Privacy Policy.
Last Updated 17 August 2025

1. Who We Are

Welsh National Theatre (“WNT”, “we”, “our”, “us”) is committed to protecting your privacy.
We are the data controller of your personal data under the UK General Data Protection Regulation (UK GDPR).
Contact details: Welsh National Theatre
Email: admin@welshnationaltheatre.com

2. Information We Collect

We collect and process the following categories of information:

A. Information you provide directly:

  • Name, email address and contact details when subscribing to our mailing list, contacting us, or otherwise engaging with us.

B. Information we collect automatically:

  • Technical information such as IP address, browser type, operating system, and how you interact with our website.

  • Data collected through cookies and similar technologies (including Meta Pixel and Google Analytics).

C. Information shared by partner venues:

  • For productions presented in partnership with third-party venues, we may receive limited, hashed (encrypted) ticket purchase data (such as email or phone number, purchase date, time and ticket value). We do not receive unencrypted personal details and we do not use this data to contact individuals directly.

3. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Ensure our site functions correctly (strictly necessary cookies).

  • Measure performance and improve user experience (analytics cookies, e.g. Google Analytics).

  • Track marketing effectiveness and optimise advertising (advertising cookies, e.g. Meta Pixel).

Some cookies are set by us (first-party) and some by third parties. You can manage or disable cookies through your browser settings.

Third-party services we use include:

4. How We Use Your Information

We use your information to:

  • Send updates and communications about WNT’s productions and activities.

  • Analyse and improve our website and marketing.

  • Measure the effectiveness of advertising and marketing campaigns.

  • Understand audience reach and ticket sales through hashed data from partner venues.

  • Comply with legal obligations.

5. Legal Bases for Processing

We rely on the following lawful bases under the UK GDPR:

  • Consent – for sending marketing communications when you sign up to our mailing list.

  • Legitimate Interests – for analysing website use, measuring and optimising marketing (including Meta Pixel and hashed data from venues).

  • Legal Obligation – where processing is required to comply with law.

6. How We Share Your Information

We do not sell personal data. We may share it with:

  • Service providers – such as email marketing platforms that help us deliver communications.

  • Advertising platforms – such as Meta, via tools like Meta Pixel or secure hashed uploads, to measure and improve campaign performance.

  • Legal authorities – where required to comply with law.

Some of these providers may process data outside the UK/EEA. Where this happens, transfers are safeguarded by standard contractual clauses (SCCs) or equivalent protections.

7. Children’s Data

Our website and services are intended for people aged 16 and over. We do not knowingly collect information from children.

8. Data Security

We take appropriate measures to protect your data, including secure servers, encryption, and restricted access controls. While no transmission over the internet is completely secure, we use reasonable safeguards to minimise risk.

9. Data Retention

  • Mailing list data: retained until you unsubscribe or request deletion.

  • Usage data (cookies/analytics): retained in line with provider policies, typically 12–26 months.

  • Hashed purchase data from partner venues: retained only for measurement and attribution, up to 24 months.

10. Your Rights

You have the following rights under UK GDPR:

  • Access to your data.

  • Correction of inaccurate or incomplete data.

  • Deletion of your data (“right to be forgotten”).

  • Restriction of processing.

  • Data portability (transfer of your data to another service).

  • Object to processing, including for direct marketing.

  • Withdraw consent where processing is based on consent.

  • Lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how your data is handled: www.ico.org.uk.

To exercise any of these rights, contact: admin@welshnationaltheatre.com

11. Promotional Communications

We will only send you marketing communications if you have given your consent (or under a lawful soft opt-in). You can unsubscribe at any time by clicking the link in our emails or contacting us directly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any updates will be posted here with the revised “Last Updated” date. Significant changes may be notified by email if appropriate.