Privacy Policy
Alexandra Palace is committed to protecting your privacy. We will use the information that we collect about you in accordance with, the Privacy and Electronic Communications Regulations 2003, the Data Protection Act 1998 (DPA) and any replacement laws, and, from May 2018, the General Data Protection Regulation (GDPR).
It is important that you read this Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using your personal information. This privacy policy supplements our other policies and is not intended to override them.
WHO WE ARE
Alexandra Park and Palace Charitable Trust is a registered charity. Charity Registration Number: 281991
WHAT INFORMATION DO WE COLLECT?
Personal information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, i.e. anonymous data.
We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:
- Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
- Contact Data includes billing address, delivery address, email address and telephone numbers.
- Financial Data includes bank account and payment card details.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
- Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
- Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
- Usage Data includes information about how you use our website, products and services.
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. This also includes us making a note of conversations we have had with you in person and/or communications you sent to Alexandra Palace. This helps us to manage our relationship with you and ensures you only receive communications from us that are relevant and timely.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal information but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
IF YOU FAIL TO PROVIDE PERSONAL INFORMATION
Where we need to collect personal information by law, or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with a ticket). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
HOW DO WE COLLECT YOUR INFORMATION?
You give us your information when you buy a ticket, make a purchase from a retail outlet, sign up for one of our events, update your preferences on our website, tell us your story, make a donation, apply for a job, or communicate with us. We also keep your details when you sign up to receive emails from us.
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any subsequent actions online, such as buying a ticket.
Like most websites, we receive and store certain details whenever you use the Alexandra Palace website. We use “cookies” to help us make our site – and the way you might use it – better. Cookies mean that a website will remember you and enable online transactions. It also helps us understand how you use our website, where we can make improvements and how best to tell our audiences about events they might be interested in. Fireworks.london and Kaleidoscope-festival.com are subsidiaries of Alexandra Palace and information is shared between websites.
We may also obtain personal information about you from other sources, such as if a family member or friend contacts us on your behalf. Where this occurs and it is not practical for us to provide you directly with a copy of our privacy policy, we may ask the person who provided us with your information to make this privacy policy available to you.
We may also receive information from external sources which enables us to gain a better understanding of our audiences, visitors and supporters and to improve our fundraising and marketing methods. These sources include:
Third party organisations
We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests.
Depending on your settings and the privacy policies used by social media and messaging services like Facebook, Instagram or Twitter, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.
We use social media to broadcast messages and updates about events and news. On occasion we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests.
Depending on your settings and the privacy policies used by social media and messaging services like Facebook, Instagram or Twitter, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.
Information available publicly
This may include information found in places such as Companies House your biography on your work website or information that has been published in articles/ newspapers.
Cookies
| Cookie Name | Cookie Purpose |
|---|---|
| AP GA4 Init Configuration | Collects both website and app data to better understand the customer journey Uses event-based data instead of session-based Includes privacy controls such as measurement, and behavioral and conversion modeling Predictive capabilities offer guidance without complex models Direct integrations to media platforms help drive actions on alexandrapalace.com |
| Main Site – Kaleidoscope | Sends user data analytics to Google Analytics when they visit this URL “https://alexandrapalace.com/whats-on/kaleidoscope-festival/” |
| CNV Spektrix Purchase Thankyou | Sends data to our ticket payment provider Spektrix when an order is completed |
| Google Ads – All Page Views | Sends user data analytics to Google Ads when they visit this URL “https://fireworks.london/” |
| Call Tracking – Venue Hire | Sends user data analytics to Google Ads when they visit this URL “https://alexandrapalace.com/venue-hire/our-spaces/” |
| Google Ads – CNV Spektrix | Sends user data analytics to Google Ads when they visit this URL Contains“secure/checkout/v2/orderconfirmation |
| Google Ads – Homepage | Sends user data analytics to Google Ads when they visit this URL matches RegEx“^https?://fireworks.london/?(?.*)?$” |
| Google Ads – Remarketing | Sends user data analytics to Google Ads when they visit any page on the website. |
| Google Ads – Submit Form | Sends user data analytics to Google Ads when an user submits a venue hire form. |
| Google Ads CNV See Ticket Thanks | Sends user data analytics to Google Ads when an user purchases a ticket |
| Google Ads-MCC CNV SeeTickets Thanks | Sends user data analytics to Google Ads when an user purchases a ticket |
| Google Analytics Universal Analytics | Sends user data analytics to Universal Analytics when they visit any page on the website. |
| Google Conversion Linker | Sends user data analytics to Google Analytics when they visit any page on the website. |
| Meta Pixel ID 760040058691383 | Sends user data analytics to Facebook when users visit any page on the website |
| CookieDetection | Used to identify whether cookies can be set. |
| ReturningCustomerCookie | Used to recognise return users. |
| SessionID | Used to distinguish users. |
| ASPXAUTH | Used to authenticate a logged in customer |
| SpektrixClientName | Used to distinguish Spektrix client systems. |
| QueueNumber | Used to record the user’s place when queuing for tickets |
| Google Analytics | Spektrix iframes may include Google Analytics cookies. |
Security information
We are committed to public safety at our venues and events. From time to time, we receive personal information from the police and other law enforcement agencies for the purposes of preventing and detecting offences.
HOW WE KEEP YOUR DETAILS SAFE AND SECURE
Your personal data will be held and processed on Alexandra Palace’s systems or systems managed by suppliers on behalf of Alexandra Palace. We always seek to hold your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.
OUR BASIS FOR PROCESSING YOUR PERSONAL INFORMATION AND WHAT WE USE IT FOR
We aim to be clear when we collect your data and not to do anything you wouldn’t reasonably expect.
We may process your personal data because it is necessary for the performance of a contract. For example, if you make a purchase, sign up for an event or give a donation.
We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful, and never excessive. To do this, we use data that we have stored about you, such as which events you have booked for in the past, as well as any contact preferences you may have told us about.
We use our legitimate organisational interest as the legal basis for communications by post and email. In the case of postal mailings, you may opt out of receiving these at any time using the contact details at the end of this policy.
In the case of email, we will provide you with an option to unsubscribe in every email that we send you. Alternatively, you can use the contact details at the end of this policy or update your contact preferences in your online account with us.
In the instance of an email exchange with Alexandra Palace, any emails with your personal data will be kept, appropriate for the length of engagement with you. Your details will not be automatically added to a database.
As part of our service to you, we may contact you by email or telephone to provide essential information related to your purchase and visit.
We may process personal data because it is in our legitimate interests to do so. For example we may use your personal information to understand your reasons for donating to us, to better understand your interests, to carry out screening on potential donors and to conduct due diligence on major donors (please also see the section below on Fundraising), to tailor our communications to you and/or to give you an exceptional experience at our events.
If you buy a ticket or sign up to attend one of our events, we may process your personal data for safety and security purposes if it is in our legitimate interests to do so (or the legitimate interests of a third party such as the police) or if it is necessary for us to comply with a legal obligation to which we are subject (for example, health and safety law or our obligations under the Licensing Act 2003 to prevent crime and disorder and ensure public safety). If we process any sensitive personal data (including criminal offence data) for these purposes, we will ensure the processing is necessary for reasons of substantial public interest.
We may also collect information about how you use our services (including our website) to analyse our customer base and improve our processes. Alexandra Palace also records and uses film, photographs and audio for promotional purposes on its website, social media accounts and other formats under its legitimate interests basis for processing where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use).
We may also process your personal data (including sensitive personal data) where:
- it is necessary for medical purposes (for example, in a medical emergency)
- it is necessary to protect your or another person’s vital interests
- we have your consent to do so (for example to monitor the diversity of visitors to Alexandra Palace).
- We will also ask for your consent to provide you with information about products and services and fundraising activities which may be of interest to you (apart from where it is appropriate for us to rely on our legitimate interests to do so).
ALEXANDRA PALACE AS A CHARITY/FUNDRAISING
Alexandra Park and Palace Charitable Trust is registered with the Charity Commission in England and Wales (registration number: 281991) and is registered with The Fundraising Regulator. We ask for philanthropic support in order to help us carry out our charitable purposes.
We are grateful for the support we receive and many of our supporters tell us that they want to hear from Alexandra Palace about information, events and updates that are of interest to them.
You can opt in to receive information about supporting Alexandra Palace by opting into receive information from us on our website or by talking to one of our team. You can also get in touch by emailing support@alexandrapalace.com and can change your preferences at any time.
We use third party providers to process some donations, such as Pay Pal and Just Giving. We work with these providers because they provide secure online financial transaction facilities. Use of these services is covered by their own privacy policies. Alexandra Palace does not keep any card details for our supporters.
Under our legitimate organisational interest, we may contact you by post, or occasionally by telephone, to seek your support for our charitable activities. Additionally, and only if you have given your consent, we may contact you by email to ask for your support.
Read more about our Fundraising Policy.
OTHER PROCESSING ACTIVITIES
To ensure that our communications are relevant to you and your interests and to assess your likely ability to make, and interest in making, donations to Alexandra Palace, we will use information that you have provided to us.
We may combine this with publicly available information about you such as geographical information and measures of affluence where available from external sources to assist us, and publicly available data from social media sites, in order to help us communicate in a relevant way with you.
We may use profiling techniques or third-party organisations to provide us with information about you that will help us to communicate in a relevant way with you, in particular when we are approaching you about potential philanthropic support. Such information is compiled using publicly available data about you.
You have the right to object to any of this processing at any time. If you wish to do this, please use the contact details at the end of this policy or email support@alexandrapalace.com
Please note however that before seeking or accepting major donations we are required to conduct a minimum level of due diligence, including reviewing publicly available personal data. The way in which we will do this is set out in our Fundraising Policy.
DISCLOSURE OF YOUR DETAILS TO THIRD PARTIES
There are certain circumstances under which we may disclose your personal information to third parties. These are as follows:
- To our service providers who process data on our behalf and on our instructions (for example our ticketing system software provider). We require all third parties to respect the privacy of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.
- Where we are under a duty to disclose your personal information in order to comply with any legal obligation or where there is a legitimate interest that permits us to share your personal information (for example to government bodies and law enforcement agencies for public safety and security purposes).
- To specific, named event organisers whose performances you have attended. In these cases, we will always ask for your explicit consent before disclosing your personal information.
- We may share anonymised personal information with other organisations, who use this to analyse our audience development, ticket sales and self-generated funding to better understand our customers. We will always ask for your consent to pass on personal data to other organisations.
We do not sell personal details to third parties for any purpose.
DATA SECURITY
Your debit and credit card information
If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS). You can find more information about this standard (https://www.pcisecuritystandards.org/pci_security/).
Security of your personal information
We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible. We will ensure that any third parties we use for processing your personal information do the same and that they will only process your personal information on our instructions. The third parties will also be subject to a duty of confidentiality.
We will not transfer, process or store your data anywhere that is outside of the European Economic Area, unless we have a contractual agreement in place that is of an equivalent standard to GDPR.
YOUR RIGHTS
Under the DPA you have the following rights:
- to obtain access to, and copies of, the personal data that we hold about you
- to require that we cease processing your personal data if the processing is causing you damage or distress
- to require us not to send you marketing communications
Once the GDPR takes effect in May 2018, you will also have the following additional rights:
- to require us to correct the personal data we hold about you if it is incorrect
- to require us to erase your personal data
- to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller
- to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights
Please note that these rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
CONTACT US
Please contact us if you have any questions about our Privacy Policy or information we hold about you:
Email us at enquiries@alexandrapalace.com
Or write to us at: Data Controller, Customer Services, Alexandra Palace, Alexandra Palace Way, London, N22 7AY
Social media