The England Rugby Privacy Notice

2 Sep 2024 | 10 min

1. Content Of This Privacy Notice

Background
What personal information do we collect about you
How we use this information and what is the legal basis for this use
Direct Marketing
What information do we receive from third parties
With whom do we share this information
International data transfer
What rights do you have
How long we will retain your data
How do you get in touch with us
Changes to this privacy notice

2. Background

2.1 The purpose of this Privacy Notice is to give you a better understanding of:

what information we collect;
how we use that information;
how and who this information is shared with
your data protection rights;
how to contact us; and
other useful privacy and security related matters.

This Privacy Notice applies to you if you have interacted with England Rugby through our various channels, or if you have visited Allianz Stadium or other locations at which we operate, you have contacted us to purchase something from us and/or signed up to receive updates about upcoming events, offers and ways to get involved further with England Rugby or we have contacted you for these reasons.

2.2 Certain parts of www.englandrugby.com uses "cookies" to keep track of your visit and to help you navigate between sections. For more details please see our Cookie Policy.

2.3 The RFU Regulatory and Governance Privacy Notice may also apply if you are a participant in rugby in England, including players, coaches, agents, referees, representatives of clubs/schools/colleges/universities/constituent bodies/ representative bodies (including members, officials and owners), spectators, parents, volunteers and/or such other individuals who may be under the jurisdiction of the RFU.

2.4 You can find additional information about privacy and your rights on the Information Commissioner's Office Website.

2.5 References to we, our, us, or RFU in this privacy notice are to the RFU.

2.6 References to ‘you’ or ‘your’ in this privacy notice are to you in your personal capacity as an individual and/or in your capacity as a representative for a third party (such as a club/school/college/university representative).

2.7 We have appointed a Data Protection Officer to oversee our compliance with data protection laws.

2.8 This privacy notice was drafted with brevity and clarity in mind. We are happy to provide any additional information or explanation needed.

2.9 Should you wish to contact us in relation to this Privacy Notice, our contact details are set out in the "How do you get in touch with us?" section at the end of this Privacy Notice.

3. What Personal Information Do We Collect About You?

3.1 We may collect, store and process the following personal information about you, whether you are an adult or a child:

your name, username and password;
your gender;
your age/date of birth;
your home address, email address and phone number;
your payment and delivery details, including billing and delivery addresses and credit card details, where you make purchases from us (all through our 3rd party agents);
your marketing preferences, including any consents you have given us;
the products you have purchased from us;
your rugby activity such as your role, club affiliation, and courses undertaken;
which emails you have received, opened and clicked on;
how you have reached our digital platforms and the internet protocol (IP) address you have used;
your device, browser type, versions and plug-ins, and your operating system you have used to interact with us
your journey through our digital platforms, details of England Rugby services and opportunities you have expressed an interest in, including which links you click on and any searches you made, how long you stayed on a page, and other page interaction information;
which videos you have watched and for how long;
what content you like or share;
which adverts you viewed and responded to;
which pop-up or push messages you have seen and responded to;
your subscription or membership status;
information collected in any forms you complete;
your responses to customer surveys (where you have given us permission to do so);
CCTV footage and other information obtained through electronic means;
records of your attendance at any events or competitions hosted by us;
images in video and/or photographic form and voice recordings; and enhanced profile and demographic information including household composition, income, and other lifestyle information.

4. What Special Categories Of Sensitive Personal Information Do We Collect About You?

4.1 We may also collect, store and process the following ‘special categories’ of more sensitive personal information about you which may include the following:

information about your race or ethnicity, religious beliefs and sexual orientation;
information about your health, including any medical condition and health;
information about criminal convictions and offences.

4.2 In relation to the special category personal data that we do process we, do so on the basis that:

the processing is necessary for reasons of substantial public interest, on a lawful basis, or which are set out in Schedule 1, Part 2 of the Data Protection Act 2018 and include where processing is necessary for:
the safeguarding of children and individuals at risk;
insurance;
protecting the public;
equality of opportunity or treatment;
support for individuals with a particular disability or medical condition;
it is necessary for the establishment, exercise or defence of legal claims;
based on your explicit consent.

In the table below, we refer to these as the “special category reasons for processing of your personal data”.

5. How do we use this information, and what is the legal basis for this use?

5.1 The table below describes the main purposes for which we process your personal information, the categories of your information involved and our lawful basis for being able to do this. For the purposes of this policy, please note that the purposes and lawful basis set out below apply equally if you are a child or an adult.

Purpose	Personal information used	Lawful basis
To administer any membership account(s) you have with us and managing our relationship with you, and dealing with payments and any support, service or product enquiries made by you.	All contact and membership details, transaction and payment information, records of your interactions with us, and marketing preferences.	This is necessary to enable us to properly manage and administer your membership contract with us.
To arrange and manage any contracts for the provision of any merchandise, products and/or services.	All contact and membership details. Transaction and payment information.	This is necessary to enable us to properly administer and perform any contract for the provision of merchandise, products and services.
To send you information regarding your membership benefits package, including details about ticket information, competitions and events, commercial partner offers and discounts and any relevant updates.	All contact and membership details.	This is necessary to enable us to properly manage and administer your membership contract with us.
To send you other marketing information we think you might find useful or which you have requested from us, including our news items, information about membership, events, participation products and information about our commercial partners.	All contact and membership details and marketing preferences.	Where you have given us your consent to do so.
To answer your queries or complaints.	Contact details and records of your interactions with us.	We have a legitimate interest to provide complaint handling services to you.
To track your activity on our digital platforms	Your usage of our digital platforms	We have a legitimate interest in understanding how users engage with rugby and our digital platforms.
To personalise / tailor your experience on our digital platforms and our marketing and advertising content, we will also use profiling and demographic information for this purpose	Your usage of our digital platforms and any preferences you express and profile and demographic information from third parties	We have a legitimate interest in understanding our users and appropriately promoting rugby and our brand.
The security of our IT systems.	Your usage of our IT systems and online portals.	We have a legitimate interest to ensure that our IT systems are secure.
To conduct data analytics and insights studies to better understand event attendance, participation and trends within the sport.	Records of your attendance at and interest in any online or in-person events, activations and/or competitions hosted by us. We also receive pseudonymised data for these purposes from your attendance at and interest in online and/or in-person events, activations and/or competitions hosted by tournament organisers such as World Rugby.	We have a legitimate interest in doing so to ensure that our membership is targeted and relevant and to understand how users engage with rugby. Where we receive pseudonymised data from tournament organisers such as World Rugby as described in this section, we have a legitimate interest in understanding our audience and how users engage with rugby.
For the purposes of promoting the sport, our events and membership packages.	Images in video and/or photographic form.	Where you have given us your consent to do so (save for the capturing of crowd scenes where personal images are incidental, and it is not practicable to do so).
To comply with health and safety requirements.	Records of attendance.	We have a legal obligation and a legitimate interest to provide you and other members of our organisation with a safe environment in which to participate in sport.
To provide and administer insurance policies put in place by or on behalf of the RFU.	Contact details and any other applicable or relevant personal data.	We have a legitimate interest in doing so to ensure the insurance policies can be administered. We process special category personal data on the basis set out in 4 above.
Monitoring the security of Allianz Stadium and other venues utilised by the RFU.	Images captured via CCTV and records of attendance.	We have a legal obligation and a legitimate interest to provide you and other members of our organisation with a safe environment whilst visiting Allianz Stadium and other venues utilised by the RFU.
Arranging and managing non-RFU events at Allianz Stadium	All contact and membership details, transaction and payment information and marketing preferences.	This is necessary to enable us to properly arrange and manage non- RFU events at Allianz Stadium.
For the purpose of understanding rugby within the community and our fans	Record your race/ethnic origin	Where you have given us your consent to do so
Support for individuals with a particular disability or medical condition.	Personal information required to support individuals with a particular disability or medical condition.	We have a legal obligation and a legitimate interest to provide you and other individuals who attend RFU or non-RFU events with a safe environment. We process special category personal data on the basis set out in 4 above.
To safeguard children and individuals at risk, and to comply with legal obligations and requirements with regards children or adults at risk, as a result of your attendance at RFU or non-RFU events.	Personal information required to safeguard children and individuals at risk, and to comply with legal obligations and requirements with regard to children or adults at risk. This may include special category data such as health, sex, sexual orientation, race/ethnic origin, religious/philosophical beliefs.	We have a legal obligation and a legitimate interest to provide you and other members of our organisation with a safe and fair environment. We process special category personal data on the basis set out in 4 above.

5.2 For some of your personal information there will be a legal, contractual or other requirement or obligation for you to provide us with your personal information. If you do not provide us with the requested personal information we may not be able to properly perform our contract with you or comply with legal obligations and we may note be able to provide you with products you request.

5.3 Where you have given us your consent to use your personal information in a particular manner, you have the right to withdraw this consent at any time, which you may do by contacting us as described in the "How do you get in touch with us?" section below.

6. Direct Marketing

6.1 From time to time, we may contact you by email, post or SMS with information about products and services we believe you may be interested in.

6.2 We will only send marketing messages to you in accordance with the marketing preferences you set.
Withdrawing consent or otherwise objecting to direct marketing

6.3 You can let us know at any time that you do not wish to receive marketing messages by emailing us at customermarketing@rfu.com. You can also unsubscribe from our marketing by clicking on the unsubscribe link in the marketing messages we send to you. Please note that you may continue to receive non-marketing communications from us, for example, service messages about any purchases you make.

7. What information do we receive from third parties?

7.1 We may receive information about you from third parties and in particular we may combine your information with other information that we obtain from our dealings with you or which we receive from other organisations, including:

information from constituent bodies,
representative bodies,
clubs, schools, colleges, universities,
other sports,
other rugby union governing bodies,
other rugby stakeholders (such as the Rugby Players’ Association, the Association of Rugby Agents, Premier Rugby Limited),
law enforcement,
regulatory bodies (such as the Gambling Commission, UK Anti-Doping, World Anti- Doping Agency),
market intelligence service provider, and
such other reputable third parties with whom we have relationships.

7.2 We may receive information about you from our group companies, subsidiaries or associated (including joint venture) companies in which we have an interest including: England Rugby Travel Limited, Twickenham Experience Limited, British & Irish Lions DAC, Six Nations Rugby Limited, Rugby Reflink Limited, RFU Hotel Limited and RFU Health and Leisure Limited.

7.3 We may receive information about you from other rugby union governing bodies and rugby stakeholders, including: World Rugby, European Professional Club Rugby.

7.4 We may receive information about you from the rights owner(s) of event(s) you have attended at Allianz Stadium (or other locations utilised).

7.5 We may receive information about you from commercial entities more widely such as from the Compass Group PLC, Ticketmaster UK Limited, Fanatics (International) Limited and Engage Sport Management Limited.

7.6 We may receive information about you and your household from marketing services providers, such as Experian, to enhance our profile of you.

7.7 We may receive pseudonymised information about you from event organisers such as World Rugby arising from of your attendance at and interest in online and/or in-person events, activations and/or competitions hosted by the event organiser.

7.8 We may receive information about you from rugby union governing bodies, rugby stakeholders and/or commercial partners of England Rugby for the purposes of direct marketing where you have given your express consent to do so.

8. With Whom Do We Share Your Information?

8.1 We share personal information with the following parties:

Any party approved by you.
Our group companies, subsidiaries or associated (including joint venture) companies in which we have an interest including: England Rugby Travel Limited, Twickenham Experience Limited, British & Irish Lions DAC, Six Nations Rugby Limited, Rugby Reflink Limited, RFU Hotel Limited and RFU Health and Leisure Limited.
Other service providers: for example, email marketing, market intelligence, market research, mail houses, print facilities, third party marketing platforms, gamified experience service providers, merchandising services, payment processors, data analytics service providers, CCTV contractors, promotional advisors, contractors or suppliers and IT services (including Customer Relationship Management, website, video and teleconference services).
Meta: for the purpose of displaying relevant advertising on Meta platforms, such as Facebook and Instagram.
Experian: for the purpose of understanding and enhancing our profile of you.
When someone visits England Rugby digital platforms we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
Our Commercial Partners: for the purposes of providing you with information on any tickets, special offers, opportunities, products and services and other commercial benefits provided by our commercial partners where you have given your express consent for us to do so.
Where we are required to do so by law or to assist with investigations or initiatives.
Police, law enforcement and security services and other relevant regulators, such as the Information Commissioner’s Office: to assist with the investigation and prevention of crime and regulatory breaches, and the protection of national security.
UK Government, Public Health England (or any replacement thereof), the NHS and other relevant individuals and/or organisations where it is requested.
Third parties for the purposes of arranging and managing non-RFU events at Allianz Stadium.
Third parties who organise and hold non-RFU events at Allianz Stadium such as concerts, Rugby World Cup matches, Premiership rugby union matches, barbarian matches, university rugby matches, club matches and the army v navy match. Where we share your information with an event organiser for a particular non-RFU event the event organiser will process your information in accordance with their privacy policy.

9. International Data Transfer

The personal information we collect may be transferred to and stored in countries outside of the UK and the European Economic Area (EEA). Some of these jurisdictions require different levels of protection in respect of personal information and, in certain instances, the laws in those countries may be less protective than the jurisdiction you are typically resident in. We require third parties to respect the security of your data and to treat it in accordance with the law, and if we do share your personal information outside the UK and/or the European Economic Area, you can expect a similar degree of protection in respect of your personal information.

10. What rights do you have?

10.1 You have the following rights:

Right of access (also known as a subject access request): you can ask us for a copy of your data in a machine-readable format or other common format you wish;
Right to erasure: (Also known as right to be forgotten) you can ask us to delete your data;
Right to be informed: you can ask us how why and whom we share your data with;
Right to object: you can ask us to stop processing your data;
Right to restrict processing: you can ask us to only process certain data;
Right to rectification: you can ask us to update your data; and
Right to data portability: you can ask us to move copy and transfer your data to a third party.
Rights related to automated decision making and profiling: you have the right not to be subject to a decision based solely on automatic processing, including profiling.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person or if there is a legal or regulatory reason for not providing data, or if you ask us to delete or restrict the use of information which we are required by law to keep or have legitimate interests in keeping or using.

10.2 For more detailed information on the rights you have as an individual which you can exercise in relation to the information we hold about you, please refer to the Information Commissioner’s Office website.

10.3 To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the applicable data protection authority where you live, work or where you believe a breach may have occurred. This is the Information Commissioner’s Office in the UK.

11. How long will we retain your data?

11.1 The duration for which we retain your personal information will differ depending on the type of information and the reason why we collected it from you. We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any regulatory, legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. After this time, information is deleted/destroyed in accordance with the RFU’s approved retention schedules. Please contact dataprotection@rfu.com for further information about retention periods.

11.2 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

11.3 It is important to ensure that the personal information we hold about you is accurate and up- to-date, and you should let us know if anything changes, for example if you change your phone number or email address. You can contact us by using the details set out in the "How do you get in touch with us?" section below.

12. How do you get in touch with us?

12.1 The RFU tries to meet the highest standards when collecting and using personal information.For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

12.2 We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@rfu.com or by writing to Data Protection Officer, Rugby Football Union, Rugby House, Allianz Stadium, 200 Whitton Road, Twickenham TW2 7BA.

13. Changes to this Privacy Notice?

This Privacy Notice may be updated from time to time. The date of the most recent revision at the bottom of this page

Last reviewed: 2nd September 2014 | Version: 10.0