Privacy Policy
Last updated: 28 October 2025This Privacy Policy sets out the data processing practices carried out by:
- Six Nations Rugby Limited, which is incorporated in Ireland under company number 358420 and which is tax resident in the United Kingdom where it is registered with company number FC037182 and whose business address is at Thomas House, 84 Eccleston Square, Pimlico, London SW1V 1PX (“SNRL”);
- New Zealand Rugby Union Incorporated of Level 4, 100 Molesworth Street, Thorndon, Wellington, New Zealand (“NZRU”);
- Rugby Australia Ltd ACN 002 898 544 of Rugby Australia Building, Corner Moore Park Road and Driver Avenue, Moore Park, New South Wales, 2021, Australia (“RA”);
- South African Rugby Union of SARU House, Tygerberg Office Park, 163 Uys Krige Drive, Plattekloof, 7500, Western Cape Province, South Africa (“SARU”); and
- Union Argentina De Rugby of Dardo Rocha 2950, B1640, Martinez, Provincia de Buenos Aires, República Argentina (“UAR”).
References in these Terms of Use to “we”, “us”, “our” and similar expressions are to SNRL, NZRU, RA, SARU and UAR collectively.
We have appointed Wasserman Digital and Data Limited (company number 13621120) whose registered office is 71-91 7th Floor, Aldwych House, Aldwych, London, United Kingdom, WC2B 4HN (“Wasserman”) to create, host, operate and maintain the Nations Championship official website at nationschampionshiprugby.com (the “Website”) on our behalf.
We will be the data controllers of your personal data in respect of collecting your personal data on the Website, including to administer your account on our Website. Wasserman will be the data processor of your personal data in connection with providing any services to you on our behalf via the Website.
We will sometimes share your data with others, including our Unions, other rugby stakeholders, our partners and sponsors, suppliers and other rugby and sports stakeholders.
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.
We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (“UK GDPR”). We are also subject to the EU General Data Protection Regulation (“EU GDPR”) in relation to goods and services we offer to individuals in the European Economic Area (“EEA”).
Personal data we collect about youThe personal data we collect about you depends on your use of the Website. We may collect and use the following personal data about you:
- your name;
- your email address;
- your telephone number;
- your date of birth;
- your gender, if you choose to give this to us;
- location data, if you choose to give this to us;
- your personal or professional interests;
- images and footage of you where you attend a Nations Championship event;
- your responses to surveys and questionnaires;
- marketing and communications data such as your preferences with regards to receiving marketing in relation to the Nations Championship and/or partners of the Nations Championship;
- technical and analytics information, such as information related to the browser or the device you use to access the Website, including cookies, IP address and other tracking technologies; and
- any other information you voluntarily provide to us in any communications.
We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.
How your personal data is collectedWe collect your personal data directly via your use of the website.
Sometimes, we may receive information about you from third parties. In particular, from social media sites. The Website provides interactive features that engage with social media sites, such as Facebook, Instagram and TikTok. If you use these features, these social media sites will send us personal data about you, such as identification information, account details and the number of followers you have. If you participate in activities on non-Nations Championship websites or apps – such as participating in a Facebook application – you may allow us to have access to personal data held by Facebook, or other site or app owners.
We may also obtain information about you from third party demographics providers, which we may use to help us better understand our fans and users and send them appropriate offers and information.
We also receive some information about our fans on the other ways they engage with Nations Championship content, or with other rugby stakeholders such as Unions or other rugby tournament hosts. This includes information from partners, sponsors, Unions and other rugby stakeholders on how fans purchase tickets or engage with their sites and services, or from broadcasters on their engagement with premium services. This sharing is described in the sites and policies of those third parties. We typically collect information on your engagement with a third party, including details of your interests and transactions although not about your payment details. We use this to better understand our own fans, and to help create more detailed profiles to help offer them more tailored products and marketing.
If we provide online services to a child where we need parental consent for this, we may ask for a parent’s email address, to ask for consent.
How and why we use your personal dataUnder data protection law, we can only use your personal data if we have a proper reason. For example:
- where you have given consent;
- to comply with our legal and regulatory obligations; or
- for our legitimate interests or those of a third party.
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.
More details about how we use your personal data and why are set out in the table below.
Purpose | Lawful basis relied on under the UK GDPR and EU GDPR | Relevant categories of personal data |
|---|---|---|
To register and create an account on our Website and provide with access to that account. | Necessary for our legitimate interest (to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you). If you are under 16, we will instead rely on the consent of your parent or guardian in processing this data. |
|
Communications with you not related to marketing, including about the website terms or policies or other important notices (other than those addressed above) and to manage our relationship with you | Processing is necessary for compliance with a legal obligation to which we are subject (Article 6(1)(b)). Our legitimate interests (Article 6(1)(f)), which is to be as efficient as we can so we can deliver the best service to you. If you are under 16, we will instead rely on the consent of your parent or guardian in processing this data. |
|
For security purposes, including to verify your identity, and to monitor accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law | Necessary for our legitimate interest (to ensure the security of our services and data and in preventing and detecting fraud or other wrongdoing). |
|
To use data analytics to improve marketing in relation to the website | Necessary for our legitimate interests (to develop our business and to inform our marketing strategy). |
|
To deliver relevant marketing materials to you | Consent (to send you direct marketing, which you may remove your consent to at any time by following the opt-out links which can be found on all communication we will send to you). If you are under 16, we will need to seek the consent of your parent or guardian before we send you direct marketing. Without this consent, we will not send you direct marketing (even where you have opted in). |
|
To deliver surveys, competitions, promotions and questionnaires | Consent (You may remove your consent at any time by following the opt-out links which can be found on all communication we will send to you). Necessary for our legitimate interests (to develop our business and to inform our marketing strategy, and to perform our contract with you including when allowing you to enter competitions / promotions). |
|
To publicise, promote and distribute footage of the Nations Championship | Where you attend a Nations Championship event, we will receive images and footage of those events to publicise, promote and distribute footage of these events, which may include your image. |
|
To protect our business interests, including use in connection managing our relationships with partners and suppliers, with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements, and processing to protect our IP or enforce company policies. | Necessary for our legitimate interests (to process data to protect our business interests, managing our relationships with our partners and suppliers, and legal rights including seeking relevant legal advice and sharing with organisations as needed to assist with these purposes). |
|
To comply with our legal and regulatory obligations. | Compliance with our legal obligations including where we need to comply with: data protection legislation consumer law legislation our duty of care obligations a court order in the context of civil or criminal proceedings |
|
We will share personal data with:
- our group entities;
- our Unions, sponsors, partners and other rugby and sports stakeholders;
- any third parties which you have opted-in to receive marketing and communications from;
- social media and ad-tech suppliers;
- individuals invited by you to join a Fantasy rugby league; and
- other third parties we use to help us run and monitor the Website, e.g. Wasserman and cloud based servers.
We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.
We or the third parties mentioned above occasionally also share personal data with:
- our external auditors, e.g. in relation to the audit of our accounts, in which case the recipient of the information will be bound by confidentiality obligations;
- our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;
- law enforcement agencies, courts, tribunals, governmental authorities and regulatory bodies to comply with our legal and regulatory obligations;
- other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.
We may also share aggregated, anonymous information with any third party. This information is not linked to personal information that can identify you or another individual person. Amongst other reasons, this information may be shared for analytics advertising purposes.
How long your personal data will be keptWe will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements (which generally require us to retain your personal data for 6 years after your last interaction with or use of the Website). For anyone under 16 whose account is not properly authorised by their parent/guardian, we will delete the data they have provided within 30 days.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period of 7 days after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.
Transferring your personal data out of the UK or the EEAIt is sometimes necessary for us to transfer your personal data to countries outside the UK or the EEA. In those cases we will comply with applicable laws designed to ensure the privacy of your personal data.
Under data protection laws, we can only transfer your personal data to a country outside the UK or the EEA where:
- the UK government or European Commission has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy decision/regulation’).
- there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
- a specific exception applies under relevant data protection law.
Where we transfer your personal data outside the UK or the EEA, we do so on the basis of an adequacy decision/regulation or legally-approved standard data protection clauses. In the event we cannot or choose not to continue to rely on either of those mechanisms at any time, we will not transfer your personal data outside the UK or the EEA unless we can do so on the basis of an alternative mechanism or exception provided by applicable data protection law.
Your rightsYou have the following rights, which you can exercise free of charge:
Access | The right to be provided with a copy of your personal data |
Rectification | The right to require us to correct any mistakes in your personal data |
Erasure (also known as the right to be forgotten) | The right to require us to delete your personal data – in certain situations |
Restriction of processing | The right to require us to restrict processing of your personal data in certain circumstances, e.g. if you contest the accuracy of the data |
Data portability | The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party – in certain situations |
To object | The right to object:
|
Not to be subject to automated individual decision making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you |
The right to withdraw consents | If you have provided us with a consent to use your personal data you have a right to withdraw that consent at any time Withdrawing a consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn |
For more information on each of those rights, including the circumstances in which they apply, please contact us (see ‘How to contact us’ below) or see guidance from your relevant supervisory authority (e.g. the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights).
If you would like to exercise any of those rights, please:
- email us – see below: ‘How to contact us’;
- provide enough information to identify yourself and any additional identity information we may reasonably request from you; and
- let us know what right you want to exercise and the information to which your request relates.
Please contact us if you have any queries or concerns about our use of your personal data (see below ‘How to contact us’). We hope we will be able to resolve any issues you may have.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, or to an EU data protection authority where you live, work or where you believe a breach may have occurred. This may be the Data Protection Commission in Ireland (DPA). We would, however, appreciate the chance to deal with your concerns before you approach the ICO or other supervisory authority so please contact us in the first instance.
The UK’s Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.
The Irish DPA may be contacted using the details at https://www.dataprotection.ie/en/faqs/initial-contact-dpc/making-complaint-dpc.
Changes to this privacy policyThis privacy notice was published on 23rd October 2025. We may update this privacy notice from time to time and it will be available on request.
How to contact usYou can contact us if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.
Our contact details are shown below:
Our contact details |
|---|
Postal address: C/O Wasserman Digital and Data Limited, 71-91 7th Floor, Aldwych House, Aldwych, London, England, WC2B 4H Email address: |
In the event of any inconsistency between the English language version of these Terms of Use and any other language translations (if made available), the English language version shall always take precedence.
Individual Union Privacy PoliciesAustralia - https://australia.rugby/privacy
England - https://www.englandrugby.com/the-rfu/policies/privacy-notice
Fiji - https://www.fijirugby.com/privacy-policy/
France - https://api.www.ffr.fr/wp-content/uploads/2020/12/Sites-FFR_CGU_FR-2.pdf
Ireland - https://www.irishrugby.ie/privacy/
Italy - https://federugby.it/privacy/
Japan - https://en.rugby-japan.jp/privacypolicy/
New Zealand - https://www.allblacks.com/privacy-policy/
Scotland - https://scottishrugby.org/privacy-policy/
South Africa - https://www.sarugby.co.za/general/privacy-policy-updated-2021/
Wales - https://www.wru.wales/privacy-policy/