Privacy Policy


Scottish Opera (“we”) is committed to protecting and respecting your personal information. Please read this Privacy Statement to understand how we will use or process any personal data we collect from you; why we collect or process it; what we do to keep it secure and your rights if you have any concerns about the information we hold about you and how we use it. We work in accordance with the General Data Protection Regulation (GDPR) 2018, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). 

We regularly review our practices to ensure that your privacy is appropriately protected. We may update or modify this Privacy Statement from time to time so we recommend you should view it regularly. This Privacy Statement was updated on 2 September 2024.   

contents

=Who we are 

Scottish Opera is Scotland’s national opera company. We give performances across Scotland and beyond, and provide an extensive education and outreach programme for people of all ages. We are a registered charity (SC019787) and a company limited by guarantee. Scottish Opera is the data controller of the personal information you share with us. 

 Scottish Opera is registered at the Information Commissioner’s Office. Our data protection registration number is Z4805469 

You can contact us at: 

Scottish Opera 
39 Elmbank Crescent 
Glasgow G2 4PT 

By phone +44 (0)141 248 4567, by email info@scottishopera.org.uk or via our website at www.scottishopera.org.uk/contact-us. 

If you have questions about your personal information or how we use it, please contact our Data Protection Officer by email data@scottishopera.org.uk or by phone +44 (0)141 248 4567. 

  

How we collect your personal information 

We collect your personal information when you interact with Scottish Opera: 

  1. When you sign up to receive emails from us (distributed through DotDigital).
  2. When you make an online purchase.
  3. When you join us as a member or renew your membership.
  4. When you make a donation.
  5. When you visit our website: we use cookies to improve the experience of using our website. This means we will remember your previous visits and track the pages on our website that you visit. Please see section on our Cookie Policy below for more information.
  6. When you sign up to participate in one of our education and outreach projects.
  7. When you tell us information about yourself at meetings, in conversations, etc.
  8. When you visit our social media channels, including Facebook, Twitter, Instagram and YouTube, we receive the personal information that you share with us according to your privacy settings. To find out more about how these companies process your personal information, we recommend that you read their privacy policies.
  9. We may get personal information about you from third parties, including the venue box offices where you buy tickets for our performances.
  10. When you provide goods or services to us, we may collect information about you. 

  

The types of information we collect 

We collect information that’s necessary to carry out our business, provide you with services you have requested, keep you informed about our activities and to understand your needs.   

  

Joining our e-newsletter mailing list 

When you sign up to receive our e-newsletter mailing through our website, we collect the following information: 

  • First name 
  • Last name 

  • Email address 
  • Date of birth

  • Contact preferences 

  

Joining us as a member or becoming a donor 

When you join us or renew as a member, supporter or donor, we collect the following information: 

  • Full name 
  • Postal address 
  • Email address 
  • Phone numbers 
  • Information about your donation or gift 
  • Family and spouse/partner details, and relationships to other donors 
  • Ticket purchase and event registration / attendance 

We may also collect additional personal information such as: 

  • Direct debit information 
  • Credit/debit card details 
  • Gift Aid status and gift information  
  • Contact preferences 
  • Current interests, activities and background information 
  • Details of correspondence sent to or received from you 
  • Information you give us when completing any membership or donation forms or when we meet 
  • Wealth assessment information 
  • Information that is publicly available, such as information published in newspapers 
  • Information shared with us by a partner organisation, such as ticket booking information shared by our venues and box offices (Theatre Royal Glasgow (ATG), Capital Theatres Edinburgh, Aberdeen Performing Arts and Eden Court Inverness). Please check venue and box office privacy policies when you provide your information to them. 

Scottish Opera will not keep your card details once the transaction is complete. Credit/debit card details will only be used for processing your sales transaction or gift. Card details and personal information will be shared with a third-party processor, Worldpay, to authenticate and authorise payments.  Direct Debits will be processed through Bottomline PTX or Finastra Bacsactive software. Scottish Opera will not keep your card details once the transaction is complete.     

Participating in Scottish Opera Young Company, Memory Spinners, Community Choir or other workshops or groups 

When you join us to participate in a scheme, project or workshop such as Scottish Opera Young Company, Memory Spinners or Community Choir, we collect the following information: 

  • Full name 
  • Postal address 
  • Email address 
  • Phone numbers 

We may also collect additional personal information as required by the particular participatory group such as: 

  • Credit/debit card details 
  • Date of birth 
  • Musical ability, including any relevant qualifications 
  • Name and participation consent of parent or guardian 
  • Emergency contact/next of kin contact details 
  • Medical information 
  • Details of correspondence sent to or received from you 

  

Using our website 

When you visit our site, we obtain the following information from your session: 

  • IP address 

Please see our Cookies Policy below for more information. 

  

Visiting our premises 

We use CCTV in our premises at Elmbank Crescent and Edington Street for security reasons to protect our staff and premises.  

  

How we use your personal information 

We use information about you to provide our services to you and manage transactions. You can opt out of, or ask us to change, the way we use this data at any time by contacting us at data@scottishopera.org.uk 

  

E-newsletter mailing list – under GDPR processing basis of consent 

When you sign up to receive news and updates from us by email, we will use your information to send you regular newsletters by email to keep you up-to-date with relevant information about Scottish Opera performances, events, news and opportunities to support our work.  We keep a record of the emails we send you, and may track whether you receive or open them so we can make sure we are sending you the most relevant information.  We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe.  

  

Current and recent members and donors: Administrative – under GDPR processing basis of legal obligation 

We will use the data we hold about you to keep you informed about your membership status and Direct Debit set-up and renewal information.   

  

Current and recent members and donors: Marketing and Fundraising – under GDPR processing basis of legitimate interest We use your data to: 

  • Provide excellent customer service 
  • Keep records of our relationship with you 
  • Administer your donation including, where appropriate, processing Gift Aid 
  • Process payments 
  • Ensure that we contact you with information most relevant to you, which may include: 
  • Information relating to your membership or donations, including renewal reminders 
  • Information about performances, events, education events and ways of supporting Scottish Opera, including Play a Supporting Role Appeals 
  • News and updates about Scottish Opera and related matters, including Brio magazine which is sent to current members and donors 
  • Thank you communications for your support or donations 
  • Personal invitations to events, and confirmation of event attendance / receipt of payment for an event 
  • Requests to support us in various ways 

  

Current and recent members and donors: Telephone communications – under GDPR processing basis of legitimate interest  

We will use the data we hold about you to telephone you for the following purposes. If you are registered with the Telephone Preference Service, we will only telephone you if you have explicitly given consent for us to do so. 

  • To thank you for your support 
  • To provide information about events for members and donors 
  • To invite you to events, including tours, meetings, Education projects and performances 

  

Current and recent members and donors: Prospect Research – under GDPR processing basis of legitimate interest  

From time to time we engage Prospecting for Gold to undertake wealth screening and research, to help us understand the philanthropic interests of our donors and potential donors, including gathering information from publicly available resources such as Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives.  

We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, ticket buyers or those connected with Scottish Opera in some other form. We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations. 

You can opt out of your data being used for wealth screening purposes by contacting us on data@scottishopera.org.uk. 

 

Current and recent members of Friends of Scottish Opera and the Alexander Gibson Circle (AGC): E-mail communications – under PECR basis of soft opt-in.  

As a small proportion of your gift to the Friends or AGC incurs VAT, PECR permits the use of email to communicate with you, unless you advise us that you wish otherwise. We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe. We will use the data we hold about you to send you information for the following purposes: 

  • E-mail communications to thank you for your support and special messages from Scottish Opera to members and donors, such as Christmas Greetings 
  • Information about and invitations to events, including tours, meetings, Education projects and performances 

Other current and recent donors (excluding Friends of Scottish Opera and AGC members): E-mail communications – under GDPR processing basis of consent  

If you consent to receiving communications from us by email, we will use the data we hold about you to send you information for the following purposes: 

  • E-mail communications to thank you for your support and special messages from Scottish Opera to members and donors, such as Christmas Greetings 
  • Information about and invitations to events, including tours, meetings, Education projects and performances 

We will always provide you with an opportunity to unsubscribe in any emails that we send to you, and will retain your information until you unsubscribe. 

  

Gift membership – under GDPR processing basis of consent 

If you are given a membership as a gift from another individual, we will ask for your consent to collect and process your information to use as described above for members and donors. 

  

Current and recent Friends of Scottish Opera, Alexander Gibson Circle members and other current and recent members and donors – retention of data 

We will retain your data whilst you are a member/donor and for two years beyond this time, at which point, if there has been no further action, we will mark your record as inactive, after which point we will use your data to maintain a record of gifts and essential information but will not use the data to contact you. 

  

Current and recent Scottish Opera ticket buyers – under GDPR processing basis of consent (via venue or box office) 

We may use the data we hold about you to send you information for the following purposes: 

  • Information about performances, events and ways of supporting Scottish Opera, including specific fundraising appeals such as Play a Supporting Role 
  • From time to time, we may also use your information to contact you for market research purposes. Participation in any such research is voluntary 

We will keep your personal information until you tell us you no longer wish to hear from us.  

This information will be held by the venue or box office from which you purchased tickets under the terms of their respective privacy policies, and also in Scottish Opera's Spektrix system. 

  

Participants in Scottish Opera Youth Company, Memory Spinners, Community Choir and other workshops and groups – under GDPR processing basis of contract 

We will only use your personal information to administrate your participation in a Scottish Opera project or workshop and to keep you informed about it.  To ensure your wellbeing, we may need to hold sensitive information, including medical information and next of kin contact details.  As with all your personal information, this will only be available to those who need it and will be stored securely. We will only keep your personal information until the end of the project or scheme in which you are participating, unless you give us permission to keep it for longer so that we can keep you informed about our activities. Credit / debit card details will only be used for processing your sales transaction.  Card details and personal information will be shared with a third-party processor to authenticate and authorise payments.  Scottish Opera will not keep your card details once the transaction is complete unless you give us permission to store them (optional). If permission is given, we will store the details in a way that is PCI compliant and will always ask for consent before using any stored details for a transaction unless you have consented to continuous authority. Credit/debit card details will only be used for processing your sales transaction or gift. Card details and personal information will be shared with a third-party processor, Worldpay, to authenticate and authorise payments.  Direct Debits will be processed through Bottomline PTX or Finastra Bacsactive software.

  

Visiting premises / CCTV – under GDPR processing basis of legitimate interest 

We use CCTV in our premises at 39 Elmbank Cresent, Glasgow G2 4PT and at 40 Edington Street, Glasgow G4 9RD to protect the security of our staff and premises. We keep CCTV footage on our system for 20 days. 

  

Retention of your personal information 

We will only keep information that is necessary for our business purposes, and will only keep it for as long as is reasonably necessary for those purposes and to fulfil our legal obligations, for example, to comply with financial auditing requirements and HMRC.  The retention period will vary according to the purpose as detailed above (in the section ‘How we use your personal information’).  For more information, please contact our Data Protection Controller at data@scottishopera.org.uk. 

  

Sharing your personal information 

We will not sell or rent your personal information to any third parties without your prior consent. 

From time to time we may engage a Data Processor to provide services on our behalf and, in such cases, we may have to share personal information with them in order for them to do so. In such cases they will use and disclose your information only to the extent necessary to perform that service. These suppliers are currently:  

  • Spektrix, hosted ticketing and customer relationship management system 
  • DotDigital, an email service provider  
  • Prospecting for Gold 
  • Codiance, website developer 
  • Mail Marketing, our mailing house 
  • Purple Seven, which provides software to enable audience analytics and insights 
  • Purple Seven Vital Statistics, which is a data management and communications system 
  • Worldpay, our card payment processors 
  • Enthuse (charity checkout), which provides an online payment solution for people making donations to us 
  • HMRC, to provide information related to Gift Aid and if requested by HMRC for another reason 
  • Charities Aid Foundation, which provides an online donation processing platform 
  • BACS, for payment processing 
  • Finastra Bacsactive, for direct debit collections and payments 
  • Bottomline PTX, for processing direct debit collections 
  • Google, which provides analytics of website use 
  • Hotjar - behavioural analytics and website user experience tool 
  • Survey Monkey - an online survey tool 

We have agreements in place with these suppliers to ensure that your data is secure and is only used for the purposes we specify and in accordance with this Privacy Statement. Any transfer of data will be done securely, in accordance with best practice and in compliance with the Data Protection Act 1998.  
We may disclose your personal information where there is a legal requirement on us to do so. Your data will never be sold or passed to any third party for any other purpose. 

  

Cookies Policy 

When you use our website, the web server automatically collects standard information such as your IP address, browser type, operating system and access times. Like many websites, we use cookies. These are small electronic files which are downloaded to your device when you visit a website.  The information received is used to monitor the volume, type and pattern of traffic using the site which helps us ensure that our website provides the best possible service to users. Cookies may also be used for remarketing purposes. You can disable cookies in your web browser so your computer will not receive them – for information about cookies and how to manage them, visit http://tools.google.com/dlpage/gaoptout 

Please be aware that without cookies you will be unable to view some parts of our site, or it may not function properly. 

  

Cookies used on our site 

We use two types of cookies: 

  • Strictly necessary cookies These cookies are essential in order to enable you to move around the website and use its features. 
  • Analytical cookies 
    These cookies enable us to recognise and count the number of visitors to our site in an anonymous way, and to see how visitors use the site. This helps us to improve how our website works. For this, we use Google Analytics (Google Inc.). These cookies cannot be used to identify you personally. The information generated by the cookie will be transmitted and stored by Google on servers in the United States. Analytical cookies may be used to track the effectiveness of an online advertising campaign. These are used for analysis purposes to help optimise online advertising campaigns and ensure you receive ads that are relevant to you. To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout 

  

Links to other websites 

Scottish Opera’s website may contain links to other websites owned and operated by third parties.  We cannot guarantee the privacy policies of these websites, and advise you to read the Privacy Statement on any such websites.  

  

Keeping your data safe 

Your personal information will be held and processed securely by Scottish Opera or our suppliers mentioned above. We implement robust security technologies, processes and procedures to protect the information we hold from unauthorised access and improper use or disclosure. Access to personal data is strictly controlled, and all members of staff and data processors who have access to personal information are legally obliged to respect its confidentiality. Occasionally we may use service providers located outwith the EEA. Currently we use USA-based data processors Google Analytics provided by Google Inc. and email distributor DotDigital, part of The Rocket Science Group, which is certified to the EU-US Privacy Shield Framework. In such cases, we ensure that any information is transferred securely and disclose your information only to the extent necessary to perform that service. We ensure that these suppliers process your information securely and that your data is only used for the purposes we specify and in accordance with our Privacy Policy. 

If required to do so by law, we may need to disclose your details. 

  

Your rights 

  • We are committed to handling your information responsibly and securely. You have the following rights relating to your personal data: 
  • To request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. 
  • To request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. 
  • To request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 
  • To object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. 
  • To request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 
  • To withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.  

You can exercise your rights by contacting our Data Protection Controller at 

Scottish Opera 
39 Elmbank Crescent 
Glasgow G2 4PT 
Email: data@scottishopera.org.uk 

If you are unhappy with how we handle your personal information, you can write to us using the contact details noted above. You have the right to make a complaint to the supervisory authority: please contact the Information Commissioner’s Office (ICO) https://ico.org.uk/concerns or the Independent Panel for Fundraising Standards and Complaints in Scotland. 

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 

This statement was published on 2 September 2024.