Cancel
PRIVACY POLICY (UK and Ireland)
Introduction
Your privacy is important and you have the right to know how we use your personal information. This policy covers how we collect, use, store and protect your personal information.
If you are in the UK, “ODEON” means Odeon Cinemas Limited and this company is the controller. If you are in the Republic of Ireland, “ODEON” means United Cinemas International (Ireland) Limited and this company is the controller.
This Privacy Policy was last updated in September 2021.
Covid-19 Test and Trace: Data Protection notice
Following current Government guidance we may need to collect your contact details to support health authorities in tracing guests if someone subsequently tests positive for Covid-19.
In the Republic of Ireland following government guidance we are requesting guests aged 18 or over provide proof of a valid Covid Certificate to gain entry to our cinemas. This will require us to scan the QR code on your certificate to determine its status (more information is available at https://www.gov.ie/en/publication/3a698-eu-digital-covid-certificate/). In Ireland we can only permit access to those with a certificate which shows they are fully vaccinated or confirms recovery from infection in the last 6 months. When scanning QR codes we do not retain any data of your covid certificate status. This processing is in accordance with the General Data Protection Regulation Article 6(1)(c) (processing is necessary for compliance with a legal obligation to which we are subject).
In England and Scotland NHS posters with the QR codes for checking in will still be available for guests, but there is no legal requirement to separately collect guests details for NHS Test and Trace purposes (Test and Protect in Scotland). In Scotland we may still request lead guest contact details for Test and Protect purposes and in Wales we may still request contact details for each of the group for Test, Trace and Protect purposes. However it is no longer mandatory for guests to provide this information. The processing of your personal data is in accordance with the General Data Protection Regulation Article 6(1)(f) (processing is necessary for our legitimate interest in assisting public health authorities in relation to the coronavirus public health epidemic).
Where we do hold this information, Government guidance requires that contact details obtained for testing and tracing purposes are held for 21 days (in the Republic of Ireland these details need to be retained for 28 days). When collected online we hold the same information for our own operational purposes.
In the Republic of Ireland only the lead guests contact details need to be provided. Government guidance requires that contact details obtained for testing and tracing purposes are held for 21 days (in the Republic of Ireland these details need to be retained for 28 days). When collected online we hold the same information for our own operational purposes.
In Northern Ireland the Covid test and trace app which uses blue tooth technology can be used, but no data is collected at cinema for Test and Trace purposes.
If you are a digital guest, who has recently attended one of our cinemas in England, Scotland or Wales and wishes to opt out of sharing your name and contact details with health authorities for tracing purposes, please email [email protected]
We use your personal information to:
It is important that the personal information which we hold about you is up to date. Please keep us informed if your personal information changes.
1.1 Making a purchase or joining myLIMITLESS
We use the purchase information which you submit to process your credit or debit card transaction.
We don't hold your full payment card information. We use third-party providers; Datacash (Mastercard), Worldpay, Braintree and Harlands Services Limited to process card payments on our behalf.
If you joined myLIMITLESS by direct debit, Harlands Services Limited process your payments on our behalf.
We may use your information to assist in the collection and recover money owed.
Where you purchase a gift card from another retailer we process the gift card number and the amount placed on the gift card. We do not hold any other details.
The processing of your purchase information is necessary for the performance of our contract with you.
1.2 myODEON members
We use the Information you provide to us when you register to:
myODEON members also have the option of adding a photo of themselves to their account. If you have a myLIMITLESS subscription with us, a photo of yourself is mandatory as it is linked to your digital myLIMITLESS card.
1.2.1 How old do I have to be to have a myODEON account?
In the UK and Ireland you have to be 16 or older to open an account with us.
1.3 Service Communications
We use your information to manage your order. We may contact you by email or phone with information about your order, such as cancellations. This is necessary for the performance of the contract.
1.4 Social Media comments and feedback
When you contact us on social media, we use your information to respond, and keep a record of this. This may include information about your identity, or any other relevant personal information that is visible from your social media post and/or public profile.
We may also use this information in a statistical and anonymised format to identify trends and improve your cinema experience.
We may contact you directly via social media platforms if we’d like to share your comments or pictures with other guests or publish them on our marketing channels. We will always ask you for your permission to use your post.
1.5 Complaints and incidents
When there is a complaint, incident or query we use your personal information to contact you, record and investigate the incident. We also report on and analyze complaints and incidents to improve the cinema experience and for the administration of any subsequent legal claims.
We may record calls to and from our contact centre for quality assurance and training and monitoring purposes.
We rely on legitimate interests to use your personal information in this way.
If we collect your sensitive personal information, we process this on the basis of legal obligation. This is so that we can comply with our health and safety/reasonable adjustments obligations.
In a medical emergency if personal information needs to be shared to protect your or someone else we process your information on the basis of vital interests.
1.6 Competitions
We use your information to select and inform competition winners. Where you actively enter into one of our competitions, we rely on your consent as the lawful basis for processing. For social media interactions, we rely on legitimate interests.
1.7 Market research
We use your information to understand trends and monitor and improve our services. We may contact you by email to ask you to participate in a survey.
Participation in surveys is completely voluntary and you can complete the online survey anonymously.
We rely on legitimate interests to use your personal information in this way.
1.8 CEA Cards
The CEA Card is a national card scheme developed for UK cinemas by the UK Cinema Association (UKCA). This card enables a companion of a disabled cinema guest to receive a complimentary ticket at participating cinemas. More details on the CEA Card scheme are available here: https://www.ceacard.co.uk/
We process the CEA card number in your booking to provide you with this complimentary ticket. We process this information on the basis of ‘legal obligation’. This is so that we can comply with our reasonable adjustments obligations.
1.9 Sensitive Personal Information
We only process sensitive personal information about you with your explicit consent, or to comply with legal obligations such as making reasonable adjustments for you or for health and safety purposes.
We process limited health, medical or disability information, for the following purposes:
This section provides details on how we use your personal information for direct marketing purposes.
2.1 Direct marketing communications
We only send you direct marketing where you have provided your consent. We keep you informed about our latest film and cinema news, offers and promotions by email, messages in your members area, and via push notifications.
You can opt out of email marketing and in-account messages by opting out of email marketing via the preference centre on the ODEON website at any time.
To help improve our service we use industry standard technologies such as pixels and gifs to track and understand how you are interacting with us . You can prevent the use of these technologies by disabling image auto loading in your emails at any time using your email provider’s settings.,
Where you have given us your consent to send you direct marketing, this consent will remain valid whilst any of the following apply
2.2 Social media advertising
We would like to keep you informed about our latest offers and promotions using your email address and other online identifiers to send you information about our product offers and promotions via social media platforms.
We may share your email address in an encrypted form with social media organisations, such as Facebook and Twitter.
Examples of this would include Facebook’s Custom Audiences feature and Twitter’s Tailored Audience Program. If you don’t want us to retarget you, you can either:
Change your social media settings on that platform, or
Opt out of direct marketing communications (see ‘Updating your preferences’).
Please remember that ODEON social media is provided via social media sites which have their own functionality, terms, cookies and privacy policies. ODEON social media may make use of those functions, but we do not control them and are not responsible for them.
2.3 Profiling
To provide you with relevant content and improve your cinema experience, we use your purchase history, watchlist and location. We rely on legitimate interests to use your personal information in this way.
2.4 Updating your preferences
You can change your marketing preferences at any time by:
You have the right to do the following in relation to your personal information:
Please see the ‘What if I have a query or a complaint?’ section below for information on how to exercise your rights.
We do not share your contact details with third party companies for direct marketing purposes.
4.1 What information do you share with third parties?
From time to time, we may share statistical information about you with third parties such as advertisers, business partners and sponsors, to help us and them analyse, develop, manage and market our goods and services. This information will be shared in a way that ensures that your identity is not revealed to them.
We use security measures to protect your personal information. These measures include physical and administrative and technical safeguards such as encryption, security certificates and access controls to help protect your personal information.
We look at ways to identify and mitigate potential privacy and security risks, and then monitor and test our security systems to help protect your personal information.
Our employees and contractors are provided with access to your personal information on a 'need to know’ basis. Our suppliers (data processors) who provide services on our behalf may also have access to your personal information where this is necessary for them to deliver the service.
Whenever we collect or process your personal information, we’ll only keep it for as long as is necessary for the purpose for which it was collected (including for the purposes of satisfying any legal, accounting, or reporting requirements).
Full purchase information (including your contact information) is normally held for six years after the purchase date for tax and legal purposes. We do need to keep some anonymous information for longer than this, such as purchase statistics, so we can analyse it to identify trends and changes in activity.
At the end of the retention period, your personal information is either deleted or anonymised. Where the data is anonymised it is used for statistical analysis, business planning and product and services development.
Other examples of personal information retention periods include:
Call recordings to and from our guest service centre are held for a period of 12 months.
Should you have a query in relation to our policies in this area please contact the DPO via the details in the ‘What if I have a query or complaint’ section below.
We may transfer personal information outside of the European Economic Area ("EEA") so that it can be processed by staff operating outside the EEA or one of our suppliers, for the purpose of fulfilment of your order, provision of support services or data analysis.
Because the law in some countries does not provide the same level of protection as the UK and Republic of Ireland, we put in place data transfer agreements (which are considered appropriate safeguards) with each company that processes personal information outside of the EEA. These agreements require that, wherever your personal information is held, it is protected to the same high standard as required by law in the UK or Republic of Ireland.
8.1 Sponsored screenings
We work with organisations where we provide special events and screenings for their customers and members (“sponsored screenings”) (When you book tickets and attend one of these sponsored screenings we share your name, contact details and ticket information with the organisation so that it can:
We rely on legitimate interests to share your personal information in this way.
The sponsoring organisation is also a controller of your Personal Information. How they use your personal information will be governed by their own terms and privacy policies.
8.2 CCTV
We capture direct camera footage and images of you when you enter the field of vision of CCTV cameras on our premises.
We use CCTV to:
For CCTV we rely on the legal basis of our ‘legitimate interest’ to protect our colleagues, customers and visitors from harm, and protect our property, assets and reputation from accidental or malicious loss, damage or destruction.
8.2.1 Who do we share your CCTV footage with?
Footage from CCTV may be used by:
8.2.2 How long is CCTV footage kept for?
CCTV footage is normally held for 30 days.
In some cases, copies of footage may be kept for longer, for example to support investigation of a suspected crime or accident and any related legal or regulatory action. These copies are securely destroyed when they are no longer needed.
8.3 Cookies
We use information collected using cookies and web beacons to help us analyse, develop, manage, provide and market our goods, services and our communications to you. Third parties and our partners also use cookies and web beacons for similar purposes for their benefit. Our Cookies Policy contains more information on how you can control the cookie settings on your device.
8.4 ODEON wifi
When you use ODEON Wi-Fi, we collect information about:
This section explains how we collect and use personal information when you are interacting with us as a corporate customer. It also provides information on how we handle your personal information if you enquire about, book or attend a corporate event, or if you enquire about or purchase bulk vouchers and other corporate gift products.
9.1 Corporate customers and potential customers
We process the contact information of corporate customers and potential customers to do the following:
We will send you marketing communications:
When processing your personal information for all other purposes we rely on legitimate interests.
9.1.1 Who do we share your personal information with?
We share your information internally within the ODEON Cinemas Group when reasonably required.
We do not share your contact details with third party companies for direct marketing purposes.
We may share your personal information with our suppliers (data processors) if it is necessary to deliver a service to you. Where we share personal information with a supplier we do so under a contract which obliges them to handle your personal information securely and only for our purposes.
Further relevant information for corporate customers [and potential customers] can be found in the following sections:
3.0 What are my personal information rights?
6.0 How long do you keep my Personal Information
7.0 Do you transfer my personal information overseas?
8.3 Cookies
9.2 Delegates of corporate customers
We may process personal information (names, allergens and access requirements) of delegates who attend corporate events at our premises as part of an event hire arrangement with one of our corporate customers.
The corporate customer who has hired the cinema for the event is the controller and we are their processor. Any use of your personal information will be on the instruction of the controller and any privacy notice they have provided to you.
9.3 Corporate gift cards
We get your contact details through direct contact or information obtained by our third party lead generators, in order to provide you with information about our corporate gift cards and vouchers.
Companies can buy corporate gift cards from our sales agent OPIA.
In these circumstances we use your personal information for the following purposes:
• contact you about your interest in gift cards.
• take orders and deal with fulfilment of gift cards.
• monitor your procurement volumes of gift cards with us.
• have account review meetings with you.
We rely on legitimate interests to use your personal information for these purposes.
We keep this personal information for 6 calendar years from the date of our last purchase.
9.3.1 Bulk Tickets
We provide bulk tickets to organisations for employee benefit schemes.
Companies can buy bulk tickets from our sales agent OPIA. .
Sales reports from OPIA do not include personal data, except where the business name and address constitute personal information in the context of partnerships or sole traders. We have a legitimate interest to process this information for our sales insights information.
We process the following personal information:
The name, job title, organisation and contact details of the delegates who will be attending meetings at one of our locations. Where the building is managed by a third party, we may need to provide them with the same personal information prior to your attendance. We may also collect any access requirements you have, as well as allergen information (if refreshments are being provided).
We process this information as the controller for our legitimate interest in delivering the event to you or in the case of suppliers, to receive the service from you.
10.1 Who do we share your personal information with?
We share your information internally with teams that your arrangements or communications relate to.
We will not share personal information with any third parties outside the ODEON Cinemas Group for the purposes of direct marketing. We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors.
Further relevant information for attendees can be found in the following sections:
3.0 What are my personal information rights?
6.0 How long do you keep my Personal Information
7.0 Do you transfer my personal information overseas?
8.3 Cookies
In some cases, ODEON sells tickets and other items on behalf of its other group companies.
If ODEON or any part of ODEON's business undergoes a restructure, sale, merger or transfer,we may transfer customer information (including your personal information) to other ODEON group companies or the third party company, as the case may be.
If you have any queries concerning your personal information or this Privacy Policy, you can contact our Guest Service Centre by using the contact details shown on the Website "Contact Us" page or our Data Protection Officer using the details below .
UK email: [email protected]
Ireland email: [email protected]
UK Contact address: Data Protection Officer, ODEON , 3rd Floor, 8 First Street, Manchester, M15 4RP
Ireland Contact address: Data Protection Officer, ODEON, Blanchardstown Shopping Centre, Blanchardstown, Dublin 15, Republic of Ireland.
Our security procedures mean that we may occasionally request proof of identity before we are able to disclose information to you.
If you are in the UK you can make a complaint at any time, to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
If you are in Ireland you can make a complaint at any time, to the Data Protection Commission (DPC), https://www.dataprotection.ie/
We would, however, appreciate the chance to deal with your concerns before you approach the regulator, so we would be grateful if you would please contact us in the first instance.
© ODEON 2006-2021. All rights reserved. Version 4.9 dated September 2021.