Tron Theatre Ltd is a Scottish registered charity (SC012081) that receives public funding from various sources including Creative Scotland, to produce and present theatre work in accordance with our Artistic Policy.  Tron Theatre Ltd is also registered as a company under registration number SC77475.

The Tron has a commercial arm to help subsidise our work, Tron Events Ltd which is also a registered company under registration number SC130468.  Tron Events Ltd is a wholly owned subsidiary and gifts its profits to Tron Theatre Ltd for investment in artistic programming, education and building maintenance.

Tron Events Ltd’s activities are fully covered by this Privacy Policy and Tron Theatre Ltd’s dedication to protecting your privacy in relation to its use of any personal information collected.

When we refer to ‘’we’’ or ‘’our’’ or “us” or ‘’the Tron’’ we are referring to Tron Theatre Ltd and Tron Events Ltd

The Tron collects various types of information about you during interactions and purchases you make.
By submitting your details, you agree to Tron Theatre (and where applicable, external venues that we work with) to provide you with the services, activities or online content you select.

Information you give us
When you register with one of our online systems to buy tickets, make a donation, purchase merchandise, pre-order drinks or food or make a pre-booking for any activities or events, we’ll store personal information you give us such as your name, email address, postal address, telephone number and card details.

We will also store a record of your purchases and donations. From time to time we may also collect, use and share aggregated data such as statistical or demographic data.  This may be derived from personal data that we hold but this is not considered personal data by law as it does not directly or indirectly reveal your identity.

Information about your interactions with us
When you participate in the Tron’s activities, such as newsletters, blogs, script submissions etc we collect information about how you interact with our content and adverts.  Also, when we send you a mailing we store a record of this, and in the case of emails, where possible, we keep a record of which ones you have opened and which links you have clicked on.

Information from third parties
We occasionally receive information about you from third parties.  For example, we may receive information such as name and email address or have specific access requirements if a company hosting a show at our venue has invited you or if you have booked via an external booking source like the producing company who invites you, via analytics providers such as Google, advertising networks such as Facebook or from search information providers such as Google AdWords..

We also use cookies, which are small text files that are automatically placed onto your device by some websites that you visit. They are widely used to allow a website to function as well to provide website operators with information on how the site is being used.

We use cookies to keep track of your basket as well as to identify how the website is being used and what improvements we can make.

The Tron will never purchase data nor sell data with third parties.

Sensitive personal data
Data laws recognise that certain categories of personal information are more sensitive such as health information, race, religious beliefs and political opinions.  We do not actively collect this type of information about our customers unless there is a clear reason for doing so.

For example, when signing up for our Creative Learning programme of work we require medical information and emergency contact details or when pre-ordering any food offers at our café/bar or for any events where food is provided by the Tron, we will ask for dietary requirements.

CCTV/Surveillance
We have installed a CCTV system within the Tron premises for the purposes of public and staff safety and crime prevention and detection.  CCTV is also installed on the outside of the Tron building for the purposes of building security and crime prevention and detection.

In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information about the scheme.

Images captured by CCTV will not be kept for longer than necessary, which is 30 days as standard.  However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated .  The CCTV system is located in a secure area of the building and the data it captures is password protected to prevent unauthorised access.

You have the right to see CCTV images of yourself and be provided with a copy of the images, providing it does not contravene another individual(s) rights or privacy.

We will only disclose images and audio to other authorized bodies who intend to use it for the purposes stated above.  Images and audio will not be released to the media for entertainment purposes or placed on the internet for public viewing.

We operate CCTV and disclose in accordance with the code of practice issued by the Information Commissioner and the Home Office.

We will only use your personal information when the law allows us to.

Note that we may process your personal information for more than one lawful ground depending on the specific purpose for which we are using your information.

Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been stipulated.

Performance of a Contract
This is where we need to perform the contract we are about to enter into or have already entered into with you.

Legitimate Interest
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.  For example, if you have been to see a show that is new writing, we may contact you about other new writing shows.  If you have booked pre-order drinks and food, we may contact you about other catering related events or offers.

Legal or Regulatory Obligation
Where we need to comply with legal and regulatory requests from governing bodies like the police.

Explicit Consent
Where we have your explicit consent before using your personal information in that specific situation.

We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful, and never excessive.  To do this, we use data that we have stored about you, such as which events you have booked for in the past, as well as any contact preferences you may have told us about.

We use legitimate interest as the legal basis for collating a list of customers to communicate with by post and email but for your peace of mind we use explicit consent (via the contact preferences set when you created your account) as the final check prior to sending these communications.

This means that once we have collated our list of customers who match our search criteria, we run that through a consent check which produces a final list of those who wish to hear from us by post and those who wish to hear from us by email.

If you are happy for both, we will always prioritise email over post for both cost monitoring and environmental reasons.

To change your contact preferences, you can use the contact details at the end of this policy or update them in your online account with us.

As part of our service to you, we may contact you by email or telephone to provide essential information related to your purchase and visit.

Tron Theatre Ltd is a registered charity (SC012081) and is registered with the Office of the Scottish Charity Regulator (UK).

Under legitimate interest, we may contact you by post or email to promote ways you can support us and the work that we do.  This contact will be based on your activities and purchase history with us.

Aside from this, and only if you have given your consent, we may contact you to seek your financial support.

We may analyse data we hold about you to ensure that the content and timing of the communications we send is as relevant to you as possible, as well as analyse data we hold about you to identify and prevent fraud.
In order to improve our website, we may analyse information about how you use it and the content and ads that you interact with.

Such information is compiled using publicly available data about you.

In all of the above cases we will always keep your rights and interests at the forefront to ensure they are not overridden.

You have the right to object to any of this processing at any time. If you wish to do this, please use the contact details at the end of this policy. Please bear in mind that if you object this may affect our ability to carry out tasks above that are for your benefit.

Data storage and processing

We enlist the use of various software packages to provide our services. Detailed here are a list of systems, data storage locations, along with any associated sub-processors.

Service Provider: Adyen
Purpose: Payment Processing
Data Location: EU
Sub-Processors: Adyen N.V. UK Branch, Adyen do Brasil Instituição de Pagamento Ltda., Adyen Mexico SA de CV, Adyen N.V., Adyen Australia Pty Ltd, Adyen Singapore Pte. Ltd., Adyen Japan K.K., Adyen Canada Ltd., Adyen MEA FZ-LLC Arjaan, Adyen India Technology Services Pvt. Ltd., Adyen India Tech Hub Pvt. Ltd.

Service Provider: crowdEngage
Purpose: Mobile ticketing and order fulfilment
Data Location: Ireland
Sub-Processors: AWS Amazon, Cloudflare, Bird, Twilio

Service Provider: DotDigital
Purpose: E-marketing
Data Location: UK & EEA
Sub-Processors: N/A

Service Provider: Infinite Eye
Purpose: Website hosting
Data Location: UK
Sub-Processors: N/A

Service Provider: Microsoft
Purpose: Data hosting
Data Location: UK
Sub-Processors: N/A

Service Provider: Purple Seven
Purpose: Audience engagement
Data Location: UK
Sub-Processors: N/A

Service Provider: Spektrix
Purpose: Arts CRM system
Data Location: UK & EEA
Sub-Processors: Microsoft Azure, Mailgun Technologies, Cloudflare, Inc, Loqate (part of the GBG group), Sendsafely, Logz.io

Service Provider: Square
Purpose: Point of sale
Data Location: EU
Sub-Processors: Google Analytics, Facebook, BugSnag and Crashlytics

Service Provider: Stripe
Purpose: Payment processing
Data Location: USA
Sub-Processors: More information from https://stripe.com/gb/legal/service-providers

Service Provider: TAWK
Purpose: Webchat & service ticketing
Data Location: USA
Sub-processors: Digital Ocean, AWS Amazon, Google Inc., Loggly, Postmastery, Sendgrid, Cloudflare, Inc, Pinecone, PostHog, Microsoft Clarity.

Service Provider: The Audience Agency
Purpose: Audience engagement
Data Location: UK or EU
Sub-processors: N/A

Service Provider: Yesplan
Purpose: Building operations scheduling
Data Location: EU
Sub-processors : N/A

In general, we will keep your information confidential except where disclosure is required or permitted by law (for example to government bodies and law enforcement agencies).

Theatre Companies & External Venues or Events
The Tron works with various theatre companies along with external venues and are often asked by them to provide contact details for their mailing lists.  This information is provided to them under legitimate interest and with explicit consent provided by you in your customer account.

When you create your account, we will ask you if you would like to receive information from the theatre companies that you choose to attend and if you’d prefer that by post or email, although where possible we prioritise email.

If we are selling for an external venue or event that is out-with the Tron, we will seek marketing permissions separately to those provided when you originally created your customer account with us.

Any changes you wish to make to consents given can be done via the contact details at the end of this policy or by logging into your online account.

Service Providers
The Tron will keep your information completely confidential, including never disclosing any private or sensitive data when providing analytical reports or applying for funding.

The Tron requires these third parties to comply strictly with its instructions and that they do not use your personal information for their own business purposes unless you have explicitly consented to the use of your personal information in this way.  This permission would be obtained separately from the standard permissions currently in place along with documentation stipulating the full details of the requests.

Apps
We may offer the facility for you sign-in to our systems via a third-party service app (e.g. Facebook) to interact with us.  In such instances you will be presented with a dialog box, which will ask for your permission to allow your personal information to be shared with the Tron.

Whilst the Tron may endeavor to offer you an alternative option that will enable you to interact with us without using a third-party, this may not always be possible.

Social Media
If you choose to interact with us via any of our social media streams (e.g. Facebook, Bluesky, Instagram etc) the Tron may receive or have access to information about you, this is based upon what you have chosen to share in your social media accounts.  The Tron do not use this information and relies solely on the social media channels aggregated marketing data tools along with posts directly on our pages.

To change any permission or to manage the viewing of our posts, please refer to your social media provider.

If you use your credit or debit card to purchase from us or to make a donation, we will ensure that this is carried out securely and in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).

You can find more information about this standard here.

For transparency in our ticketing system (Spektrix) there is the functionality to store your card details for use in a future transaction.  This is carried out in compliance with PCI-DSS and in a way where none of our staff members are able to see your full card number.  We never store your 3 or 4-digit security code.
In addition, we can store your card details in order to pay up a membership scheme.  This is done via a function called Continuous Authority and is also governed by PCI-DSS.

All of the other payment systems in the Tron utilise a one-time entry and use for card information.

We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your personal information as secure as possible.  We will ensure that any third parties we use for processing your personal information do the same.

We will not transfer, process or store your data anywhere that is outside of the European Economic Area, unless we have a contractual agreement in place that is of an equivalent standard to GDPR.

If you wish to make changes to the information or permission you provided, log into your theatre account via tron.co.uk.

Should you solely wish e-mails to stop, you can also use the “Unsubscribe” link at the bottom of one of our e-mails.  This will stop any of the similar emails being sent to your email address, however it will not stop service related emails as they are not subject to permissions under legitimate interest.

For logging exclusions from processing activities or any other amendments you require that are not covered above, please see the Contact Details & Further Information section of this policy.

Any objections you make to any processing of your data will be stored against your customer record on our system so that we can comply with your requests.

Retention Periods
We will hold your personal information on our systems for as long as is necessary for the relevant activity.
If you request that your account be deleted we will deactivate it on the database and, while the Tron cannot use the personal information, it will remain on the system for administration and financial regulatory purposes before being fully deleted, timescale for this will be determined on a case-by-case basis.  During this time, you can request for it to be reactivated at any point.

Occasionally applicants are asked to submit material to the Tron Theatre in order for us to assess their application for one of our employment opportunities or development programmes, and we must keep this material on file for the duration of the assessment process.  Unless instructed otherwise by the applicant, once the assessment process has ended we will keep a copy of this material archived should the applicant wish to discuss the project further with Tron Theatre staff at any stage.

The Tron Theatre, as a publicly funded organisation, also has an obligation to keep a record of it’s history, which may include user generated content, e.g. feedback and reviews, evaluations and script submissions.  Therefore, some content submitted to, or shared with, the Tron may be retained for prolonged periods of time or potentially indefinitely in the Tron Archive.

The Tron Theatre archive is held by Glasgow University in the Scottish Theatre Archive.  Information on Tron Theatre Company and visiting company productions is deposited annually with the University for digital archiving.  Where possible, we will endeavor to inform you upfront or let you know at a later date whether we are likely to keep content indefinitely or pass it onto an approved historical archive.

No personal information on Tron customers or its suppliers will be sent for historical archiving.

Under the General Data Protection Regulations, you have rights, which are detailed below.

Please use the contact details at the end of this policy if you would like to exercise this right, or any of the rights listed below. If you are a European citizen and consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, i.e. the Information Commissioner’s Office.

Request access to your personal information
You have a right to request a copy of the personal information that we hold about you.

Request correction of your personal information
You have the right to request that we correct the personal information we hold about you, although we may need to verify the accuracy of the new information you provide to us.

Request deletion of your personal information
You have the right to request that we delete or remove personal information where there is no good reason for us continuing to process it.  Please note that we may not always be able to comply with your request for erasure if there are specific legal reasons – which will be notified to you at the time of your request.

Object to processing of your personal information
You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation, which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.  In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing your personal information
You have the right to request that we suspend the processing of your personal data in the following scenarios:
(a) if you want us to establish the accuracy of the data;
(b) where our use of the data is unlawful, but you do not want us to erase it;
(c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims;
or (d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Request transfer of your personal information
You have the right to request that the personal information we hold about you is transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format.  Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent
In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time.  However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.  If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Please also note the following:

No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights).  However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights).  This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.  We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond
We try to respond to all legitimate requests within one month.  Occasionally it may take us longer than a month if your request is particularly complex or you have made multiple requests.  In this case, we will notify you and keep you updated.