This notice explains how the Pavilion uses personal information when you buy tickets, visit, donate, participate, volunteer, contact us or use our website and apps.
Last reviewed: 19 July 2026
1. Who is responsible for your information?
The Pavilion is operated through two related organisations. The organisation responsible for your information depends on how you interact with us:
- Gorleston Pavilion Theatre Ltd, company number 15213070, is responsible for theatre operations including ticket sales, events, venue hire and customer services.
- Gorleston Pavilion Trust Ltd, company number 07311986 and registered charity 1142375, is responsible for charitable activities, donations, volunteering and heritage work.
For some shared services the organisations may each be a controller. Both can be contacted at Pavilion Theatre, Pier Gardens, Gorleston, Norfolk NR31 6PP, by telephone on 01493 662841 or by email at admin@pavtheatre.com.
2. What information do we use?
Depending on your relationship with us, we may use:
- your name, postal address, email address and telephone number;
- booking, attendance, membership, donation and transaction records;
- account identifiers, communication preferences and consent records;
- correspondence, enquiries, complaints and feedback you send us;
- access requirements or other information you choose to give us so that we can make suitable arrangements;
- information needed for volunteering, participation, safeguarding or venue-hire relationships; and
- technical information such as IP address, browser, device, pages visited and cookie choices.
We normally receive information directly from you. We may also receive it from someone booking on your behalf, a parent or guardian, our ticketing and fundraising providers, delivery partners, public sources or another organisation where you have authorised the disclosure.
Access and safeguarding information can include special category information, such as health or disability details. We only use the minimum needed and apply the additional legal condition required by data protection law, such as explicit consent or substantial public interest where applicable.
3. Why do we use it, and on what lawful basis?
| Purpose | Usual lawful basis |
|---|---|
| Sell and administer tickets, memberships and services | Contract and steps taken at your request |
| Answer enquiries and manage our relationship with you | Contract or our legitimate interest in customer service |
| Process donations, Gift Aid and financial records | Contract, legal obligation and legitimate interests |
| Send email news and offers | Consent, or a permitted charitable or customer soft opt-in where its legal conditions are met |
| Provide access adjustments and protect people from harm | Contract, legal obligation, vital interests or substantial public interest, as appropriate |
| Keep the website secure and understand essential usage | Legitimate interests and legal obligations |
| Use optional analytics, media and similar technologies | Consent |
| Establish, exercise or defend legal claims | Legitimate interests and legal obligation |
Our legitimate interests include operating and improving the theatre, preventing fraud, keeping appropriate records, understanding our audiences and providing effective customer service. We balance these interests against your rights before relying on them. You can object to this processing using the contact details below.
Where information is needed to enter into or perform a contract, we may be unable to provide the relevant ticket, service or arrangement if it is not supplied. Optional marketing and analytics choices do not affect your ability to buy a ticket.
5. Is information sent outside the UK?
Some suppliers operate internationally, so information may be processed outside the UK. Where a restricted transfer takes place, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard.
You can ask us for more information about the safeguard used for a particular supplier.
6. How long do we keep information?
Our standard retention periods are:
| Record | Standard period |
|---|---|
| Bookings, payments, donations and Gift Aid records | Six years after the end of the relevant financial year, unless a longer period is legally required |
| Routine enquiries and customer-service correspondence | Up to two years after the matter is closed |
| Marketing contact details | Until you withdraw or the record becomes inactive; a minimal suppression record may be retained to honour your choice |
| Cookie preferences and related consent evidence | Up to one year before consent is requested again |
| Rights requests and data-protection complaints | Three years after the matter is closed |
| Safeguarding, accident, insurance and legal records | According to the applicable statutory, safeguarding, insurance or limitation period and the seriousness of the matter |
We may keep a record longer where a dispute, investigation, legal hold or regulatory requirement applies. When information is no longer required, we delete it securely or anonymise it.
7. Children and young people
Children and young people attend performances and may take part in workshops, stage-school activities, volunteering or productions. An adult will normally make a ticket purchase, but we may use a child’s information where it is necessary to administer participation, keep them safe or provide an appropriate service.
We minimise this information, use age-appropriate explanations and seek parent or guardian involvement where appropriate. We do not use children’s information for behavioural advertising or sell it.
8. How do we protect information?
We use proportionate technical and organisational measures, including access controls, staff and volunteer guidance, secure suppliers, backups, patching and incident procedures. No system is completely secure, but we regularly review the risks and act on suspected breaches.
9. Your data protection rights
Depending on the circumstances, you have the right to:
- receive information about how we use your information;
- ask for a copy of it;
- correct inaccurate or incomplete information;
- ask us to erase or restrict its use;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain information in a portable format; and
- withdraw consent at any time.
These rights are not absolute and depend on the lawful basis and any applicable exemptions. There is normally no charge. We will respond without undue delay and usually within one calendar month once we have what we reasonably need to verify and understand your request.
Email admin@pavtheatre.com or write to the postal address above. You can unsubscribe from marketing using the link in any marketing email.
10. Questions and complaints
Please contact us first if you have a concern. Our complaints policy explains how we acknowledge, investigate and respond to data-protection complaints.
You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the opportunity to resolve your concern first.
11. Changes to this notice
We review this notice at least annually and when our services or the law change. We will update the review date and bring material changes to your attention where appropriate.