Privacy notice for Worcester Warriors mobile app users
Sixways Stadium ("the Company", "we", "us") is aware of its obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and is committed to processing your data securely and transparently. This privacy notice covers the Worcester Warriors mobile application ("the App") published on the Apple App Store and Google Play. It sets out the personal data the App processes, how we use it, how long we keep it, and your rights in relation to it.
This Privacy Notice has effect from 30 April 2026. Any change in the way that we process personal data through the App will be detailed in an updated Privacy Notice published within the App.
A separate privacy notice covers our wider stadium and customer operations (ticket sales over the counter, membership, CCTV, building access, marketing communications, and similar). That notice is available on our website and is not duplicated here.
Data controller details
The Company is a data controller, meaning that it determines the processes used when handling your personal data. Our registered address is Sixways Stadium, Warriors Way, Worcester, WR3 8ZE. Please direct any queries to hello@warriors.co.uk or call 01905 972700.
Data the App processes
The App processes a small, defined set of personal data:
- Email address: collected only if you choose to sign in to the App. Signing in is optional; you can browse the App without an account. If you do sign in, your email address is used to identify you to our ticketing provider so that we can display your tickets and order history.
- Name: returned to the App by our ticketing provider alongside your tickets and orders once you have signed in, so that we can show you whose account is signed in and which name appears on each ticket. The App does not ask you to enter your name directly. Name is only collected if you sign in.
- Match ticket and order data: looked up against your email address each time you open the relevant area of the App, so we can display the tickets you have purchased. This data is fetched on demand and is not stored long-term by the App.
- App interactions: because the App is server-driven, your interactions with it (such as which screens you open, which buttons you tap, and which items you select) are sent to our servers in order to render the next screen. We use this interaction data to operate the App, to keep it secure, and to improve reliability. We do not use it for advertising or for profiling you across other services.
The App does not collect your postal address, date of birth, phone number, photograph, gender, marital status, dependants, next of kin, bank or payment card details, precise or approximate location, contacts, microphone, camera, health data, or device identifiers used for advertising. The App does not contain analytics SDKs, does not contain crash-reporting SDKs, and does not share data with advertising networks.
Advertising in the App
The App may display advertisements and promotional content from local businesses and Club partners. These adverts are managed directly by the Club; the App does not use any third-party advertising networks (such as Google AdMob or Meta Audience Network), does not use advertising IDs, and does not track you across other apps or websites. The same advert is shown to every user; we do not personalise advertising based on your data.
Lawful bases for processing
We rely on the following lawful bases under UK GDPR for the data the App processes:
- Performance of a contract: to authenticate you when you sign in and to display the tickets and orders associated with your email address.
- Legitimate interests: to operate the App, to render server-driven screens in response to your interactions, to keep the App secure, and to diagnose faults. We have balanced this against your privacy rights and only process the minimum data needed.
The App does not rely on consent for any of the data listed above, and the App does not carry out direct marketing.
How we collect your data
Your email address is provided directly by you when you sign in to the App. Your name and your ticket and order data are returned to the App by our ticketing provider in response to a lookup against your email address. App interaction data is generated automatically as you use the App and sent to our servers to render each screen.
Sharing your data
Within the Company, the data the App processes is only accessible to employees and contractors who need it to operate or support the App.
To deliver the App, we share the minimum data necessary with the following processors. They act on our written instructions and are not permitted to use your data for their own purposes:
- Our ticketing provider: receives your email address so that it can return the tickets, orders and associated name linked to your account.
- Our authentication provider: verifies your identity when you sign in.
- Our hosting and infrastructure providers: operate the servers that power the App and receive interaction data in order to render screens.
The Apple App Store and Google Play, on which the App is distributed, may collect their own data about installs, updates and crashes in accordance with their own privacy policies. We do not control that data.
We do not sell your data, and we do not share it with advertising networks.
Where any of the above processors are located outside the United Kingdom, we ensure that appropriate safeguards (such as the UK International Data Transfer Agreement or equivalent contractual clauses) are in place before personal data is transferred.
Protecting your data
Communication between the App and our servers is encrypted in transit using HTTPS / TLS. Access to stored data is restricted to authorised personnel and systems, and credentials are stored using industry-standard hashing.
How long we keep your data for
- Email address held against your App account: retained for as long as you continue to use the App. Removed within 30 days of an account deletion request.
- Name: held only for the duration of your signed-in session and refreshed from the ticketing provider on demand. The App does not retain a long-term local copy.
- Ticket and order data: held by our ticketing provider in line with their retention policy. The App itself does not retain a long-term copy.
- App interaction data: retained for no more than 90 days for operational and diagnostic purposes.
Account and data deletion
You may delete your App account and the personal data associated with it at any time by emailing hello@warriors.co.uk from the email address registered to your account, with the subject line "App account deletion request".
On receiving a deletion request we will:
- Remove your email address from the App's authentication records within 30 days.
- Delete App interaction data linked to your account within the same period.
Some data may be retained for longer where we are required to do so by law, or where we have a legitimate reason linked to a wider customer relationship (for example, ticket purchase records held by our ticketing provider for accounting and statutory purposes). In those cases the data is retained only for as long as the legal or contractual obligation requires.
Your rights in relation to your data
The law on data protection gives you certain rights in relation to the data we hold on you. These are:
- The right to be informed: fulfilled by this notice.
- The right of access: you can request a copy of the data we hold on you by making a subject access request.
- The right for any inaccuracies to be corrected.
- The right to have information deleted: see "Account and data deletion" above.
- The right to restrict processing.
- The right to portability.
- The right to object to processing carried out on the basis of our legitimate interests.
- The right not to be subject to automated decision-making that produces legal or similarly significant effects. The App does not carry out automated decision-making or profiling.
If you wish to exercise any of these rights, please contact us using the details above.
Children
The App is rated suitable for all ages and its content (match information, news, ticket display) can be browsed without signing in or providing any personal data. The sign-in and account features of the App are intended to be used by the adult ticket holder responsible for an account; we do not knowingly create App accounts for children under the age of 13.
We have designed the App in line with the principles of the UK Age Appropriate Design Code: the App does not profile users, does not use behavioural or personalised advertising, does not use third-party ad networks or advertising IDs, does not use behavioural tracking, does not collect location, and collects only the minimum personal data needed to display tickets to the account holder. Any advertisements shown in the App are non-personalised promotions of local businesses and Club partners managed directly by the Club.
If you are a parent or guardian and believe a child under 13 has created an account or provided personal data through the App, please contact us at hello@warriors.co.uk and we will remove it.
Third-party services
The App may contain links to websites and services operated by third parties (for example, our website or social media platforms). Any information you provide on those third-party sites or services is provided directly to the operator and is governed by their privacy and security policies. We are not responsible for the practices of those third parties and encourage you to review their policies before providing any information.
Making a complaint
We hope to resolve any query or concern you may raise about our use of your information directly. The supervisory authority in the UK for data protection matters is the Information Commissioner's Office (ICO). If you think your data protection rights have been breached in any way by us, under the UK GDPR you are able to make a complaint to the ICO at https://ico.org.uk.