Privacy Policy

1. Who We Are

Best Acts is a theatre production company based in Scotland, providing touring theatrical productions, venue technical production support, licensed bar services, and event promotion. This Privacy Policy explains how we collect, use, and protect your personal data when you visit our website or contact us regarding our services.

For the purposes of UK data protection law, the data controller is:

Best Acts is registered with the Information Commissioner's Office (ICO). ICO Registration Number: ZA367294.

2. Data We Collect

We may collect the following personal information:

• Name and email address (when you submit an enquiry)
• Phone number (if provided voluntarily)
• Message content submitted via our contact form
• Details relating to the type of service enquired about (e.g. bar service, venue hire, show booking, promotion)
• Technical data such as browser type and IP address (collected only where you have consented to analytics cookies)

We do not collect sensitive (special category) personal data.

3. Ticket Sales — TicketSource

Tickets for Best Acts productions are sold through TicketSource, an independent ticketing platform operated by TicketSource Ltd. When you purchase a ticket via ticketsource.co.uk, your transaction and personal data (including name, email, and payment information) are handled directly by TicketSource under their own Privacy Policy and Terms of Service.

Best Acts does not process, store, or have access to your payment card details. We may receive your name and contact information from TicketSource solely for the purpose of managing attendance at our events. In this context TicketSource acts as a data processor on our behalf and is bound by appropriate data processing agreements.

We encourage you to review TicketSource's privacy policy at ticketsource.co.uk/privacy before purchasing tickets.

4. Bar Service Payments — SumUp

When Best Acts provides licensed bar services for private events, venue hire, or Denny Civic Theatre events, we accept card payments through SumUp, a secure payment processing platform operated by SumUp Limited.

When you make a card payment for bar services, your payment card information is processed directly by SumUp and is not stored or retained by Best Acts. We only receive a payment confirmation and, where necessary, contact information to manage bar service delivery and event logistics. SumUp acts as an independent data controller for payment data; please review SumUp's privacy policy for full details.

Best Acts complies with PCI-DSS standards and does not store full payment card details.

5. How We Use Your Data

Your data is used to:

• Respond to booking, venue hire, and production enquiries
• Provide information about our touring shows and services
• Process and manage bar service bookings and event support requests
• Facilitate promotion and marketing services for venues and promoters
• Improve the performance and usability of our website (only where analytics consent has been given)

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects.

6. Legal Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6:

• Legitimate interests (Article 6(1)(f)) — the primary basis for processing enquiry form data. We have a legitimate interest in responding to business and service enquiries, and we have assessed that this interest is not overridden by your rights. You may object to this processing at any time (see Section 9).
• Contractual necessity (Article 6(1)(b)) — where a booking or service agreement is in place, we process data as necessary to fulfil that contract.
• Legal obligation (Article 6(1)(c)) — where we are required to retain records (e.g. financial records for HMRC purposes).
• Consent (Article 6(1)(a)) — for optional analytics and functional cookies only. You may withdraw this consent at any time via our Cookie Policy without affecting the lawfulness of processing before withdrawal.

7. Cookies

We use a small number of cookies on this website, categorised as Essential, Functional, and Analytics. Essential cookies are strictly necessary for the site to operate. Functional and Analytics cookies are optional and are only set with your prior consent, in line with UK PECR and UK GDPR.

We do not use advertising cookies, third-party tracking networks, or social media tracking pixels. No data derived from cookies is sold or shared with third parties.

You can manage or withdraw your consent at any time via our Cookie Policy.

8. International Data Transfers

We do not intentionally transfer personal data outside the United Kingdom. Our website is hosted on infrastructure operated by Base44 (a platform provider); please refer to their privacy documentation for details of their data hosting arrangements. Where any transfer does occur, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter 5.

9. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Contact form enquiries: retained for up to 12 months from receipt, unless an ongoing business relationship requires longer retention
• Event attendance and bar service records: retained for up to 7 years to comply with financial and legal obligations (e.g. HMRC)
• Cookie consent records: 12 months from consent (stored locally on your device)

Once data is no longer needed, it is securely deleted or anonymised.

10. Your Rights Under UK GDPR

As a data subject, you have the following rights. To exercise any of these rights, please contact us using the details in Section 11.

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — to request deletion of your data where there is no compelling reason for its continued processing
• Right to restrict processing — to ask us to limit how we use your data
• Right to data portability — to receive your data in a structured, commonly used format (where processing is based on consent or contract)
• Right to object — to object to processing based on legitimate interests; we will cease processing unless we can demonstrate compelling legitimate grounds
• Rights related to automated decision-making — we do not carry out automated decision-making or profiling, but you have the right not to be subject to decisions based solely on automated processing
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to complain — you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113

We will respond to all valid requests within one calendar month as required by UK GDPR. In complex or multiple cases, this may be extended by a further two months; we will notify you if this applies.

11. Contact & Data Enquiries

For any privacy-related enquiries, requests to exercise your rights, or data protection concerns, please contact us:

If you are not satisfied with our response, you have the right to escalate your complaint to the ICO (see Section 10).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be posted on this page with an updated date. We encourage you to review this policy periodically. Continued use of our website following any changes constitutes acceptance of the updated policy.