Our Privacy Commitment

The Edinburgh International Festival Society (in this policy collectively ‘Edinburgh International Festival Society’, ‘Edinburgh International Festival’, ‘International Festival’, ‘we’, ‘us’ and ‘our’) is committed to protecting the information we gather that identifies you as an individual (your personal information). We understand that your information is important to you and that you may have concerns. We have developed this privacy policy to give you all the details you need about how we process your personal information, why we process it and the steps we take to keep it secure. We may update this privacy policy when our safeguards change, and we recommend you check this page regularly. The current policy is effective from 26 of March 2019.

You do not need to share all the information outlined below, but there may be some of our services you cannot use to a full extent if you choose to withhold information.

The Edinburgh International Festival Society delivers the Edinburgh International Festival every year. We are a charitable company limited by guarantee. The Edinburgh Festival Centre Ltd is a wholly owned trading subsidiary of the Edinburgh International Festival Society.

We are registered as the Edinburgh International Festival Society at the Information Commissioner’s Office and our data protection registration number is Z7668082. We are the data controller for the personal information you share with us and we operate in accordance with current data protection legislation.

Contact details for the Edinburgh International Festival Society:

The Hub
Castlehill
Edinburgh
EH1 2NE

You can contact us by telephone +44 (0)131 473 2099, through our website contact form and by email contact@eif.co.uk.

If you would like to speak to someone about your personal information and its use, please contact dataprotection@eif.co.uk.

Ticketing System and Online Accounts

Edinburgh International Festival Box Office sells tickets to our events through the website eif.co.uk. You will create an online account as part of the booking process. Once set up, you can access your online account at any time. The account is hosted on the Spektrix ticketing system. Spektrix is headquartered in London. Personal information stored in the Spektrix system is stored in a UK-based datacentre.

How we collect your personal information

We collect your personal information in ways you would expect when you interact with the Edinburgh International Festival, such as when you book a ticket for one of our events, join us as a member or use our website.

We collect your personal information:

• When you buy a ticket and create an online account
• When you join us as a member, renew your membership or manage your membership
• When you donate
• When you join our Young Musician’s Passport scheme
• When you contact us by phone, in person, online or by post to make an enquiry or to access information
• When you use our website, such as filling in one of our online forms or entering a competition
• When you agree to receive communications from the International Festival
• When you sign up to our newsletter through our website, which is distributed through DotDigital
• When you access our social media channels, including Twitter, Instagram, YouTube, Facebook, Flickr, Pinterest and Snapchat: we only receive personal information that you share with us voluntarily and that is compatible with your privacy settings. To find out more about how these social media companies process your personal information, we recommend that you read their privacy policies. From time to time, we may collect your personal information from third parties.

The Personal information we collect

We only collect personal information that is necessary to meet our business needs and to provide you with the services you have requested.

Creating an account or buying a ticket

When you create an account with us or buy a ticket to one of our events, we will obtain information directly from you including the following:

• Title
• First Name
• Middle Initial
• Last Name
• Address
• Postcode
• Email
• Telephone number
• Your communication preferences

Transactions and order fulfilment

When you buy a ticket for one of our events, we obtain information from you to fulfil the sales transaction including the following:

• Name
• Card details
• Billing address

Joining us as a member or donor

When you join us as a member or donor, we collect basic account information as above. We may also collect additional personal information including:

• Direct debit information
• Card details
• Gift aid information
• Booking information, direct debit and gift aid information via your membership priority booking form

Card details will only be used for the purpose of handling your sales transaction. Card details and personal information will be passed to third-party processors to ensure the payments you make are authenticated, submitted and authorised.

Young Musician’s Passport

When you join our Young Musician’s Passport scheme, open to Edinburgh-based young musicians who are below 18 years of age, we collect basic account information as above. We also collect additional personal information as per the eligibility requirements of the scheme including:

• Your date of birth
• The name and participation consent of a parent and/or guardian

Using our website

When you use our website, we obtain information from your session namely:

• IP address

You can read more in the ‘Cookies’ section below.

How we use your personal information

We collect personal information from you where we have a valid legal basis for doing so, such as to fulfil a contract we have with you or because you have given your consent to the sharing. We will always explain to you our purposes for collecting personal information at the point of collection and we will let you know if our purposes change. We rely on legitimate interest for our marketing communications. For our bookers, members and donors, we will have to send a number of service emails related to sales and membership contracts.

Contracts

We use your information to meet our business needs, provide you with our services and to fulfil contracts. In relation to our bookers and members, we use your information to:

• set up your account
• fulfil ticket requests, donations and membership requests
• provide information and support in connection with your account type
• administer and manage your membership
• process payments
• send you service emails related to your account, your ticket purchases and/or your membership, for example, receipts and confirmations, acknowledgements and thank you communications, gift aid and payment verifications
• send you information about the events you have booked, such as cancellations and changes to the programme
• communicate with you when you initiate contact with us
• customer service
• general administration and recordkeeping

Consent - Marketing for our partner organisations

We will ask you if you want to receive additional marketing from our core venue partners by email. You can manage your marketing preferences at any time and more information is provided in the ‘Managing the personal information that we hold about you’ section.

Young Musician’s Passport - Parental consent

For participants of our Young Musician’s Passport scheme who are younger than 18 years of age, we ask that a parent or guardian give consent to your participation. We may also seek parental or guardian consent, where required, for participation in projects that are managed by our Learning and Engagement team.

Legitimate interests and legal obligations

We also use the information you provide for a number of legitimate purposes and to comply with legal obligations we may have.

General

• We take steps to combat fraud and credit risk
• We ensure the security of our information systems
• We respond to and record enquiries when you contact us
• We administrate the International Festival as part of our daily business
• We process donations, including in accordance with due diligence and our obligations under charity law
• We keep records to comply with our legal and financial obligations
• We deliver and improve our customer service to you
• We use CCTV on our premises at The Hub for the protection of our staff

Marketing

• For marketing related to the International Festival’s programme, we rely on a legitimate interest basis. We will only contact people who have a previous recent booking history with us, with information about events which may be relevant to their booking history. Marketing communications includes online and offline tools such as emails and leaflets. If you wish to opt out of receiving marketing communications, you can manage your marketing preferences at any time and more information is provided in the ‘Managing the personal information that we hold about you’ section.
• For marketing related to fundraising and membership, we rely on a legitimate interest basis. We only contact people with a strong booking history and direct customer relationship with the International Festival who we feel may be interested in exploring further support opportunities we have available.
• We measure the effectiveness of our marketing campaigns and personalise our marketing communications so that they are more relevant to you as a booker and as an audience member.
• We classify our audience into groups and segments on the basis of booking history and ticket purchases, attendance over time and information that is provided when you create an account, such as your postcode. We use anonymised data for this profiling.
• We conduct analytics to better understand our development as an organisation. We use anonymised data for this analytical research. We consider the growth and sales rate of our tickets and combine this with other relevant data such as interaction with our website and social media.
• We conduct in-depth audience research by email, online and/or in person every year to better understand the overall experience of the International Festival from the perspective of our audience. This research is based on a random sample of our attendees who self-select to take part. You are under no obligation to participate. Full details of the process are provided when we approach you to participate.

Donors and Members

We conduct Research to support a number of our fund-raising and income generation activities as a charity. This includes: ensuring that our membership and fund-raising campaigns, events and fund-raising communications are targeted in the most effective way; evaluating the effectiveness of these campaigns and making changes where required; determining whether certain individuals may be interested in supporting us, including as a major donor; ensuring we conduct campaigns and fund-raising activity in compliance with law and industry codes of practice; and ensuring that we have reasonable knowledge of prospective donors to minimise the risk of reputational damage to the International Festival.

We conduct the following research using existing supporter data and/or information from publicly available sources:

Membership. We conduct analysis of our audience by attendance, post code or other information on our own database to market our Membership Scheme to individuals who might be especially interested in joining our scheme to support us and take advantage of the benefits Membership can offer. This activity where our audience is segmented is not targeted at specifically identifiable individuals in the first instance. We use personal information such as contact details to send individuals information about the International Festival, the Membership Scheme and their Membership benefits in a targeted manner to make sure our Membership marketing budget is used effectively and appropriately.

Fund-raising. We conduct analysis of our audience by attendance, donations, postcode and other information on our own database to contact our supporters who might be interested in supporting our fund-raising campaigns (which could include donations, individual giving schemes and legacy giving schemes). This activity where our audience is segmented is not targeted at specifically identifiable individuals in the first instance and communications sent to individuals thereafter are done so in accordance with our legitimate interests.

Major Gift Prospects. For a smaller number of our audience, where we want to better understand their engagement with the International Festival and their potential interest in supporting us further, we carry out research on information in our own database such as their connections to ticket buying and history of giving to the International Festival and we may seek additional information from third party sources such as the following websites:

• Google – google.co.uk and other search engines
• Office of the Scottish Charity Regulator - oscr.org.uk
• Public register of companies - beta.charitycommission.gov.uk
• Companies House - beta.companieshouse.gov.uk/
• LinkedIn - linkedin.com
• Websites of other arts organisations and charities
• Company websites, newspaper archives, and housing market websites
• UK Electoral Roll and Directory Enquiries – 192.com
• Social Media platforms including Twitter, Instagram and Facebook where that information is publicly available, compatible with your privacy settings and you have shared it voluntarily

We endeavour to make sure that any research and data collection we do is only sourced from publicly available sources where an individual would, in our view, have reasonable expectation that their information may be freely read by the public or the individual has freely made information available in respect of their business and philanthropic interests. We do not seek to gather information where it is reasonable to conclude that the individual has made an effort to keep that information private such as information on family life or personal relationships that exist outside the business world.

We carefully balance our legitimate interests against your interests as an individual. You can exercise your rights over your personal information at any time.

How we share your personal information

We have clear agreements with all of our service providers who process your personal information on our behalf. They will only use your personal information for the purposes we specify and as outlined in this privacy policy.

• We do not sell, rent or trade your personal information to third parties for marketing or research purposes. We always ensure we have your consent before allowing our core venue partners to use your personal information for marketing purposes.
• We may share your personal information, particularly your booking history, with our venue partners for research and development purposes. Data is pseudonymised and/or anonymised when used in this way.
• Personal information obtained directly from our American Friends’ donors will be shared with our international service partner Chapel and York.
• We also share your information with companies who provide services on our behalf, including mailing, processing orders and card payments, email delivery, website hosting, cloud services and customer service. You can read more in the ‘Security’ section.
• We share your information with a number of GDPR-compliant data companies to assist us in our profiling and segmentation market research. Recent and current companies we work with include Culture Republic and Baker Richards. Where this research involves automated processing, personal information is anonymised and will produce no substantial or legal effect for individuals involved.
• We may disclose your personal information to a government agency or other authorised body where we are required to do so in order to comply with a law or court order, for example, charity law.

Managing the personal information that we hold about you

We are committed to giving you control over the personal information you share with us. You can update and manage your personal information in different ways. Managing your information is as easy as sharing it.

You can easily manage the personal information we hold about you through your online account. Go to eif.co.uk and sign in via the ‘my account’ button. You have options to update your contact details and to manage your communications preferences for the Edinburgh International Festival and our core venue partners should you wish to. You can update your marketing preferences at any time.

Electronic marketing communications sent by the Edinburgh International Festival will include functions to opt-out of similar communications in the future. Communications will also contain information and links that will allow you to manage your account preferences as above.

If you prefer, you can contact us directly about amendments to your personal information using our contact information provided in the ‘Privacy Commitment’ section or by emailing us - contact@eif.co.uk.

Cookies

Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful because they allow a website to distinguish you from other users which helps to provide you with a good experience when you browse that website.

The Edinburgh International Festival website eif.co.uk uses three types of cookies as set out below.

Strictly necessary cookies

Our website uses “session cookies” to provide our online booking service. These cookies are essential in order to enable you to move around the website and use its features, such as the shopping basket. Session cookies are created temporarily. Once you close the browser, all session cookies are deleted.

Analytical cookies

These cookies allow us to recognize and count the number of visitors in an anonymous form and to see how visitors move around the site when they’re using it. This helps us to improve the way our website works. In order to do this we use Google Analytics, a web analytics service provided by Google, Inc. (“Google”).

Google Analytics uses cookies to help the website analyse how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. We will never (and will not allow any third party to) use Google Analytics to track or collect any personally identifiable information of visitors to our site. Neither we nor Google will link, or seek to link, an IP address with the identity of a computer user.

Some event promoters may also make use of analytical cookies to track the effectiveness of their online advertising campaigns. These cookies are used for analysis purposes to help optimise online advertising campaigns and ensure you only receive ads from those event promoters that are relevant to you.

Re-marketing cookies

We use cookies to remarket to visitors to our website. Adverts will appear across websites you visit, which are part of the Google Display Network, with the content of these adverts based on your browsing activity on our website, eif.co.uk. If you wish to opt out of receiving these re-marketing ads you can do so by visiting Google’s Ads Settings page

You can choose whether or not to allow the setting of cookies using the privacy settings of your browser; however, session cookies must be enabled in order for our online service to process your booking correctly. Find out more about how to control cookies here.

Security

We take the safeguarding of your information seriously. Our primary systems, including our internal systems and Spektrix, use servers located in the UK. Your personal information may also be shared with data processors in the USA. We only work with USA-based processors who can provide a comparable level of data security that meets the requirements of European data protection law.

USA-based data processors we currently use are Freshdesk provided by FreshWorks Inc; Google Analytics provided by Google; Facebook Business Manager provided by Facebook; and Greenvelope. To find out more about how these organisations process personal information, we recommend that you read their privacy policies.

Our own secure server ensures that your personal details stay personal.

Every credit card purchase you make at our website is done through our Secure Server Technology. This provides many security features, including:

• authentication: this assures your browser that your data is being sent to the correct computer server, and that the server is secure.
• encryption: this encodes the data, so that it cannot be read by anyone other than the secure server.
• data Integrity: this checks the data being transferred to ensure it has not been altered.

Our online ticketing facility accepts:

MasterCard; American Express; Visa; Visa Debit and Maestro.

Our secure server software encrypts information, ensuring that Internet transactions stay private and protected.

If you have any questions or concerns about our security, please contact our box office boxoffice@eif.co.uk.

Retention

We will only collect and retain personal information from you in order to meet our purposes outlined in this privacy policy.

We will not retain information that is unnecessary for our business purposes. Generally, we will retain ticket and membership purchase information for a minimum of seven years in order to comply with our financial auditing requirements. Should you wish to be removed from our marketing lists and those of our venue partners, we will have to retain a minimum amount of information about you on our system in order to fully comply with your request.

Your choices and rights

You can make choices and exercise your rights in relation to the personal information we hold about you.

• You have the right to be informed about how we collect and process your personal information.
• You have the right to withdraw your consent where it has been give, for example to receive marketing information from our core venue partners.
• You have the right to object to our processing your personal information for reasons of our legitimate interests, for example, our fundraising and membership marketing or our event marketing. We will respond to your objections insofar as we are able, except where to do so may pose a risk to our company such as limiting our ability to combat fraud and credit risk.
• You have the right to correct your personal information in cases where the information we hold about you is inaccurate or incomplete. The easiest way to ensure your information is accurate is to update any incorrect information through your Edinburgh International Festival online account.
• You have the right to ask us to stop processing your personal information.
• You can further request that we delete your personal information in a number of circumstances including when you withdraw consent, when you successfully object to processing and when the personal data we hold about you is no longer required for the purpose we collected it.
• You have the right to obtain and reuse your personal information across other services.

Under the General Data Protection Regulation, you can request to see full details of the personal information that the Edinburgh International Festival Society holds about you. In order to initiate a request with us about your personal information, please send us a description of the information you would like to access using the contact details outlined in the ‘Privacy Commitment’ section or by emailing our data protection lead at dataprotection@eif.co.uk.

If you would like to lodge a complaint with the supervisory authority, please contact the Information Commissioner’s Office www.ico.org.uk.

This privacy policy was updated on 12 April 2021 at 16.30pm GMT.