Sign up

Westival Privacy Policy

This privacy policy explains how Westival Limited collects, uses and protects your personal data.

1. Who we are

Westival Limited (“Westival”, “we”, “us”, “our”) runs the Westival music festival in Wales. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

  • Company: Westival Limited, registered in England and Wales, company number 11193133
  • Address: 11-13 Thomas Court, London Road Industrial Estate, Pembroke Dock, Wales, SA72 4RZ
  • Email: hello@westival.wales

This policy explains what personal data we collect when you sign up to hear from us or visit our website, how we use it, and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. What we collect

We collect the details you give us through our sign-up forms, a record of your consent, and information about how you use our website.

  • Email address – so we can send you marketing emails.
  • Mobile phone number – so we can send you marketing text messages (SMS).
  • Consent record – the date and time you signed up, the form or page you used, and the wording of the consent you agreed to. We keep this to show that you asked to hear from us.

If you accept analytics cookies, we also collect website usage data through Google Analytics: the pages you visit and how long you spend on them, the site or link that brought you to us, buttons and links you click, your device type, browser and operating system, and your approximate location (town or region). Google Analytics 4 does not store your full IP address.

We do not ask for, and do not want, any special category data (such as health, religion or ethnicity) through our sign-up forms.

3. How we use your data and our lawful basis

We use your email address and phone number to send you marketing about Westival, and our lawful basis is your consent.

That marketing may include line-up announcements, ticket releases and on-sale dates, festival news and updates, and offers connected to Westival.

Lawful basis. We rely on your consent under Article 6(1)(a) of the UK GDPR. Under PECR, we must also have your consent before sending marketing by email or SMS. Our sign-up forms exist to join our mailing list, so you can only sign up by opting in to marketing; we never pre-tick consent boxes.

Withdrawing consent. You can withdraw your consent at any time, free of charge (see section 6). Withdrawing does not affect marketing we sent lawfully before you withdrew.

We do not use your data to make decisions about you by automated means that have legal or similarly significant effects. We do not sell your personal data.

Website analytics. We use Google Analytics to understand how people find and use our website, so we can improve it and see which announcements and campaigns work. This relies on cookies, small files stored on your device. We only set analytics cookies if you accept them through our cookie banner, so our lawful basis is your consent (UK GDPR Article 6(1)(a) and PECR regulation 6). You can change your choice at any time through the [Cookie settings] link on our website. We use Google Analytics to look at overall trends, not to identify you, and we do not link it to your mailing list details. [We have turned off Google Signals and advertising features.]

Google Analytics sets two cookies: _ga, which distinguishes one visitor from another, and _ga_[ID], which keeps track of your session. Both expire after 2 years.

4. Who we share your data with

We share your details only with service providers who help us send our marketing, and they may use it only on our instructions.

These providers are: Mailchimp, which stores our mailing list and sends our emails ; Firetext, which sends our text messages built with plot, which hosts our website and sign-up forms and Google, which provides Google Analytics to measure how our website is used (UK, EU and USA).

Each provider acts as our processor under a written contract that requires them to keep your data secure and confidential. We may also disclose your data if the law requires it, for example to comply with a court order, or to a buyer if Westival or its business is sold.

International transfers. Some of our providers may store or access data outside the UK. Where they do, we make sure the transfer is protected, either because the UK Government has approved the destination (for example under the UK–US Data Bridge) or because we use the ICO’s International Data Transfer Agreement or Addendum. You can ask us for details of these safeguards.

5. How long we keep your data and how we protect it

We keep your details until you unsubscribe, or until [24] months after you last engaged with our messages, whichever comes first.

  • If you unsubscribe: we delete your details from our marketing list but keep your email address or phone number on a suppression list, so we can make sure we never contact you again.
  • If you stop engaging: after [24] months without opening or clicking our messages, we may contact you once to ask whether you still want to hear from us, then delete your details if you do not confirm.
  • Consent records: we keep these for as long as we hold your details, and for up to [6] years afterwards in case we need to show we had your consent.

Website usage data: Google Analytics keeps data linked to cookies and identifiers for [14] months, after which it is deleted automatically. Overall reports that cannot identify you may be kept longer. Analytics cookies expire after 2 years, and you can delete them from your browser at any time.

We use appropriate technical and organisational measures to protect your data, including password-protected accounts with restricted access, two-factor authentication on our marketing platforms, and contracts with our providers requiring them to keep data secure.

6. Your rights and how to unsubscribe

You can stop our marketing at any time: click “unsubscribe” in any email, reply STOP to any text message, or email us at hello@westival.wales.

To stop website analytics, reject or turn off analytics cookies through the [Cookie settings] link on our website, delete cookies in your browser, or install Google’s opt-out browser add-on. You can read how Google handles data in Google’s privacy policy.

Under UK data protection law you also have the right to:

  • Access – ask for a copy of the personal data we hold about you.
  • Rectification – ask us to correct data that is wrong or incomplete.
  • Erasure – ask us to delete your data.
  • Restriction – ask us to limit how we use your data.
  • Objection – object to direct marketing at any time; we will stop.
  • Portability – ask for your data in a commonly used, machine-readable format.
  • Withdraw consent – at any time, without affecting earlier lawful use.

To use any of these rights, email hello@westival.wales or write to us at the address in section 1. We will respond within one month, and there is usually no charge. We may need to confirm your identity before acting on a request.

7. Complaints, children and changes

Complaints. If you are unhappy with how we have handled your data, please contact us first at hello@westival.wales so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Children. Our marketing is intended for adults. You must be 18 or over to sign up. If we learn that we hold details of someone under that age, we will delete them.

Changes to this policy. We may update this policy from time to time, for example if we change providers or start collecting new data. The latest version will always be on our website, with the date it was last updated. If we make significant changes, we will let you know before they take effect.

Last updated: 16 October 2026