1. Privacy commitment
National Theatre Wales (NTW) is committed to protecting your privacy. We will use the information that we collect about you in accordance with, the Privacy and Electronic Communications Regulations 2003, the Data Protection Act 1998 (DPA) and any replacement laws, and, from May 2018, the General Data Protection Regulation (GDPR).
Who we are
National Theatre of Wales (NTW) is a national arts organisation and a registered charity presenting theatrical work predominantly in the English-language. We receive 60% of our funding from Arts Council of Wales (ACW), with the remaining income being generated from a mix of ticket sales, commercial partnerships, sponsorships, trust and foundations, grant giving bodies and individual donations.
NTW is a charity registered in England and Wales, number 1127952, and a company limited by guarantee registered in England and Wales, number 6693227
If you have any queries regarding this policy please get in touch, our contact details are:
Address: National Theatre Wales, 30 Castle Arcade, Cardiff, CF10 1BW
Phone: 02920 353070
Data Protection Officer: Lorne Campbell, Artistic Director
You also have the right to lodge a complaint with the supervisory authority, The Information Commissioner’s Office – ico.org.uk
2. Personal Information
Across our operations the personal information that we collect can include:
- Names, title, date of birth and gender
- Information about race, ethnicity, and sexual orientation (you have the right to decline to provide us with this information)
- Contact details including postal address, e-mail, phone numbers and links to social media accounts
- Transaction history (we never store your whole card number, although we may keep a note of the last four digits to help us identify transactions)
- Access requirements (for example if you require wheelchair access, audio description, BSL interpretation, or any other access requirement) and whether you have a disability defined by the Equality Act 2010
- Welsh language preferences
- Details of visits to our website including traffic data, location data, operating system, browser usage, and the resources that you access
- Image and likeness (as captured in photographs and videos we use for promotional purposes (note: we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use))
- Other background personal information you provide to us (for example when you apply for a job, tell us your story, provide a reason for making a donation or correspond with us)
We may also process your personal data (including sensitive personal data) where:
- It is necessary for medical purposes (for example, in a medical emergency)
- It is necessary to protect your or another person’s vital interests
- We have your consent to do so (for example, to monitor the diversity of NTW’s audiences and participants
- We will also ask for your consent to provide you with information about products and services and fundraising activities which may be of interest to you (apart from where it is appropriate for us to rely on our legitimate interests to do so).
Personal Information will be held on our system and used for operational purposes such as the processing of bookings and orders in connection with our on-line ticket services and for mailing list subscriptions. We keep a record of the e-mails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any subsequent actions online, such as buying a ticket.
In order to process a transaction, your Personal Information and card details may be passed to third-party service providers. Card details will only be used for the purpose of handling an individual transaction.
The Personal Information you supply to us when you opt-in to marketing communications will be used by NTW to keep you up-to-date with events and activities organised by, and news and information from NTW and its co-producers, other arts organisations and our sponsors.
Each email we send you offers you the opportunity to unsubscribe from these preferences, or you can ask us to do this by emailing email@example.com.
3. Giving you control
We may tell you about events, productions, priority booking and information about performance sites and occasionally may include information in these communications from partner organisations or organisations who support us. We make it easy for you to tell us how you want to hear from us (by using the “Log In” on our website and updating your preferences in the “Your Account” section) or by telling our Ticket Office team over the phone or in person. You can opt-out from these communications at any time – every e-mail sent to you will tell you how to do this.
If you have opted out of these communications, we may still get in touch with you. For example, we may e-mail you to give you important information about the events you have booked or to tell you about any changes.
You have the right to obtain from us an electronic or paper copy of all Personal Information concerning yourself, or to speak to a NTW representative on any matter, by e-mailing firstname.lastname@example.org or writing to National Theatre Wales, 30 Castle Arcade, Cardiff, CF10 1BW.
If you would like to revise the information provided to us at any time, or feel what we currently have on record is incorrect, you may update the information by emailing the address above.
If you decide not to use our services any further or to instruct us to cease using your Personal Information as contemplated in this Policy, and notify us either in writing or by email as mentioned above, we shall destroy any retained Personal Information.
From time to time we may ask you for further information in order to update our records or for particular purposes. We will always tell you how we will use any further information received from you.
In order to make our website simpler to use and improve our service, we sometimes place small amounts of information on your computer. These are known as ‘cookies’ and they are used by most major websites.
Cookies are used to remember settings so you don’t have to change them again every time you load a web page. They recognise that you are logged in to an area of the website so you don’t have to keep re-entering your username and password. They also measure how you use the website so we can continue to improve it.
5. Social Media
Depending on your settings and the privacy policies used by social media and messaging services like Facebook, LinkedIn, Twitter or Instagram, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.
6. Third Parties
We may need to disclose your details:
- If we run an event in partnership with another named organisation so that they can help us run the event
- In order to comply with any legal obligation to do so. This includes the police and other crime protection and detection agencies or regulatory bodies
- To our legal advisors
- For the purposes of regulatory or inspection compliance, for example, to the Charity Commission
- To funding bodies, particularly Arts Council of Wales, who may use anonymised personal information to analyse our audience development programmes, ticket sales and self-generated funding to understand the impact of the public investment made in NTW
- Data processing services acting in accordance with our instructions, and subject to confidentiality obligations
We may also receive data about you from third parties. This could include other artistic venues where you have seen NTW’s work, or other partners that we work with where you have consented to share your information with NTW.
We may also receive information from external sources, which enables us to gain a better understanding of our audiences, visitors and supporters and to improve our fundraising and marketing methods.
When someone visits nationaltheatrewales.org we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in an anonymous way which does not identify anyone individually. We do not make, and do not allow Google to make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be open about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Search queries (Google Search Appliance (GSA)) and results are logged anonymously to help us improve our website and search functionality. No user-specific data is collected by either NTW or any third party.
We may also use external services such as PCS Predict address finder to ensure that we keep contact information on our database up to date.
7. Supporting NTW
We are a registered charity (1127952) and rely heavily on voluntary contributions from our audience and other funders to ensure we maintain our world-class programmes of work and making them available to everyone.
You can opt-in to receive information about supporting NTW by logging in to our website and updating your preferences in the “Your Account” section, or by telling our Ticket Office team or one of the Development Team over the phone or in person. We will inform you about our current campaigns, their progress and ways that you can make a real difference and effect change, as well as invitations to events where you can get closer to our artistic programme.
From experience we know that our donors would expect us to have ascertained a level of interest and considered the appropriateness of a request for donations before approaching them. We therefore research some of our customers and supporters and occasionally potential supporters to find shared interests. This research may include information we hold on them (for example, payment methods and postcodes) and publicly available information (for example, but not limited to, social media, news media, biographies on your work website, Companies House, Charity Commission), where they live, their age and similar demographics. In some cases, we will rely on legitimate interest for processing data of potential supporters. This means we may carry out initial research on potential higher-level donors prior to requesting consent. This information will also help us to meet our obligations to protect the charity from financial fraud and risk. We do not use wealth-screening companies to analyse our data.
8. How we keep your details safe and secure
8.1 Your personal data will be held and processed on NTW’s systems or systems managed by suppliers on behalf of NTW. We maintain a customer relationship management (CRM) system to hold contact details and a record of your interactions with NTW such as ticket purchases, donations, memberships, queries, complaints and attendance at special events. Where possible we aim to keep a single record for each customer.
8.2 We always seek to hold your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.
NTW may transfer your data to the USA, to organisations such as Facebook, Google or Wordfly. Where this is the case we will ensure that only organisations who are a part of the EU privacy shield initiative will handle your personal information. More details on this certification can be found at privacyshield.gov/welcome
9. How long we will keep your information
10. Log files
10.1 Every time someone visits our web site a log file is generated on our server.
10.2 The log file records the time and date of your visit, the files that were requested, your IP (Internet Protocol) address, the referrer URL (if provided) and the browser version. We collect this information to help us diagnose problems and administer our systems and to audit the geographical make-up of users and how they have arrived at our site; that is, from what other sites have visitors arrived – this information being obtained from the referrer URL.
10.3 We do not normally link IP addresses to anything personally identifiable, which means that you remain anonymous even though we include your IP address in our aggregate information. However, we can and will attempt to use IP addresses to identify a user when we feel it is necessary to enforce compliance with our terms and conditions, or to protect our services and other users.
11. Use and disclosure of Personal Information
11.1 If you contact us we reserve the right to keep a record of that correspondence and incorporate the information it contains into our database.
11.2 If we are required by law or requested by the police or a regulatory or government authority investigating potentially illegal activities to provide information concerning your activities whilst using the network we shall do so. We may also disclose Personal Information to appropriate third parties to assist in anti-fraud checks and investigations.
12. Surveys and Promotions
From time to time we conduct surveys (such as SurveyMonkey (USA), whose data handling satisfies the provision of GDPR) and promotions and may request information from you as part of these. Participation in these is entirely voluntary and you therefore have a choice whether or not to disclose any information, which might be required. We may also ask you whether you would like to receive promotional emails and mailings from us about our other products or services. Again, you are under no obligation to accept such information.
13. Users Under 18
If you are under 18, please ensure that you obtain your parent/guardian’s consent beforehand whenever you provide Personal Information to the website. Users without such consent are not allowed to provide us with Personal Information.
14. Your Rights
Under the DPA you have the following rights:
- To obtain access to, and copies of, the personal data that we hold about you
- To require that we cease processing your personal data if the processing is causing you damage or distress
- To require us not to send you marketing communications
The following additional rights will come into effect from 25 May 2018 on the implementation of the new GDPR:
- To require us to correct the personal data we hold about you if it is incorrect
- To require us to erase your personal data
- To require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
- To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller
- To object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.
Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.