Privacy Policy

Our Privacy Commitment

The Edinburgh International Festival Society (in this policy collectively ‘Edinburgh International Festival Society’, ‘Edinburgh International Festival’, ‘International Festival’, ‘we’, ‘us’ and ‘our’) is committed to protecting the information we gather that identifies you as an individual (your personal information). We understand that your information is important to you and that you may have concerns. We have developed this privacy policy to give you all the details you need about how we process your personal information, why we process it and the steps we take to keep it secure. We may update this privacy policy when our safeguards change, and we recommend you check this page regularly. The current policy is effective from 12 December 2024.

You do not need to share all the information outlined below, but there may be some of our services you cannot use to a full extent if you choose to withhold information.

The Edinburgh International Festival Society delivers the Edinburgh International Festival every year. We are a charitable company limited by guarantee. The Edinburgh Festival Centre Ltd is a wholly owned trading subsidiary of the Edinburgh International Festival Society.

We are registered as the Edinburgh International Festival Society at the Information Commissioner’s Office and our data protection registration number is Z7668082. We are the data controller for the personal information you share with us, and we operate in accordance with current data protection legislation.

Contact details for the Edinburgh International Festival Society:
The Hub
Castlehill
Edinburgh
EH1 2NE

You can contact us by telephone +44 (0)131 473 2099, through our website contact form and by email [email protected].

If you would like to speak to someone about your personal information and its use, please contact [email protected].

Ticketing System and Online Accounts

Edinburgh International Festival Box Office sells tickets to our events through the website eif.co.uk. You will create an online account as part of the booking process. Once set up, you can access your online account at any time. The account is hosted on the Spektrix CRM system. Spektrix is headquartered in London. Personal information stored in the Spektrix system is stored in a UK-based datacentre.

How we collect your personal information

We collect your personal information in ways you would expect when you interact with the Edinburgh International Festival, such as when you book a ticket for one of our events, join us as a member or use our website.

We collect your personal information:

When you buy a ticket and create an online account
When you join us as a member, renew your membership or manage your membership
When you donate
When you join our Young Musician’s Pass scheme
When you join our Access Pass scheme
When you contact us by phone, in person, online or by post to make an enquiry or to access information
When you use our website, such as filling in one of our online forms or entering a competition
When you agree to receive communications from the International Festival
When you sign up to our newsletter through our website, which is distributed through DotDigital
When you access our social media channels such as Facebook and Instagram. We only receive personal information that you share with us voluntarily and that is compatible with your privacy settings. To find out more about how these social media companies process your personal information, we recommend that you read their privacy policies. From time to time, we may collect your personal information from third parties.

The personal information we collect

We only collect personal information that is necessary to meet our business needs and to provide you with the services you have requested.

Creating an account or buying a ticket

When you create an account with us or buy a ticket to one of our events, we will obtain information directly from you including the following:

Title
First Name
Middle Initial
Last Name
Address
Postcode
Email
Telephone number
Your communication preferences

Transactions and order fulfilment

When you buy a ticket for one of our events, we obtain information from you to fulfil the sales transaction including the following:

Name
Card details
Billing address

Joining us as a member or donor

When you join us as a member or donor, we collect basic account information as above. We may also collect additional personal information including:

Direct debit information
Card details
Gift aid information
Booking information, direct debit and gift aid information via your membership priority booking form

Debit/credit card details will only be used for the purpose of handling your sales transaction. Debit/credit card details and personal information will be passed to third-party processors to ensure the payments you make are authenticated, submitted and authorised.

Young Musician's Pass

When you join our Young Musician’s Pass scheme, open to Edinburgh-based young musicians and singers who are aged between 8 and 18 years of age, we collect basic account information as above. We also collect additional personal information as per the eligibility requirements of the scheme including:

Your date of birth
The name and participation consent of a parent and/or guardian

Access Pass

When you join our Access Pass scheme, open to anyone who has specific access requirements, we collect basic account information as above. We also collect additional personal information as per the eligibility requirements of the scheme including:

Whether you require a wheelchair space or wheelchair transfer seat, a free essential companion ticket, a touch tour ticket or a seat for viewing BSL interpretation
Whether you attend with an assistance dog, use an enhanced hearing or audio description headset or whether you have limited mobility
Whether you require additional support in the event of an evacuation

Using our website

When you use our website, we obtain information from your session, namely:

IP address

You can read more in the ‘Cookies’ section below.

How we use your personal information

We collect personal information from you where we have a valid legal basis for doing so, such as to fulfil a contract we have with you or because you have given your consent to the sharing. We will always explain to you our purposes for collecting personal information at the point of collection and we will let you know if our purposes change. We rely on legitimate interest for our marketing communications. For our bookers, members and donors, we will have to send a number of service emails related to sales and membership contracts.

Contracts

We use your information to meet our business needs, provide you with our services and to fulfil contracts. In relation to our bookers and members, we use your information:

to set up your account
to fulfil ticket requests, donations and membership requests
to provide information and support in connection with your account type
to administer and manage your membership
to process payments
to send you service emails related to your account, your ticket purchases and/or your membership, for example, receipts and confirmations, acknowledgements and thank you communications, gift aid and payment verifications
to send you information about the events you have booked, such as cancellations and changes to the programme
to communicate with you when you initiate contact with us
for customer service
for general administration and recordkeeping

Consent - marketing for our partner organisations

We will ask you if you want to receive additional marketing from our core venue partners by email. You can manage your marketing preferences at any time and more information is provided in the ‘Managing the personal information that we hold about you’ section.

Young Musician's Pass - parental consent

For participants of our Young Musician’s Pass scheme who are younger than 18 years of age, we ask that a parent or guardian give consent to your participation. We may also seek parental or guardian consent, where required, for participation in projects that are managed by our Discovery and Participation team.

Legitimate interests and legal obligations

We also use the information you provide for a number of legitimate purposes and to comply with legal obligations we may have.

General

We take steps to combat fraud and credit risk
We ensure the security of our information systems
We respond to and record enquiries when you contact us
We administrate the International Festival as part of our daily business
We process donations, including in accordance with due diligence and our obligations under charity law
We keep records to comply with our legal and financial obligations
We deliver and improve our customer service to you
We use CCTV on our premises at The Hub for the protection of our staff

Marketing

For marketing related to the International Festival’s programme, we rely on a legitimate interest basis. We will only contact people who have a previous recent booking history with us, with information about events which may be relevant to their booking history. Marketing communications includes online and offline tools such as emails and leaflets. When you book with us, we will assume that you want to hear from us, unless you opt out by unticking a box for email or post. This is known as a ‘soft opt in’. We will always be transparent and clear – so no tricky double negatives. You can manage your marketing preferences at any time and more information is provided in the ‘Managing the personal information that we hold about you’ section.
For marketing related to fundraising and membership, we rely on a legitimate interest basis. We only contact people with a strong booking history and direct customer relationship with the International Festival who we feel may be interested in exploring further support opportunities we have available.
We measure the effectiveness of our marketing campaigns and personalise our marketing communications so that they are more relevant to you as a booker and as an audience member.
We classify our audience into groups and segments on the basis of booking history and ticket purchases, attendance over time and information that is provided when you create an account, such as your postcode. We use anonymised data for this profiling.
We conduct analytics to better understand our development as an organisation. We use anonymised data for this analytical research. We consider the growth and sales rate of our tickets and combine this with other relevant data such as interaction with our website and social media.
We conduct in-depth audience research by email, online and/or in person every year to better understand the overall experience of the International Festival from the perspective of our audience. This research is based on a random sample of our attendees who self-select to take part. You are under no obligation to participate. Full details of the process are provided when we approach you to participate.

Donors and Members

We conduct research to support a number of our fundraising and income generation activities as a charity. This includes: ensuring that our membership and fund-raising campaigns, events and fund-raising communications are targeted in the most effective way; evaluating the effectiveness of these campaigns and making changes where required; determining whether certain individuals may be interested in supporting us, including as a major donor; ensuring we conduct campaigns and fund-raising activity in compliance with law and industry codes of practice; and ensuring that we have reasonable knowledge of prospective donors to minimise the risk of reputational damage to the International Festival.

We conduct the following research using existing supporter data and/or information from publicly available sources:

Membership. We conduct analysis of our audience by attendance, post code or other information on our own database to market our Membership Scheme to individuals who might be especially interested in joining our scheme to support us and take advantage of the benefits Membership can offer. This activity where our audience is segmented is not targeted at specifically identifiable individuals in the first instance. We use personal information such as contact details to send individuals information about the International Festival, the Membership Scheme and their Membership benefits in a targeted manner to make sure our Membership marketing budget is used effectively and appropriately.

Fundraising. We conduct analysis of our audience by attendance, donations, postcode and other information on our own database to contact our supporters who might be interested in supporting our fund-raising campaigns (which could include donations, individual giving schemes and legacy giving schemes). This activity where our audience is segmented is not targeted at specifically identifiable individuals in the first instance and communications sent to individuals thereafter are done so in accordance with our legitimate interests.

Major Gift Prospects.

For a smaller number of our audience, where we want to better understand their engagement with the International Festival and their potential interest in supporting us further, we carry out research on information in our own database such as their connections to ticket buying and history of giving to the International Festival and we may seek additional information from third party sources and research partners.

We endeavour to make sure that any research and data collection we do is only sourced from publicly available sources where an individual would, in our view, have reasonable expectation that their information may be freely read by the public or the individual has freely made information available in respect of their business and philanthropic interests. We do not seek to gather information where it is reasonable to conclude that the individual has made an effort to keep that information private such as information on family life or personal relationships that exist outside the business world.

We carefully balance our legitimate interests against your interests as an individual. You can exercise your rights over your personal information at any time.

How we share your personal information

We have clear agreements with all of our service providers who process your personal information on our behalf. In these cases, Edinburgh International Festival is the data controller and any third party is the data processor. Data processors will only use your personal information for the purposes we specify and as outlined in this privacy policy.

We will share your personal data (your name, email address and telephone number, where given) with our core venue partners in pre-event front of house reports when you book to attend an event at the venue. The legal basis for this is “performance of a contract”.
We will not sell, rent or trade your personal information to third parties for marketing or research purposes. We always ensure we have your consent before allowing our core venue partners to use your personal information for marketing purposes.
We may share your personal information, particularly your booking history, with our venue partners for research and development purposes. Data is pseudonymised and/or anonymised when used in this way.
Personal information obtained directly from our American Friends’ donors will be shared with our international service partner Chapel and York.
We also share your information with companies who provide services on our behalf, including mailing, processing orders and card payments, email delivery, website hosting, cloud services and customer service. You can read more in the ‘Security’ section.
We share your information with a number of GDPR-compliant data companies to assist us in our profiling and segmentation market research. Where this research involves automated processing, personal information is anonymised and will produce no substantial or legal effect for individuals involved.
We may disclose your personal information to a government agency or other authorised body where we are required to do so in order to comply with a law or court order, for example, charity law.
We will only consider relevant data-sharing requests from our event partners, such as co-producers of events at the International Festival. We will obtain explicit consent from you to share your personal data in these cases. We will always put in place a data-sharing agreement with that party that clearly outlines what data is to be shared and how that data will be processed. In these cases, both the International Festival and the partner with which the personal data is shared will both be considered independent data controllers.

Managing the personal information that we hold about you

We are committed to giving you control over the personal information you share with us. You can update and manage your personal information in different ways.

If you prefer, you can contact us directly about amendments to your personal information using our contact information provided in the ‘Privacy Commitment’ section or by emailing us - [email protected].

You can easily manage the personal information we hold about you through your online account. You have options to update your contact details and to manage your communications preferences for the Edinburgh International Festival and our core venue partners should you wish to. You can update your marketing preferences at any time.

Electronic marketing communications sent by the Edinburgh International Festival will always include functions to opt-out of similar communications in the future. Communications will also contain information and links that will allow you to manage your account preferences as above.

Cookies

Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful because they allow a website to distinguish you from other users which helps to provide you with a good experience when you browse that website.

You can find out more about cookies on the Edinburgh International Festival website here.

Security

We take the safeguarding of your information seriously. Our primary systems, including our internal systems and our ticketing/CRM platform Spektrix, use servers located in the European Economic Area. Your personal information may also be shared with data processors in the USA. We only work with USA-based processors who can provide a comparable level of data security that meets the requirements of European data protection law.

Our own secure server ensures that your personal details stay personal.

Every credit card purchase you make at our website is done through our Secure Server Technology. This provides many security features, including:

authentication: this assures your browser that your data is being sent to the correct computer server, and that the server is secure.
encryption: this encodes the data, so that it cannot be read by anyone other than the secure server.
data Integrity: this checks the data being transferred to ensure it has not been altered.

Our online ticketing facility accepts:

MasterCard; American Express; Visa; Visa Debit and Maestro.

Our secure server software encrypts information, ensuring that Internet transactions stay private and protected.

If you have any questions or concerns about our security, please contact our box office by emailing [email protected].

Retention

We will only collect and retain personal information from you in order to meet our purposes outlined in this privacy policy.

Retention

We will not retain information that is unnecessary for our business purposes.

Generally, we will retain ticket and membership purchase information for a minimum of seven years in order to comply with our financial auditing requirements. Should you wish to be removed from our marketing lists and those of our venue partners, we will have to retain a minimum amount of information about you on our system in order to fully comply with your request.

Your choices and rights

You can make choices and exercise your rights in relation to the personal information we hold about you.

You have the right to be informed about how we collect and process your personal information.
You have the right to withdraw your consent where it has been given, for example to receive marketing information from our core venue partners.
You have the right to object to our processing your personal information for reasons of our legitimate interests, for example, our fundraising and membership marketing or our event marketing. We will respond to your objections insofar as we are able, except where to do so may pose a risk to our company such as limiting our ability to combat fraud and credit risk.
You have the right to correct your personal information in cases where the information we hold about you is inaccurate or incomplete. The easiest way to ensure your information is accurate is to update any incorrect information through your Edinburgh International Festival online account.
You have the right to ask us to stop processing your personal information.
You can further request that we delete your personal information in a number of circumstances including when you withdraw consent, when you successfully object to processing and when the personal data we hold about you is no longer required for the purpose we collected it.
You have the right to obtain and reuse your personal information across other services.

Under the General Data Protection Regulation, you can request to see full details of the personal information that the Edinburgh International Festival Society holds about you. In order to initiate a request with us about your personal information, please send us a description of the information you would like to access using the contact details outlined in the ‘Privacy Commitment’ section or by emailing our data protection lead at [email protected].

If you would like to lodge a complaint with the supervisory authority, please contact the Information Commissioner’s Office.

This privacy policy was updated on 12 December 2024 at 16:00 GMT.