Privacy policy

ReAct Theatre Co. is the controller of the personal information described in this notice. Our Information Commissioner’s Office (ICO) registration number is ZC101785. Our Data Protection Officer is Luke Lambert. Contact us at hello@reacttheatreco.com and mark privacy requests for the attention of the Data Protection Officer.

This notice covers this website, including enquiry forms, online bookings and payments. Our members’ space has its own privacy notice at reactmembers.com/privacy.

• Enquiries: your name, email, phone number (optional), whether you are a student or parent/guardian, the student’s age, acting experience and audition plans, how you found us, and any online availability you share. If you continue past the first step of an enquiry form, we save those first details even if you don’t finish.
• Bookings: the service, date and time you choose, the student’s name, any comments, and the booking’s status.
• Payment information: see “Financial information” below.
• Website use: with your consent, analytics and advertising information about how you use the site (see “Cookies”).

We collect financial information in two situations, and we limit it to what we need.

Card payments. Card details are typed into Square’s secure payment form. They go straight to Square and are never seen or stored by ReAct. We keep a record of each payment: the amount, what it was for, the number of sessions, any offer applied, the date, its status, Square’s payment reference and receipt link, and the name and email given at checkout. Square may also carry out fraud checks and card verification (such as 3D Secure) under its own privacy policy.

Bursary applications. If you apply for a bursary, we ask for information about household income, employment, benefits, dependants, essential living costs and financial commitments, and may ask for supporting evidence such as proof of income. For applicants under 18, this normally comes from a parent or legal guardian.

We use financial information only to take payments, issue receipts and refunds, prevent fraud, keep accounting records, and assess and administer bursaries. Bursary information is seen only by ReAct’s founders or directors who assess or administer awards. It is never shared with other students, and recipients are never publicly identified without consent.

Our lawful bases are performance of a contract (taking payment for a booking, or assessing a bursary you have asked us to consider), legal obligation (keeping financial records for HMRC), and legitimate interests (preventing fraud and resolving payment issues).

• To reply to enquiries, arrange trial sessions and send you the information you asked for (steps you ask us to take before a contract).
• To deliver bookings, send confirmations and reminders, and manage attendance (performance of a contract).
• To follow up an enquiry you started, and to understand which adverts and pages work (legitimate interests, and consent for analytics and advertising cookies).
• To keep required accounting and tax records and meet safeguarding duties (legal obligation).

We share information only as needed: with authorised ReAct staff and tutors; Square to process card payments; Google (Google Calendar) where bookings are added to our calendar; our email provider to send confirmations; and our website hosting and database providers (Lovable and its partners, including Supabase and Cloudflare). If you accept those cookies, Google Analytics and Meta receive website-use information; they never receive your form answers or card details. We may share information if required by law or to protect someone’s safety. We never sell personal information.

Staff areas are password-protected, payment and bursary records are only accessible to authorised staff, and card details never reach our systems. No online service is completely secure; please tell us promptly if you think something has gone wrong.

Some providers, including Google, Meta, Square, Supabase and Cloudflare, may process information outside the UK, including in the United States and the European Economic Area. Where safeguards are needed, we rely on the UK–US Data Bridge, UK adequacy regulations, or the ICO’s International Data Transfer Agreement or Addendum.

• Enquiries that don’t lead to a booking: up to 2 years from our last contact, unless you ask us to delete them sooner.
• Participant and registration records: the class or workshop plus 3 years for insurance.
• Payment and financial records: 6 years for HMRC.
• Bursary application information and evidence: only for as long as needed to assess, administer and review the award, then deleted. A record of the award itself is kept with our financial records.
• Records relating to safeguarding concerns: 25 years.

You can ask to access, correct or delete your information, to restrict or object to how we use it, or to receive a copy, by emailing hello@reacttheatreco.com. You can withdraw consent for cookies at any time using “Cookie settings” in the site footer. Some rights have legal exceptions, for example where we must keep financial records. We normally reply within one calendar month and don’t charge a fee.

Essential storage keeps the site and checkout working. Analytics (Google Analytics) and advertising (Meta Pixel) only run if you accept them in the cookie notice. If you accept cookies, the first step of an enquiry may be saved before you finish so we can follow up. Square’s card form uses its own essential technologies to process and protect payments.

We work with young performers. Where information is about someone under 18, we apply extra care and limit access. Bursary applications involving household finances are normally made by a parent or legal guardian, who gives any consent needed.

For questions or requests, contact Luke Lambert, Data Protection Officer, at hello@reacttheatreco.com. If you are unhappy with our response, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or on 0303 123 1113. We may update this notice; the current version and its date will stay on this page.