URC Privacy Policy

Effective date: 24th September 2026

Last updated: 24th September 2026

This Privacy Policy explains how Pro Rugby Championship DAC, trading as and operating the United Rugby Championship and URC (URC, we, us or our), collects, uses, shares and protects personal data.

Pro Rugby Championship DAC is the controller of personal data processed under this Privacy Policy, except where this policy explains that another organisation acts as a separate controller or where another privacy notice applies.

Registered office: 3rd Floor, Millbank House, Arkle Road, Sandyford Industrial Estate, Dublin 18, D18 C6R3, Ireland.

If you have questions about this Privacy Policy or how we process personal data, you can contact us at:

Email: privacy@unitedrugby.com

Post: Data Protection, URC, 3rd Floor, Millbank House, Arkle Road, Sandyford Industrial Estate, Dublin 18, D18 C6R3, Ireland.

Where we have appointed a Data Protection Officer or a designated data protection contact, they can be contacted using the details above.

1. What this policy covers

This Privacy Policy describes how we use personal data when you interact with URC online and offline, including when you:

• visit or use our websites, apps, digital services or online content;
• create or use an account or single sign-on service;
• sign-up to and/or become a member of URC loyalty or rewards programme (as updated from time to time);
• purchase tickets, hospitality, merchandise, subscriptions or other products or services;
• attend URC matches, competitions, events, venues or hospitality experiences;
• enter competitions, prize draws, promotions, surveys, polls, fantasy games or online games;
• receive newsletters, marketing communications, offers or personalised content;
• interact with us on social media or through third-party platforms;
• contact us with enquiries, comments, complaints or rights requests;
• act as a supplier, contractor, club, union, broadcaster, sponsor, venue, commercial partner or other business contact; or
• otherwise interact with URC, our clubs, unions, competition venues, broadcasters, sponsors, commercial partners or other rugby stakeholders.

This policy also explains how we use information that we receive from third parties, including clubs, unions, other rugby stakeholders, ticketing providers, competition venues, broadcasters, fantasy game providers, social media platforms, demographics providers, sponsors and commercial partners.

Some third parties process personal data as independent controllers and may provide their own privacy notices. Where you interact directly with those organisations, you should also read their privacy notices.

2. Summary of how we use personal data

We use personal data to:

• provide URC websites, apps, accounts, content, products and services;
• administer ticketing, hospitality, competitions, games, prize draws and promotions;
• manage your relationship with us, including customer support and complaints;
• operate and improve our websites, apps, digital services, content and fan experiences;
• manage safety, security, access control and incident response at URC events and venues;
• understand fan engagement and improve URC competitions, products, services and commercial offerings;
• personalise content, recommendations, offers and marketing where permitted by law;
• send marketing communications where we have a lawful basis to do so;
• administer relationships with suppliers, clubs, unions, venues, broadcasters, sponsors and other stakeholders;
• comply with legal, regulatory, tax, accounting, safeguarding, health and safety and law enforcement requirements;
• establish, exercise or defend legal claims; and
• protect the rights, property, safety and security of URC, fans, players, staff, event attendees and others.

Where we rely on consent, you may withdraw that consent at any time. Where we rely on legitimate interests, you may have the right to object to our processing. You have an absolute right to object to direct marketing and profiling for direct marketing at any time.

3. Personal data we collect from you

We collect personal data that you provide directly to us, including:

• identity and contact details, such as name, email address, postal address, telephone number, date of birth, username and account details;
• account and login information, such as account credentials, single sign-on details, account preferences and authentication information;
• purchase and transaction information, such as ticket, hospitality, merchandise, subscription, competition, promotion or service purchase details, order history, delivery details and customer service records;
• payment-related information, such as payment confirmation and transaction references. We do not generally receive full payment card details where payments are processed by third-party payment providers;
• marketing and communications preferences, such as newsletter subscriptions, opt-ins, opt-outs, preferred teams, interests and communication channels;
• competition, game and promotion information, such as entry forms, eligibility information, answers, rankings, fantasy game information, prize fulfilment details and related correspondence;
• survey and market research responses, such as opinions, feedback, demographic information and fan preferences;
• event attendance information, such as ticketing, access, seat, hospitality, accreditation, attendance, access control and customer service information;
• communications content, such as enquiries, complaints, requests, social media messages, user-generated content and other communications you send to us;
• business contact information, such as your name, role, employer, professional contact details, communications and contract-related information;
• information required by forms, where the relevant form indicates that information is mandatory; and
• loyalty or reward programme information where you have enrolled as a member of any URC loyalty or reward programme your point accumulation, any engagement that has added or removed loyalty points and any usage of your loyalty points e.g. where you have redeemed points.

If you do not provide information that is mandatory for a particular purpose, we may be unable to provide the relevant account, ticket, product, service, competition entry, prize, event access, customer support or other requested service.

4. Personal data we generate or collect automatically

When you use our websites, apps, digital services or online content, we may collect or generate information such as:

• device identifiers, cookie identifiers and similar online identifiers;
• IP address, browser type, device type, operating system and approximate location derived from technical information;
• pages viewed, links clicked, content watched, search terms, referral sources and navigation paths;
• interactions with emails, adverts, push notifications and online content;
• account usage, login history and security logs;
• information relating to your loyalty or rewards programme membership;
• preferences, inferred interests and engagement scores; and
• analytics information about use of our websites, apps, content and services.

We may collect some of this information through cookies, pixels, SDKs and similar technologies. Non-essential cookies and similar technologies are used only where permitted by applicable law and, where required, with your consent. Further information is provided in our Cookie Policy and cookie preference tools.

At events and venues, we may collect or generate information such as access control logs, ticket scan information, CCTV images, incident reports, customer service records, safety and security records, and records relating to refusal of entry, removal from a venue or venue bans.

5. Personal data we receive from third parties

We may receive personal data about you from third parties, including:

• clubs, unions and rugby stakeholders, such as information about ticket purchases, event attendance, fan engagement, preferences, membership, subscriptions, competitions or interactions with their services;
• ticketing, payment and hospitality providers, such as Ticketmaster or other ticketing partners, including ticket purchases, attendance, customer service and payment confirmation information;
• competition venues and event operators, including access, safety, security, customer service and incident-related information;
• broadcasters, streaming services and media partners, such as information about engagement with URC content, premium services or subscriptions, where shared in accordance with their privacy notices and applicable law;
• fantasy game, online game and promotion partners, such as account, team, ranking, competition entry and engagement information;
• social media platforms and third-party login providers, where you choose to interact with us through those platforms, use social login, share content, use plug-ins or otherwise authorise the platform to share information with us;
• demographics, analytics and data enrichment providers, where permitted by law, to help us understand our fan base and improve our services and communications;
• sponsors and commercial partners, where you have interacted with a partner promotion or have given permission for relevant sharing; and
• other team members, officials or representatives, where they enter you or your team into a competition, event or promotion.

Where a third party provides personal data to us, that third party is responsible for ensuring that it has a lawful basis to share the data with us. Their own privacy notice may also apply.

6. How we use personal data and our legal bases

We process personal data for the purposes and legal bases set out below.

Where we rely on legitimate interests, we consider and balance our interests against your rights, freedoms and reasonable expectations. You may object to processing based on legitimate interests in certain circumstances.

7. Direct marketing and marketing preferences

We may use personal data to send you marketing communications about URC, our competitions, events, tickets, hospitality, merchandise, content, products, services, competitions, promotions, partners and sponsors.

We will send electronic marketing communications, such as email, SMS or app push notifications, where we have your consent or where otherwise permitted by applicable law. Where permitted, we may rely on our legitimate interests to market similar products or services to existing customers, subject to your right to opt out.

We may also show you online advertising or personalised content through our websites, apps, social media platforms, advertising networks or third-party platforms. Where this involves non-essential cookies, pixels or similar tracking technologies, we will obtain consent where required.

Where we ask whether you want to receive offers or updates from clubs, sponsors, commercial partners or other rugby stakeholders, we will explain what you are agreeing to. We will share your personal data with those parties for their own marketing only where we have a lawful basis to do so, including consent where required.

You can opt out of direct marketing at any time by:

• using the unsubscribe or opt-out link in an electronic marketing message;
• changing your account or preference centre settings, where available;
• adjusting your cookie or advertising preferences, where relevant; or
• contacting us at privacy@unitedrugby.com.

You have an absolute right to object to direct marketing and to profiling carried out for direct marketing purposes.

8. Fan analytics, personalisation and profiling

We may use personal data to better understand URC fans, improve our services and provide more relevant content, offers and experiences. This may involve combining information that we collect directly from you with information generated through your use of our services and information received from clubs, unions, broadcasters, ticketing partners, fantasy game providers, sponsors, commercial partners and other rugby stakeholders.

For example, we may use information about your preferred teams, ticket purchases, event attendance, website or app activity, content engagement, competition participation, fantasy game activity, location, marketing preferences and interactions with URC communications to:

• understand fan interests and engagement;
• create audience segments;
• personalise content, recommendations, adverts and offers;
• measure the effectiveness of campaigns and sponsorship activity;
• improve competitions, products, services and fan experiences; and
• develop aggregated reports and insights.

We may share aggregated or anonymised insights with clubs, unions, broadcasters, sponsors, commercial partners and other rugby stakeholders. Where we share identifiable personal data with those parties, we will do so only where we have a lawful basis and appropriate safeguards.

You may object to profiling based on legitimate interests in certain circumstances. You always have the right to object to profiling carried out for direct marketing purposes.

We do not use your personal data for solely automated decisions that produce legal or similarly significant effects, unless we tell you otherwise and provide the information and safeguards required by law.

9. Cookies and similar technologies

We use cookies, pixels, tags, SDKs and similar technologies on our websites, apps and digital services. These technologies may be used to:

• make our websites, apps and services work;
• remember your preferences;
• secure our services and prevent fraud;
• measure website, app and content performance;
• understand how users interact with URC services;
• personalise content and recommendations;
• deliver and measure advertising; and
• integrate social media and third-party content.

Some cookies and similar technologies are strictly necessary for our services to function. Others, such as analytics, advertising, personalisation and social media technologies, are non-essential and will be used only where permitted by applicable law and, where required, with your consent.

You can manage your cookie preferences through our cookie banner, cookie preference centre or your browser settings. Withdrawing consent does not affect processing that occurred before consent was withdrawn.

Our Cookie Policy provides further information about the cookies and similar technologies we use, the third parties involved, cookie durations, purposes, and how you can manage your choices.

10. Who we share personal data with

We may share personal data with the following categories of recipients where lawful and appropriate:

• clubs, unions, leagues and rugby stakeholders, for fan engagement, competition administration, ticketing, service improvement, analytics, marketing where permitted, and development of rugby-related products and services;
• ticketing, hospitality, payment and fulfilment providers, to process purchases, issue tickets, provide hospitality, deliver products or services and manage customer support;
• competition venues, event operators, security providers and emergency services, to manage event attendance, access control, safety, security, medical incidents and venue operations;
• broadcasters, streaming services and media partners, to support content delivery, fan engagement, analytics and commercial arrangements where lawful;
• fantasy game, online game, competition and promotion partners, to administer games, competitions, rankings, entries and prizes;
• sponsors and commercial partners, for sponsorship activation, promotions, offers and analytics where lawful and, where required, with your consent;
• IT, hosting, cloud, CRM, email, analytics, security, maintenance and support providers, who help us operate our websites, apps, systems and services;
• marketing, advertising and social media platforms, where used for marketing, measurement, advertising, personalisation or audience management and where permitted by law;
• market research organisations, which may act as processors or independent controllers depending on the activity;
• professional advisers, including lawyers, auditors, insurers, accountants and consultants;
• government authorities, regulators, courts, law enforcement bodies and public authorities, where required or permitted by law or necessary to protect rights, safety or security; and
• prospective purchasers, transferees or restructuring parties, where relevant to a business sale, transfer, merger, restructuring or similar transaction.

Some recipients process personal data on our behalf as processors. Others may act as independent controllers or joint controllers, depending on the circumstances. Where another organisation is an independent controller, its own privacy notice will apply to its processing of your personal data.

11. International transfers

We are based in Ireland, but URC is an international competition and we may transfer personal data to countries outside the European Economic Area, including where:

• matches, events or competitions take place outside the EEA, including in South Africa;
• clubs, unions, venues, broadcasters, sponsors, commercial partners or other rugby stakeholders are located outside the EEA;
• our IT, cloud, analytics, ticketing, payment, CRM, marketing, advertising, security or other service providers process data outside the EEA; or
• international travel, event administration, ticketing, hospitality, customer service, legal compliance or security requirements make a transfer necessary.

Where personal data is transferred outside the EEA, we will ensure that an appropriate transfer mechanism or safeguard is in place where required by law. This may include:

• an adequacy decision by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• Binding Corporate Rules;
• the EU-US Data Privacy Framework, where applicable to a certified recipient;
• supplementary measures, where required; or
• a specific derogation permitted by data protection law, such as where a transfer is necessary to perform a contract with you or to implement pre-contractual measures at your request.

Where data is transferred outside the EEA because you purchase tickets, hospitality or services for an event taking place outside the EEA, we may transfer relevant data where necessary to facilitate your purchase, travel, attendance, access, safety or related services.

You may contact us using the details above to request further information about the safeguards used for international transfers.

12. Children and young people

Most of our websites, apps and services are not directed at children under 18. However, children and young people may interact with URC through events, competitions, promotions, youth fan activities, online games, family activities, mascot programmes, school or community activities, or content involving rugby.

Where we provide an online service directly to a child and consent is required under applicable data protection law, we may ask for a parent’s or guardian’s contact details in order to obtain or verify consent. We may also process parent or guardian contact details to administer participation by a child or young person in an event, competition, activity or promotion.

Where children or young people participate in events, competitions, promotions, filming, photography, community activities or similar activities, we may provide additional notices or consent forms where appropriate.

If you are a parent or guardian and believe that a child has provided personal data to us without appropriate consent, please contact us at privacy@unitedrugby.com.

13. Event safety, security, CCTV and venue management

When you attend URC matches, events, venues or hospitality experiences, we may process personal data for event administration, safety, security, access control and customer service purposes. This may include ticketing information, access control logs, accreditation details, CCTV footage, incident reports, medical or first aid information, accessibility information, customer service records, complaints, and records relating to refusal of entry, removal from a venue or venue bans.

We may share relevant information with clubs, unions, venues, event operators, security providers, medical providers, emergency services, law enforcement bodies, regulators and professional advisers where necessary and lawful.

CCTV and other safety or security systems may be operated by URC, venues or event partners. Additional notices may be displayed at venues. CCTV footage and incident records are generally retained only for as long as necessary for safety, security, investigation, legal or insurance purposes, unless a longer period is required or permitted by law.

14. Special category data

In limited circumstances, we may process special category personal data, such as health information, accessibility requirements or other sensitive information. This may occur, for example, where:

• you provide accessibility or medical information for event attendance or participation;
• a medical, first aid, safety, safeguarding or security incident occurs at an event;
• processing is necessary to protect vital interests;
• processing is necessary for legal claims;
• processing is required or permitted by law; or
• you have given explicit consent, where required.

Where we process special category data, we will do so only where we have a lawful basis under data protection law and an applicable special category condition, and we will apply appropriate safeguards.

15. Photography, filming, broadcast and user-generated content

URC matches, events and activities may be photographed, filmed, streamed, broadcast or otherwise recorded. Images, video or audio may include spectators, participants, staff, officials, volunteers, guests and other attendees.

We may use photography, video, audio, broadcast footage and user-generated content for purposes such as event coverage, news reporting, match operations, broadcast, streaming, highlights, social media, marketing, archival, security, training and commercial promotion, where lawful.

Ticket terms, venue notices, event terms, consent forms or separate notices may provide additional information about photography, filming, broadcast and media use. If you have concerns about photography or filming at an event, please contact event staff where appropriate or contact us using the details in this policy.

16. Your data protection rights

Subject to applicable law and any relevant limitations, you may have the following rights in relation to your personal data:

• access: to request a copy of the personal data we hold about you;
• rectification: to ask us to correct inaccurate or incomplete personal data;
• erasure: to ask us to delete personal data in certain circumstances;
• restriction: to ask us to restrict processing in certain circumstances;
• portability: to receive certain personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller where technically feasible;
• objection: to object to processing based on legitimate interests in certain circumstances;
• direct marketing objection: to object at any time to direct marketing and profiling for direct marketing;
• withdrawal of consent: to withdraw consent where we rely on consent, without affecting processing carried out before withdrawal; and
• automated decision-making rights: rights relating to certain solely automated decisions that produce legal or similarly significant effects, where applicable.

These rights may be limited in some circumstances. For example, we may not be able to fulfil a request where doing so would reveal personal data about another person, adversely affect the rights or freedoms of others, conflict with legal obligations, affect legal privilege, prejudice legal claims, or require deletion of information we are required or permitted to retain.

To exercise your rights, please contact us at privacy@unitedrugby.com. We may need to verify your identity before responding. We will respond within the timeframe required by applicable law.

If you have unresolved concerns, you have the right to complain to a supervisory authority. As Pro Rugby Championship DAC is established in Ireland, you may contact the Irish Data Protection Commission. You may also have the right to complain to the supervisory authority in the EU member state where you live, work or where you believe an infringement occurred.

17. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to provide services, manage our relationship with you, comply with legal obligations, resolve disputes, enforce agreements, protect rights and safety, and establish, exercise or defend legal claims.

Our retention periods vary depending on the type of data and purpose of processing. In general:

Where personal data is no longer required, we will delete it, anonymise it or securely retain it in accordance with applicable law and our retention practices.

18. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures may include access controls, authentication, encryption, monitoring, staff training, supplier due diligence, contractual protections and incident response procedures.

No system or transmission is completely secure. You are responsible for keeping your account credentials confidential and for notifying us if you suspect unauthorised use of your account.

19. Third-party websites, platforms and services

Our websites, apps, emails and content may link to or integrate with third-party websites, platforms, plug-ins or services, including social media platforms, ticketing providers, broadcasters, sponsors, commercial partners and other rugby stakeholders.

Those third parties may collect and use personal data independently. Their own privacy notices and terms apply to their processing. We are not responsible for the privacy practices of third parties where they act as independent controllers.

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, processing activities, legal requirements or operational practices. The latest version will be made available on our website and will show the effective date or last updated date.

Where we make material changes, we will take appropriate steps to bring those changes to your attention, such as by updating our website, sending a notification, or requesting renewed consent where required.