Privacy Notice – NHS Test & Trace


NHS Test and Trace: How we use our visitors’ personal information

Purpose of this privacy notice

This privacy notice provides information on how New Theatre Lincoln Ltd (operating as New Theatre Royal Lincoln) collects and processes the personal data of its visitors for the purposes of supporting NHS Test and Trace.


What we use personal data for

To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, DHSC has provided guidance which we have chosen to follow. The guidance recommends that we collect and keep a limited record of visitors who come onto our premises for the purpose of contact tracing.

By maintaining records of visitors, and sharing these with NHS Test and Trace where requested, we can help to identify people who may have been exposed to coronavirus.


What persona data we collect

As a visitor of New Theatre Royal Lincoln, we will encourage you to scan the NHS Test and Trace app QR code or use a register to provide some basic information and contact details. The following information will be collected:

  • the names of all customers or visitors aged 16 or over;
  • a contact phone number for each customer or visitor; and,
  • date of visit.


Responsibility for compliance with data protection legislation

The New Theatre Royal Lincoln as the data controllers for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information. If that information is requested by the NHS Test and Trace service, the service will at this point be responsible for compliance with data protection legislation for that period of time.

The NHS Test and Trace as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the New Theatre Royal Lincoln, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.


Data retention

NHS Test and Trace as part of its guidance, has recommended that we retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period.

Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing it will be destroyed by us 21 days after the date of your visit.

However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.


Who your data may be shared with

We will only share information with NHS Test and Trace if it is specifically requested by them. For example, if other customers at the venue subsequently tested positive, NHS Test and Trace can request the log of customer, visitor and staff details on a particular day.

Your information will always be stored and used in compliance with the relevant data protection legislation.


Lawful basis for processing your data

The use of your information is covered by the UK General Data Protection Regulations Article 6 (1) (f) – legitimate interests of the venue or establishment. The legitimate interest in this case is the interest of the New Theatre Royal Lincoln in co-operating with NHS Test and Trace in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus. Collection of information from or about children under the age of 18 requires the consent of their parent or guardian.


Your rights and broader data protection information

For more information on your legal rights as a data subject, what information and data we store, how we use personal data and who to contact on such matters you can read our Privacy Policy which is available on our website privacy notice. We keep our privacy policy under regular review, and we will make new versions available on our website as it changes.