Privacy Policy /

1. Introduction

This Privacy Policy covers the Australian Rugby League Commission Limited, National Rugby League Limited and each of its associates, related entities and subsidiaries (together, "we," "us," "our," and the "NRL" ) as well as the Clubs (where applicable). For the avoidance of doubt, a reference in this Privacy Policy to the NRL (including the NRL doing or not doing an act) is a reference to, and is intended to also cover, the States. Please read this Privacy Policy carefully as it describes how we collect, use, disclose and otherwise handle your Personal Information.

The NRL recognises the importance of your privacy and your right to control your Personal Information and is committed to complying with applicable privacy laws (including the Privacy Act and GDPR).

The NRL is always seeking to better understand how Players, Rugby League Administrators, Clubs, States and, most importantly, NRL fans interact, communicate and otherwise share Personal Information in order to continue to develop the game of Rugby League. The NRL has invested heavily, in conjunction with the Clubs, States and selected third parties, to establish and administer a data storage architecture for processing your Personal Information (Rugby League Exchange).

2. Anonymity and pseudonymity

We offer you the opportunity, wherever it is lawful and practicable, of not identifying yourself, or of using a pseudonym, when entering transactions, or otherwise dealing with, the NRL in relation to a particular matter by contacting the NRL Privacy Officer (see clause 11).

3. What kinds of personal information do we collect?

3.1 The types of Personal Information the NRL may collect depends on the purposes for which it is collected but may include (without limitation):

(a) your name, gender, date of birth, occupation, residential address, email address, telephone number and other contact details;
(b) your favourite Club and other information dealings with the NRL, Clubs, States or selected ticketing companies such as memberships, subscriptions and attendance history at Matches (whether you have used your membership to purchase tickets or as a casual ticket purchaser); and

(c) purchasing preferences and financial details.

3.2 The NRL will not collect Sensitive Information about you unless:

(a) you have consented to the collection of such specific Sensitive Information;
(b) the NRL is specifically permitted to do so under the NRL Rules, including for health, medical and anti-doping testing purposes and investigation of disputes (whatever the nature of the dispute);
(c) the collection is required or authorised by law; or
(d) the collection is otherwise permitted under applicable privacy laws (including the Privacy Act and GDPR).

In addition to Personal Information, we use cookies, web beacons and other technologies on our website and applications to collect information about your usage of our services (for instance, third party websites you visit to better understand your preferences and what types of products and services you may be interested in).

4. How do we collect your personal information?

4.1 Where it is reasonable and practicable to do so, the NRL will collect your Personal Information from you. If you are a Minor, the NRL may collect Personal Information about you from your parent or legal guardian.

4.2 In addition to collecting Personal Information directly from you, the NRL may also collect Personal Information from:

(a) the Clubs, States and selected third parties (for instance, Ticketek and Ticketmaster) as part of the Rugby League Exchange; and
(b) a third party (such as a Rugby League Partner or other corporate partner of the NRL or Clubs, or information that is on public record or which is otherwise unsolicited).

5. Why do we collect, use, hold and disclose your personal information?

5.1 The NRL generally only collects, uses, discloses or holds Personal Information that is reasonably necessary for the NRL to perform one or more functions or activities in administering the game of Rugby League (the primary purpose), including:

(a) organisation, conduct and promotion of Competitions and Matches (including for the purpose of providing information and making ticket offers to you);
(b) direct communication with you by Rugby League Administrators;
(c) disclosure to Rugby League Partners, unless you have indicated that you do not want to receive any communication from Rugby League Partners;
(d) compliance with the NRL Rules, including the administration and development of Rugby League (if you are a Participant);
(e) serving content in accordance with your preferences and previous consumption;
(f) serving advertising that is suited to your age; and
(g) evaluating and servicing the NRL's relationships with its Rugby League Partners, including to tailor your experience interacting with our Rugby League Partners.

5.2 Wherever practicable, the NRL will inform you more specifically of the primary purpose of a collection as part of its collection statement, which will be made available to you at the time of the collection.

5.3 When we collect your Personal Information, your Personal Information will only be used or disclosed for the primary purpose for which it was collected, a related secondary purpose, in accordance with any express consent you give the NRL or as otherwise lawfully required (e.g. where your Personal Information is requested by a law enforcement agency).

Direct Marketing

5.4 The NRL may use or disclose your Personal Information to a Rugby League Administrator for the secondary purpose of direct marketing communication, if:

(a) the NRL collected the information from you;
(b) you would reasonably expect your Personal Information would be used or disclosed for direct marketing;
(c) the NRL has provided a simple means by which you can request not to receive direct marketing; and
(d) you have not made a request not to receive direct marketing.

5.5 Where you would not reasonably expect your Personal Information to be used for direct marketing, or the information has been collected from a third party (for instance, from the Clubs as part of the Rugby League Exchange), the NRL may use the information for the secondary purpose of direct marketing communication only where:

(a) you have expressly consented to the use or disclosure for direct marketing, or it is impracticable for the NRL to seek your consent before that use;
(b) you have not made a request to the NRL not to receive direct marketing communication;
(c) in each direct marketing communication, the NRL always prominently displays a simple notice or actionable option that you may express a wish not to receive any further direct marketing communication; and
(d) each written direct marketing communication by the NRL with you sets out the NRL's contact details including business address, telephone and fax numbers and email address.

6. Who do we disclose your personal information to?

6.1 Subject to compliance with applicable privacy laws (including the Privacy Act and GDPR) and this Privacy Policy, the NRL may also:

(a) disclose your Personal Information to its affiliates (including without limitation the States, a Competition Administrator and a Club) to enable them to administer the game of Rugby League in their area and provide related activities and services; and
(b) unless you inform the NRL otherwise, disclose your Personal Information to Clubs, States, Rugby League Partners and selected other partners as part of the Rugby League Exchange to enable such recipients to provide you with information, materials and promotional opportunities. This sharing of Personal Information via the Rugby League Exchange will assist the NRL, Clubs, States, Rugby League Partners and selected other partners to more effectively administer promotional and information sharing activities.

6.2 The NRL may disclose your Personal Information to its service providers such as ticketing agents, mail houses or other similar third party organisations for the purpose of implementing the primary purposes, including fulfilling ticket requests and communicating Rugby League related offers. For example, the NRL uses third party credit card payment gateway services on its website and applications. If you pay for tickets or services through the NRL's website and applications, the NRL will be required to provide certain financial details to the third-party service provider to effect the transaction. The NRL requires these third party organisations to keep your contact details and Personal Information confidential and only use them for the designated purpose. The NRL may also disclose your Personal Information to other service providers which assist the NRL in the conduct of its operations, such as information services providers, information technology providers and other similar third party organisations.

7. Data quality and security

7.1 The NRL will take reasonable steps to:
(a) make sure that the Personal Information it collects, uses or discloses is accurate, complete and up-to-date; and
(b) protect the Personal Information it holds about you or that is within its direct control from misuse, interference and loss and from unauthorised access, modification or disclosure.

7.2 The NRL will take reasonable steps to destroy or permanently de-identify Personal Information if it is no longer needed for any purpose for which the information may be used or disclosed (at your request or otherwise) or if you withdraw your consent, unless the NRL is required by or under law, or a Court order, to retain such information. Where the NRL is required to destroy or permanently de-identify your Personal Information, it will take reasonable steps to inform other parties using, holding or disclosing the same Personal Information (including any links to, copies of or replication of that Personal Information).

8. Openness, access, correction and deletion

8.1 The NRL strives to provide you with the greatest available control of the Personal Information which the NRL collects from you or about you from the Clubs, States and other third parties. Accordingly, the NRL is continually developing and enhancing the ways which you can access your Personal Information (for example, via your NRL Account or communications preferences centre).

8.2 The NRL will provide you with a variety of ways to access, review and manage your Personal Information. For example, if you have an NRL Account you can use your login credentials to access, review and manage your Personal Information at any time. If you don't have an NRL Account, you can still opt out of and otherwise manage your communications preferences via links in emails and other communications we send to you from time to time. You will be responsible for ensuring your Personal Information remains accurate, complete and up to date.

8.3 Separate from the preference centre and upon your request, the NRL will take reasonable steps to let you know, in general terms, what sort of Personal Information it holds, for what purposes, and how it collects, holds, uses and discloses that information. Where the NRL has collected your Personal Information from your directly or with your consent, you have a right to receive (upon request) that Personal Information from the NRL in a structured, commonly used, machine readable format and/or a right to instruct the NRL to transmit that Personal Information to a third party (if technically feasible).

8.4 Before supplying any Personal Information to you or updating your Personal Information at your request, the NRL must be reasonably satisfied as to your identity (for example, by asking to see your passport or driver's licence). The NRL is not under any obligation to provide Personal Information to you where the NRL is not required to do so under applicable privacy laws (including the Privacy Act and GDPR).

8.5 If the NRL refuses to provide you with access to Personal information it holds on you in the manner requested by you, the NRL will either:

(a) take such steps (if any) as are reasonable in the circumstances to give access to the information in a way that meets the needs of the NRL and you; or
(b) provide you with a written notice that sets out:
(i) the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and
(ii) the mechanisms available to complain about the refusal.

8.6 If:

(a) the NRL is satisfied that, having regard to a purpose for which the Personal Information is held, the information is inaccurate, out-of-date, incomplete or irrelevant or misleading; or
(b) you request the NRL to correct your Personal Information,
the NRL will take reasonable steps to correct the Personal Information to ensure that, having regard to the purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading. The NRL will not charge you for making such a request or for correcting the information.

8.7 If the NRL refuses to correct the Personal Information at your request, the NRL will provide you with a written notice that sets out the same matters listed in clause 8.5(b).

8.8 You can request deletion of your Personal Information by contacting the NRL Privacy Officer at privacyofficer@nrl.com.au. In most cases we will comply with your requests unless we are required to maintain your Personal Information for legal or any other applicable reason. If the NRL refuses to delete the Personal Information at your request, the NRL will provide you with a written notice that sets out the same matters listed in clause 8.5(b).

9. Transborder data flows

9.1 Subject to clauses 9.2 and 9.3, the NRL will not transfer your Personal Information to an overseas recipient unless it has first taken steps reasonable in the circumstances to ensure that the Personal Information that it transfers will not be held, used or disclosed by the recipient of the information inconsistently with, or otherwise in breach of, applicable privacy laws (including the Privacy Act and GDPR). For example, the NRL may adopt appropriate contractual clauses with overseas recipients that ensure their compliance with applicable privacy laws (including the Privacy Act and GDPR. This clause does not apply to the transfer of Personal Information in accordance with the NRL Rules, including to facilitate the registration of a Player by an international Rugby League association.

9.2 We may disclose your Personal Information to overseas recipients for things such as processing membership and hosting services, most likely in China, Singapore, the United States and New Zealand, although countries where such recipients are located may vary.

9.3 The NRL may transfer Personal Information about you to someone who is in a foreign country if:

(a) the NRL reasonably believes that the recipient is subject to a law or binding scheme that has the effect of protecting the information in a way that is, overall, substantially similar to applicable privacy laws (including the Privacy Act and GDPR) and there are mechanisms available to you to enforce that protection or scheme; and
(b) you expressly consent to the transfer after the NRL has informed you that the applicable privacy laws (including the Privacy Act and GDPR) will no longer apply if you provide your express consent.

10. Notifiable data breaches scheme

In the event of any loss, or unauthorised access or disclosure of your Personal Information that is likely to result in serious harm to you, the NRL will investigate and notify you and where applicable the relevant supervisory authority (e.g. the Australian Information Commissioner) within 72 hours of becoming aware of the loss, or unauthorised access or disclosure, in accordance with applicable privacy laws (including the Privacy Act and GDPR).

11. Inquiries procedure

11.1 All complaints and inquiries concerning your Personal Information, including in respect of alleged breaches of this Privacy Policy or applicable privacy laws (including the Privacy Act and GDPR), should be directed to the NRL Privacy Officer:

The Privacy Officer
Rugby League Central
Driver Avenue
Moore Park NSW, Australia 2021
(02) 9359 8611
privacyofficer@nrl.com.au

11.2 At all times, privacy complaints will be treated seriously, dealt with promptly and confidentially, and will not affect your existing obligations or commercial arrangements with the NRL.

12. Privacy Policy updates

This Privacy Policy was updated in November 2021. We may update this Privacy Policy from time to time, in which case we will post the updated version of the Privacy Policy on our website (www.NRL.com). As such, please check back periodically to see if our Privacy Policy has been updated.

13. Definitions

In this Policy:

Club means any Club registered with the NRL or States from time to time.

Competition means any competition, tournament or league registered or carried out by the NRL or States including the pre-season, season proper, finals series and any post season tournament or knockout cup competition and any other football competition or tournament.

Competition Administrator means the entity responsible for the conduct and staging of a Competition and includes (without limitation) the NRL and States (including the divisions and associations that make up the States).

GDPR means the European Union General Data Protection Regulation.

Match means a game of Rugby League football and includes any match staged, participated in, sanctioned by, or played under the auspices of the NRL, States or a Competition Administrator (including any match held as part of a Competition).

Match Official means any person in charge of safety or any other person appointed by the NRL, the States or a Competition Administrator to assume responsibility in connection with a Match.

Minor means any person younger than 16 years of age.

NRL Account means a person's login credentials and personal account for accessing the NRL digital network, including the NRL website and application and fantasy/tipping websites and applications etc.

NRL Privacy Officer means the person appointed by the NRL from time to time to deal with complaints and inquiries under this Privacy Policy.

NRL Rules means its constitution, rules, regulations, policies and procedures and any other ancillary document that governs the NRL in administering the game of Rugby League, as promulgated and amended from time to time.

Official means:

(a) a Club Official, Match Official or Team Official;
(b) an employee, consultant, officer or director of the NRL, the States or a Competition Administrator; or
(c) a member of a council, committee, panel or body constituted by the NRL, States or a Competition Administrator.

Personal Information means any information or an opinion about an identified natural person, or a natural person who is reasonably identifiable whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.

Participant means participants in the game of Rugby League including the Players and Officials.

Player means any person who is, from time to time, registered to a Club or is selected as a member of a Representative Team, whether that person is male or female, junior or senior or an amateur or professional.

Privacy Act means the Privacy Act 1988 (Cth).

Privacy Policy means this document as updated from time to time and made available on the NRL's website (www.NRL.com).

Representative Match means a team participating in a Representative Match.

Representative Team means any team selected to participate in a Representative Match.

Rugby League Administrators mean the NRL, States, a Competition Administrator or a Club (as the case may be) with which the Participant has a direct relationship, including for the purposes of registration with the League and participation in a Competition.

Rugby League Exchange has the meaning given to that term in clause 1 of this Privacy Policy.

Rugby League Partners means any entity that has a commercial agreement or arrangement with the NRL, States, Competition Administrator or Club (as the case may be) and which you may also have a direct relationship with (including by participation in a Competition).

Sensitive Information means information or an opinion about a natural person's racial or ethnic origin, political opinions. membership of political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record that is also Personal Information as well as health information, genetic information, biometric information for the purposes of verification/identification and biometric templates about a natural person.

States means Queensland Rugby League, New South Wales Rugby League, Country Rugby League of New South Wales, NRL Victoria, NRL South Australia, NRL Northern Territory, NRL Western Australia and NRL Tasmania.

Team Official means any personnel involved with the management, preparation or participation of a Club's team (whether paid or unpaid), including the coaches, managers, medical staff (including team or match day doctor), physiotherapists, gear persons and other support staff.