Privacy Policy | Pegasus Theatre Chicago

Last Updated: 9.20.2026

This Privacy Policy describes how Pegasus Theatre Chicago, (“we,” “us,” or “our”) collects, uses, discloses, secures, and retains personal information across all of our activities as a nonprofit performing arts and theatre organization — including box office and ticketing, classes, camps, and youth education programs, fundraising and donor relations, volunteer coordination, our website, and our partnerships with school districts, including Chicago Public Schools (“CPS”). It applies to patrons, donors, volunteers, program participants and their families, website visitors, and students served through school partnerships.

Where this Policy conflicts with the terms of a signed agreement between us and a school district — including a Student Data Exhibit — the executed agreement controls as to Student Data covered by that agreement, and any conflicting terms are waived and given no effect.

I. Information We Collect

Depending on how you interact with us, we may collect the following categories of information:

Category of Data	Who It’s Collected From	Purpose
Contact info (name, email, phone, address)	Patrons, donors, volunteers, program families	Ticketing, communications, fundraising, newsletters
Payment info (processed by a Payment Processor)	Ticket buyers, donors, class/camp registrants	Purchases, donations, tuition/fees
Program enrollment & participant info (age, class/camp selection, emergency contact)	Students/participants in on-site classes, camps, youth programs	Program administration, safety, scheduling
Health/dietary/accessibility info (as provided)	Camp/program participants and families	Accommodations and participant safety
Photos, video, and audio of performances/onsite classes	Performers, students, audience members	Marketing, archival records, education (see Section VI)
Website usage data (pages viewed, device/browser info, cookies)	Website visitors	Site functionality, analytics
Student names via school partnerships (see Section V)	Students enrolled through partner school districts (e.g., CPS or private schools)	Delivering contracted educational programming to the district
Competition/contest entrant info (name, address, phone, grade, school, teacher, parent/guardian info, uploaded entries)	Entrants in our annual Young Playwrights Festival competition and their parents/guardians	Administering the competition: registration, judging, results, prize fulfillment (see Section VI)

Not every category applies to every individual — for example, a ticket buyer’s data differs from a camp participant’s or a partner-district student’s.

II. How We Use Information

To process ticket purchases, donations, tuition, and program registrations.
To communicate with patrons, donors, volunteers, and program families (e.g., season updates, on-site class or performance schedules, receipts).
To administer classes, camps, and youth programs, including safety and emergency contact purposes.
To market and promote productions and programs, including using performance/ photos and video as described in Section VI.
To operate, secure, and improve our website.
To deliver contracted educational services to partner school districts, subject to the Student Data terms in Section V.

We do not sell personal information, and we do not use Student Data (as defined in Section V) for targeted advertising.

III. Cookies and Website Analytics

Our website may use cookies or similar technologies for site functionality, ticketing/e-commerce, and aggregate analytics (e.g., which pages are visited).
Analytics/marketing tools used include Google Analytics, AudienceView ticketing platform cookies.
You can control cookies through your browser settings; disabling some cookies may affect site functionality (e.g., online ticket purchase).

IV. Photography, Video, Audio, and Media Releases

As a performing arts organization, we routinely photograph, record, and livestream performances, rehearsals, and classes for archival, educational, and promotional purposes.

Adult performers, students, and program participants may be asked to sign a media release prior to participation.
For participants under 18, we obtain consent from a parent or legal guardian before using a minor’s image, name, or likeness in promotional materials, unless the recording is incidental audience/crowd footage of a public performance.
Photos/video collected as part of classroom instruction delivered under a school district partnership are treated as Student Data under Section V and are not used for promotional purposes without separate consent, consistent with the district agreement.
Anyone may decline a media release; declining does not affect eligibility to participate, though we may be unable to guarantee exclusion from incidental wide/crowd shots of live performances.
To revoke consent or request removal of specific media, contact us using the information in Section XIII.

V. Student Data Collected Through School Partnerships

When Pegasus delivers programming to students through a school district partnership (including CPS), we handle Student Data under the terms below, consistent with the Illinois Student Online Personal Protection Act (SOPPA, 105 ILCS 85), FERPA, and the applicable district agreement. Program pre- and post-assessment data is collected and retained in aggregate, de-identified form only — it does not include student names, email addresses, or other direct identifiers. To the extent this aggregate data does not constitute personally identifiable “Student Data” under FERPA/SOPPA, the disclosures below are nonetheless provided for transparency regarding how this program-related data is handled.

A. Single Sign-On (SSO) and Authentication Integration

Pegasus Theatre Chicago integrates with CPS Single Sign-On through Google Workspace, and is compatible with CPS-approved SSO platforms:

Supported SSO/authentication protocol: Google SSO (OAuth 2.0 / OpenID Connect) via Google Workspace.
Google Workspace is also used for our organization’s program-related email communications.
Authentication data is encrypted in transit (TLS 1.2+), consistent with Google Workspace’s standard security infrastructure.
Credentials and tokens are never stored in plaintext by us; authentication is handled by Google Workspace rather than a locally-managed credential store.
Pre- and post-program assessment data is collected online via Jotform web forms rather than SFTP or a custom API.

B. Disclosure of Student Data to Third Parties

We do not sell Student Data and do not use it for targeted advertising. Every third party or subprocessor with access to Student Data is listed below, along with the reason for that access. Any party not listed is prohibited from using Student Data. (Our website hosting provider, DreamHost, LLC, is not listed below because it hosts our public website only and does not receive, process, or store Student Data.) This table is reviewed at least annually and updated promptly when subprocessors change.

Name of Third Party / Subprocessor	Student Data Use	Reason for Use
Google LLC (Google Workspace)	Student name, authentication tokens (for SSO/email); aggregate, de-identified program assessment data (during the active program year only)	Single sign-on authentication with CPS; encrypted storage of aggregate program data while the program is active
Jotform Inc.	Student pre-program and post-program survey/assessment responses, exported and retained only in aggregate, de-identified form (no names or emails in the retained dataset)	Online collection of pre- and post-program assessment data

C. Where Student Data Is Stored

Pre- and post-program assessment data is collected via Jotform and retained in aggregate, de-identified form only — names, email addresses, and other direct identifiers are not included in the stored dataset.
During the school year in which it is collected (i.e., while the program is active), this aggregate data is stored on encrypted Google (Google Workspace/Drive) storage.
Once the program is no longer active, this same aggregate, de-identified data is transferred to an organization-owned hard drive for long-term archival storage.
Because this archived data contains no student names, emails, or other identifiers linking it to a specific student, it does not constitute personally identifiable “Student Data” under FERPA/SOPPA at the point of archival storage. As an additional best practice, the archive drive is encrypted and password-protected, with access restricted to authorized staff.
Data within Jotform itself is deleted from Jotform’s platform once the aggregate results have been exported and confirmed retained as described above.

D. Retention, Deletion, and Breach Notification

Identifiable Student Data (e.g., roster/authentication data via Google Workspace) is retained only as long as necessary to deliver the contracted program, or as required by law.
Aggregate, de-identified program assessment data (see Section V.C) is not personally identifiable and is retained for 10 years for program evaluation purposes before secure disposal.
Upon termination of a district agreement or upon written request, we will delete or de-identify any remaining identifiable Student Data within [30] days and confirm deletion in writing.
In the event of a breach involving identifiable Student Data — whether at a subprocessor (e.g., Google Workspace, Jotform) or otherwise — we will notify the affected district without unreasonable delay and consistent with the Agreement and applicable law.

E. Parent, Student, and Eligible Student Rights

Requests to inspect, correct, or delete Student Data should generally be directed to the partner school district, which will coordinate with us as required by the Agreement.

VI. Annual Competition/Contest Data

In addition to the school-based residency programming described in Section V (which is provided under our agreement with school districts, including CPS, and any related RFQ), Pegasus Theatre operates an annual Young Playwrights Festival competition open to entrants independent of that agreement. Entry is open to the public and does not require any connection to a school district we partner with — entrants may attend any school, or none, and many entrants do attend schools within partner districts such as CPS. However, the competition is not part of the school-based residencies provided under the Agreement or subject to the related RFQ, and it is not delivered using SSO or any private or district-provided roster or account data. Because it is a separate offering, it is not subject to the school-partnership-specific safeguards described in Section V (e.g., CPS SSO integration, aggregate-only data handling) — instead, it is governed entirely by this section.

A. Information We Collect for the Competition

To administer the competition, we collect identifiable information directly from entrants and/or their parents/guardians, including:

Entrant name and address
Grade level, school, and teacher (if applicable)
Phone number
Parent/guardian name and contact information
Contest entry materials, uploaded directly by the entrant or their parent/guardian through our entry submission form

For entrants under 18, we obtain parental/guardian consent as part of the registration process before using the entrant’s information for the competition.

B. How Competition Data Is Collected and Stored

Collection method: VIA Jotform w/ data encryption technology.
Storage: Google Workspace for contest period, then stored on company’s external hard drive w/ data encryption.

C. Retention and Deletion

Retention period: entrant data is deleted or de-identified within after the competition concludes, except as needed for historical Finalist/Winners prize/tax records.
Parents/guardians of entrants under 18 may request access to, correction of, or deletion of their child’s competition data by contacting us using the information in Section XIII.

D. Third-Party Access to Competition Data

Third party access: none beyond internal staff. Evaluators and judges only access scripts with no identifying information
We do not sell competition entrant data or use it for targeted advertising.

E. How Competition Data Is Used

We use competition data solely to administer the contest — registration, communicating results, and prize fulfillment — and, only where a media release has been signed (see Section IV), to publicize winners. We do not use competition data for any purpose unrelated to the competition.

VII. Data Security

Our website is hosted by DreamHost, LLC.
Organizational email, calendaring, and single sign-on authentication with CPS are handled through Google .
Encryption of sensitive data in transit and, where applicable, at rest, across our cloud-based vendors.
Role-based access controls limiting data access to authorized staff/volunteers on a need-to-know basis.
Payment card data is processed by a PCI-compliant third-party processor; we do not store full card numbers.
Archived aggregate program data stored on a local device (see Section V.C) contains no student identifiers and is additionally encrypted and password-protected, with access restricted to authorized staff.
Regular review of vendors and subprocessors that handle personal information.

VIII. Data Retention (General)

Outside of Student Data (governed by Section V.C) and competition data (governed by Section VI), we retain personal information for as long as needed to fulfill the purpose it was collected for — e.g., donor records for tax/reporting purposes, program records for the season, media releases for the duration we may use the related footage — after which it is deleted or de-identified, unless a longer period is required by law.

IX. Minor’s Privacy

Programs and competitions designed for or open to minors (school aged youth) are administered with parental/guardian consent for registration and any media release, consistent with the Children’s Online Privacy Protection Act (COPPA) where applicable. We do not knowingly collect personal information directly from children under 13 through open public website forms without parental involvement.

X. Your Rights and Choices

You may opt out of marketing communications at any time (e.g., via the unsubscribe link in our emails).
You may request access to, correction of, or deletion of your personal information by contacting us using the information in Section XIII, subject to record-keeping obligations (e.g., donation/tax records).
Parents/guardians of program participants may request removal of a minor’s media as described in Section IV.

XI. Changes to This Policy

We will review and update this Policy as required to keep current with rules and regulations, new technologies and security standards. We will post those changes on the website or update the “last updated” date of the Privacy Policy. If the changes are material, you will be notified via a notice on our website.

XII. Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at boxoffice@pegasustheatrechicago.org.

We may update this Policy to reflect changes in our practices, programs, technology, or legal requirements. The “Last Updated” date above reflects the most recent revision. Material changes affecting a school district partnership will also be communicated as required by the applicable agreement.

XIII. Contact Us

Questions about this Policy or our data practices may be directed to:Pegasus Theatre Chicago
1105 W Chicago Ave., Lower Level
Chicago, IL 60642
Email: info@pegasustheatrechicago.org