Privacy notice

Last updated 22 October 2026

The Company Hub is the internal website for the Wicked London company. It holds as little personal information as possible. This page explains what it does hold, why, who can see it, how long it is kept, and what you can ask us to do.

Who runs it

The Company Hub is run for the Wicked London company by Playful Productions. If you have any question about your information, speak to the Company Manager.

What the hub holds, and why

Physio bookings Your name and your track or department, and the time of the slot you booked. That's all — the hub never asks for, or stores, the reason you're seeing the physio, any injury, or any treatment notes. It's held so the physio knows who is coming in and when.

Contacts Names, roles and contact details of key people (for example management and departments), added by management so the company can reach them. Personal numbers are only listed with that person's agreement.

Cast information Cast names, roles and headshots, shown to the physio and management so they can recognise who they're seeing. They're read from the company's check-in system each time the page is opened; the hub doesn't keep its own copy.

Schedules, notices and documents Uploaded by management. Some, like rehearsal calls, include names. They're held so the company can see them in one place.

Social events Event details and posters posted by the social team. These don't normally include personal information.

Logging in Everyone logs in with a shared password for their group, so the hub doesn't know who you are individually. When you log in, your browser is given one cookie that keeps you logged in for 12 hours. It contains only which group you logged in as. There are no advertising or tracking cookies. To stop people guessing passwords, the address a failed login came from is remembered for 15 minutes, in memory only.

Change log A record of changes made in the hub — for example a notice added, a slot blocked or a password changed — with the time and which login made it (such as "Company Manager" or "Physio"). It never records passwords, contact details, or who booked the physio. It's kept so management can see what changed and put mistakes right.

Company Corner: shout-outs The message you write and, only if you choose to add it, your name. Shout-outs are seen only by management until they're approved, then by everyone logged in. Each one is deleted a week after it's approved; ones that aren't approved are deleted within a week.

Company Corner: polls Your vote is counted without recording who you are. To stop the same phone voting twice, your browser keeps a random code and the hub stores only a scrambled version of it. Polls and their results are deleted a week after they close.

Company Corner: lost property A description, where it was found and, if added, a photo of the item (never of people), posted by management. Photos are re-saved by the hub page before upload, which removes hidden details phones add, such as location. Items are removed when collected, or after 30 days.

Company Corner: daily word puzzle Your guesses, streak and results stay on your own phone. Nothing about the puzzle is sent to the hub.

The legal basis for all of this is the company's legitimate interest in running the production and looking after the people in it.

Who can see it

Information	Who can see it
Who has booked a physio slot, and cast information	The physio, the cover physio and management (Company Manager, Stage Management). Everyone else only sees that a slot is "Booked".
Change log	Management (Company Manager, Stage Management) only.
Shout-outs waiting for approval	Management only.
Approved shout-outs, poll results, lost property	Anyone in the company who has logged in.
Contacts, schedules, notices, social events	Anyone in the company who has logged in.

Nothing in the hub can be seen without logging in, apart from this page.

How long it's kept

Information	Kept for
Physio bookings	Until one week after the week of the booking ends, then deleted automatically.
Regular (recurring) physio slots	Until the physio or management removes them.
Contacts	Until they're removed — including when someone leaves the company.
Schedules, notices and documents	Until their end date, or until management removes them.
Social events	Deleted automatically once the event date has passed.
Shout-outs	One week after approval; unapproved ones within a week.
Polls and results	One week after the poll closes.
Lost property (and photos)	Until collected, or 30 days.
Change log	12 months, then deleted automatically.
Backups	30 days (physio bookings are never included).
Login cookie	12 hours, or until you log out.

Where it's kept

On a small server inside the theatre. It's reached over the internet through Cloudflare, which carries the connection securely and so handles your device's internet address.

For "Getting home tonight", the server itself fetches live line status and bus times from Transport for London. Nothing about you is sent to TfL.

When you open a PDF in the hub, the viewer is loaded from Cloudflare's cdnjs, so your browser contacts that service.

Backups

Each night an encrypted copy of the hub is made, so nothing is lost if the server fails. It's kept on the server and in the company's Google Drive for 30 days, then deleted. Physio bookings are left out of backups. Anything deleted from the hub is gone from the backups within 30 days.

Your rights

You can ask to:

see the information the hub holds about you;
have it corrected if it's wrong;
have it deleted — for example a booking or a contact entry;
object to it being used.

Speak to the Company Manager. If you're not happy with the answer, you can complain to the Information Commissioner's Office at ico.org.uk.

← Back to the Company Hub