Privacy Policy
9 June 2026
PRIVACY POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The Station Cinema is a trading name of Richmondshire Building Preservation Trust Limited, a registered charity and company limited by guarantee. We are committed to protecting your privacy and handling your personal information responsibly and lawfully.
This Privacy Policy explains what personal information we collect from you, how we use it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Policy applies when you use our website (stationcinema.com) or any associated mobile applications, or when you book tickets, attend screenings, or otherwise interact with us. If you have any questions, please contact us using the details in Section 12.
1 DATA CONTROLLER
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Richmondshire Building Preservation Trust Limited
Trading as The Station Cinema
Registered in England and Wales · Company No. 04637976
Registered Charity No. 1099607
VAT Registration No. 852758787
Address: The Station, Station Yard, Richmond, North Yorkshire, DL10 4LD
Data protection enquiries: info@stationcinema.com
We are not currently required to register with the Information Commissioner’s Office (ICO) as a data controller; however, we comply fully with UK GDPR and the Data Protection Act 2018. If our obligations change, we will update this Policy accordingly.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2. PERSONAL INFORMATION WE COLLECT
We may collect and process the following categories of personal information:
• Technical & usage data, IP address, browser type, operating system, timestamp, traffic and weblog data, location data (derived from IP), pages visited, and resources accessed. We use this to improve your experience and suggest relevant content based on your location.
• Contact form data, when you use our contact forms (e.g. "Contact Us"), we collect your first name, last name, email address and the reason for your enquiry. Mandatory fields are marked with an asterisk (*). Providing other information is at your sole discretion.
• Marketing preferences, information about how you respond to email and other marketing campaigns, where you have consented to receive them.
• Correspondence records, if you contact us, we will keep a record of that communication.
• Cookie and tracking data, we use cookies and similar technologies on our Website. Please refer to our Cookie Policy for full details of what we use and why.
Payment card data, any debit or credit card data entered on our Website is transmitted directly to our card processing provider. No card data is passed through or retained by any Station Cinema systems.
We do not intentionally collect special category data (such as health, racial, or political information) unless you voluntarily provide it, for example in relation to accessibility requirements. Where we do, we handle it with the additional care required by UK GDPR Article 9.
3. HOW WE USE YOUR PERSONAL INFORMATION & LAWFUL BASIS
We only process your personal information where we have a lawful basis under UK GDPR Article 6.
─────────────────────────────────────────────────────────────────────────
Responding to enquiries and contact form submissions (Legitimate interests)
Processing ticket purchases and fulfilling orders (Performance of a contract)
Sending direct marketing communications (Consent)
Sending newsletters or event information (Consent)
Tailoring Website content to your preferences (Legitimate interests)
Ensuring the Website works effectively for your device (Legitimate interests)
Improving and developing the Website and IT systems (Legitimate interests)
Analysing our customer base and content interests (Legitimate interests)
Complying with legal or regulatory obligations (Legal Obligation/legitimate interests)
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You have the right to object to processing on this basis, see Section 6.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
4. DO YOU HAVE TO PROVIDE YOUR INFORMATION?
You are not obliged to provide personal information when browsing our Website. However, we will be unable to process ticket purchases or respond to enquiries if the necessary information is not provided. Mandatory fields on our forms are marked with an asterisk (*).
5. HOW LONG WE KEEP YOUR INFORMATION
We retain your personal information only for as long as necessary. Our general retention periods are:
• Marketing data until you withdraw consent or unsubscribe, after which we retain a suppression record to honour your preference.
• Transaction and booking records 7 years from the date of the transaction, to comply with HMRC accounting and tax obligations.
• Contact form and general correspondence up to 3 years from the date of last contact, unless a longer period is required to resolve a dispute or legal matter.
• Charitable governance records where required by charity law under obligatoins of the Charity Comission and Companies House
• Website technical logs, up to 24 months.
• Legal or regulatory obligations for the period required by the relevant law or regulator.
After the applicable retention period, your data will be securely deleted or anonymised.
6. SHARING WITH THIRD PARTIES
We do not sell your personal information. We may share it with the following categories of trusted third parties, where necessary:
• IT and hosting providers, who host our website and systems, acting as data processors under written contracts requiring compliance with UK GDPR.
• Payment processors, who handle online transactions on our behalf. No card data passes through or is retained by our own systems.
• Email delivery platforms, used to send booking confirmations, newsletters, and marketing communications where you have consented.
• Ticketing system providers, who support the delivery of our online booking service.
• Fraud prevention and security services, where required to investigate or prevent suspected fraud or illegal activity.
• Law enforcement and regulatory authorities, where we are under a legal obligation to disclose information in response to a verified lawful request.
• Professional advisers, including legal, financial, or charity advisers where necessary to protect our legal position or fulfil our obligations.
• Payment processors, who handle online transactions on our behalf. No card data passes through or is retained by our own systems.
• Email delivery platforms, used to send booking confirmations, newsletters, and marketing communications where you have consented.
• Ticketing system providers, who support the delivery of our online booking service.
• Fraud prevention and security services, where required to investigate or prevent suspected fraud or illegal activity.
• Law enforcement and regulatory authorities, where we are under a legal obligation to disclose information in response to a verified lawful request.
• Professional advisers, including legal, financial, or charity advisers where necessary to protect our legal position or fulfil our obligations.
All third parties with whom we share data are required to handle it in accordance with UK GDPR and applicable law. A list of our current third-party data recipients is available upon request.
7. YOUR RIGHTS
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal information:
• Right of Access, you may request a copy of the personal information we hold about you (a Subject Access Request). We will ask you to verify your identity before releasing any data.
• Right to Rectification, you may ask us to correct any inaccurate or incomplete personal information we hold about you.
• Right to Erasure, you may request that we delete your personal information where we no longer have a lawful basis to retain it. Note that some data must be kept for legal or regulatory reasons (e.g. transaction records for tax purposes).
• Right to Restriction, you may ask us to restrict our processing of your data, for example, while a rectification request is being resolved.
• Right to Data Portability, where we process your data by automated means on the basis of your consent, you may request that we provide it to you (or a third party) in a structured, machine-readable format.
• Right To Object, you have the right to object to processing carried out on the basis of our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to Withdraw consent where processing is based on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.
•Rights in relation to automated decision-making — we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this Policy and inform you accordingly.
To exercise any of the above rights, please contact us see Section 9 below. We will respond within one month of receiving your request (which may be extended by a further two months in complex cases).
8. INTERNATIONAL TRANSFERS
We do not routinely transfer your personal information outside the United Kingdom. In the event any transfer becomes necessary, we will ensure that appropriate safeguards are in place in accordance with UK GDPR Chapter V (such as the UK International Data Transfer Agreement or an equivalent approved mechanism) and will update this Policy accordingly.
9. DATA SECURITY
We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, accidental loss, alteration, or disclosure. These include:
• Encrypted (HTTPS) connections for all data transmitted through our website.
• Access controls and role-based permissions limiting who within our organisation can access personal data.
• Data minimisation, we collect and retain only what is necessary for the stated purpose.
• Contractual requirements on all third-party processors to maintain equivalent security standards.
• Regular review of our information security practices.
• No method of transmitting data over the internet can be guaranteed to be completely secure, and any transmission is made at your own risk. Where you hold a password for any of our services, you are responsible for keeping it confidential and for notifying us promptly if you believe it has been compromised.
• Access controls and role-based permissions limiting who within our organisation can access personal data.
• Data minimisation, we collect and retain only what is necessary for the stated purpose.
• Contractual requirements on all third-party processors to maintain equivalent security standards.
• Regular review of our information security practices.
• No method of transmitting data over the internet can be guaranteed to be completely secure, and any transmission is made at your own risk. Where you hold a password for any of our services, you are responsible for keeping it confidential and for notifying us promptly if you believe it has been compromised.
10. COOKIES AND TRACKING TECHNOLOGIES
Our website uses cookies and similar tracking technologies to operate effectively, improve your experience, and analyse how the site is used.
We use the following categories of cookies:
•Strictly necessary cookies, essential for core website functionality. These cannot be disabled.
•Analytics cookies, used to understand visitor behaviour so we can improve the website. Only placed with your consent.
•Functionality cookies, used to remember your preferences and settings.
•Marketing cookies, used to deliver relevant content and measure the effectiveness of our communications, where you have consented.
•Analytics cookies, used to understand visitor behaviour so we can improve the website. Only placed with your consent.
•Functionality cookies, used to remember your preferences and settings.
•Marketing cookies, used to deliver relevant content and measure the effectiveness of our communications, where you have consented.
On your first visit to our website, you will be presented with a cookie consent banner. You may accept or decline non-essential cookies at that point, and adjust your preferences at any time via the cookie settings link on our website.
11. MARKETING COMMUNICATIONS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
We will only send you marketing communications, by email, post, or other means where you have given us your prior consent. We will offer a clear opt-in when we collect your details.
You may withdraw your consent and unsubscribe from marketing at any time by:
• Clicking the "unsubscribe" link in any marketing email; or
• Contacting us directly using the details in Section 9.
Opting out of marketing will not affect any other communications we need to send you (such as booking confirmations or responses to your enquiries).
12. CONTACT & COMPLAINTS
━━━━━━━━━━━━━━━━━━━━━━━━
If you have any questions, comments or requests regarding this Privacy Policy, or wish to exercise any of your rights, please contact us:
Data Protection Contact
Richmondshire Building Preservation Trust Limited
Trading as The Station Cinema
The Station, Station Yard, Richmond, North Yorkshire, DL10 4LD
Email: info@stationcinema.com
How to raise a complaint with us: If you have a concern about how we handle your personal data, please contact us in the first instance and we will aim to resolve it promptly. We will acknowledge your complaint within five working days and provide a full response within one month.
Right to complain to the ICO: If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
Information Commissioner's Office
Website: ico.org.uk
Helpline: 0303 123 1113
13. CHANGES TO THIS POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━
We may update this Policy from time to time to reflect changes in our practices or applicable law. Any changes will be published on this page with an updated revision date. We encourage you to review this Policy periodically.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The Station Cinema · Privacy Policy · Last updated June 2026