Privacy Policy

This Privacy Policy sets out how we collect, use, store, and protect your personal information when you visit our website, book tickets, make a purchase, contact us, or otherwise interact with our services.

This policy applies to all personal data processed by Roxy Movies (The Oxford Cinema) LTD, the company responsible for the operation of our cinema websites and venues across the UK. Wherever this policy refers to “we”, “us”, or “our”, it means Roxy Movies (The Oxford Cinema), acting as the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our website or services, you acknowledge that you have read and understood the terms of this Privacy Policy. We may update this policy from time to time to reflect changes in the law, our operations, or data protection practices. When we do so, we will revise the date at the top of this page and, where appropriate, notify you of any significant changes.

We are committed to managing your data responsibly and transparently, in line with applicable privacy legislation and best practice. If you have any questions about how we handle your personal information, or if you would like to exercise your data protection rights, you can contact us at: info@oxfordcinema.co.uk.

Last updated: May 2025.

What Personal Information We Collect
We collect a range of personal information directly from you when you interact with our website, book tickets, make purchases, or contact us for support. This includes basic identification and contact details such as your full name, email address, phone number, and billing address. If you create an account with us, we may also collect your login credentials and account preferences.

When making a booking or purchase, we collect transaction-related data including the films you select, the cinema location, session time, ticket type, number of tickets, and any applicable discounts or vouchers used. For payment processing, although we do not store your card details ourselves, your payment information (such as the last four digits of your card, payment method, and transaction ID) may be handled securely by our third-party payment processors in compliance with PCI DSS standards. This includes payment services such as Mastercard's Click to Pay, as seen in your transaction experience.

In the case of service or support requests, we may retain correspondence records, including your messages and any relevant attachments, to ensure accurate resolution and quality assurance.

If you opt into marketing communications or participate in surveys, competitions, or promotions, we may also collect preference data, feedback, and voluntary demographic details such as age group or interests, where provided.

We do not intentionally collect special category (sensitive) personal data such as health, biometric, or criminal records. However, in specific circumstances where such information is disclosed voluntarily for accessibility or safety reasons—such as to request reasonable adjustments—we will only process it where absolutely necessary and with appropriate legal safeguards in place.

All data collected is limited to what is necessary for the purposes described in this policy, and we aim to keep it accurate, secure, and up to date.

How We Use Your Personal Data
We use the personal information you provide to us in a variety of ways that are necessary for delivering our services, improving user experience, complying with legal obligations, and operating our business effectively and securely.

We use your information to process and manage your ticket bookings, including issuing booking confirmations, processing payments, and handling any related inquiries or disputes. If there is a need to cancel, reschedule, or amend any part of your booking — such as changes to screening times, venue access, or film listings — we use your information to send you timely service-related communications. These messages are transactional in nature and may include notifications about cancellations, delays, altered showtimes, or other critical service announcements.

Your information is also used to administer and support your customer account, where applicable, including updating your profile details and maintaining accurate records of your bookings. If you contact us, we use your data to respond to and resolve your inquiries or complaints effectively.

We may also use your information to carry out internal analytics, such as reviewing attendance patterns or service performance, in order to enhance our cinema operations and tailor offerings. This analysis is always performed in a way that does not identify you personally unless strictly necessary.

Additionally, where legally permitted, we may contact you with important updates to our terms, policies, or service features. These communications are not promotional and are necessary to meet our contractual or legal obligations and keep you informed as a user of our services.

Where you have provided marketing consent, your information may also be used to share details of new releases, special offers, loyalty rewards, and similar promotions; however, you can opt out of marketing communications at any time.

Legal Basis for Processing Your Personal Data
We process your personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR). The legal bases on which we rely to collect and use your personal information include:

Performance of a Contract: We process your personal data when it is necessary to perform our contract with you, or to take steps at your request before entering into a contract. For example, this includes processing payment details when you book tickets or providing you with customer service related to your booking.
Legitimate Interests: In some cases, we process your data because it is in our legitimate interest to do so, provided that your interests and fundamental rights do not override those interests. Examples include improving our services, analysing sales data, managing customer relationships, handling complaints, ensuring site security, and direct marketing to existing customers (unless you opt out).
Consent: Where required, we rely on your explicit consent to process your personal data. This applies, for example, when you subscribe to receive marketing emails or participate in optional surveys or competitions. You may withdraw your consent at any time by contacting us at info@oxfordcinema.co.uk or by using the unsubscribe links in our communications.
Compliance with Legal Obligations: We may also process your personal data where we are legally obliged to do so. This includes compliance with financial regulations, tax and accounting requirements, health and safety obligations, and the lawful handling of complaints or incidents.
Vital Interests: In rare circumstances, we may need to process your personal data to protect your vital interests or those of another person, for instance in the case of a medical emergency during your visit to the cinema.
Where we process special category data (such as health or accessibility information), we will only do so where necessary and with a lawful basis under Article 9 of the UK GDPR, such as with your explicit consent or to meet our legal obligations under health and safety or equal opportunity legislation.

How We Share Your Personal Data
We do not sell your personal data. However, we may share your information with trusted third parties under limited circumstances, as detailed below:

• Service Providers: We use third-party providers to deliver essential services such as payment processing, ticket booking, IT support, email distribution, and website hosting. These providers are contractually bound to handle your data securely and only as instructed by us.
• Legal and Regulatory Requirements: We may disclose your personal data where required by law or where we believe such action is necessary to comply with legal obligations, regulatory investigations, court orders, or to protect our rights or the rights of others (e.g. fraud prevention or enforcement of terms).
• Group Entities and Business Transfers: If we undergo a merger, acquisition, restructuring, or asset transfer, your personal information may be transferred as part of that transaction. In such cases, the new entity will be required to use your data in accordance with this Privacy Policy.
• Marketing and Analytics Tools: We may share anonymised or aggregated usage data with marketing agencies, research institutions, or analytics platforms to better understand customer preferences and improve our services. This data cannot be used to personally identify you.
• Emergency Situations: In the event of a serious health or safety issue, we may need to share limited personal information with emergency services or relevant authorities to protect you or others.

We ensure that any third party we share personal data with complies with data protection laws and adheres to appropriate technical and organisational safeguards.

How Long We Keep Your Personal Data
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to meet any legal, accounting, or regulatory obligations.

The specific retention periods depend on the nature of the data and the reasons for its collection. Our general guidelines are as follows:

• Transactional Records (e.g. ticket purchases, bookings, refund records): kept for up to 6 years to comply with financial and tax legislation.
• Customer Service Records (e.g. complaints, enquiries): retained for up to 3 years after the last contact to allow for proper follow-up and accountability.
• Email Marketing Consent and Preferences: stored for as long as you remain subscribed. If you unsubscribe, we retain minimal data (e.g. your email address with opt-out flag) to prevent re-subscription in error.
• Account Information: retained until you delete your account or after a period of inactivity of 24 months.
  Anonymised Data: we may retain anonymised data (which cannot be used to identify you) indefinitely for statistical and reporting purposes.

When your personal data is no longer required, we securely delete or anonymise it. Where deletion is not immediately possible (for example, due to backup or archival systems), we will securely store and isolate it from any further processing until it can be safely deleted.

If you have any questions about our retention practices, please contact us at info@oxfordcinema.co.uk.

Your Rights and How to Exercise Them
Under the UK General Data Protection Regulation (UK GDPR), you have the following rights regarding your personal data:

• Right to Access: You can request a copy of the personal data we hold about you and information on how we use it.
• Right to Rectification: You have the right to correct inaccurate or incomplete data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You can ask us to delete your personal data where there is no legal reason for us to continue holding it.
• Right to Restrict Processing: You may ask us to suspend the processing of your data if, for example, you want us to verify its accuracy or the reason for processing it.
• Right to Data Portability: Where applicable, you may request that we transfer your personal data to you or a third party in a structured, commonly used, machine-readable format.
• Right to Object: You can object to our processing of your data where we rely on a legitimate interest, or where we use your data for direct marketing.
• Rights in Relation to Automated Decision-Making and Profiling: We do not make decisions based solely on automated processing.

You can exercise any of these rights by contacting us at info@oxfordcinema.co.uk. We may ask for proof of identity and may take up to one month to respond, in accordance with UK GDPR guidelines.

Sharing Your Personal Data
We only share your personal data when necessary and in line with applicable data protection laws. Your data may be shared with the following categories of third parties:

• Service providers: We work with trusted third-party providers who support the operation of our cinema and website services (e.g., ticketing platforms, email systems, payment processors). They may access personal data only to perform these services on our behalf and are bound by contractual obligations to keep it secure and confidential.
• Payment processors: When you make a purchase, your payment details are handled by a secure third-party payment provider. We do not store or access your full payment card details.
• Regulatory or legal authorities: We may disclose personal data where required to comply with applicable law, regulation, legal process or enforceable governmental request (e.g. for fraud prevention or to protect safety and rights).
• Professional advisers: This includes legal, audit, or insurance partners where necessary to support the management of legal and financial matters.

We will never sell your personal data. We also do not share your personal information with any third party for their marketing purposes.

Children’s Privacy
Our website and services are not intended for use by children under the age of 13. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that a child has provided us with personal information, please contact us and we will promptly delete such data.

Contact Details and Complaints
If you have any questions or concerns about this privacy policy or how we handle your personal information, please contact us directly. You can reach the manager of the cinema via the contact details below:

Email: info@oxfordcinema.co.uk
Postal Address: Magdalen St, Oxford OX1 3AE, United Kingdom
Contact Person: Cinema Manager

We aim to respond to all enquiries as promptly as possible. In some cases, we may request proof of identity before disclosing any personal data.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the UK’s data protection authority:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Phone: 0303 123 1113

However, we would appreciate the opportunity to resolve your concerns before you approach the ICO, so please contact us in the first instance if possible.