Legal and Privacy

Company Number
3419514 (Registered in England & Wales)

Welsh Rugby Union Privacy Notice

About this document

This document sets out information on the personal information collected by the Welsh Rugby Union Group. The Welsh Rugby Union Group comprises:

The Welsh Rugby Union Limited;
Millennium Stadium plc;
Millennium Stadium Experience Limited; and
WRU Supporters Club Limited.

References to the “WRU Group”, “us” or “we” are references to the Welsh Rugby Union Group.

We may make changes to this notice from time to time. We will notify you of any significant changes, but encourage you to review this notice periodically.

This notice was last updated on: 31 January 2022

Our contact details

Name: Welsh Rugby Union Group

Address: Principality Stadium, Westgate Street, Cardiff, CF10 1NS

Phone Number: 02920 822 000

E-mail: info@wru.wales (please include “Privacy Notice” in the subject line)

Write to us: Legal Affairs Team, Principality Stadium, Westgate Street, Cardiff, Wales CF10 1NS

If you have any questions about any of the information in this notice, or would like to request further details on how we process your information, or to exercise your rights, please contact us using the details above.

How we collect personal information

Most of the personal information we collect is provided to us directly from you in the following circumstances:

When you use one of our websites, or those operated on our behalf, at wru.wales, principalitystadium.wales, wrugamelocker.wales; cardiffconferences.co.uk and welshrugbyticketexchange.seatunique.com;
When you use one of our mobile applications, including The Official WRU App, the Principality Stadium Ticketing App, the Principality Stadium Experience VIP Ticketing App, the WRU Ref App and the WRU Clubs App;
When you use the WRU online player registration portal;
When you use any other website or application which we may make available from time to time; and
When you contact us with enquiries, complete forms on our websites and applications, subscribe to receive our marketing communications or provide feedback to us.

We collect certain information automatically when you use our websites and applications, such as information on you equipment, browsing actions and patters. We collect this information by using cookies and other similar technologies. You can find out more information on this in our Cookies Notice.

We also receive personal information indirectly, from the following sources in the following scenarios:

We receive information from rugby union clubs, other rugby union national governing bodies and other regulatory organisations, including World Rugby, the Sports Councils, the World Anti-Doping Agency and the Health and Safety Executive.
We also receive personal information from payment providers, transport providers and third parties that provide services to us so that we can operate our websites and applications, and provide goods and services requested by you. For example, when you book tickets for tours and events through our providers or purchase memberships.
We receive information from analytics providers in order to improve our services. This includes information on your interaction with our social media accounts.
We may also receive personal information (which may include sensitive personal information relating to criminal convictions and offences) from the Disclosure and Barring Service in relation to our recruitment and safeguarding activities (see the relevant sections below for more information).

The type of personal information we collect

The types of personal information we collect will vary depending on who you are and why we are collecting your information. We currently collect and process the following information:

Who you are:	Information we collect:
Visitors to our websites and apps.	(i) your name and title; (ii) your date of birth; (iii) your gender; (iv) your contact information (including telephone number, postal address and/or email address); (v) information relating to your interactions with our websites or applications; (vi) your demographic information such as post code, preferences and interests; and (vii) any information you volunteer which is relevant to the provision of the products and services you have requested.
Purchasers or holders of membership packages or debentures.	(i) your name and title; (ii) your date of birth; (iii) your gender; (iv) your contact information (including telephone number, postal address and/or email address); (v) your payment details; (vi) information relating to your interactions with our websites and application; (vii) your demographic information such as post code, preferences and interests; and (viii) any information you volunteer which is relevant to your membership or debenture.
Purchasers of match and event tickets, stadium tour tickets and merchandise.	(i) your name and title; (ii) your date of birth; (iii) your gender; (iv) your contact information (including telephone number, postal address and/or email address); (v) your payment details; (vi) information relating to your interactions with our websites and applications; (vii) your demographic information such as post code, preferences and interests; (viii) any information you volunteer which is relevant to the provision of the tickets and/or merchandise you have purchased; and (ix) personal contact information to assist with the containment of the Covid-19 virus and support the relevant Government authorities and the NHS Track and Trace scheme, including name, email address, mobile number and residential address.
Rugby players, Exiles players, coaches, match officials and club officials.	(i) your name and title; (ii) your date of birth; (iii) your gender; (iv) your contact information (including telephone number, postal address and/or email address); (v) your biographical information; (vi) information about your match performance and your personal and professional conduct where relevant to your involvement in rugby union in Wales; (vii) your likeness; (viii) your image; (ix) your voice; (x) your statements; (xi) any personal information contained in any form of personal identification, such as a passport; (xii) your payment details; (xiii) any information you volunteer which is relevant to our relationship with you or your club; and (xiv) special categories of personal information (including without limitation information revealing racial or ethnic origin and information concerning physical and mental health) and personal information relating to criminal convictions and offences.
Individuals who work with our partners, sponsors and suppliers.	(i) your name and title; (ii) your job title; (iii) your contact information (including telephone number, postal address and/or email address); (iv) any personal information contained in any form of personal identification; (v) your payment details; and (vi) any information you volunteer which is relevant to our relationship with your organisation.
Job applicants.	(i) your name and title; (ii) your current job title; (iii) your contact information (including telephone number, postal address and/or email address); (iv) personal information concerning your education, qualifications and employment history; and (v) any other personal information which appears in your curriculum vitae or which is relevant to your potential recruitment, which may include special categories of personal information (including without limitation information revealing racial or ethnic origin and information concerning physical and mental health) and information relating to criminal convictions and offences.
Attendees of events hosted by the WRU Group, including a Welsh rugby union match, a rugby match involving the Wales national team or any event held at Principality Stadium.	(i) your name and title; (ii) your date of birth; (iii) your gender; (iv) your contact information (including telephone number, postal address and/or email address); (v) your biographical information; (vi) your physical description; (vii) your likeness; (viii) your image; (ix) your voice; (x) your statements; (xi) any personal information contained in any form of personal identification; (xii) your payment details; (xiii) any information you volunteer which is relevant to our relationship with you; and (xiv) special categories of personal information (including without limitation information revealing racial or ethnic origin and information concerning physical and mental health) and personal information relating to criminal convictions and offences.

Personal information of children under 18

Our websites, applications and other commercial products and services are not specifically targeted at children under 18, although we appreciate that they may appeal to children. If you are under 18, we ask that you obtain your parent’s or guardian’s consent before submitting personal information to us or requesting any products or services from us.

If you are a parent or guardian of a child under 18, please ensure that you supervise your child’s use of our websites and applications, and our products and services and ensure they obtain your consent before submitting any personal information to us or requesting any products or services from us.

We process personal information relating to children under the age of 18 in connection with our regulatory duties, for example in relation to the registration of players and our safeguarding activities.

Use of CCTV

We have security measures in place at Principality Stadium and our other premises, including CCTV, body cameras and building access controls. There are signs in place showing that CCTV is in operation. The images captured are securely stored and only accessed on a need to know basis (e.g. to look into an incident). CCTV recordings are typically automatically overwritten after a short period of time unless an issue is identified that requires investigation (such as a theft). We require visitors to our offices to sign in at reception and keep a record of visitors for a short period of time. Our visitor records are securely stored and only accessible on a need-to-know basis (e.g. to look into an incident).

Aggregated and anonymised data

We also collect, use and share aggregated and anonymised such as statistical or demographic data for any purpose. This data could be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data from our websites to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated and anonymised data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this privacy notice.

If you fail to provide your personal information

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

Why we collect your information

Under the data protection laws we require a lawful basis for processing the information we collect. The bases we rely on are:

Your consent. You are able to remove your consent at any time. You can do this by using the contact details in the ‘our contact details’ section above or, with respect to emails, clicking the unsubscribe link in any email.
We have a contractual obligation.
We have a legal obligation.
We have a vital interest.
We need it to perform a public task.
We have a legitimate interest or are fulfilling the legitimate interests of a third party (which can include you).

The table below provides more information on the reasons we collect and use your personal information, as well as the lawful bases we rely on. The information we collect is used for the following reasons:

Reason:

Lawful basis:

Fulfilment of our obligations when you use our products and services. This includes:

· when you use our websites and applications, including where you register for an account;

· when you purchase goods and / or services from us (either directly or through our partners) such as tickets to matches and other events, membership packages or debentures, corporate hospitality packages, and merchandise; and

· when you enter prize draws, competitions, and other promotions.

· In order to fulfil a contract with you.

· In order to comply with our legal obligations when you are attending Principality Stadium.

· In order to fulfil our legitimate interests or those of a third party, including provision of the goods and services in the most efficient way.

Fulfilment of our governance and regulatory duties as the governing body of rugby union in Wales. This includes:

· administering and maintaining registrations in respect of Welsh rugby union players, Exiles players and match officials;

· managing the administration of Welsh rugby union at a club, regional and international level;

· administering drug and alcohol testing in accordance with our obligations under applicable laws and regulations;

· administering disciplinary proceedings in relation to players, match officials, club officials and others under the auspices of the Welsh Rugby Union Disciplinary Panel; and

· complying with our safeguarding responsibilities, which require us to protect the safety, wellbeing and freedoms of children and others involved in the game of rugby in Wales and to ensure the suitability of those who work with them in coaching and similar roles.

· In order to fulfil a contract with you.

· In order to comply with our legal obligations.

· In order to fulfil our legitimate interests or those of a third party, including ensuring effective and efficient governance, regulation and administration of Welsh rugby union and to protect and uphold its reputation and integrity.

Monitoring the performance of and improving our goods and / or services. This includes through the use of feedback surveys, user insights and analytics of data we obtain.

· In order to fulfil our legitimate interests or those of a third party, including:

o monitoring our performance as the governing body of rugby union in Wales;

o monitoring the quality of our goods and services;

o improving our goods and services;

o ensuring we provide high quality goods and services; and

o tailoring our marketing of our goods and services.

Sending out marketing communications.

· We have your consent if you have opted-in to receive such communications.

Responding to any general enquiries we receive.

· In order to fulfil our legitimate interests in providing you with good customer service.

Creation of content for our websites, applications, and communications.

· In order to fulfil our legitimate interests or those of a third party, including crediting your work where you have created the content.

Recruitment purposes, including:

· assessing your application;

· communicating with you about the recruitment process; and

· keeping records of the recruitment process.

· In order to fulfil a contract with you.

· In order to fulfil our legitimate interests or those of a third party, including to ensure we make appropriate and informed recruitment decisions.

Receipt or supply of services from partners and suppliers. This includes:

· managing relationships with organisations you represent; and

· receiving or supplying products and services.

· In order to fulfil our legitimate interests or those of a third party, including ensuring we have effective working relationships with our partners and suppliers.

Business administration and legal compliance. This includes:

· compliance with our legal obligations;

· enforcing our legal rights;

· protecting the rights of third parties; and

· processing in connection with a business transition such as a merger, reorganisation, acquisition by another company, or sale of all or a portion of our assets.

· In order to comply with our legal obligations.

· In order to fulfil our legitimate interests or those of a third party, including protecting our rights and interests.

Special Category Information

Certain information we collect is known as ‘special category information’ and is subject to additional rules and protections. Special category information includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, personal information concerning a person’s health, sex life or sexual orientation, as well as genetic data and biometric data (such as urine or blood samples). It also includes personal information relating to criminal convictions and offences.

Where our processing activities involve the processing of special categories of personal information or personal information relating to criminal convictions or offences, we rely on the following lawful bases to legitimise our processing:

You have given your explicit consent to the processing for one or more specified purposes;
The processing is necessary for the purposes of carrying out obligations and exercising rights (ours or yours) in the field of employment and social security and social protection laws, as authorised under applicable law;
The processing is necessary to protect the vital interests of an individual where that individual is physically or legally incapable of giving consent;
The processing is necessary for the establishment, exercise or defence of legal claims; or
The processing is necessary for reasons of substantial public interest, including without limitation, processing necessary for the purposes of: (i) monitoring equality of opportunity or treatment; (ii) preventing or detecting unlawful acts; (iii) safeguarding children and individuals at risk; (iv) insurance matters; (v) eliminating anti-doping in sport; and (vi) maintaining standards of behaviour in sport and the integrity of the game.

Who we share your personal information with

We will only share personal information with others when we are legally permitted to do so. When we share personal information with others, we put contractual arrangements and security mechanisms in place to protect the personal information and to comply with our data protection, confidentiality and security standards.

We may need to share it with third parties as follows:

Other organisations within our group of companies where necessary for administrative purposes or where those organisations assist us in the provision of our products and services or in the fulfilment of our duties as the governing body of rugby union in Wales.
Third-party service providers, including:
- IT providers;
- Analytics providers;
- Payment services providers;
- Delivery and courier companies;
- Event partners and suppliers;
- Marketing and customer relationship specialists;
- Organisations that assist us with the administration of our promotions and competitions;
- Organisations that assist us with the management, operation and/or delivery of our products and services;
- Recruitment agencies and other related organisations; and
- Auditors, lawyers, and other professional advisors.
Law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation. This may include the Government, Public Health Wales, the NHS and other relevant individuals and/or organisations where it is requested for the purposes of the NHS Track and Trace scheme and/or containment of the Covid-19 virus.
Rugby union and other governing and regulatory bodies, including, without limitation, World Rugby, the Sports Councils, the World Anti-Doping Agency and the Health and Safety Executive.
Other third parties: Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal information, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights. We will only fulfil requests for personal information where we are permitted to do so in accordance with applicable law or regulation

Sharing information outside of the UK

Where necessary, we may store or share the personal information we collect outside of the UK. Whenever we transfer your information out of the UK, we ensure a similar level of protection is given to it. This is achieved either because the protections available have been deemed adequate by the applicable authorities, or by implementing additional safeguards such as additional contracts or security measures.

How we store your personal information

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long we keep your information

We will normally retain your personal information for as long as you use our services and for up to three years after your last use of our services or your last interaction with us (for example, the last time you opened an electronic communication from us, visited one of our websites, played for a local rugby club or purchased a ticket for an event at Principality Stadium). We may then destroy such personal information without further notice or liability.

However, in some circumstances we will retain your personal information for a different time period, including:

we will retain recorded CCTV footage at Principality Stadium in accordance with applicable legislation, unless we are required to retain it for longer (for example, if we are investigating an incident, or have been asked to retain specific CCTV footage for a longer period by government or law enforcement officials); and
we will retain your personal information for longer if we believe we may need it in order to respond to any claims, to protect our rights or the rights of a third party, and we will retain your personal information for longer if we are required to retain them in order to comply with applicable laws; and
if any personal information is only useful for a short period (e.g. for a specific marketing campaign), we may delete it at the end of that period.

We will always retain your personal information in accordance with data protection law and never retain your personal information for longer than is necessary.

If you have opted out of receiving marketing communications from us, we will need to retain certain personal information indefinitely so that we know not to send you marketing communications again.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

Not all of these rights will apply automatically and we will notify you and provide you with reasoning where we are unable to fulfil your request.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. This time period may be extended in certain circumstances and we will notify you if this is the case.

Please contact us using the details above if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us using the contact details above.

You can also complain to the ICO if you are unhappy with how we have used your information.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Third Party Websites

Our websites and applications contain links to third party websites and services. When you use a link to go to another website or you request a service from a third party, this notice no longer applies.

Your browsing of and interactions with any other websites, or your dealings with any third party service provider, is subject to that website’s or third party service provider’s own rules and policies.

We do not monitor, control or endorse the privacy practices of any third parties.