PRIVACY POLICY

NSW Waratahs Ltd (“Waratahs”, “we” or “us”) takes your privacy seriously. The purpose of this Policy is to explain the ways in which we handle your personal information to protect your privacy whilst also enhancing the way we cater for your interests and improve our administration of Rugby in New South Wales.

The Policy applies to both Participants and Supporters of Rugby.  The term Participants as used in this Policy includes players, match officials, coaching staff, administrators, volunteers and other individuals involved in playing, officiating and administering our game.  The term Supporters as used in this Policy includes fans, ticket purchasers, visitors to our websites, members of a Rugby club, and other individuals and entities who have an interest in or connection with Rugby.

If you do not wish to provide your personal information to us, you may not be able to participate in the competitions we administer, or we may not be able to provide you with the product or service you are after. 

We collect your personal information to help administer the game of Rugby in Australia and to improve the way in which we interact and communicate with our Supporters and Participants.  Rugby as a game, and sport as an industry, has changed considerably in recent years and we are always looking to develop our understanding of the preferences and interests of our Participants and Supporters. 

Equally, we understand that your personal information is sensitive and important to you and we will only store and use your personal information for legitimate reasons connected to our administration of Rugby. It is our aim to be open, transparent and accountable in how we handle your personal information. We are always endeavoring to improve the accuracy and currency of the information we hold about you to help serve the purposes for which we hold it.

We understand the importance of keeping your personal information safe and secure. We have taken significant steps to protect your personal information from misuse, loss, unauthorised access or disclosure. These steps include implementing strict confidentiality practices for employees, contractors and service providers, and investing in security software to protect against the possibility of cyber-attack or other external threats. Waratahs also undertakes regular system penetration testing to ensure that your information is protected whilst in our possession.

Further, we will take reasonable steps to delete or de-identify personal information if it is no longer needed for any legitimate purpose. This requirement does not apply where the information is contained in a Commonwealth record or where we are required by law to retain the information.

Where possible we will collect personal information directly from you. We may collect your personal information on paper-based or electronic forms (online), over the phone or when you engage with us on social media or via one of our websites. We will notify you of the collection of your personal information and will tell you why we are collecting it and how we plan to use it, unless these things are obvious at the time when the information is collected.

We may also receive information about you from third parties such as ticketing agencies, government, broadcast or commercial partners, websites or social media applications, or other public or commercial data sources.  The information we collect from you is subject to this Policy.  The information collected from third parties is subject to the privacy practices of those parties.

When you register to become a Participant in Rugby, be that by way of a Registration Form or online registration platform, a record that contains personal information is made by Waratahs or on behalf of Waratahs by the club that you have registered with. If you are a junior Participant, we will collect your personal information from your parent or guardian. Personal information about Participants is recorded in systems and databases controlled by Waratahs including without limitation the Competition Management and Registration System (the national player registration database) and the Australian Rugby Customer Relationship Management (CRM) System.

If you are a player, the personal information that we hold may include but is not limited to:

• Your name, address, telephone and email contact details;
• Your gender, date of birth and marital status;
• Information about rugby clubs you have played with or participated in;
• Details of rugby programs you have participated in;
• Details of rugby club memberships you have purchased;
• Details of any accreditations you hold;
• Your playing status and history;
• Your relationships to other people in the database;
• Details of any disciplinary breaches you may have been involved in; and
• Cases and queries you have raised with us over time.

If you are a match official, the personal information we hold may include the information listed above and may also include (without limitation):

• Details of any accreditations you hold or courses you have completed (including, if required, working with children certification);
• Your availability and preferences (including times and locations/venues) for scheduling purposes; and
• Data relating to your performance as a match official for training and development purposes.

If you are a coach, the personal information we hold may include the information listed under the ‘player’ section above and may also include (without limitation):

• Details of any accreditations you hold or courses you have completed (including, if required, working with children certification); and
• Your Individual Development Plan (which may include your coaching history and developmental goals).

As a Participant, we may also collect information about your health or other information which is defined by privacy laws as ‘Sensitive Information’. Examples of circumstances in which Sensitive Information may be collected include:

• Collecting information about your health (such as injuries you have suffered e.g. concussion);
• Collating injury history, medications and supplement use for professional and semi-professional players through an athlete data management system in accordance with the Waratahs Medical Policy and Waratahs Sports Supplements Policy (and equivalent policies for Super W, Uni Sevens Series, Australian Schools Championships and other Waratahs competitions);
• Collecting information about your criminal history to determine your fitness to participate in Rugby in the capacity in which you participate or intend to participate;
• Collecting information about your racial or ethnic origin (such as when we conduct games or competitions for indigenous players);
• Collecting information regarding your gender status for the purposes of ensuring you are safely participating in an appropriate competition; and
• Collecting information to administer the Professional Players Code of Conduct, Anti-Doping Policy, Illicit Drugs Policy and Anti-Corruption and Betting Policy, and any other official Waratahs policy.

Under Australian law, Sensitive Information is afforded a higher level of protection than other forms of personal information. We will only collect or use Sensitive Information with your consent and where reasonably necessary for the safe and effective administration of Rugby. Please note that this may include the collection or use of your Sensitive Information where Waratahs is investigating an alleged breach of its codes, policies and rules that you are bound by or where Waratahs is bringing proceedings for any such breach.

Furthermore, we may use de-identified health information to participate in research studies or to prepare submissions to government or international bodies.  You can withhold or withdraw your consent for the collection or use of your Sensitive Information at any time.

We collect personal information from Supporters in the course of administering the game of Rugby in Australia, for example when we provide Supporters with services such as:

• Purchasing tickets for Rugby matches in Australia;
• Buying Rugby merchandise online;
• Entering competitions and promotions;
• Attending Rugby hospitality events;
• Subscribing to our membership programs or newsletters; and/or
• Accessing our websites, apps or social media platforms.

If you are a Supporter, the personal information that we collect and hold may include but is not limited to:

• Your name, age, billing and/or shipping address, email address, gender, occupation and telephone number;
• Your game attendance history;
• Your Rugby club affiliation/s;
• Opinions and beliefs provided via surveys and questionnaires;
• Your credit card information;
• Details of items ordered or purchased from us; and
• Cases and queries you have raised with us.

The information we hold about you is primarily in electronic form.  The information we collect is held by Waratahs and its service providers in multiple systems including local storage, cloud based and third-party systems (such systems may have data storage facilities offshore).  If you would like further information on Waratahs’ data holding arrangements, please contact the Privacy Officer listed below. 

You may visit our websites and other digital platforms without identifying yourself. If you identify yourself (for example, by signing in), any personal information you provide to us will be managed in accordance with this Policy. When you visit our websites and other digital platforms, our systems may record certain information about your use of those websites, including which web pages you visited and the time and date of your visit.

We may use ‘cookies’, web beacons and other technologies on our website and applications to collect some personal information about you including information about your use of our services (for example, third party websites you visit so we may understand your preferences for products and services).  We will treat this information in the same way as other personal information we collect about you.  You can use the settings in your browser to control how your browser deals with cookies.  However, in doing so, you may be unable to access certain pages, features or content on our website.

We may also collect ‘IP addresses’ relating to you when you access and use the websites. We may collect and manage IP addresses for internet session management and security purposes.

We will provide you with the option of dealing with us anonymously or by pseudonym where it is lawful and practicable. However, choosing to do so may mean that you cannot participate in our programs. For example, it would not be possible for you to be involved as a participant without identifying yourself.

Participants

If you are a Participant we may use your personal information, including Sensitive Information if reasonably necessary, to:

• Organise, promote and conduct competitions and matches;
• Convene clinics, camps and player development activities;
• Assist with education and development;
• Procure appropriate insurance coverage or policies;
• Select and administer teams; or
• Administer the rules of Waratahs competitions.

We may also use your personal information (but not Sensitive Information) to do the things set out under paragraph 26 below.

We may disclose your personal information to bodies such as:

• A club you are registered with;
• Other Australian Rugby bodies such as the state or territory union where you live;
• Other governing bodies and competition administrators of Rugby including World Rugby and SANZAAR;
• Organisations responsible for administering anti-doping rules;
• Our insurers;
• Our sponsors, commercial partners and broadcasters (including so such third parties may promote their products and services to you including through direct marketing, subject to their privacy policies and practices); or
• Regulatory bodies and/or law enforcement.

Supporters

If you are a Supporter, we may use your personal information to:

• Verify your identity;
• Develop, run, administer and market competitions, programs and activities relating to Rugby;
• Market products, services, merchandise and special offers made available by us or our respective corporate partners, licensees, suppliers, sponsors, broadcasters and affiliated unions;
• Update and improve our customer databases;
• Administer and manage our respective websites and provide you with access to those websites;
• Keep you informed of news and information (such as advance notice of ticket sales) relating to Rugby, including by distributing newsletters, publications and other communications via various media;
• Research and develop new competitions, programs, activities and other events relating to Rugby; or
• Research and develop new products, services and merchandise relating to Rugby.

We may disclose your personal information to:

• Other Australian Rugby bodies such as the state or territory union where you live;
• Other governing bodies and competition administrators of Rugby including World Rugby and SANZAAR;
• Our sponsors, commercial partners and broadcasters (including so such third parties may promote their products and services to you including through direct marketing, subject to their privacy policies and practices);
• Our ticketing agents;
• Companies we have engaged to perform services on our behalf, including advertising and marketing firms, consultants, social media partners, data hosting or servicing firms, and professional advisers such as accountants or lawyers; or
• Regulatory bodies and/or law enforcement.

Other uses and disclosures

In addition, we may also use and disclose personal information for a range of administrative, management and operational purposes including:

• Planning, managing, monitoring and evaluating our programs and competitions;
• Training staff, contractors and volunteers;
• Risk management;
• Responding to and managing our legal liabilities and claims;
• Investigating any integrity related matters, including bringing disciplinary/regulatory proceedings;
• Responding to enquiries and complaints regarding our services;
• Obtaining advice from consultants and other professional advisers; and/or
• Data analysis, enrichment and research, including matching and analysing it with third party data to help determine which products or services you may be interested in.

From time to time, we may contact you to provide you with information regarding other products, programs and services offered by us. This may include newsletters or other communications about our programs, and promotional offers regarding our competitions, events and merchandise. This may also include offers from other Australian Rugby Bodies, our corporate partners, broadcasters and sponsors who may also contact you directly to promote and market their products and services. For an up to date list of the corporate partners from which you may receive such offers, please visit the partner page of Waratahs or any Australian Rugby Body you support.

If you do not wish to receive marketing material from Waratahs, other Australian Rugby Bodies or their corporate partners, broadcasters or sponsors please click the unsubscribe link found in the footer of emails or at the bottom of text messages you receive. We will always provide a simple notice or option allowing you to express a wish not to receive any further direct marketing communications. You can also contact us at any time to let us know that you would like to be removed from our direct marketing lists. Contact information for the Waratahs Privacy Officer is listed below.

In some cases, we may transfer personal information aboutyou to individuals or organisations that are based overseas (such as World Rugby) as a part of our administration of Rugby competitions, promotions, integrity matters, research or other projects. We also use a range of leading service providers, some of which have operations based outside Australia examples include Salesforce, Microsoft and Amazon Web Services). Some of the countries where your data may be stored include Ireland, the United States, New Zealand, and Singapore, and other countries from time to time.

Whenever we transfer your personal information to individuals or organisations based overseas or with operations overseas, we will take reasonable steps to ensure that the recipient of the information upholds the same standards of fair handling of information and equivalent privacy protections as are available in Australia. For example, Waratahs may require appropriate contractual clauses with third parties that ensure their compliance with applicable privacy laws.

You may request access to the personal information Waratahs holds about you and can request the correction of your personal information if it is not accurate or complete. If you would like to do so, please contact the Waratahs Privacy Officer noted below. Subject to any lawful grounds for withholding the requested information, we will endeavour to provide it to you in a timely manner. If your request is denied, we will provide you with the reasons for our decision, and the mechanism available to complain about any such decision.

You may also update your personal information online by logging onto the relevant Waratahs website or platform.  For example, if you have a Rugby ID (a personal account for accessing Waratahs services, websites and portals such as Rugby Xplorer), you can use your credentials to login and manage your personal information at any time.  It is your responsibility to ensure the personal information we hold about you remains accurate and up to date.  If you don’t have a Rugby ID, you can still manage your preferences and opt out of communications by accessing links in emails and other communications we send you or otherwise by contacting Waratahs. 

You may request the deletion of your personal information in some circumstances, such as when Waratahs no longer needs the information, your consent is withdrawn or you validly object to the processing of your information. If you are entitled to deletion we will comply with your request as soon as practicable. However please note it is possible that certain residual information will remain in our databases or may otherwise need to be maintained by Waratahs for valid reasons (such as, for example, record-keeping or compliance with legal obligations).

You have the right to request the personal information held by Waratahs for the purpose of transferring it to a third party of your choice. If you request your information for this purpose, we will provide it to you or transfer it to the nominated third party in a commonly-used, machine-readable format.

You may contact the Waratahs Privacy Officer to complain about any aspect of Waratahs’ privacy practices. The Privacy Officer’s contact details are below. We will respond to your complaint within a reasonable period of time and will inform you of the next steps that we or you may take in respect of your complaint.

Waratahs has in place a Data Breach Procedure & Response Plan. Accordingly if there is any loss, unauthorised access or disclosure of your personal information that is likely to result in serious harm to you, Waratahs will urgently investigate the matter and notify you and the Australian Information Commissioner (if applicable) as soon as practicable.

This Policy was updated in February 2021.We may update the Policy from time to time to keep it current with privacy law in Australia and other relevant jurisdictions, in which case we will post the updated Policy on our websites. Please check back periodically to see if our Policy has been updated.