Privacy Policy

Contents of this Privacy Policy for Cellar Door Promotions Limited t/a Cellar Door Film Society herein referred to as “CELLAR DOOR”

Introduction

What we mean by CELLAR DOOR brands

Explaining some of the terms which we use

The information which we may collect about you

Important information about cookies, mobile apps, CELLAR DOOR social media, third party links and CELLAR DOOR Wi-Fi

How we use your information and the lawful bases for doing so

How we may share your information with third parties

How we protect your information, and your security responsibilities

How long we will keep your information

Where your information may be processed

Knowing your legal rights

Updating your information and contacting us or the supervisory authority

A. Introduction

Purpose of this Privacy Policy

This Privacy Policy together with the Cookies Policy (which we collectively refer to as our “Privacy & Cookies Policy”), aims to give you information on how CELLAR DOOR collects and processes your Personal Information through your sign up, registration and use of CELLAR DOOR online and non-online services (including the Website, Guest Services, Mobile Apps, CELLAR DOOR Social Media, CELLAR DOOR Wi-Fi, and other CELLAR DOOR Services.

Please see Part B below, for details of the brands which are we referring to, when we refer to ‘CELLAR DOOR’. See Part C below for an explanation of some of the capitalised terms we use.

It is important that you read the Privacy & Cookies Policy together with any other privacy notice or fair processing notice which we may provide on specific occasions, when we are collecting or processing Personal Information about you. This is so that you are aware of how, and why, we are using your Personal Information. This Privacy Policy supplements the other notices and is not intended to override them.

Your acknowledgement of, and agreement to, the Privacy & Cookies Policy

The Privacy & Cookies Policy contains important information about how we handle and process the Personal Information which we collect from you – please read it carefully. If you are reading this Privacy & Cookies Policy online, please print or save a copy for your records.

By accessing, using or registering on the Website or CELLAR DOOR Social Media, downloading, using or registering on a Mobile App, contacting Guest Services, using CELLAR DOOR Wi-Fi or applying for, signing, using or registering as a CELLAR DOOR member or using any of the CELLAR DOOR Services, you acknowledge that you have read, and agree to the provisions of, the Privacy & Cookies Policy.

Amendments to this Privacy Policy

CELLAR DOOR reserves the right to add to, or amend, the Privacy & Cookies Policy from time to time. Amendments will take effect when posted on the Website, Mobile App or CELLAR DOOR Social Media. Please check the Website, Mobile Apps or CELLAR DOOR Social Media “Privacy Policy” and “Cookies Policy” section regularly for changes. If you access, use or register for any of the CELLAR DOOR Services after any amendment to the Privacy & Cookies Policy, you acknowledge that you have read, and agree to the provisions of, the updated version of the Privacy & Cookies Policy. Unless otherwise stated, our latest Privacy & Cookies Policy applies to all of the Personal Information which we have about you (but this only applies to the extent that this is permitted by applicable law).

Where there are important changes to the Privacy & Cookies Policy, we will inform you by either prominently posting a notice, or emailing you, to let you know that the Privacy & Cookies Policy has been updated.

However, we will only use your Personal Information for the purposes for which we collected it, which includes contacting you in the future for our marketing and advertising purposes, including without limitation to inform you about CELLAR DOOR services or events we believe might be of interest to you, to develop promotional or marketing materials and provide those materials to you, and to display content and advertising on or off the Services that we believe might be of relevance to you. If we need to use your Personal Information for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so. Please note though, we will only process your Personal Information in other circumstances without your knowledge or consent, where this is required or permitted by law.

B. What we mean by the CELLAR DOOR Brands

About CELLAR DOOR

Cellar Door Brands: “Cellar Door Film Society” provide cinema and entertainment services under the CELLAR DOOR company in the UK. “CELLAR DOOR / we / our / us” means the respective brands listed in the previous sentence, to the extent that the controller remains as Cellar Door Promotions Limited “CELLAR DOOR” for the respective service or provision referred to in the Privacy Policy.

The Controller

CELLAR DOOR is a controller for the purposes of the GDPR (i.e. is responsible for, and controls the processing of, your Personal Information), as follows:

CONTROLLER NAME

Cellar Door Promotions Limited

NATURE OF SERVICE

This is a controller in respect of the Personal Information processed in connection with the sale of tickets, food, drinks, membership fees and merchandise for its event(s) / shop(s). It is also the controller in respect of the Personal Information processed in connection with the administration of and transactions of all brands.

C. Explaining some of the terms which we use

Definitions

Please note that we use the following definitions in the Privacy & Cookies Policy:

“Cookies Policy” means the Cookies Policy (as updated by CELLAR DOOR from time to time)

“GDPR” means the General Data Protection Regulation (as updated from time to time).

“Guest Services” means any Guest Services facility operated by third parties including Eventbrite, Seetickets, Ticketmaster.

“Mobile Apps” means CELLAR DOOR mobile website(s) developed from time to time

“CELLAR DOOR Services” means any or all of the following (as applicable to you):

– Your sign up, registration and use of the Website, Guest Services, Mobile Apps, CELLAR DOOR Social Media, member or CELLAR DOOR Wi-Fi;

– Purchasing tickets, goods and services from CELLAR DOOR

“CELLAR DOOR Social Media” means the parts of social media provided by third parties (such as Facebook) through which CELLAR DOOR provides services such as information, applications and similar activities.

– “CELLAR DOOR Wi-Fi” means the wireless internet access provided by CELLAR DOOR at it’s co-working space NEXUS and from time to time other CELLAR DOOR related events

– “Personal Information” has the same meaning as ‘personal data’ under the GDPR. This in essence means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

– “Privacy & Cookies Policy” means this Privacy Policy together with the Cookies Policy (as updated by CELLAR DOOR from time to time).

– “Privacy Policy” means this privacy policy (as updated by CELLAR DOOR from time to time).

– “Website” means our website at https:///www.cellardoorfilmsociety.co.uk 

D. The information which we may collect about you

Types of Personal Information which we may collect about you

CELLAR DOOR may collect and process Personal Information about you as set out in this Part D. Please also refer to Part E, as that deals with additional information which may be collected and processed by us or third parties.13. We may collect, use, store, process and transfer different types of Personal Information about you, which we have grouped together as follows:

13.1. Identity Information – this consists of identity information, and may include: first name, last name, title, date of birth and age.

13.2. Contact Information – this consists of contact information, and may include: billing address; delivery address; email address; and telephone numbers.

13.3. Financial Information – Any credit/debit card payments and other payments you make through our Site will be processed by our third party payment providers and the payment data you submit will be securely stored and encrypted by the payment service providers using up to date industry standards. Please note that we do not ourselves store the debit/credit card data that you submit.

13.4. Transactional Information – this consists of details about payments to, and from, you; usage of points, vouchers, promotions, memberships and gift cards; and other details of products and services which you have purchased from us.

13.5. Technical Information – this consists of technical browser or device related information, and may include: your device type; internet protocol (IP) address; your session data; browser type and version; time zone setting; and location data.

13.6. Profile Information – this consists of profile data about you, and may include: your interests; your preferences; your feedback; survey responses; information about how you use the CELLAR DOOR Services.

13.7. Marketing Preferences Information – this consists of your preferences in receiving marketing from us and our third parties, and your communication preferences.

13.8. Other Information – this is other Personal Information which you voluntarily choose to share with us; as well as CCTV footage and photography when you enter our premises and / or attend our events.

We also collect, use and share aggregated data, such as statistical or demographic data for any purpose. Aggregated data may be derived from your Personal Information but is not considered Personal Information in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Technical Information to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your Personal Information, so that it can directly or indirectly identify you, we treat the combined data as Personal Information which will be used in accordance with this Privacy Policy.

Special categories of Personal Information

We do not collect special categories of Personal Information about you, other than with your explicit consent, or to comply with legal obligations in respect of making appropriate provision (such as access rights) or health and safety, or safeguards for individuals suffering from health, medical or disability issues. Consequently, we will process limited health, medical or disability

Personal Information, for the following purposes:

15.1. Registration of CEA card (being the national card scheme developed for UK cinemas by the UK Cinema Association (UKCA))

15.2. Food allergy information for CELLAR DOOR hosted events.

15.3. Complaints or queries where consumers of their own volition, provide health, medical or disability information; we will not process such information, unless it is applicable to the respective complaint or query.

15.4. Accident, injury or incident reports.

If you fail to provide Personal Information

Where we need to collect Personal Information by law, or under the terms of a contract which we have with you (or we are intending on entering into with you), and you fail to provide that information when requested, then we may not be able to perform the contract we have, or are trying to enter into. In this case, we may not be able to provide you with the respective product or service, or we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

Making a purchase

If you make a purchase, CELLAR DOOR will collect the information which we need to fulfil your order and notify you of the status of your order.

You need to be 18 or over to set up an account with us.

If you set up an account with us CELLAR DOOR will collect the information which we need to open, administer and run your account, and to deal with any enquiries which you may have about it. The joining process will set out the minimum information which you will need to provide (in the form of mandatory fields) and you may provide us with other relevant information if you chose.

Competitions, Surveys, Correspondence

CELLAR DOOR will obtain the Personal Information which you submit, when you enter a competition or promotion on the Website, Mobile App or using CELLAR DOOR Social Media.

From time to time, we may contact you by email to ask you to participate in a user survey, where you have consented to such communications. Participation in surveys is completely voluntary, and we will collect such Personal Information as you provide in respect of any such surveys.

If you contact us for any reason (e.g. to report a fault on the Website) we may keep a record of that correspondence.

Using our services and marketing communications from CELLAR DOOR

CELLAR DOOR may collect information about your use of our services. We may also collect information about marketing communications we send to you and how you respond to them. See Part F below, for more details about this.

Important information about cookies, mobile apps, CELLAR DOOR social media, third party links and CELLAR DOOR Wi-Fi

CELLAR DOOR uses information collected using cookies and web beacons to help us analyse, develop, manage, provide and market our goods, services and our communications to you. Certain third parties use cookies and web beacons for similar purposes for their benefit. Please read our Cookies Policy for more details in respect of the use of cookies and web beacons in respect of the CELLAR DOOR Services.

CELLAR DOOR is the controller in respect of its own cookies only.

Mobile Apps

If you are using Mobile Apps, then certain functionality requires location data from your device to work. If you do not want the Mobile Apps to use your location data, please change your settings on your device; some Mobile Apps ask you if you want to do this when you download them (e.g. iPhone apps), or depending on your device, others may ask you when you access them (e.g. CELLAR DOOR mobile website). If you change your mind and want to opt out later, you will need to change the settings on your Mobile App. Please see the relevant help sections for your device for more information in this regard.

CELLAR DOOR Social Media

If you are using CELLAR DOOR Social Media, please remember that CELLAR DOOR Social Media is provided via social media sites which have their own functionality, terms and privacy policies. You should be aware that these functions are part of the social media site, and are subject to the respective social media site’s terms and privacy policy. Please ensure that you have read these carefully, and that you have checked your personal settings to ensure that you are happy with how your information will be used by the social media site. CELLAR DOOR Social Media may make use of these functions, but CELLAR DOOR does not control them and is not responsible for them.

CELLAR DOOR Social Media may allow you to see your friend’s details and contact them. An example of this would be our Event Planner within Facebook. Where this is the case, this function is provided by the social media site provider and not CELLAR DOOR. CELLAR DOOR does not hold your friend’s details. Any messages which you send to friends via CELLAR DOOR Social Media, use the relevant social media’s functionality and are not sent from CELLAR DOOR.

Third party links

The Website, Mobile Apps and CELLAR DOOR Social Media may contain links to websites which are not controlled by CELLAR DOOR. This might include a link in a third party advertisement. The fact that the Website, Mobile Apps and CELLAR DOOR Social Media provide links to any such website, does not mean that CELLAR DOOR endorses that website or any of the services or products it offers. We are not agents for any such websites or advertisers, and we are not authorised to make representations on their behalf (unless explicitly stated). CELLAR DOOR is not responsible for the privacy practices of any such websites. You provide Personal Information to such websites at your own risk, and you should check their privacy policies accordingly.

CELLAR DOOR Wi-Fi

When you use CELLAR DOOR Wi-Fi, we may collect information about:

33.1. Your device and its location;

33.2. The volume of data which you use;

33.3. The websites and applications which you access; and

33.4. Your usage by access time, frequency and location.

However, such information is used only to provide you with access to the CELLAR DOOR Wi-Fi, and is not used for any profiling, marketing or other purposes.

If you do not want the CELLAR DOOR Wi-Fi to use your location data, please change your settings on your device. Please see the relevant help section for your device. Disabling such access may result in loss of certain functionality accordingly.

F. How we use your information and the lawful bases for doing so

We will only use your Personal Information in circumstances in which the law allows us to. Most commonly, we will use your Personal Information in the following circumstances:

35.1. Where we need to perform the contract, we are about to enter into, or have entered into, with you;

35.2. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;

35.3. Where we need to comply with a legal or regulatory obligation; or

35.4. To protect your, or a third party’s, vital interests (i.e. medical emergency situations).

Consent as a lawful basis

Generally, we do not rely on consent as a lawful basis for processing your Personal Information, other than in relation to:

36.1. Sending certain direct marketing communications to you;

36.2. Using cookies on our Website or Mobile Apps (where such cookies are not of the strictly necessary type for functional purposes); or

36.3. Processing special categories of Personal Information in relation to health, medical or disability information, which you choose to provide to us (to the extent that this is not required for complying with a legal or regulatory obligation).

You have the right to withdraw consent at any time by contacting us (contact details are shown in Part L below), or in respect of cookies, following the directions referred to in the Cookies Policy.

Making a purchase, or joining CELLAR DOOR Brands(s) where relevant

If you make a purchase, CELLAR DOOR will use your information to fulfil your order and notify you of the status of your order, which for online purchases will usually include sending you a booking or purchase confirmation email (this will be undertaken pursuant to our contractual performance obligations). Details of your purchases will be linked to you (and your membership account if the purchase has been made under NEXUS), in order to provide any applicable loyalty points (in accordance with our contractual arrangements) or membership benefits (pursuant to our legitimate interests), as well as to generate a profile of the types of purchases which you prefer (again, pursuant to our legitimate interests), so that we can send you more targeted (and therefore relevant) advertising, information and offers. We may also use anonymised information derived from this, for statistical and trend analysis purposes.

Any credit/debit card payments and other payments you make through our Site will be processed by our third party payment providers and the payment data you submit will be securely stored and encrypted by our payment service providers using up to date industry standards. Please note that we do not ourselves directly process or store the debit/credit card data that you submit.

Purposes for which we will use your Personal Information

We have set out below, in a table format, a further description of certain ways in which we may use your Personal Information, and which of the lawful bases we rely upon to do so. We have also identified both in the table and in the Privacy & Cookies Policy, what our legitimate interests are where appropriate.

Please note, that we may process your Personal Information on more than one lawful ground, depending on the specific purposes for which we are using your Personal Information. Please contact us if you need details about the specific lawful ground which we are relying upon, to process your Personal Information, where more than one ground has been set out in the table below:

PURPOSE OR ACTIVITY

To register you as a new customer

TYPE OF PERSONAL INFORMATION

Contact information
Financial information
Identity Information

Marketing Preferences Information
Profile Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Contract in respect of contractual arrangements relating to the membership or loyalty scheme)
Legitimate interest (build brand loyalty and facilitate transacting with us)
Consent (marketing opt-in)
Legal obligation (disability access requirements compliance)

PURPOSE OR ACTIVITY

To process and deliver your order including:

Manage payments, fees and charges

Process any loyalty or membership points or benefits
Collect and recover money owed to us
Interacting with your device where applicable in relation to taking the order and fulfilling it
Checking disability status to ensure accessibility requirements are met

TYPE OF PERSONAL INFORMATION

Contact Information
Financial Information
Identity Information

Technical Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Contract (in respect of the performance of the contractual arrangements
Legitimate interests (to recover debts due to us)
Legal obligation (disability access requirements compliance)

PURPOSE OR ACTIVITY

To manage our relationship with you, which may include:

Notifying you about changes to our terms or Privacy & Cookies Policy
Asking you to leave a review or take a survey
Inviting you to participate in a competition
Administrating our loyalty schemes

TYPE OF PERSONAL INFORMATION

Contact Information
Financial Information
Identity Information
Marketing Preferences Information

Other Information
Profile Information
Technical Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Legitimate interests (to manage our relationship with you; build brand loyalty and customer retention; keep our records and customers updated; to study how customers use our products or services; to develop our products and services; to grow our business; and to inform our marketing strategy)
Consent (marketing opt-in)
Contract (in respect of the performance of the contractual arrangements)
Legal obligation (disability access requirements compliance)

Legal obligation (disability access requirements compliance)

PURPOSE OR ACTIVITY

To administer and protect our business and the CELLAR DOOR Services, which may include: 

Troubleshooting, testing, system maintenance, support, reporting and hosting of data 
Fraud detection and fraud prevention
Incident investigation
Data analysis

TYPE OF PERSONAL INFORMATION

Contact Information
Financial Information
Identity Information
Other Information

Technical Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Legitimate interests (for running, managing and safeguarding our business; provision of administration and IT services; network security and general security; to prevent fraud; and in the context of a business reorganisation or group restructuring exercise)

PURPOSE OR ACTIVITY

To deliver relevant website and mobile app content and advertisements to you, and measure or understand the effectiveness of the advertising we serve to you

TYPE OF PERSONAL INFORMATION

Contact Information
Financial Information
Identity Information

Marketing Preferences Information
Profile Information
Technical Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Legitimate interests (build brand loyalty and customer retention; keep our records and customers updated; to study how customers use our products or services; to develop our products and services; to grow our business; and to inform our marketing strategy; marketing in respect of related or similar products or services, to those in respect of which you have transacted with us)
Consent (marketing opt-in)

PURPOSE OR ACTIVITY

To use data analytics to improve our CELLAR DOOR Services, products and services, marketing, customer relationships and experiences

To make suggestions and recommendations to you about goods or services that may be of interest to you

TYPE OF PERSONAL INFORMATION

Contact Information
Financial Information
Identity Information
Marketing Preferences Information

Other Information
Profile Information
Technical Information
Transactional Information

LAWFUL BASIS FOR PROCESSING (INCLUDING BRIEF DETAILS OF LEGITIMATE INTEREST)

Legitimate interests (to define types of customers for our products and services; to keep our Website and Mobile Apps updated and relevant; build brand loyalty and customer retention; keep our records and customers updated; to study how customers use our products or services; to develop our products and services; to grow our business; and to inform our marketing strategy; marketing in respect of related or similar products or services, to those in respect of which you have transacted with us)
Consent (marketing opt-in)

In the other provisions of Part F, we have included further details of how we may use your Personal Information, as well as details of our legitimate interests where appropriate. The lawful bases for such processing (where they are not addressed in the above table), will be: consent in respect of marketing communications (where we have stated that we are not relying upon legitimate interests); contract in respect of contractual performance, or taking steps at your request prior to entering into a contract; legal requirements in respect of health and safety statutory requirements, and in respect of disability status (to ensure appropriate access requirements are fulfilled); vital interests in respect of medical emergencies; and legitimate interests for other purposes.

Marketing communications from CELLAR DOOR

If you are over 18, we may send you marketing communications if you have consented to this, or, when you have transacted with us, we may send you marketing communications pursuant to our legitimate interest, in respect of related or similar CELLAR DOOR products or services.

CELLAR DOOR marketing communications will be about film times, film and cinema news, promotions, loyalty schemes, competitions and special offers, as well as information about CELLAR DOOR products and services. We will send marketing communications through the communication methods which you have opted into.

Marketing messages will come from CELLAR DOOR / CELLAR DOOR Brands. They may include information on carefully selected partners from time to time, but we will NEVER pass your Personal Information to any third party for direct marketing. With regards to Cellar Door Film Society 2020 information shared with our media partners on the co-promotion of the event are: First Name, Surname, Email, Telephone Number only. The purposes of sharing the above information details will be in relation to the co-promoted competition only. Outside of this, where we directly provide you with news and offers of organisations outside CELLAR DOOR, we do not give them your identity details.

Every information email from CELLAR DOOR will contain details of how you can unsubscribe, and you can always contact us to unsubscribe using the methods set out at Paragraphs 72 to 73 below.

Survey information

Survey information will be used for the purposes of understanding customer trends, monitoring or improving our services and, sometimes, to contact you with news and offers. This will be provided to you where you have opted into such surveys by way of consent.

Special categories of Personal Information

If you provide us with special categories of Personal Information, such as that relating to a disability, we will use this for the purpose of providing you with access to our goods and services, in a manner which takes into account such disability (pursuant to our legal obligation to address such accessibility requirements). We would also like to refer you to Paragraph 15, for further details in respect of our collection and processing of special categories of Personal Information.

CELLAR DOOR Wi-Fi

We will use the data which we collect when you use CELLAR DOOR Wi-Fi, in order to provide you with access to the CELLAR DOOR Wi-Fi service.

CCTV

We use CCTV systems in our premises, for our legitimate interests (and for those of our customers, visitors, business partners and service providers) of detecting, investigating and addressing incidents (including health and safety, civil or criminal unlawful acts). This is to safeguard our premises, business, goods and services, as well as our customers, visitors, business partners and service providers. Footage from CCTV may be used by: us; the third parties referred to in this paragraph; by our representatives or those of our third parties; the police; or health and safety investigators; in detecting, investigating and addressing any incidents.

G. How we may share your information with third parties

We may pass your Personal Information (name and email address) to the following third parties:

51.1. Our advisers in order for them to provide us with advice;

51.2. Other companies and individuals in order for them to perform functions on our behalf (e.g. developing, maintaining and analysing customer databases; creating, sending out and analysing customer communications; administering competitions; developing, maintaining and analysing the CELLAR DOOR Services and providing customer services; and operating our CELLAR DOOR membership).

Where we transfer your Personal Information (name and email address) to service providers which are acting as our processors, we will do so, on the basis that the respective third parties have agreed with us, that they with comply with the appropriate GDPR safeguards, including that they have in place adequate technical and organisational measures to protect the respective Personal Information, will not pass it on to any other party (without our explicit approval and only with valid grounds), and will not use it for any purpose other than to provide us with advice or perform the function specified on our behalf.

We also reserve the right to release Personal Information without your consent, or without consulting you, when we believe that this is appropriate to comply with our legal obligations, to enforce our terms and conditions or other legal rights, to protect the security of the CELLAR DOOR Services, to prevent fraud, or otherwise to protect the legitimate interests of CELLAR DOOR or its customers.

From time to time, we may share statistical information about customers with third parties such as advertisers, business partners and sponsors, to help us and them analyse, develop, manage and market our goods and services. This information will be shared in a way that ensures that your identity is not revealed to them.

Where you are a registered user of CELLAR DOOR, we may share the following information with third parties for the following marketing purposes:

55.1. We may share your email address in an encrypted and de-identified form with third party social media platforms (such as Facebook), in order for these third parties to identify you as a registered user of their services. Such third parties then use other information that they hold about you and analyse it to identify other users of their services who share similar interests to you. You may then receive advertising and promotions about CELLAR DOOR products and services on such third party social media platforms. The use of your information by such third party social media platforms is governed by their privacy policies, and any applicable consents that you have provided to such social media platforms, where such consents are required by applicable law;

55.2. We may share a unique identifier with third parties and their partners, in order for these third parties and their partners to identify you as a registered user of their services. Such third parties and their partners then use this information to send you advertising and promotions about CELLAR DOOR products and services on their websites and mobile services. The use of your information by such third party service providers is governed by their privacy policies, and any applicable consents that you have provided to such third party service providers, where such consents are required by applicable law.

If CELLAR DOOR or any part of CELLAR DOOR’s business is restructured, sold to, or integrated with, another business, we may transfer customer information (including your Personal Information) to other CELLAR DOOR group companies or the new owners, as the case may be. Where CELLAR DOOR operates under a commercial arrangement with a third party, we may at the end of that commercial arrangement, transfer customer information relevant to that brand / business (which may include your Personal Information) to that third party. In each case, the transferred information is to be used by the new holder of the information and its group of companies, in the same ways as set out in this Privacy Policy, including providing you with any information services you receive from CELLAR DOOR.

H. How we protect your information, and your security responsibilities

Security

The nature of the Internet is such that we cannot guarantee the security of the information which you transmit to us via the Internet, and any transmission over the Internet is at your own risk. We follow strict security procedures, so that Personal Information is processed in a manner that ensures appropriate security of the Personal Information, including appropriate protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures. We store information which you provide to us, on secure servers, and payment transactions are encrypted using SSL technology.

We will notify you, and any applicable supervisory authority, of a Personal Information breach, where we are legally required to do so.

User names and passwords

If you choose, or are provided with, a user name, user identification code, password, security question and answer, verification number or any other piece of security information as part of our security procedures, you must treat such information as confidential and not disclose it to any third party. If you become aware of any unauthorised use of your security information, you must inform us immediately. We have the right to disable any account and registration with us at any time, if in our opinion, you have failed to comply with your obligation to keep your security information secure.

I. How long we will keep your information

Retention arrangements – how long we will keep your Personal Information

We will only retain your Personal Information for as long as is necessary, to fulfil the purposes which we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

For tax and legal claims purposes, we retain Transactional Information (with the associated Identity Information and Contact Information to the extent required for such purposes) for six years after an individual ceases being a customer.

In some circumstances we may anonymise your Personal Information (so that it can no longer be associated with you) for research, trend analysis, or statistical purposes, in which case we may use this information indefinitely without further notice to you.

J. Where your information may be processed

Transfer of Personal Information outside the European Economic Area

The Personal Information that we collect from you, may be transferred to, and processed at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff operating outside the EEA who work for us or one of our suppliers. Such staff may be engaged in, amongst other things, fulfilment of your order, provision of support or administration services, analysis of statistical data, or other functions as referred to in the Privacy & Cookies Policy. By submitting your Personal Information, you agree to this transfer, storing or processing.

Whenever we transfer your Personal Information outside the EEA, we ensure a similar degree of data protection safeguarding is afforded to it, by ensuring at least one of the following safeguards is implemented:

65.1. We will only transfer your Personal Information to countries that have been deemed to provide an adequate level of protection for Personal Information by the European Commission (further details in respect of such safeguards are available from: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en );

65.2. Where we use certain service providers (including in the USA), we may use specific contracts approved by the European Commission which give Personal Information the same protection it has in Europe (further details in respect of such safeguards are available from:  https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside eu/model-contracts-transfer-personal-data-third-countries_en); or

65.3. Where we use providers based in the USA, we may transfer Personal Information to them, if they have agreed to comply with the Privacy Shield, which requires them to provide similar protection to Personal Information shared between Europe and the USA. (further details in respect of such safeguards are available from: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en).

K. Knowing your legal rights

Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your Personal Information. If you wish to exercise these rights, in order to assist us with promptly dealing with them, we would request that you direct them, using the contact details shown in Paragraph 74 below.

You have the right to:

67.1. Request access to your Personal Information (commonly known as a “subject access request”). This enables you to receive a copy of the Personal Information which we hold about you, and to certain details in respect of the processing of such Personal Information.

67.2. Request correction of the Personal Information that we hold about you. This enables you to have corrected, any incomplete or inaccurate data which we hold about you, though we may need to verify the accuracy of the new data which you provide to us.

67.3. Request erasure of your Personal Information. This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information, where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your Personal Information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

67.4. Object to processing of your Personal Information where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation which makes you want to object to processing on this ground, as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes.

67.5. Request restriction of processing of your Personal Information. This enables you to ask us to suspend the processing of your Personal Information, in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it, as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

67.6. Request the transfer of your Personal Information to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

67.7. Withdraw consent at any time where we are relying on consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights referred to in Paragraph 67 above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you, to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that Personal Information is not disclosed to any person who has no right to receive it. We may also contact you, to ask you for further information in relation to your request, to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month, if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

L. Updating your information and contacting us or the supervisory authority

Updating and accessing your Personal Information and contacting us

It is important that the Personal Information which we hold about you, is accurate and current. Please keep us informed if your Personal Information changes during your relationship with us.

If you want to modify or update your registered details at any time, you can do this by logging in to the Website. Alternatively, you may inform us by any of the methods set out at Paragraph 73 below, of any changes in your Personal Information or marketing message preferences, and we will update or modify your Personal Information accordingly.

You can contact us with any queries or requests concerning your Personal Information or this Privacy Policy, by using the contact details shown below:

Contact email: privacy@cellardoorfilmsociety.co.uk

Your right to contact the supervisory authority

You also have the right to make a complaint at any time, to the Information Commissioner’s Office (“ICO”), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so we would be grateful if you would please contact us in the first instance.

Last updated: June 2020.