Privacy Policy
Last updated: January 2026
Alexandra Park and Palace Charitable Trust (“Alexandra Palace”, “we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy.
This Privacy Notice explains how we collect, use, store and share your personal data, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
WHO WE ARE
Alexandra Park and Palace Charitable Trust is the data controller responsible for your personal data.
Registered charity number: 281991
Address: Alexandra Palace, Alexandra Palace Way, London N22 7AY
Email: support@alexandrapalace.com
If you have any questions about this Privacy Notice or how we use your data, please contact us using the details above.
HOW WE USE PERSONAL DATA
Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, i.e. anonymous data.
We collect personal data directly from you, from third parties, and automatically through your use of our website.
The categories of individuals whose data we process include:
- Visitors and event attendees
- Donors and supporters
- Venue hire customers, suppliers and business contacts
- Website users
Visitors to Alexandra Palace (including event attendees)
- What information we collect
- Your name and contact details
- Ticket and booking details
- Payment information (handled securely by payment providers)
- Information about how you use our website
- CCTV images and incident records when you are on site
- Any accessibility or medical information you choose to share with us
- Photographs or video footage taken at events
Why we use this information and our legal reasons
- To sell tickets and manage bookings – we will to it is needed to provide the service you have booked (Performance of a contract under Article 6 UK GDPR)
- To provide customer support before, during and after your visit – we will to it is needed to provide the service you have booked (Performance of a contract under Article 6 UK GDPR)
- To keep visitors, staff and performers safe and CCTV monitoring – we will do it as we have legal responsibilities to keep people safe (Legal obligation under Article 6 UK GDPR) and because we have a genuine reason to run and improve Alexandra Palace in a responsible way (Legitimate interests under Article 6 UK GDPR)
- To meet health and safety and licensing requirements – because we have legal responsibilities to keep people safe (Legal obligation under Article 6 UK GDPR)
- To improve our events, venues and website – because we have a genuine reason to run and improve Alexandra Palace in a responsible way (Legitimate interests under Article 6 UK GDPR)
- Marketing (email and SMS) – we obtained consent from you (where required under PECR)
- To promote Alexandra Palace using photos and video taken at events – Because we have a genuine reason to run and improve Alexandra Palace in a responsible way (Legitimate interests under Article 6 UK GDPR)
Photography and Filming
We may take photographs or film footage at events for promotional purposes. Signage will inform you when filming is taking place. You may object at any time.
- Special category data (article 9 UK GDPR)
Sometimes we may need to use sensitive information, such as medical or accessibility details, or CCTV images linked to an incident. We only do this when it is needed in an emergency or it is necessary for public safety.
Where we process medical or accessibility information, we rely on:
- Article 9(2)(c) – vital interests (emergency situations)
- Article 9(2)(g) – substantial public interest (safeguarding and safety)
- Article 9(2)(a) – explicit consent (where appropriate)
We only collect such information where necessary and proportionate.
- Donors and supporters
- What information we collect
- Your name and contact details
- Records of donations and support
- Your communication preferences
- Limited publicly available information (for example, location or professional background)
Why we use this information and our legal reasons
- To process your donation and provide receipts or acknowledgements – we will do this because it is needed to process your donation and provide the service you expect (Performance of a contract under Article 6(1)(b) UK GDPR)
- To administer Gift Aid and keep appropriate financial records – we will do this because we must meet charity law, HMRC and financial reporting requirements (Legal obligation under Article 6(1)(c) UK GDPR)
- To respond to your enquiries and manage our relationship with you as a supporter – we will do this because we have a genuine reason to manage our charitable activities effectively and maintain appropriate supporter records (Legitimate interests under Article 6(1)(f) UK GDPR)
- To keep in touch about our work and future fundraising activities by post – we will do this because we have a genuine reason to promote our charitable purposes and fundraising activities (Legitimate interests under Article 6(1)(f) UK GDPR). You have the right to object to this at any time.
- To send you fundraising communications by email or SMS – we will only do this where you have given us your consent (Consent under Article 6(1)(a) UK GDPR and in accordance with the Privacy and Electronic Communications Regulations (PECR)). You can withdraw your consent at any time.
- To analyse donations and supporter engagement to improve our fundraising approach – we will do this because we have a genuine reason to develop and sustain our charitable income in a responsible and effective way (Legitimate interests under Article 6(1)(f) UK GDPR)
- To carry out proportionate due diligence checks on significant donations – we will do this because we must comply with charity law and regulatory guidance (Legal obligation under Article 6(1)(c) UK GDPR) and because we have a genuine reason to protect the charity from financial crime, reputational harm or regulatory breach (Legitimate interests under Article 6(1)(f) UK GDPR)
- Where due diligence involves reviewing publicly available information that may reveal sensitive personal data (for example political associations) – we will only do this where it is necessary for reasons of substantial public interest, such as preventing unlawful acts or protecting the public from dishonesty (Article 9(2)(g) UK GDPR and Schedule 1 of the Data Protection Act 2018)
- If you voluntarily provide sensitive information (for example for diversity monitoring purposes) – we will only use this with your clear permission (Explicit consent under Article 9(2)(a) UK GDPR)
We do not routinely ask donors to provide special category personal data (such as information about health, ethnicity, religion or political views). However, in limited circumstances, we may process special category data:
- If you voluntarily provide it to us (for example for diversity monitoring purposes) – we will only use this with your clear permission (Explicit consent under Article 9(2)(a) UK GDPR).
- As part of proportionate fundraising due diligence on significant donations, where publicly available information may reveal matters such as political associations or regulatory findings – we will only do this where it is necessary for reasons of substantial public interest, such as preventing unlawful acts, protecting the charity from financial crime, or safeguarding our reputation (Article 9(2)(g) UK GDPR and Schedule 1, Part 2 of the Data Protection Act 2018).
We will only process such information where it is necessary and proportionate, and decisions will not be based solely on automated processing.
Fundraising due diligence
In some circumstances, we are required to carry out due diligence checks on significant donations in order to comply with the Fundraising Regulator’s Code of Practice and to protect the charity’s reputation and integrity. This may involve reviewing publicly available information about donors or individuals connected with organisations, including professional roles, business interests, and relevant media coverage. In limited cases, this may include information relating to political associations, regulatory matters, or publicly reported legal issues. We do this only where necessary and proportionate, and decisions are always made by people rather than through automated systems. Further information about how we carry out fundraising due diligence, including the lawful bases we rely on and your rights, is available in our Fundraising Due Diligence Privacy Information (link here).
III. Customers and clients (such as venue hires, suppliers and business partners)
What information we collect
- Names and contact details
- Business contact information
- Payment and contract details
- Emails and other communications
Why we use this information and our legal reasons
- To negotiate, enter into and manage contracts (including venue hire agreements and supplier contracts) – we will do this because it is needed to enter into or carry out a contract with you (Performance of a contract under Article 6(1)(b) UK GDPR)
- To provide services and respond to enquiries relating to venue hire, partnerships or supply arrangements – we will do this because it is needed to carry out a contract or to take steps before entering into a contract (Performance of a contract under Article 6(1)(b) UK GDPR)
- To manage payments, invoices, credit control and accounts – we will do this because it is needed to carry out a contract (Performance of a contract under Article 6(1)(b) UK GDPR) and because we must meet financial reporting and tax obligations (Legal obligation under Article 6(1)(c) UK GDPR)
- To comply with legal and regulatory requirements, including charity law, tax law, health and safety and audit requirements – we will do this because we must meet our legal responsibilities (Legal obligation under Article 6(1)(c) UK GDPR)
- To maintain appropriate business records and manage day-to-day business relationships – we will do this because we have a genuine reason to operate and administer Alexandra Palace effectively and responsibly (Legitimate interests under Article 6(1)(f) UK GDPR)
- To protect Alexandra Palace from financial loss, fraud or misuse of our services – we will do this because we have a genuine reason to protect our organisation and charitable assets (Legitimate interests under Article 6(1)(f) UK GDPR).
LEAD FORMS AND CAMPAIGNS
Sometimes we run advertising campaigns, competitions or sign-up forms on social media platforms, particularly LinkedIn, TikTok, Meta and Google. If you choose to fill in a form on one of these platforms, we may receive information such as:
- Your name
- Email address
- Telephone number
- Postcode
- Marketing preferences
- Any other information you provide
We may use this information to:
- contact you about the campaign, event or competition;
- provide what you have requested;
- administer competitions or prize draws
- send marketing messages, where you have agreed to receive them
How the platforms use your data
When you use social media platforms, they also collect and use your personal information for their own purposes. This is controlled by their own privacy policies and procedures. We encourage you to read the privacy policies of the platforms you use.
OUR LEGITIMATE INTERESTS:
Where we rely on legitimate interests, these include:
- Operating and improving Alexandra Palace
- Promoting our charitable purposes
- Ensuring visitor safety
- Communicating in ways people reasonably expect
- Social media engagement
You have the right to object to processing based on legitimate interests.
IF YOU FAIL TO PROVIDE PERSONAL INFORMATION
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a ticket). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
HOW DO WE COLLECT YOUR INFORMATION?
You give us your information when you buy a ticket, make a purchase from a retail outlet, sign up for one of our events, update your preferences on our website, tell us your story, make a donation, apply for a job, or communicate with us. We also keep your details when you sign up to receive emails from us.
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any subsequent actions online, such as buying a ticket.
Like most websites, we receive and store certain details whenever you use the Alexandra Palace website. We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events they might be interested in.
We may also obtain personal information about you from other sources, such as if a family member or friend contacts us on your behalf. Where this occurs and it is not practical for us to provide you directly with a copy of our privacy policy, we may ask the person who provided us with your information to make this privacy policy available to you.
We may also receive information from external sources which enables us to gain a better understanding of our audiences, visitors and supporters and to improve our fundraising and marketing methods. These sources include:
Third party organisations
We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests.
Depending on your settings and the privacy policies used by social media and messaging services like Facebook, Instagram or Twitter, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.
Please see our Cookies Policy page for more information.
YOUR RIGHTS
You have rights over how your personal information is used. These rights apply under UK data protection law. You have the right to:
- Ask for a copy of your personal information: You can ask us what personal information we hold about you and receive a copy of it.
- Ask us to correct information: If you think the information we hold about you is wrong or incomplete, you can ask us to fix it.
- Ask us to delete your information: In some situations, you can ask us to delete your personal information.
- Ask us to limit how we use your information: You can ask us to pause or restrict how we use your personal information in certain circumstances.
- Object to how we use your information: You can object to us using your personal information where we rely on our own interests, including for fundraising or marketing.
- Withdraw your consent: If we are using your information because you have given consent, you can withdraw that consent at any time.
- Ask for your information to be transferred: You can ask us to provide the personal information you gave us in a format that allows you to pass it to another organisation, where this applies.
- Ask us to stop sending you marketing: You can tell us at any time if you no longer want to receive marketing communications from us.
Please note that these rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you wish to do this, please use the contact details at the end of this policy or email support@alexandrapalace.com
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. You can contact them by calling 0303 123 1113 or online at www.ico.org.uk/concerns
DISCLOSURE OF YOUR DETAILS TO THIRD PARTIES
There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:
- To our service providers who process data on our behalf and on our instructions (for example our ticketing system software provider). We require all third parties to respect the privacy of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.
- Where we are under a duty to disclose your personal information in order to comply with any legal obligation or where there is a legitimate interest that permits us to share your personal information (for example to government bodies and law enforcement agencies for public safety and security purposes).
- For some events, we work with external organisers. If we need to share your personal information with a specific event organiser, we will only do this with your clear permission.
- We may share information that has been anonymised (so it cannot be linked back to you) with other organisations. This helps us understand our audiences, ticket sales and income and improve our services.
We do not sell personal details to third parties for any purpose.
RESTRICTED TRANSFERS
We mainly keep and use your personal information within the UK. If we ever need to transfer your personal information outside the UK, we will only do so where appropriate protections are in place. This means we will make sure there are legal safeguards to protect your information to the same standard as UK data protection law. These safeguards may include:
- A decision by the UK government that the country provides an adequate level of data protection, or
- A legally approved contract that requires the recipient to protect your information properly
We will not transfer your personal information outside the UK unless these protections are in place.
DATA SECURITY
Your debit and credit card information
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard (https://www.pcisecuritystandards.org/pci_security/).
Security of your personal information
We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will ensure that any third parties we use for processing your personal information do the same and that they will only process your personal information on our instructions. The third parties will also be subject to a duty of confidentiality.
AUTOMATED DECISION-MAKING
Automated decision-making takes place when a system uses personal information to make a decision without human involvement. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making unless we have a lawful basis for doing so and we have notified you. We do not envisage that any decisions will be taken about you by automated means, however we will notify you if this position changes.
DATA RETENTION
We only retain your personal data for as long as necessary or unless required to do so by law. You can ask us for more information about how long we keep different types of data by contacting: support@alexandrapalace.com.