mobile icon

Privacy Notice

Customers Privacy Notice

As a customer of Newcastle Castle run by The Heart of the City Partnership, the personal data that we process and / or hold about you is the information provided by you during your transactions with us for us to carry out our business on your behalf.

In the main part this would be:

  • Your name and address (when required for processing of gift aid ticketing) is stored securely through our third-party POS systems operator. This information is accessible via our back-office system to restricted personnel and is used to make submissions to HMRC for gift aid reclaim.
  • Debit or credit card details which are processed by our merchant account services. Every year we verify our PCI DSS compliance. No card details are held in house. At no point will the organisation or its employees store card details when/if you pay by debit or credit card.
  • Your email address should you opt to leave it on our feedback form, newsletters sign-up forms, other contact forms or during the gift aid and non-gift-aid ticketing process (both online or offline), so we can contact you regarding future events and offers. This data is used in Mailchimp and is stored on a spreadsheet which is held securely on our IT system or deleted from our own IT system once uploaded to MailChimp, access being restricted to only employees and volunteers, who are processing our communications with you.
  • CCTV footage while being monitored in clearly defined CCTV areas.

Personal data may be retained for as long as necessary for us to carry out our business with you, or until you tell us that you no longer wish us to retain your information. Personal data will then be deleted unless it is required to meet a statuary obligation. Personal data that we hold may be shared with third parties in pursuance of statuary obligations.

  • Financial records will be retained until the end of the statutory requirement, a minimum of 6 years.
  • Gift aid records retained for HMRC inspection for a minimum of 6 years.
  • Email addresses retained until you tell us otherwise.
  • CCTV images stored for a maximum of 30 days except for when required as part of an investigation.

You may object to the organisation processing your personal data for any or all the purposes listed above. To exercise this right, you should contact the Castle Team & Operations Manager, giving clear details of the processing activities and/or types of personal data to which, your objection applies.

Personal data is never sold to third parties.