1. Privacy commitment

National Theatre Wales (NTW) is committed to protecting your privacy. We will use the information that we collect about you in accordance with, the Privacy and Electronic Communications Regulations 2003, the Data Protection Act 1998 (DPA) and any replacement laws, and, from May 2018, the General Data Protection Regulation (GDPR).

Who we are

National Theatre of Wales (NTW) is a national arts organisation and a registered charity presenting theatrical work predominantly in the English language.

NTW is a charity registered in England and Wales, number 1127952, and a company limited by guarantee registered in England and Wales, number 6693227

Please read this Privacy Policy to understand how your personal information will be treated. This policy may change from time to time so please check it periodically. This update is current as of May 2018.

If you have any queries regarding this policy please get in touch, our contact details are:

Address: National Theatre Wales, Tramshed Tech, Unit D, Pendyris St, Cardiff, CF11 6BH

Email: privacy@nationaltheatrewales.org

Phone: +44 (0)29 2252 8171

Website: nationaltheatrewales.org

Data Protection Officer: Leonora Thomson, Interim Chief Executive Officer

You also have the right to lodge a complaint with the supervisory authority, Information Commissioner’s Office (ICO).

2. Personal information

Across our operations the personal information that we collect can include:

• Names, title, date of birth and gender
• Information about race, ethnicity, and sexual orientation (you have the right to decline to provide us with this information)
• Contact details including postal address, email, phone numbers and links to social media accounts
• Transaction history (we never store your whole card number, although we may keep a note of the last four digits to help us identify transactions)
• Access requirements (for example if you require wheelchair access, audio description, BSL interpretation, or any other access requirement) and whether you have a disability defined by the Equality Act 2010
• Welsh language preferences
• Details of visits to our website including traffic data, location data, operating system, browser usage, and the resources that you access
• Image and likeness (as captured in photographs and videos we use for promotional purposes (note: we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use))
• Other background personal information you provide to us (for example when you apply for a job, tell us your story, provide a reason for making a donation or correspond with us)

We may also process your personal data (including sensitive personal data) where:

• It is necessary for medical purposes (for example, in a medical emergency)
• It is necessary to protect your or another person’s vital interests
• We have your consent to do so (for example, to monitor the diversity of NTW’s audiences and participants
• We will also ask for your consent to provide you with information about products and services and fundraising activities which may be of interest to you (apart from where it is appropriate for us to rely on our legitimate interests to do so).

The details which you provide about yourself and any information which identifies you (as detailed above) may be retained by us if either you provide this information when you directly engage with NTW, such as when you buy a ticket, sign up to one of our events, subscribe to an email list, update your preferences on our website, post a message on the Community pages, make a donation, apply for a job or correspond with us. We also keep your details through the use of cookies on our website.

Personal Information will be held on our system and used for operational purposes such as the processing of bookings and orders in connection with our on-line ticket services and for mailing list subscriptions. We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. We may then track any subsequent actions online, such as buying a ticket.

In order to process a transaction, your Personal Information and card details may be passed to third-party service providers. Card details will only be used for the purpose of handling an individual transaction.

The Personal Information you supply to us when you opt-in to marketing communications will be used by NTW to keep you up-to-date with events and activities organised by, and news and information from NTW and its co-producers, other arts organisations and our sponsors.

Each email we send you offers you the opportunity to unsubscribe from these preferences, or you can ask us to do this by emailing boxoffice@nationaltheatrewales.org.

3. Giving you control

We may tell you about events, productions, priority booking and information about performance sites and occasionally may include information in these communications from partner organisations or organisations who support us. We make it easy for you to tell us how you want to hear from us (by using the “Log In” on our website and updating your preferences in the “Your Account” section) or by telling our Ticket Office team over the phone or in person. You can opt-out from these communications at any time – every email sent to you will tell you how to do this.

If you have opted out of these communications, we may still get in touch with you. For example, we may email you to give you important information about the events you have booked or to tell you about any changes.

You have the right to obtain from us an electronic or paper copy of all Personal Information concerning yourself, or to speak to a NTW representative on any matter, by emailing privacy@nationaltheatrewales.org or writing to National Theatre Wales, Tramshed Tech, Unit D, Pendyris St, Cardiff, CF11 6BH.

If you would like to revise the information provided to us at any time, or feel what we currently have on record is incorrect, you may update the information by emailing the address above.

If you decide not to use our services any further or to instruct us to cease using your Personal Information as contemplated in this Policy, and notify us either in writing or by email as mentioned above, we shall destroy any retained Personal Information.

From time to time we may ask you for further information in order to update our records or for particular purposes. We will always tell you how we will use any further information received from you.

4. Cookies

In order to make our website simpler to use and improve our service, we sometimes place small amounts of information on your computer. These are known as ‘cookies’ and they are used by most major websites.

Cookies are used to remember settings so you don’t have to change them again every time you load a web page. They recognise that you are logged in to an area of the website so you don’t have to keep re-entering your username and password. They also measure how you use the website so we can continue to improve it.

See more information on our Cookie Policy.

5. Social media

We use social media to broadcast messages and updates about events and news, including our online Community. On occasion, we may reply to comments or questions you make to us on social media platforms. You may also see adverts from us on social media that are tailored to your interests. See our cookie policy for further information.

Depending on your settings and the privacy policies used by social media and messaging services like Facebook, LinkedIn, Twitter or Instagram, we may receive non-personally identifying demographic or analytical information from these services that enables us to better understand the reach and effectiveness of our advertising.

6. Third parties

We may need to disclose your details:

• If we run an event in partnership with another named organisation so that they can help us run the event
• In order to comply with any legal obligation to do so. This includes the police and other crime protection and detection agencies or regulatory bodies
• To our legal advisors
• For the purposes of regulatory or inspection compliance, for example, to the Charity Commission
• To funding bodies, particularly Arts Council of Wales, who may use anonymised personal information to analyse our audience development programmes, ticket sales and self-generated funding to understand the impact of the public investment made in NTW
• Data processing services acting in accordance with our instructions, and subject to confidentiality obligations

We may also receive data about you from third parties. This could include other artistic venues where you have seen NTW’s work, or other partners that we work with where you have consented to share your information with NTW.

We may also receive information from external sources, which enables us to gain a better understanding of our audiences, visitors and supporters and to improve our fundraising and marketing methods.

When someone visits nationaltheatrewales.org we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in an anonymous way which does not identify anyone individually. We do not make, and do not allow Google to make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be open about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

Search queries (Google Search Appliance (GSA)) and results are logged anonymously to help us improve our website and search functionality. No user-specific data is collected by either NTW or any third party.

We may also use external services such as PCS Predict address finder to ensure that we keep contact information on our database up to date.

We use a third-party service, WordPress.com, to publish our blogs. These sites are hosted at WordPress.com, which is run by Automattic Inc. We use a standard WordPress service to collect anonymous information about users’ activity on the site, for example, the number of users viewing pages on the site, to monitor and report on the effectiveness of the site and help us improve it. WordPress requires visitors that want to post a comment to enter a name and email address. For more information about how WordPress processes data, please see Automattic’s Privacy Policy.

We do not sell personal details to third parties for any purpose nor will we share your personal data from 25 May 2018 with any other organisations or promoters that have not been named in our privacy policy for their own marketing communications.

7. Supporting NTW

We are a registered charity (1127952) and rely heavily on voluntary contributions from our audience and other funders to ensure we maintain our world-class programmes of work and making them available to everyone.

You can opt-in to receive information about supporting NTW by logging in to our website and updating your preferences in the “Your Account” section, or by telling our Ticket Office team or one of the Development Team over the phone or in person. We will inform you about our current campaigns, their progress and ways that you can make a real difference and effect change, as well as invitations to events where you can get closer to our artistic programme.

Based on the frequency of your visits and purchasing patterns, we may promote our campaigns to you or ask you for additional support for our work. If you are a donor, we may use a number of basic research tools to estimate your potential interest in supporting us further or in different ways. Your information may also be shared with us by independent fundraising sites such as JustGiving or The Big Give if you make a donation to NTW, but only when you have indicated that you give your consent to hear from us. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

From experience we know that our donors would expect us to have ascertained a level of interest and considered the appropriateness of a request for donations before approaching them. We therefore research some of our customers and supporters and occasionally potential supporters to find shared interests. This research may include information we hold on them (for example, payment methods and postcodes) and publicly available information (for example, but not limited to, social media, news media, biographies on your work website, Companies House, Charity Commission), where they live, their age and similar demographics. In some cases, we will rely on legitimate interest for processing data of potential supporters. This means we may carry out initial research on potential higher-level donors prior to requesting consent. This information will also help us to meet our obligations to protect the charity from financial fraud and risk. We do not use wealth-screening companies to analyse our data.

We may also be given information on potential donors via our trustees and key stakeholders for the purposes of fundraising events and other activity. Where this is the case we will endeavour to send a copy of this Privacy Policy at the first point of contact, or at the latest within a month of receiving the information.

8. How we keep your details safe and secure

8.1 Your personal data will be held and processed on NTW’s systems or systems managed by suppliers on behalf of NTW. We maintain a customer relationship management (CRM) system to hold contact details and a record of your interactions with NTW such as ticket purchases, donations, memberships, queries, complaints and attendance at special events. Where possible we aim to keep a single record for each customer.

8.2 We always seek to hold your data securely. Access to customer information is strictly controlled. The CRM system can only be accessed by people who need it to do their job. Certain data, for example sensitive information, is additionally controlled and is only made visible to members of staff who have a reason to work with it.

8.3 As part of the services offered to you through NTW’s website, the personal information you provide may be transferred to countries outside of the European Economic Area (EEA). By way of example, this may happen if any of the computer servers used to host our website are located in a country outside of the EEA. If NTW transfers your personal information outside of the EEA in this way, we will take steps to ensure that your privacy rights continue to be protected as outline in the privacy policy.

NTW may transfer your data to the USA, to organisations such as Facebook, Google or Wordfly. Where this is the case we will ensure that only organisations who are a part of the EU privacy shield initiative will handle your personal information. More details on this certification can be found at privacyshield.gov/welcome.

Google will not associate your IP address with any other data previously held. You may refuse the use of cookies by selecting the appropriate settings on your browser. Please note that if cookies are disabled, you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

9. How long we will keep your information

We will keep your information only for as long as is reasonably necessary for the purposes set out in this privacy policy and to fulfil our legal obligations. We will not keep more information than we need. The retention period will vary according to the purpose, for example, for a ticket purchase we will cease to market to individuals who have not had any further interaction with NTW. We will continue to use this data for analysis for a further seven years, but will remove it after this point in time. However, for a customer that had pledged a legacy to NTW, we will retain this information for as long is required to process the bequest. Some information may be retained indefinitely for historical, statistical or research purposes. However, you have the right to require us to erase personal data.

10. Log files

10.1 Every time someone visits our web site a log file is generated on our server.

10.2 The log file records the time and date of your visit, the files that were requested, your IP (Internet Protocol) address, the referrer URL (if provided) and the browser version. We collect this information to help us diagnose problems and administer our systems and to audit the geographical make-up of users and how they have arrived at our site; that is, from what other sites have visitors arrived – this information being obtained from the referrer URL.

10.3 We do not normally link IP addresses to anything personally identifiable, which means that you remain anonymous even though we include your IP address in our aggregate information. However, we can and will attempt to use IP addresses to identify a user when we feel it is necessary to enforce compliance with our terms and conditions, or to protect our services and other users.

11. Use and disclosure of Personal Information

11.1 If you contact us we reserve the right to keep a record of that correspondence and incorporate the information it contains into our database.

11.2 If we are required by law or requested by the police or a regulatory or government authority investigating potentially illegal activities to provide information concerning your activities whilst using the network we shall do so. We may also disclose Personal Information to appropriate third parties to assist in anti-fraud checks and investigations.

12. Surveys and promotions

From time to time we conduct surveys (such as SurveyMonkey (USA), whose data handling satisfies the provision of GDPR) and promotions and may request information from you as part of these. Participation in these is entirely voluntary and you therefore have a choice whether or not to disclose any information, which might be required. We may also ask you whether you would like to receive promotional emails and mailings from us about our other products or services. Again, you are under no obligation to accept such information.

13. Users under 18

If you are under 18, please ensure that you obtain your parent/guardian’s consent beforehand whenever you provide Personal Information to the website. Users without such consent are not allowed to provide us with Personal Information.

14. Your rights

Under the DPA you have the following rights:

• To obtain access to, and copies of, the personal data that we hold about you
• To require that we cease processing your personal data if the processing is causing you damage or distress
• To require us not to send you marketing communications

The following additional rights will come into effect from 25 May 2018 on the implementation of the new GDPR:

• To require us to correct the personal data we hold about you if it is incorrect
• To require us to erase your personal data
• To require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
• To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller
• To object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.