Birds of Paradise Theatre Company

Birds of Paradise Theatre Company

Last updated: November 2025

1. Who we are

Birds of Paradise Theatre Company (BOP) is Scotland’s pioneering theatre company creating accessible and inclusive theatre. We are committed to protecting your privacy and handling your personal data responsibly.

Data Controller:

• Organisation: Birds of Paradise Theatre Company
• Registered Address: The Boardwalk, 105 Brunswick Street, Glasgow, G1 1TF
• Company Number: SC143878
• Charity Number: SC023666

Contact us:

• Email: all@boptheatre.co.uk
• Phone: 0141 552 1725
• Post: The Boardwalk, 105 Brunswick Street, Glasgow, G1 1TF

If you have any questions about this privacy policy or how we handle your data, please contact us using the details above.

2. What this policy covers

This privacy policy explains how we collect, use, store and protect your personal information when you:

• Visit our website
• Contact us through our website contact form
• Interact with us in any other way

Personal information means any information that can identify you as an individual, such as your name, email address, or information about how you use our website.

3. Information we collect

We collect very limited personal information through our website:

3.1 Information you provide directly

When you sign up for our newsletter:

• Your email address (only)

When you contact us through our website contact form:

• Your name
• Your email address
• Any information you include in your message

When you sign up for events, workshops, or opportunities:

• Your name and contact details (email, phone)
• Access requirements and disability information (if you choose to provide it)
• Application materials or other information relevant to the opportunity
• Demographic information (where relevant)

When you make a donation:

• Your name
• Email address
• Postal address (optional)
• Donation amount
• Gift Aid declaration (if applicable)
• Payment information (processed securely by our payment processor)

3.2 Information collected automatically (with your consent)

When you visit our website and consent to cookies, we collect:

• Information about your visit (pages viewed, time spent, referring website)
• Your approximate location (country/city level)
• Device and browser information
• IP address (anonymised)

This information is collected through:

• Google Analytics – to understand how visitors use our website
• Google Ads – to measure the effectiveness of any advertising campaigns we run

Important: We do not collect this information unless you actively consent to cookies through our cookie banner. If you reject cookies, we will not track your visit.

4. How and why we use your information

4.1 Newsletter sign-ups (Mailchimp)

What we do: Send you email newsletters about our work, events, and fundraising

Lawful basis: Consent – you actively choose to subscribe to our newsletter

Information we collect: When you sign up for our newsletter through the form in our website footer, we collect:

• Your email address

We do not collect your name through the newsletter sign-up form.

How we collect it:

• You enter your email address in the newsletter sign-up form
• You click the “Sign up” button
• You receive a confirmation email from Mailchimp
• You must click the confirmation link to complete your subscription (double opt-in)

This two-step process ensures you genuinely want to receive our newsletters.

How we use it:

• To send you monthly (or less frequent) email newsletters containing:
  • News and updates about Birds of Paradise’s work
  • Announcements about upcoming events and shows
  • Fundraising appeals and ways to support our work
  • Other information about our accessible theatre programmes
• To track email engagement (open rates and click rates) to improve our communications
• To maintain our subscriber list

How long we keep it: We keep your email address on our mailing list indefinitely until:

• You unsubscribe
• Your email bounces repeatedly (we delete bounced emails annually)
• We identify you as an inactive subscriber

Data sharing and Mailchimp: Your newsletter subscription is managed through Mailchimp, an email marketing platform. Mailchimp acts as a data processor on our behalf.

What Mailchimp does:

• Hosts our email newsletter list
• Sends newsletters on our behalf
• Tracks email opens and link clicks
• Stores your subscription preferences
• Manages the double opt-in confirmation process

Important information about Mailchimp:

• Mailchimp stores data on servers outside the UK, including in the United States
• Mailchimp has appropriate technical and organisational security measures in place
• We have a data processing agreement with Mailchimp
• Mailchimp does not share your information with other organisations
• Mailchimp does not set cookies when you subscribe through our website form
• For full details: Mailchimp Privacy Policy

Email tracking: Our newsletters include tracking technology to measure:

• Whether you opened the email
• Which links you clicked

This helps us understand what content is most valuable to our subscribers and improve our communications. This tracking is standard email marketing practice and does not identify you beyond your email address.

Your control:

• Subscribing is entirely voluntary – there are no pre-ticked boxes
• Newsletter subscription is separate from event sign-ups or donations
• You must confirm your subscription via email (double opt-in)
• Every newsletter includes an unsubscribe link
• You can unsubscribe at any time by:
  • Clicking “unsubscribe” in any newsletter (takes effect immediately)
  • Emailing all@boptheatre.co.uk (processed within 48 hours)
• Once unsubscribed, we’ll stop sending newsletters immediately and remove you from the list

Note: Newsletter subscription is completely separate from event sign-ups or donations. If you donate or sign up for an event, you will NOT be automatically added to our newsletter – you must opt in separately.

4.2 Contact form submissions

What we do: Process enquiries and respond to your messages

Lawful basis: Consent – you provide this information voluntarily when you contact us

How we use it:

• To respond to your enquiry
• To provide information you’ve requested
• To improve our services based on feedback

How long we keep it: We retain contact form submissions for up to 2 years, then securely delete them

4.3 Event and opportunity sign-ups (Google Forms/SurveyMonkey)

What we do: Collect information when you sign up for events, workshops, artist opportunities, or other activities

Lawful basis: Legitimate interests – processing is necessary to manage the events and opportunities we run, and to fulfil our mission of creating accessible and inclusive theatre

Information we collect:

• Contact details (name, email address, phone number)
• Access requirements and disability information (if you choose to provide it)
• Demographic information (where relevant for monitoring or opportunity requirements)
• Application materials (for artist opportunities)
• Any other information relevant to the specific event or opportunity

How we collect it: We sometimes use third-party form services embedded on or linked from our website:

• Google Forms
• SurveyMonkey

These services may temporarily store your information on their servers before we download it to our systems.

How we use it:

• To administer the event, workshop, or opportunity you’ve signed up for
• To contact you about the specific event or opportunity
• To provide appropriate access arrangements based on your requirements
• To assess applications for artist opportunities
• To improve our programmes and ensure they meet community needs
• For equal opportunities monitoring (in anonymised, aggregate form)

Special category data (access requirements): When you provide information about disabilities or access requirements, this is “special category data” under UK GDPR. We only collect this information to ensure we can provide appropriate support and make our events accessible. By providing this information, you consent to us processing it for these purposes.

You can withdraw this consent at any time by contacting us, though this may affect our ability to provide the access arrangements you need.

How long we keep it:

• General event/opportunity sign-ups: Up to 12 months after the event or opportunity concludes
• Successful applicants (e.g., selected artists): Up to 2 years to maintain records of our programmes
• Event attendees: Up to 12 months after the event

After these periods, we securely delete the information unless you’ve separately consented to ongoing communications (see section 4.1).

Data sharing: Your sign-up information is only accessible to BOP staff members who need it to administer the event or opportunity. We protect access with two-factor authentication (2FA).

We do not share your information with partner organisations or other third parties unless:

• You’ve given explicit consent for a specific purpose
• We’re required to by law

Third-party processors: Google (for Google Forms) and SurveyMonkey may temporarily process your data when you submit a form. They act as data processors on our behalf. Their servers may be located outside the UK, including in the United States. Both companies have appropriate safeguards in place for international data transfers.

• Google’s privacy policy: https://policies.google.com/privacy
• SurveyMonkey’s privacy policy: https://www.surveymonkey.com/mp/legal/privacy/

Your control:

• Providing information is optional – only sign up if you wish to participate
• You can update your information by emailing all@boptheatre.co.uk
• You can request deletion of your information at any time (though this may mean we cannot include you in the event/opportunity)

4.4 Website analytics (Google Analytics)

What we do: Analyse how visitors use our website

Lawful basis: Consent – obtained through our cookie banner

How we use it:

• To understand which pages are most visited
• To improve website content and navigation
• To report visitor numbers to our funders (Creative Scotland and other funding bodies) in anonymised, aggregated form
• To demonstrate our reach and impact

How long we keep it: Google Analytics retains data according to their retention settings. We have configured our Google Analytics to retain data for 14 months

Data sharing: This data is processed by Google and stored on Google’s servers. See section 6 for more information about Google’s role.

4.5 Advertising effectiveness (Google Ads)

What we do: Measure the effectiveness of any online advertising campaigns

Lawful basis: Consent – obtained through our cookie banner

How we use it:

• To understand which adverts bring visitors to our website
• To improve our advertising strategy
• To ensure efficient use of marketing budgets

How long we keep it: Data is retained according to Google Ads’ retention policies

Data sharing: This data is processed by Google. See section 6 for more information.

4.6 Donations (Donorbox)

What we do: Process donations made through our website

Lawful basis:

• Contract – processing is necessary to complete your donation transaction
• Legal obligation – we must retain Gift Aid declarations to comply with HMRC requirements
• Consent – for sending you thank you messages and future fundraising appeals (you can opt out at any time)

Information we collect: When you make a donation through our Donorbox donation page, we collect:

• Your name
• Email address
• Postal address (if you provide it)
• Donation amount and frequency (one-off or regular)
• Gift Aid declaration (if you choose to claim Gift Aid)
• Payment information (processed securely by Donorbox’s payment processor – we do not see or store your full card details)

How we use it:

• To process your donation
• To send you a confirmation and thank you message
• To claim Gift Aid on your behalf (if you’ve made a Gift Aid declaration)
• To send you updates about our work and future fundraising appeals (if you consent to this)
• To maintain stewardship relationships with our supporters
• To report anonymised donation statistics to our funders (e.g., “we received X donations totalling £Y”)
• To comply with charity law and financial reporting requirements

Gift Aid: If you make a Gift Aid declaration, we are legally required to keep records of:

• Your name and address
• The date and amount of your donation
• Your Gift Aid declaration

We must retain these records for at least 6 years after the end of the accounting period in which the donation was made, as required by HMRC.

Marketing communications: When you donate, we will ask if you’d like to receive updates about our work and future fundraising appeals. You can:

• Opt in to receive these communications
• Opt out at any time by clicking “unsubscribe” in our emails or contacting all@boptheatre.co.uk
• Update your preferences at any time

How long we keep it:

• Donor records (general): We keep donor information indefinitely to maintain relationships with our supporters and to steward donations appropriately
• Gift Aid declarations: Minimum 6 years as required by HMRC, typically longer to maintain accurate records
• Marketing consent: Until you withdraw consent or we identify that you’re no longer engaged with our communications

If you request deletion of your data, we will delete what we can while retaining only what is legally required (e.g., Gift Aid records for HMRC).

Data sharing and Donorbox: Your donation is processed through Donorbox, a third-party donation platform. Donorbox acts as a data processor on our behalf.

What Donorbox does:

• Hosts the donation form on our website
• Processes your payment securely through their payment processor
• Stores your donation information
• May use cookies and tracking technologies on the donation page

Important information about Donorbox:

• Donorbox may store data on servers outside the UK, potentially including the United States
• Donorbox has appropriate technical and organisational security measures in place
• We have a data processing agreement with Donorbox
• Donorbox does not share your information with other organisations for their own purposes
• For full details: Donorbox Privacy Policy

Payment processing: Donorbox uses secure payment processors (such as Stripe or PayPal) to handle card payments. These processors:

• Are PCI-DSS compliant (the highest security standard for card payments)
• Do not share your full card details with us or Donorbox
• Have their own privacy policies regarding payment data

Your control:

• Making a donation is entirely voluntary
• You can opt out of marketing communications at any time
• You can update your information by emailing all@boptheatre.co.uk
• You can request deletion of your data (subject to legal retention requirements for Gift Aid)

Donorbox cookies: If you visit our donation page, Donorbox may set cookies on your device. These are covered by our cookie consent banner. If you reject optional cookies, some Donorbox functionality may be limited, though you can still make a donation.

5. Cookies

We use cookies on our website to improve your experience and analyse how visitors use our site.

For full details about:

• What cookies we use
• Why we use them
• How to manage your cookie preferences
• Your rights regarding cookies

Please see our separate Cookie Policy.

The information in this privacy policy about cookie consent (sections 3.2, 4.4 and 4.5) should be read alongside our Cookie Policy.

6. Who we share your information with

6.1 Third-party service providers

We use several third-party services to operate our website and organisation effectively. These services process data on our behalf as “data processors”:

Pooka & Co (website development and hosting)

Our website is developed and hosted by Pooka & Co Ltd, a web agency based in Edinburgh, Scotland.

When you use our website, Pooka & Co may process:

• Technical website data (server logs, error logs)
• Any data submitted through website forms (before it reaches us)
• Website performance and security data

Pooka & Co provides:

• Website hosting and maintenance
• Technical support and development
• Website security (via Wordfence)
• WordPress platform management

Important information about Pooka & Co:

• Based in Edinburgh, Scotland (UK company)
• Data stored on UK servers
• Specialises in accessible and user-friendly websites
• We have a data processing agreement with Pooka & Co
• Contact: hello@pooka.co
• Website: https://www.pooka.co/

Mailchimp (email marketing)

When you subscribe to our newsletter:

• Mailchimp hosts our email list and sends newsletters on our behalf
• Mailchimp stores your email address and subscription preferences
• Mailchimp tracks email opens and clicks to help us improve our communications
• Mailchimp acts as a data processor on our behalf

Google (Analytics and Ads)

When you consent to cookies, your website usage data is processed by Google through:

• Google Analytics
• Google Ads

Google Forms

We sometimes use Google Forms for event sign-ups and opportunity applications. When you submit a form:

• Google temporarily stores your information on their servers
• We download this data to our own systems
• Google acts as a data processor on our behalf

SurveyMonkey

We sometimes use SurveyMonkey for surveys and sign-ups. When you submit a form:

• SurveyMonkey stores your information on their servers
• We access this data through their platform
• SurveyMonkey acts as a data processor on our behalf

Donorbox

We use Donorbox to process donations. When you donate:

• Donorbox hosts the donation form and processes your payment
• Donorbox stores your donation information
• We access this data to manage donor relationships
• Donorbox acts as a data processor on our behalf

Important information about these services:

• Most process data on servers which may be located outside the UK (Pooka & Co uses UK servers)
• All have implemented appropriate safeguards for data protection and international data transfers where applicable
• We have data processing agreements with these services where required
• For more information:
  • Pooka & Co
  • Mailchimp Privacy Policy
  • Google’s Privacy Policy
  • SurveyMonkey’s Privacy Policy
  • Donorbox Privacy Policy

6.2 Funders

We share anonymised, aggregated statistics (such as total website visitor numbers) with our funders, including:

• Creative Scotland
• Other funding bodies supporting our work

This information is:

• Provided in aggregate form only (e.g., “5,000 visitors last month”)
• Cannot identify individual visitors
• Used to demonstrate our reach and impact
• Required as part of our funding agreements

We never share personal information (names, email addresses, individual browsing behaviour) with funders.

6.3 Legal requirements

We may disclose your information if required to do so by law, or in response to valid requests by public authorities (e.g., a court or government agency).

7. International data transfers

Some of the organisations we work with (specifically Mailchimp, Google, SurveyMonkey, and Donorbox) process data outside the United Kingdom, including in the United States.

When we transfer your personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK Information Commissioner’s Office
• Adequacy decisions recognising that certain countries provide adequate data protection

Our third-party service providers have implemented appropriate safeguards for international transfers.

8. Special category data (access requirements and disability information)

8.1 What is special category data?

UK data protection law recognises that certain types of personal information are more sensitive and require extra protection. This includes information about:

• Health
• Disability
• Race or ethnic origin
• Religious or philosophical beliefs
• Sex life or sexual orientation

8.2 When we collect special category data

We may collect special category data when:

• You provide access requirements when signing up for events or opportunities
• You share disability information to help us ensure our events are accessible
• You provide equal opportunities monitoring information (which is optional and used only in anonymised form)

8.3 Why we collect it

We collect this information solely to:

• Provide appropriate access arrangements and support
• Ensure our events and opportunities are accessible and inclusive
• Monitor and improve our accessible arts practice
• Fulfil our mission of creating theatre for D/deaf and disabled audiences and artists

8.4 Our lawful basis for processing special category data

Under UK GDPR, we need both a lawful basis (Article 6) and a separate condition for processing special category data (Article 9).

For access requirements and disability information:

• Lawful basis: Legitimate interests (managing accessible events)
• Article 9 condition: Explicit consent – by providing this information, you give us explicit consent to process it for the purposes described above

You can withdraw this consent at any time by contacting all@boptheatre.co.uk, though this may affect our ability to provide the support you need.

For equal opportunities monitoring:

• Lawful basis: Legitimate interests (improving our accessible practice)
• Article 9 condition: Used only in anonymised, aggregate form for statistical purposes

8.5 Extra safeguards

We apply additional protections to special category data:

• Access is restricted to staff members who need it to provide appropriate support
• Information is stored securely with two-factor authentication
• We never share this information with third parties unless you’ve given explicit consent
• We delete it in line with our retention schedule (see section 10)

9. How we protect your information

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it from:

• Unauthorised access
• Accidental loss
• Destruction or damage

Security measures include:

• Secure transmission of data via encrypted connections (HTTPS)
• Restricted access to personal information on a need-to-know basis
• Regular security assessments
• Secure data storage with our service providers

However, please be aware that no method of transmission over the internet is completely secure. We cannot guarantee absolute security of information transmitted to our website.

10. Your rights

Under UK data protection law, you have the following rights:

9.1 Right to be informed

You have the right to clear information about how we use your personal data (which is what this privacy policy provides).

9.2 Right of access

You have the right to request a copy of the personal information we hold about you. This is known as a “subject access request.”

9.3 Right to rectification

You have the right to ask us to correct personal information about you that is inaccurate or incomplete.

9.4 Right to erasure

You have the right to ask us to delete your personal information in certain circumstances, such as when:

• The data is no longer necessary for the purpose we collected it
• You withdraw your consent (where consent was the lawful basis)
• You object to the processing and there are no overriding legitimate grounds

Important exceptions:

• We must retain Gift Aid declarations for at least 6 years to comply with HMRC requirements
• We may need to retain some information to comply with other legal obligations
• We may retain information where we have a compelling legitimate interest to do so

9.5 Right to restrict processing

You have the right to ask us to restrict how we use your personal information in certain circumstances.

9.6 Right to data portability

You have the right to receive personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another organisation.

9.7 Right to object

You have the right to object to processing of your personal data in certain circumstances.

9.8 Right to withdraw consent

Where we rely on consent as our lawful basis for processing, you have the right to withdraw that consent at any time. This includes:

• Withdrawing cookie consent (via our cookie settings)
• Asking us to delete information you provided via the contact form

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

9.9 How to exercise your rights

To exercise any of these rights, please contact us using the details in section 1. We will respond to your request within one month.

You will not usually have to pay a fee to exercise these rights. However, we may charge a reasonable fee or refuse to comply with your request if it is clearly unfounded, repetitive or excessive.

10. How long we keep your information

We only keep your personal information for as long as necessary for the purposes we collected it.

Retention periods:

After these periods, we securely delete or anonymise the information.

11. Children’s privacy

Our website is not directed at children under 16 years of age. We do not knowingly collect personal information from children under 16.

If you are under 16, please do not submit any personal information through our website without the consent and supervision of a parent or guardian.

If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information.

12. Links to other websites

Our website may contain links to other websites operated by other organisations. This privacy policy only applies to our website.

When you click on links to other websites, we encourage you to read their privacy policies. We are not responsible for the privacy practices or content of other websites.

13. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in:

• How we process personal information
• Legal requirements
• Our business operations

When we make significant changes, we will update the “Last updated” date at the top of this policy.

We encourage you to review this privacy policy periodically to stay informed about how we protect your information.

14. How to complain

If you have concerns about how we handle your personal data, please contact us first using the details in section 1. We will do our best to resolve your concerns.

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

Information Commissioner’s Office

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Questions?

If you have any questions about this privacy policy or how we handle your personal information, please contact us using the details in section 1.

We are committed to protecting your privacy and will be happy to help with any concerns you may have.

Birds of Paradise Theatre Company
Creating accessible and inclusive theatre since 1993

COMPANY NUMBER: SC143878
CHARITY NUMBER: SC023666