Europe) S.a r.l. et Cie SCA], which processes your card or account payment. Their own privacy notice applies to how they use your details.
- Our website host and technical suppliers, [WEB HOST NAME], who store the site and its database and provide backups and security.
- Our email provider, [EMAIL / MARKETING PROVIDER, e.g. Mailchimp, Brevo, Google Workspace], which sends booking confirmations and, where relevant, trip announcements.
- Our accountant and professional advisers, where needed for bookkeeping, tax or legal advice.
- Public authorities, insurers or the police, where we are legally required to disclose information or need to establish or defend a legal claim.
Everyone who processes personal information on our behalf does so under a written contract that requires them to keep it secure and to use it only for the purposes we specify.
6. Cookies and similar technologies
Cookies are small files stored on your device. We use:
- Strictly necessary cookies, which make the site work. These keep the contents of your basket, remember you through checkout, keep you signed in to your account, protect forms against spam and remember your cookie choices. These do not require your consent because the site cannot function without them.
- Analytics cookies, which tell us how many people visit, which trips they look at and where visitors come from, so we can improve the site. [ANALYTICS TOOL, e.g. Google Analytics 4, OR DELETE THIS BULLET IF NONE IS USED.] These are only set if you accept them.
- Embedded content. Some pages include content from other sites, such as video players, maps or Facebook. Those sites may set their own cookies and track your interaction with that content as if you had visited them directly.
You can accept or reject non-essential cookies using the banner shown on your first visit, and change your choice at any time via [LINK OR MECHANISM FOR CHANGING COOKIE SETTINGS]. You can also block or delete cookies through your browser settings, although parts of the site, including booking, may then stop working.
7. Where your information is stored
We aim to keep your information within the UK and the European Economic Area. Some of our suppliers, particularly email, analytics and hosting providers, may store or access data outside the UK. Where that happens, we make sure the transfer is protected by one of the safeguards allowed under UK data protection law, such as UK adequacy regulations covering the country concerned, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards that apply.
8. How long we keep your information
| Information | Retention period |
|---|---|
| Booking, order and payment records | 7 years from the end of the tax year in which the trip took place, to meet HMRC record keeping requirements |
| Passenger lists and pick-up allocations for a specific trip | Deleted within [3] months of the trip, other than the underlying order record above |
| Accessibility, medical and dietary information | Deleted within [3] months of the trip unless you ask us to keep it on file for future bookings |
| Emergency contact details | Deleted within [3] months of the trip |
| Website account details | For as long as your account is open, and for [12] months after you last log in or ask us to close it |
| Enquiries and correspondence | [24] months from our last contact with you |
| Marketing list details | Until you unsubscribe, and then a minimal record of your unsubscribe so that we do not contact you again |
| Published reviews and testimonials | Until you ask us to remove them |
| Website server and security logs | [12] months |
Where we no longer need your information we delete it securely, or anonymise it so that it can no longer identify you.
9. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your information, which is the purpose of this notice.
- Access a copy of the personal information we hold about you.
- Rectification, meaning correction of information that is inaccurate or incomplete.
- Erasure of your information where there is no good reason for us to continue holding it.
- Restrict processing of your information in certain circumstances, for example while we check its accuracy.
- Data portability, meaning a copy of information you gave us in a machine readable format, where we rely on consent or contract and process it electronically.
- Object to processing based on our legitimate interests. You can object to direct marketing at any time and we will always stop.
- Withdraw consent at any time where we rely on it, without affecting anything done before you withdrew it.
- Not be subject to automated decision making that has a legal or similarly significant effect. We do not carry out any such automated decision making or profiling.
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. That period can be extended by up to two further months for complex requests, and we will tell you if that applies. There is normally no charge. We may need to verify your identity before acting on a request.
To stop receiving trip emails, use the unsubscribe link at the bottom of any email or simply reply asking to be removed.
10. Security
We take appropriate technical and organisational measures to protect your information, including encryption of the website using HTTPS, access controls and strong passwords on the systems we use, restricting access to booking data to those who need it, keeping software and plugins up to date, and taking regular backups. No transmission over the internet can be guaranteed to be completely secure, but we will notify you and the Information Commissioner's Office where a personal data breach is likely to result in a risk to your rights and freedoms.
11. Children
Our trips and this website are intended for adults. We do not knowingly collect information from children under 13, and bookings that include a child should be made by a parent, guardian or responsible adult, who provides that child's details to us. If you believe a child has given us their information directly, please contact us and we will delete it.
12. Links to other websites
Our site contains links to theatres, venues, coach operators and social media. We are not responsible for the privacy practices of those sites, and we encourage you to read their own privacy notices.
13. Changes to this notice
We may update this notice from time to time, for example if we change the systems we use. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will tell you directly.
14. How to complain
If you are unhappy with how we have handled your personal information, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF