Privacy Policy

Privacy Policy – Filmhouse (Edinburgh) Ltd. 

What is our legal basis for using your information? There are a number of lawful reasons for us to process your personal data. One of these is called ‘legitimate interest’ and means that we can process your personal data if (i) we have a genuine and legitimate reason; and (ii) are not harming any of your rights and interests. 

We will use your personal data for the purposes of Filmhouse administration, sale of goods (such as film tickets or membership), fundraising, processing donations, and our other charitable activities.

Whenever we process your personal data for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection law.

Other legal bases that we will rely on include:

• If you enter into a contract with us, we may process your personal data in order to fulfil our contract with you. This includes processing your data in connection with any purchase you make from us of film tickets, food or drink, membership, merchandise or other products; or in connection with charitable donations you make.
• If we are providing you with other e-mail communications, we will only do so with your consent. If you have given us your consent, you can withdraw your consent at any time by contacting us. 
• Where we are required to comply with our legal obligations, to establish and defend our legal rights, or to prevent and detect crimes such as fraud.

We do not normally process special categories of personal data, for example, information about your health. In any case where we needed to do so – for example in relation to members of our staff, where this information helps us ensure your safety and welfare – we would ask for your explicit consent to such use (except where you have volunteered the information to us as part of a formal process such as a job application, in which case our processing for that purpose is deemed to be already subject to your explicit consent). Sometimes your personal data may be used for statistical purposes but only in a form that no longer identifies you.  Please contact us if you would like to see our full Data Retention Policy.

What will we use your information for?

When you give your data to Filmhouse (Edinburgh) Ltd. on this website or via social media, we will only use your data as follows:

- To ensure we know how you prefer to be contacted.

- To keep a record of our relationship with you.

- To contact you if there are any important changes to a matter we deem relevant to you.

- To understand how we can improve our services, products or information.

- To tell you about changes in our services or new services, events and offers we think you’ll find of interest.

- To sign you up to mailing lists that you’ve opted in to.

Some special considerations apply around marketing communications:

- We will only contact you for marketing purposes if you give us your permission to send you this kind of communication.

- If you do allow us to send you marketing communications, then we will give you as much control as reasonably possible about what channels you’d like to be contacted on (e.g. email, phone, SMS, etc.).

How long we will hold your information for?

We will hold your personal data on our systems for as long as is necessary to fulfil the purposes that we collected it for, including for the purposes of satisfying any legal, accounting or other reporting requirements.

By law, we are required to retain certain information for a prescribed period of time. For example, we will keep a record of donations subject to gift aid for at least seven years to comply with HMRC rules. In circumstances where there are no such legal requirements, to determine the appropriate retention period, we will consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we are processing your personal data and whether we can achieve those purposes through other means.

Therefore, some information may be kept for more or less time depending on how long we reasonably feel it is required for.

We review our retention periods for personal data on a regular basis.

In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you ask us to delete your information in accordance with your rights set out below, we will retain basic information on a suppression list to record your request and to avoid sending you unwanted materials in the future.

Who we might share your information with.

We will NOT sell your personal data to any third parties. We may share your information with selected third parties. We will only ever share your data with third parties whom we believe to be fully compliant with GDPR and who also meet our own privacy standards, and we will only do so for purposes that you would reasonably expect in connection with the services we are providing to you or to our cinema clients. Third parties with whom we may share your information include:

• Suppliers whose technology or support we rely on in order to provide our services to you, for example our Point of Sale provider.
• Analytics and search engine providers that assist us in the improvement and optimisation of our site.
• If we run an event in partnership with other named organisations, and you sign up to attend such an event, your details may need to be shared. We will be very clear what will happen to your data when you register.
• If we merge with another organisation or form a new entity, your personal data may be transferred to that new entity as part of Filmhouse’s historical records.
• Comply with any court order or other legal obligation or when data is requested by government or law enforcement authorities;
• Enforce or apply our terms of use and any other agreements;
• Protect the rights, property, or safety of us, our employees, volunteers or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Only Filmhouse employees and approved partners or suppliers whom we may appoint from time to time, and who need the information to perform a specific job, are granted access to personally identifying information. Where we appoint an external party to analyse or process data, any such arrangements will be governed by a formal agreement between Filmhouse (Edinburgh) Ltd and that organisation, to protect the security of your data.

International transfers of personal data.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) for the purposes described in this policy. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff may be engaged in, among other things, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing.

If we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Your rights.

You have a number of rights. If you would like to exercise any of these rights, please contact us using the details set out below in the ‘Contact Us’ section. If you exercise any of these rights we may ask for proof of identity and sufficient information about your interactions with us so that we can locate your personal information. If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge except in exceptional circumstances.

If you wish to raise a complaint in relation to our processing of your personal data, you can contact us using the details set out below in the ‘Contact Us’ section. If you are not satisfied with our response or believe that we are not processing your personal data in accordance with the law you also have the right to lodge a complaint with the data protection regulator, the Information Commissioner’s Office. You can contact the Information Commissioner’s Office at: https://ico.org.uk/global/contact-us/.

Your rights include:

• A right to transparency over how we use your data and to make a subject access request (right of access);
• A right to have your personal data updated and corrected (right of correction/rectification);
• A right to ask us to delete your information (right to be forgotten);
• A right to ask us to stop processing your information (right to restriction);
• A right to object to (i) processing of your information based on our legitimate interests; (ii) processing of your information for direct marketing purposes; and (iii) automated decision making and profiling (right to object);
• A right to receive a copy of your information, or have this sent to a third party (right to data portability); and
• A right to claim compensation for material or non-material damage caused if we breach the data protection rules (right to compensation).
• 
  

If you would like to find out more about your rights, you can visit the Information Commissioner’s Office website (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr).

How you can access and update your information

We strive to maintain accurate, complete, and relevant personal information for the purposes identified in this privacy statement. If any of the personal information we hold about you is inaccurate or out of date, you may ask us to correct it. It is important that the personal information we hold about you is accurate and current. Security precautions in place to protect against the loss, misuse or alteration of your information

We have implemented reasonable measures designed to secure your personal information from accidental loss and from unauthorised access, use, alteration and disclosure. Details of these measures can be obtained on request. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Our security measures are regularly reviewed.

Contact Us

If you have any questions regarding this policy or about our privacy practices, wish to exercise any of your rights or wish to make a complaint, please contact us at EMAIL ADDRESS or by writing to us at Filmhouse c/o James Rice, 99/6 Viewforth, Edinburgh EH10 4LL and marking your query for the attention of the Director of Filmhouse (Edinburgh) Ltd.