Privacy Policy

1. Who we are

The controller responsible for the personal information described in this notice is The Phoenix Artist Club Limited, company number 02247504.

Some charitable or community activities may be delivered with Phoenix Arts Club C.I.C. If another Phoenix organisation is responsible for a particular activity, we will identify it when we collect your information.

2. Information we collect

Depending on how you interact with us, we may collect:

• your name, email address, telephone number, postal address and date of birth where relevant;
• membership details, account information and membership status;
• ticket, booking, private-hire and transaction details, including payment status and refunds;
• your newsletter choices and records of consent or unsubscribe requests;
• messages, enquiries, feedback and other correspondence you send us;
• information needed to meet an accessibility, dietary or other specific request that you choose to give us;
• technical information such as your IP address, browser and device type, requested pages, timestamps, referral information and security logs; and
• information supplied by ticketing, payment, membership or email providers when they support a service you have requested.

Payment-card information is entered into the secure systems of our payment providers. We do not normally receive or store your complete card number or security code.

3. How and why we use your information

Where we rely on legitimate interests, we consider the impact on your rights and use your information only where those interests are not overridden by your interests or fundamental rights. We do not use solely automated decision-making that produces legal or similarly significant effects.

4. Marketing

We send newsletter emails only where we have an appropriate lawful permission. The website newsletter uses a clear, unticked consent box. You can unsubscribe at any time by using the link in an email or contacting us. Withdrawing consent does not affect processing that took place before withdrawal.

We may keep a minimal suppression record after you unsubscribe so that we can respect your choice and avoid contacting you again by mistake.

5. Cookies, local storage and embedded media

The public Craft website does not currently contain advertising pixels or analytics tracking code. It uses browser local storage to remember whether you dismissed the newsletter invitation and whether you completed a newsletter signup. These records stay on your device and help prevent the invitation appearing repeatedly.

Some pages contain videos supplied by Vimeo. When an embedded video loads, Vimeo may receive technical information such as your IP address and device details and may use cookies or similar technologies under its own privacy terms. You can control or delete cookies and site storage through your browser settings, although blocking necessary storage may affect how parts of the site work.

If we introduce optional analytics, advertising technologies or other non-essential cookies in future, we will update this notice and provide appropriate choices before using them where consent is required.

6. Who we share information with

We share information only where necessary and may use:

• Line-Up and related ticketing services to manage event bookings;
• Square and other secure payment services for payments and membership transactions;
• Mailchimp to manage consented newsletter subscriptions and email campaigns;
• website hosting, email, database, security and IT-support providers;
• professional advisers, insurers, auditors and accountants; and
• courts, regulators, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

These organisations may act as our processors, or sometimes as separate controllers for their own services. We require processors to protect personal information and use it only for the agreed service. We do not sell personal information.

7. International transfers

Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an approved method such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with proportionate security measures. You may contact us for more information about the safeguards relevant to your information.

8. How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including legal, accounting and reporting requirements. In general:

• financial, transaction and contract records are normally kept for six years after the relevant accounting period or relationship ends;
• unsuccessful enquiries are generally kept for no longer than 24 months after the enquiry closes;
• newsletter information is kept until you unsubscribe or we stop the mailing service, with a minimal suppression record retained where needed to honour your choice;
• account and membership information is kept while the account is active and afterwards where needed for contractual, legal or fraud-prevention purposes; and
• technical and security logs are kept for the shortest period reasonably necessary to operate and protect the service, normally no longer than 12 months unless an incident or legal requirement justifies longer retention.

We may keep anonymised information that no longer identifies anyone.

9. How we protect information

We use appropriate technical and organisational safeguards designed to prevent personal information from being accidentally lost, altered, disclosed or accessed without authority. Access is limited to people and providers who need it for their work, and we review our systems and suppliers as appropriate. No internet service can be guaranteed completely secure.

10. Your data-protection rights

Depending on the circumstances, UK data-protection law gives you the right to:

• ask for a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where consent is our lawful basis; and
• complain to the Information Commissioner’s Office.

These rights are not absolute and exemptions may apply. To exercise a right, email customercare@phoenixartsclub.com. We may need to confirm your identity before acting. We normally respond within one month and do not charge a fee unless a request is manifestly unfounded or excessive.

You can contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113. We would appreciate the opportunity to resolve your concern first.

11. Other websites and services

Our website links to external services, including ticketing, payment and social-media sites. Their own privacy notices apply when they act independently. We are not responsible for the content or privacy practices of unrelated external websites.

12. Children

Our website is not designed for children under 13 to create accounts or join marketing lists independently. If you believe a child has provided personal information without appropriate authority, please contact us so we can investigate and take suitable action.

13. Changes to this notice

We review this notice regularly and will publish changes on this page. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to the attention of affected people before the new use begins.