Privacy policy

Who we are

ReAct Theatre Co. is the controller of the personal information described in this notice. Our Information Commissioner’s Office (ICO) registration number is ZC101785. Our Data Protection Officer is Luke Lambert. You can contact us at hello@reacttheatreco.com or through reacttheatreco.com. Please mark privacy requests for the attention of the Data Protection Officer.

What we collect

• Account and profile: your name, email address, sign-in credentials, location, biography, Spotlight link, headshot, directory visibility settings and any other profile information you choose to provide. Passwords are handled by our authentication provider; we do not display them to staff or other members.
• Classes and activity: bookings, attendance and class membership, the resources you access or save, and messages you post in class or network chats. Messages may include information you choose to share, so please avoid posting sensitive personal details in group chats.
• Payments: the name, email, phone number and optional comments you enter at checkout, plus the booking, amount, status and payment reference. Card details are entered into Square’s payment form; they are processed by Square rather than stored in your ReAct profile.
• Technical information: essential sign-in/session information, device or browser information and security or error records needed to operate and protect the service. We also remember your sign-in preference and which chats you have opened on your device.

We generally receive this information from you when you register, update your profile, send a message or book a place; staff may also enter booking and attendance information. Our wider work may involve medical, allergy, SEND, parent/guardian or safeguarding information; see our organisation-wide policy for those records.

Why we use it

• To set up your account, administer membership, show your classes and deliver bookings and paid services (performance of a contract or steps you ask us to take before entering one).
• To manage approvals, schedules, attendance, member communications, class chats, the directory and service security (our legitimate interests in running a safe, useful members’ space, balanced against your rights).
• To keep required accounting and tax records, respond to lawful requests, and meet safeguarding or other legal duties (legal obligation, where applicable).
• To use photos or video for external marketing only where you have given explicit opt-in consent, as described in our organisation-wide policy. Showing an optional headshot inside the private directory is controlled separately through your profile settings; it is not permission for public marketing.

If we need special-category information for our wider teaching or safeguarding activities, we handle it under an applicable legal condition and additional safeguards. We will not treat joining the member directory as consent to process medical or safeguarding information.

Who can see your information

Your account and profile are not a public website. Approved members can see the directory profiles of other members who have chosen to appear there, subject to each person’s field-by-field settings. Your name appears with your visible directory profile. Headshots are shown within the members’ directory when included in a visible profile. You can turn off directory visibility and choose which optional details appear under Profile.

Class chats are accessible to members with a confirmed booking in that class and to authorised staff; the network chat is for approved members and authorised staff. People in a chat can read the messages you send there. Staff and administrators can access information needed to manage members, classes and bookings. Only administrators can see the contact details and comments submitted at payment. Other members cannot see your payment information.

Who we share it with

We share information only as needed to operate the service: with authorised ReAct staff and teachers, other members where you choose to be visible or participate in chats, our website hosting and cloud database providers (Lovable and its infrastructure partners, including Supabase and Cloudflare), Square when you pay by card, and Google (Google Calendar), where class times are kept and where your name is added to any one-to-one appointment you book. Technical error reports may also be sent to our hosting provider to keep the service working. If you open an external booking link or your Spotlight link, that site has its own privacy practices. We may also share information if required by law or to protect someone’s safety. We do not sell member information. A booking message in the app is not a substitute for a payment receipt from Square.

Security and international transfers

We use access controls, private file access for uploaded headshots and member materials, and staff-only access to management information. We limit information available to other members through directory privacy choices and class access rules. No online service can guarantee absolute security; please use a strong password, keep your sign-in details private and tell us promptly if you think your account has been misused.

Some of these providers, including Google, Square, Supabase and Cloudflare, may process information outside the UK, including in the United States and the European Economic Area. Where a transfer requires safeguards under UK data protection law, we rely on the UK–US Data Bridge where the provider is certified, UK adequacy regulations for the EEA, or the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information about a particular transfer.

How long we keep it

We keep your account and profile while your membership is active, and then only as long as needed to administer bookings, resolve issues, protect the service or meet legal requirements. You may ask us to close your account or remove optional directory details. Some records must be kept after account closure.

Our organisation-wide Data Protection Policy sets these periods: general participant rosters and registration forms for the class or workshop plus 3 years for insurance; financial records for 6 years for HMRC; marketing data until consent is withdrawn or after 2 years of inactivity; and records relating to active safeguarding concerns or incidents for 25 years. In the members’ space, chat messages and staff attendance notes are deleted automatically 12 months after they were written. When an account is deleted, its profile, headshot, bookings and messages are removed straight away; payment records are kept for 6 years for HMRC with your name and contact details removed. Backups and legally required records may take longer to remove.

Your choices and rights

You can update your profile, remove your headshot, change directory visibility, download a copy of your data and permanently delete your account in Profile. To request access to your personal data, correction, deletion, restriction, portability or to object to processing based on legitimate interests, email hello@reacttheatreco.com for the attention of the Data Protection Officer. You may withdraw consent for optional marketing use at any time; this does not affect processing already carried out before withdrawal. These rights can have legal exceptions, for example where we must retain financial or safeguarding records.

We will respond to access requests without undue delay and normally within one calendar month. We normally do not charge a fee, unless a request is manifestly unfounded or excessive. We may need to verify your identity before disclosing personal information.

Cookies and device storage

The members’ space uses essential browser storage to keep you signed in, honour your “Keep me signed in” choice and remember which chats you have read. You can clear this in your browser, although doing so may sign you out or reset those preferences. Square’s embedded card form may use its own essential technologies to process and protect payments. This notice does not cover cookies on external websites you choose to visit; check those sites’ policies.

Young people and safeguarding

ReAct also works with young performers. Where we collect information about children, parents or guardians for classes or safeguarding, we apply additional care and access restrictions, and the organisation-wide Data Protection Policy describes the categories involved. Children must not hold their own account: you must be 18 or over, or a parent or guardian, to sign up. Accounts marked as booking for a child are kept out of the members’ directory and group chats. Please do not post a child’s medical details, safeguarding information or other sensitive information in member chats; contact the team directly instead.

Contact and complaints

For questions, rights requests or concerns, contact Luke Lambert, Data Protection Officer, at hello@reacttheatreco.com. If you are unhappy with our response, you can complain to the Information Commissioner’s Office (ICO), telephone 0303 123 1113. We may update this notice as the members’ space changes; the current version and its update date will remain on this page.