Alexandra Palace is committed to protecting your privacy. We will use the information that we collect about you in accordance with, the Privacy and Electronic Communications Regulations 2003, the Data Protection Act 1998 (DPA) and any replacement laws, and, from May 2018, the General Data Protection Regulation (GDPR).
Who we are
What information do we collect?
If you fail to provide personal information
How do we collect your information?
Third party organisations
Information available publicly
How we keep your details safe and secure
Our basis for processing your personal information and what we use it for
Alexandra Palace as a charity/fundraising
Other processing activities
Disclosure of your details to third parties
Alexandra Park and Palace Charitable Trust is a registered charity. Charity Registration Number: 281991
Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, i.e. anonymous data.
We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. This also includes us making a note of conversations we have had with you in person and/or communications you sent to Alexandra Palace. This helps us to manage our relationship with you and ensures you only receive communications from us that are relevant and timely.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a ticket). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
You give us your information when you buy a ticket, make a purchase from a retail outlet, sign up for one of our events, update your preferences on our website, tell us your story, make a donation, apply for a job, or communicate with us. We also keep your details when you sign up to receive emails from us.
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any subsequent actions online, such as buying a ticket.
Like most websites, we receive and store certain details whenever you use the Alexandra Palace website. We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events they might be interested in.
We may also receive information from external sources which enables us to gain a better understanding of our audiences, visitors and supporters and to improve our fundraising and marketing methods. These sources include:
We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests.
Depending on your settings and the privacy policies used by social media and messaging services like Facebook, Instagram or Twitter, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.
This may include information found in places such as Companies House your biography on your work website or information that has been published in articles/ newspapers.
Your personal data will be held and processed on Alexandra Palace’s systems or systems managed by suppliers on behalf of Alexandra Palace. We always seek to hold your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.
We aim to be clear when we collect your data and not to do anything you wouldn’t reasonably expect.
We may process your personal data because it is necessary for the performance of a contract. For example, if you make a purchase, sign up for an event or give a donation.
We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful, and never excessive. To do this, we use data that we have stored about you, such as which events you have booked for in the past, as well as any contact preferences you may have told us about.
We use our legitimate organisational interest as the legal basis for communications by post and email. In the case of postal mailings, you may opt out of receiving these at any time using the contact details at the end of this policy.
In the case of email, we will provide you with an option to unsubscribe in every email that we send you. Alternatively, you can use the contact details at the end of this policy or update your contact preferences in your online account with us.
In the instance of an email exchange with Alexandra Palace, any emails with your personal data will be kept, appropriate for the length of engagement with you. Your details will not be automatically added to a database.
As part of our service to you, we may contact you by email or telephone to provide essential information related to your purchase and visit.
We may process personal data because it is in our legitimate interests to do so. For example we may use your personal information to understand your reasons for donating to us, to better understand your interests, to carry out screening on potential donors and to conduct due diligence on major donors (please also see the section below on Fundraising), to tailor our communications to you and/or to give you an exceptional experience at our events.
We may also collect information about how you use our services (including our website) to analyse our customer base and improve our processes. Alexandra Palace also records and uses film, photographs and audio for promotional purposes on its website, social media accounts and other formats under its legitimate interests basis for processing where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use).
We may also process your personal data (including sensitive personal data) where:
Alexandra Park and Palace Charitable Trust is registered with the Charity Commission in England and Wales (registration number: 281991) and is registered with The Fundraising Regulator. We ask for philanthropic support in order to help us carry out our charitable purposes.
We are grateful for the support we receive and many of our supporters tell us that they want to hear from Alexandra Palace about information, events and updates that are of interest to them.
You can opt in to receive information about supporting Alexandra Palace by opting into receive information from us on our website or by talking to one of our team. You can also get in touch by emailing email@example.com and can change your preferences at any time.
We use third party providers to process some donations, such as Pay Pal and Just Giving. We work with these providers because they provide secure online financial transaction facilities. Use of these services is covered by their own privacy policies. Alexandra Palace does not keep any card details for our supporters.
Under our legitimate organisational interest, we may contact you by post, or occasionally by telephone, to seek your support for our charitable activities. Additionally, and only if you have given your consent, we may contact you by email to ask for your support.
To read more about our Fundraising Policy, please click here.
To ensure that our communications are relevant to you and your interests and to assess your likely ability to make, and interest in making, donations to Alexandra Palace, we will use information that you have provided to us.
We may combine this with publicly available information about you such as geographical information and measures of affluence where available from external sources to assist us, and publicly available data from social media sites, in order to help us communicate in a relevant way with you.
We may use profiling techniques or third-party organisations to provide us with information about you that will help us to communicate in a relevant way with you, in particular when we are approaching you about potential philanthropic support. Such information is compiled using publicly available data about you.
You have the right to object to any of this processing at any time. If you wish to do this, please use the contact details at the end of this policy or email firstname.lastname@example.org
Please note however that before seeking or accepting major donations we are required to conduct a minimum level of due diligence, including reviewing publicly available personal data. The way in which we will do this is set out in our Fundraising Policy.
There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:
We do not sell personal details to third parties for any purpose.
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard (https://www.pcisecuritystandards.org/pci_security/).
We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will ensure that any third parties we use for processing your personal information do the same and that they will only process your personal information on our instructions. The third parties will also be subject to a duty of confidentiality.
We will not transfer, process or store your data anywhere that is outside of the European Economic Area, unless we have a contractual agreement in place that is of an equivalent standard to GDPR.
Under the DPA you have the following rights:
Once the GDPR takes effect in May 2018, you will also have the following additional rights:
Please note that these rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Email us at email@example.com
Or write to us at: Data Controller, Customer Services, Alexandra Palace, Alexandra Palace Way, London, N22 7AY