• Last Updated: July 2026
• Data Controller: The Clifton Community Arts Centre Limited (trading as Wellington Orbit)
• ICO Registration Number: ZA783011
• Contact Email: info@wellingtonorbit.co.uk

The Clifton Community Arts Centre Limited (trading as Wellington Orbit) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our venue, use our website, subscribe to our newsletter, or use our official mobile application (developed by Admit One).

Our staff are trained to handle your information securely and appropriately in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

We currently collect and process the following categories of personal information:

·       Customer & Booking Data: Name, email address, telephone number, and postcode when you purchase tickets, gift cards, Shares or memberships via our website, box office, or mobile app.

·       Digital & Technical Data: IP address, device type, operating system, unique device identifiers, website tracking cookies, and interaction logs collected automatically via our mobile application and website.

·       Marketing Data: Name and email address when you explicitly choose to opt-in to our digital newsletter.

·       Feedback & Communications: Information you provide when contacting us via email, completing voluntary feedback forms, or participating in community projects.

·       Volunteer & Staff Data: Name, address, contact details, conflict of interest declarations, references, role application data, and health/additional support requirements.

 

Note on Anonymised Data
We collect equality monitoring data and the first three digits of customer postcodes for geographical impact reporting. This data is strictly anonymised at the point of collection, contains no personally identifiable information, and is stored completely separately from your customer profile.

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

1. Contractual Obligation: To process ticket sales, manage memberships, and fulfil bookings made via Admit One.

2. Consent: For sending marketing communications via EmailOctopus, setting web analytics cookies, or delivering push notifications through our mobile app. You can withdraw your consent at any time.

3. Legal Obligation: To maintain financial and transactional records for tax, audit, and statutory purposes.

4. Legitimate Interests: To improve our app and website performance, secure our digital networks, and manage day-to-day administrative operations.

5. Special Category Data (Employment/Social Protection Law): We maintain limited health and accessibility records for staff/volunteers who require additional structural support. This data is kept strictly confidential, filed securely, and is accessible only by authorised HR personnel and the Volunteer Coordinator.

Our mobile application, developed and published by Collaborative Software Limited t/a Admit One, complies with Apple’s global privacy mandates:

·       Location Tracking: Our app does not track, monitor, or store your real-time geographic location.

·       Push Notifications: With your explicit consent upon opening the app, we may send you push notifications regarding ticket receipts, screening reminders, or updates. You can toggle these off at any time via your device’s system settings.

·       In-App Account Deletion: If you have created an account within our mobile app, you can permanently delete your account and all associated profile data directly through the user settings panel in the app.

When you visit our website, we use cookies and tracking scripts to optimize your browsing experience and analyse web traffic. Essential cookies are deployed automatically to handle critical features like shopping carts and ticket checkout states.

Non-essential cookies, specifically Google Analytics, are used to collect information about how visitors interact with our site (e.g., page views, session duration, and referral sources). Google Analytics is configured to anonymize your IP address. These analytics cookies are blocked by default and will not be placed on your device unless you provide explicit affirmative consent via our website's cookie consent banner. You can modify or withdraw your cookie preferences at any time using the control panel on our site or by adjusting your web browser settings.

Wellington Orbit does not sell or share your personal data with third parties for marketing purposes. However, we securely share data with trusted third-party service providers who act as data processors to deliver our services:

Processor	Purpose	Additional Notes
Admit One (Collaborative Software Limited)	Point of Sale (PoS), website booking infrastructure, and mobile app management.	Processes transaction, account, and technical logs.
Windcave	Secure payment gateway processing.	Fully PCI-DSS compliant. No raw credit/debit card details are stored by Wellington Orbit.
EmailOctopus	Distribution of email marketing, news, and newsletters.	Manages subscriber lists under explicit opt-in consent structures.
Microsoft Office 365	Internal administration, operational emails, and secure digital file storage.	Uses role-based access control and encrypted cloud servers.
Google LLC (Google Analytics)	Website traffic monitoring, user behaviour analysis, and statistical performance reporting.	Data is anonymised. Managed under the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

 

International Data Transfers
Where third-party processors transfer personal data outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are actively enforced (such as International Data Transfer Agreements, Standard Contractual Clauses, or UK Adequacy Extensions) to ensure your information remains protected to the same rigorous legal standard.

We may also disclose your personal data without your consent if legally required to do so by law enforcement, regulatory bodies, or to protect the safety of our staff and visitors.

We only retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements:

·       Financial & Transactional Records (Admit One / Windcave): Retained for 6 years plus the current financial year in accordance with UK HMRC tax and accounting regulations.

·       Marketing Profiles (EmailOctopus): Retained continuously until you unsubscribe, or submit a formal request for erasure.

·       Volunteer & Staff Records: Retained for 6 years following the formal conclusion of your relationship with Wellington Orbit.

Under UK data protection law, you hold fundamental rights regarding your information:

·       Right of Access: You have the right to ask us for copies of your personal data (Subject Access Request).

·       Right to Rectification: You have the right to ask us to rectify inaccurate data or complete incomplete records.

·       Right to Erasure: You have the right to ask us to erase your personal data in certain circumstances ('Right to be Forgotten').

·       Right to Restriction & Objection: You can request that we restrict or halt the processing of your data.

·       Right to Data Portability: You can request the transfer of your digital data to another organization.

If you wish to exercise any of these rights, please email us at info@wellingtonorbit.co.uk. We will respond to your request within 30 calendar days, free of charge.

If you have any concerns or questions about how we handle your personal data, please contact us directly at:

Wellington Orbit
1 Station Road,
Wellington,
Shropshire, TF1 1BY
Phone: 01952 743 377
Email: info@wellingtonorbit.co.uk

 

This policy is reviewed regularly by Wellington Orbit to ensure ongoing technical, functional, and legislative compliance.

 

·       V1.0 July 2026 - Baselined