1. The purpose and scope of this Privacy Notice

This Privacy Notice describes how Premier Rugby Limited (“PRL” or “we”) may process personal data of players for the operation of PRL’s competitions including carrying out PRL’s functions as set out in the Premiership Regulations in force from time to time (the “Regulations”) (available at https://www.premiershiprugby.com/premiership-rugby-regulations-2021-22/).

This Privacy Notice will apply to you if you are a player who has signed the standard form player contract (the “Contract”) with a club taking part in a PRL Competition (“Club”), if you are on loan at a Club, or play in a Club’s academy.

You may have certain rights in relation to personal data we hold about you, as further described in section 5 below.

2. What personal data do we collect?

We may collect or receive personal data relating to you in PRL’s competitions.

The personal data we collect may include:

  • Biographical data: including your name, date of birth, nationality, height, weight, RFU number, Club and contact details. This data is received from you, your Club, or our service providers;
  • Performance and tracking data: including appearances, minutes played, yellow and red cards, passes, tackles, carries, metres gained, position on the pitch, and other event and tracking data. This data is received from sports data and analytics providers engaged by PRL;
  • Player imagery: including photographs and video footage featuring you. This data is received from broadcasters, photographers, videographers and other service providers, and may be collected at matches, photo shoots or promotional events;
  • Medical data: including concussion and head impact management data (including Head Injury Assessment (“HIA”) test results), cardiac screening data, injury surveillance data, and other results from testing from time to time including for Covid-19. This data is received from our medical, research, and other service providers and from your club; and
  • Diversity data: information regarding racial or ethnic origin as part of our monitoring and promotion of equality of opportunities in PRL’s competitions.

We also collect personal data in order to carry out our regulatory functions under the Salary Cap Regulations, as described in the Salary Cap Privacy Notice (available here).

3. How do we use this personal data, and what is our legal basis for this use?

We may use your personal data for the purposes set out below. We have also set out our “legal basis” for each of these uses.

Operating PRL’s competitions

Purpose

We use your personal data to facilitate your participation and your club’s participation in PRL’s competitions, and to ensure that we can operate, administer and govern PRL’s competitions. For example, we use:

  • Biographical data and player imagery to administer PRL’s competitions and to facilitate your participation in them; and
  • Performance and tracking data to operate Premiership Rugby in a safe manner, including to ensure that players are operating within designated matchday load allowance

Legal basis for use

It is in our legitimate interests to operate, administer and govern PRL’s competitions, to protect the integrity of the competitions and the game, and to ensure PRL’s competitions operate in an effective, safe and lawful manner.

Such use is also necessary for the performance of the contract.

Operating PRL’s website, app, social media channels and creative assets

Purpose

We use your personal data including your biographical data, performance and tracking data and player imagery to operate PRL’s website, app, social media channels, and create digital and physical creative assets. This includes the creation of statistics pages, graphics and analysis, fantasy rugby games, and other commercial or creative output from time to time.

Legal basis for use

It is in our legitimate interests to develop, promote and commercialise PRL’s competitions.

Regulating PRL’s competitions, and other processing in connection with legal claims, compliance and regulatory purposes

Purpose

We use your personal data for our regulatory oversight pursuant to the regulations, enforcing the measures we have put in place to protect the integrity of PRL’s competitions, and to bring or defend claims, or to respond to requests by government or law enforcement authorities.

Legal basis for use

It is in our legitimate interests to regulate PRL’s competitions to protect the integrity of the competitions and the game, and we will respond to requests by government or law enforcement authorities where required by law.

Special category data

We may also use certain sensitive or “special category data” for the purposes set out in the table below. We have also set out our “legal basis” and applicable condition for processing each of these uses.

Processing medical data

Purpose

We use your medical data to operate PRL’s competitions in a safe and lawful manner, and to assist us in performing our operational and regulatory functions.

Legal basis for use

It is in our legitimate interests to operate PRL’s competitions in a safe and lawful manner.

Where medical data constitutes special category data, we may process this where certain conditions are met, including where:

  • it is necessary for reasons of substantial public interest (including to protect the integrity and standards of behaviour of PRL’s competitions; preventing or detecting unlawful acts)
  • for reasons of public interest in the area of public health;
  • it is necessary for the purposes of preventative or occupational medicine and the management of health care systems;
  • it is necessary for the establishment, exercise or defence of legal claims;
  • you have already made the information public; or
  • we have your explicit consent.

Processing diversity data

Purpose

We may use your diversity data to identify or review the equality of opportunity or treatment between participants in PRL’s competitions, in order to promote or maintain such equality.

Legal basis for use

We may use diversity data where:

  • it is necessary for the substantial public interest in identifying or keeping under review the existence or absence of equality of opportunity;
  • we have obtained your explicit consent; or
  • you have already made the information public.

4. Do we share this personal data?

We may share selected necessary elements of your personal data with third parties in order to carry out our operational and regulatory role, including:

  • with third party service providers engaged by PRL, such as hosting providers and other technology providers, and professional advisors;
  • we may share medical data where we have a lawful basis to do so, such as:
    • sharing cardiac screening data with our clinical governance advisors, Covid-19 testing results with Public Health England and the Professional Rugby Testing Oversight Group (which includes representatives from PRL and the Rugby Football Union (“RFU”), and an independent virologist) in order to manage Club and PRL responses to results; and
    • sharing injury data with the RFU where we have received your explicit consent in connection with your participation in the Professional Rugby Injury Surveillance Project (“PRISP”); and
    • sharing HIA data with the RFU and Clubs you may represent, where it is necessary for reasons of substantial public interest to maintain standards of integrity and behaviour of PRL’s competitions, or where we receive your explicit consent; or
    • otherwise for certain research or other projects where we have a lawful basis to do so, in particular where we receive your explicit consent.
  • we may share your biographical data and performance and tracking data with the Professional Game Board (which incorporates representatives of the RFU, PRL, Rugby Players Association and Championship clubs) to the extent necessary to fulfil our regulatory obligations to monitor minutes played by Players;
  • we may share performance and tracking data, player imagery and limited other personal data with our commercial partners for their own or our joint promotional or commercial activities;
  • where it is required by law with law enforcement agencies, regulators, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.

Our sports data and analytics providers and broadcasters may share performance and tracking data and player imagery with clubs, media outlets, betting companies, and other third party licensees for commercial, statistical, analysis or betting purposes.

Other than in limited cases, we do not transfer your personal data outside the United Kingdom. In the limited cases in which we may transfer your personal data outside the United Kingdom (including to our HIA data service provider, and our video analysis software provider), we will ensure we implement appropriate safeguards to such personal data in compliance with applicable data protection law, including by way of an international data transfer agreement in a form approved by the Information Commissioner’s Office (“ICO”). We can provide details of these safeguards if applicable on request, at the details in the “Contact us” section below.

5.What are your rights in relation to your personal data?

You may have certain rights under data protection law in relation to personal data we hold about you:

  • You have the right to ask us for a copy of personal data we hold about you, and to correct your personal data.
  • You may also have a right to request that we delete or restrict processing of your personal data, and to obtain your personal data in a structured, machine readable format, or to object to our processing in certain circumstances.
  • We generally do not rely on your consent in order to process your personal data, but where we do we will inform you specifically. If we obtain this consent from you, you are permitted to withdraw your consent at any time.

Your rights are not absolute, and may be limited under data protection law, for example if you ask us to delete information which we have compelling legitimate interests in keeping, or which we are required to keep under applicable law.

To exercise your rights, you can contact us using the details in the “Contact us” section below.

6. How long do we keep this personal data?

We retain your personal data for as long as necessary to fulfil the purpose it was collected for, and for so long as we have a legal basis to do so. For example, we will retain your medical data until such time as we have no need to review or assess the applicable data for the relevant purpose.

We may also retain your personal data where we consider it reasonably necessary to investigate or defend against legal claims or potential future litigation.

To determine the appropriate retention period for personal data, we consider the applicable legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of the personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. Pursuant to our Retention and Minimisation Policy, we regularly review the length of time we keep personal data and delete anything no longer needed, or implement specific safeguards to protect stored personal data which does not need to be accessed regularly.

7.Contact us

For the purposes of this Privacy Notice the data controller is Premier Rugby Limited, whose offices are at Premier Rugby Limited, Regal House, 70 London Road, Twickenham, TW1 3QS.

If you have questions or concerns regarding the way in which your personal data is used, please contact us at privacy@premiershiprugby.com.

Details of our notification to the ICO may be found in the ICO’s Public Register of Data Controllers at www.ico.org.uk under registration number ZA394988.

You may refer any complaints you may have to the ICO.

8.Changes to this Privacy Notice

We may modify or update this Privacy Notice from time to time by posting the amended terms at [https://www.premiershiprugby.com/player-privacy-notice/]. If we make any revisions that materially change the ways in which we process your personal data, we will notify you of these changes before implementing them. 

Last updated: 29 July 2022