1. Introduction

International Rugby League Limited (IRL) is the owner of the Rugby League World Cup tournament, which consists of three prescribed IRL competitions in men’s, women’s and wheelchair disciplines (RLWC).

 

IRL has granted certain rights to Australian Rugby League Commission Limited (ARLC) to stage the RLWC to be held in Australia in October and November 2026.

 

This Privacy Policy covers the ARLC, IRL, National Rugby League Limited and each of their associates, related entities and subsidiaries (together, "we," "us," "our," and the "ARLC"). Please read this Privacy Policy carefully as it describes how we collect, use, disclose and otherwise handle your Personal Information.

 

We recognise the importance of your privacy and your right to control your Personal Information and are committed to complying with applicable privacy laws (including the Privacy Act and GDPR).

 

We are always seeking to better understand how players, Rugby League Administrators, and, most importantly, RLWC fans interact, communicate and otherwise share Personal Information in order to continue to develop the game of Rugby League. We have invested heavily in conjunction with selected third parties, to establish and administer a data storage architecture for processing your Personal Information.

 

2. Anonymity and pseudonymity

We offer you the opportunity, wherever it is lawful and practicable, of not identifying yourself, or of using a pseudonym, when entering transactions, or otherwise dealing with us in relation to a particular matter by contacting the NRL Privacy Officer (see clause 11).

 

3. What kinds of personal information do we collect?

3.1 The types of Personal Information we may collect depends on the purposes for which it is collected but may include (without limitation):

 

(a) your name, gender, date of birth, occupation, residential address, email address, telephone number and other contact details;

(b) your favourite RLWC participating nation

(c) other information regarding dealings with us or selected ticketing companies, including in connection with memberships, subscriptions and attendance history at Matches; and

(d) purchasing preferences and financial details.

 

3.2 We will not collect Sensitive Information about you unless:

 

(a) you have provided informed consent to the collection of such specific Sensitive Information;

(b) the collection is required or authorised by law; or

(c) the collection is otherwise permitted under applicable privacy laws (including the Privacy Act and GDPR).

 

In addition to Personal Information, we use cookies, web beacons and other technologies on our website and applications to collect information about your usage of our services (for instance, third party websites you visit to better understand your preferences and what types of products and services you may be interested in).

 

4. How do we collect your personal information?

4.1 Where it is reasonable and practicable to do so, we will collect your Personal Information from you. If you are a Minor, we may collect Personal Information about you from your parent or legal guardian.

 

4.2 In addition to collecting Personal Information directly from you, we may also collect Personal Information from:

 

(a) selected third parties (for instance, Ticketek and Ticketmaster); and

(b) a third party (such as a RLWC Partner or other corporate partner of the RLWC, or information that is on public record or which is otherwise unsolicited).

 

5. Why do we collect, use, hold and disclose your personal information?

5.1 We generally only collect, use, disclose or hold Personal Information that is reasonably necessary for us to perform one or more functions or activities in staging the RLWC and/or administering the game of Rugby League (the primary purpose), including:

 

(a) organisation, conduct and promotion of RLWC and RLWC Matches (including for the purpose of providing information and making ticket offers to you);

(b) direct communication with you by Rugby League Administrators;

(c) disclosure to RLWC Partners, unless you have indicated that you do not want to receive any communication from RLWC Partners;

(d) serving content in accordance with your preferences and previous consumption;

(e) serving advertising that is suited to your age; and

(f) evaluating and servicing our relationships with RLWC Partners, including to tailor your experience interacting with our RLWC Partners.

 

5.2 Wherever practicable, we will inform you more specifically of the primary purpose of a collection as part of its collection statement, which will be made available to you at the time of the collection.

 

5.3 When we collect your Personal Information, your Personal Information will only be used or disclosed for the primary purpose for which it was collected, a related secondary purpose, in accordance with any express consent you give us or as otherwise lawfully required (e.g. where your Personal Information is requested by a law enforcement agency).

 

Direct Marketing

5.4 We may use or disclose your Personal Information to a Rugby League Administrator or RLWC Partner for the secondary purpose of direct marketing communication, if:

 

(a) we collected the information from you;

(b) you would reasonably expect your Personal Information would be used or disclosed for direct marketing;

(c) we have provided a simple means by which you can request not to receive direct marketing; and

(d) you have not made a request not to receive direct marketing.

 

5.5 Where you would not reasonably expect your Personal Information to be used for direct marketing, or the information has been collected from a third party, we may use the information for the secondary purpose of direct marketing communication only where:

 

(a) you have expressly consented to the use or disclosure for direct marketing, or it is impracticable for us to seek your consent before that use;

(b) you have not made a request to us not to receive direct marketing communication;

(c) in each direct marketing communication, we always prominently display a simple notice or actionable option that you may express a wish not to receive any further direct marketing communication; and

(d) each written direct marketing communication by us with you sets out our contact details including business address, telephone and email address.

 

6. Who do we disclose your personal information to?

6.1 Subject to compliance with applicable privacy laws (including the Privacy Act and GDPR) and this Privacy Policy, we may also:

 

(a) disclose your Personal Information to enable the administration of the game of Rugby League and provide related activities and services; and

(b) disclose your Personal Information to IRL, RLWC Partners and selected other partners as part of a data exchange to enable such recipients to provide you with information, materials and promotional opportunities. This sharing of Personal Information will assist us and RLWC Partners and selected other partners to more effectively administer promotional and information sharing activities.

 

6.2 We may disclose your Personal Information to service providers such as ticketing agents, mail houses or other similar third party organisations for the purpose of implementing the primary purposes, including fulfilling ticket requests and communicating Rugby League related offers. For example, we use third party credit card payment gateway services on our website and applications. If you pay for tickets or services through our website and applications, we will be required to provide certain financial details to the third-party service provider to effect the transaction. We require these third party organisations to keep your contact details and Personal Information confidential and only use them for the designated purpose. We may also disclose your Personal Information to other service providers which assist us in the conduct of its operations, such as information services providers, information technology providers and other similar third party organisations.

 

7. Data quality and security

7.1 We will take reasonable steps to:

(a) make sure that the Personal Information we collect, use or disclose is accurate, complete and up-to-date; and

(b) protect the Personal Information we hold about you or that is within our direct control from misuse, interference and loss and from unauthorised access, modification or disclosure.

 

7.2 We will take reasonable steps to destroy or permanently de-identify Personal Information if it is no longer needed for any purpose for which the information may be used or disclosed (at your request or otherwise) or if you withdraw your consent, unless we are required by or under law, or a Court order, to retain such information. Where we are required to destroy or permanently de-identify your Personal Information, we will take reasonable steps to inform other parties using, holding or disclosing the same Personal Information (including any links to, copies of or replication of that Personal Information).

 

8. Openness, access, correction and deletion

8.1 We strive to provide you with the greatest available control of the Personal Information which we collect from you or about you from other third parties. Accordingly, we are continually developing and enhancing the ways which you can access your Personal Information (for example, via your account or communications preferences centre).

 

8.2 We will provide you with a variety of ways to access, review and manage your Personal Information. For example, if you have an account you can use your login credentials to access, review and manage your Personal Information at any time. If you don't have an account you can still opt out of and otherwise manage your communications preferences via links in emails and other communications we send to you from time to time. You will be responsible for ensuring your Personal Information remains accurate, complete and up to date.

 

8.3 Separate from the preference centre and upon your request, we will take reasonable steps to let you know, in general terms, what sort of Personal Information we hold, for what purposes, and how we collect, hold, use and disclose that information. Where we have collected your Personal Information from your directly or with your consent, you have a right to receive (upon request) that Personal Information from us in a structured, commonly used, machine readable format and/or a right to instruct us to transmit that Personal Information to a third party (if technically feasible).

 

8.4 Before supplying any Personal Information to you or updating your Personal Information at your request, we must be reasonably satisfied as to your identity (for example, by asking to see your passport or driver's licence). We are not under any obligation to provide Personal Information to you where we are not required to do so under applicable privacy laws (including the Privacy Act and GDPR).

 

8.5 If we refuse to provide you with access to Personal information we hold on you in the manner requested by you, we will either:

 

(a) take such steps (if any) as are reasonable in the circumstances to give access to the information in a way that meets the needs of us and you; or

(b) provide you with a written notice that sets out:

(i) the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and

(ii) the mechanisms available to complain about the refusal.

 

8.6 If:

 

(a) We are satisfied that, having regard to a purpose for which the Personal Information is held, the information is inaccurate, out-of-date, incomplete or irrelevant or misleading; or

(b) you request we correct your Personal Information,

we will take reasonable steps to correct the Personal Information to ensure that, having regard to the purpose for which it is held, it is accurate, up-to-date, complete, relevant and not misleading. We will not charge you for making such a request or for correcting the information.

 

8.7 If we refuse to correct the Personal Information at your request, we will provide you with a written notice that sets out the same matters listed in clause 8.5(b).

 

8.8 You can request deletion of your Personal Information by contacting the NRL Privacy Officer at privacyofficer@nrl.com.au. In most cases we will comply with your requests unless we are required to maintain your Personal Information for legal or any other applicable reason. If we refuse to delete the Personal Information at your request, we will provide you with a written notice that sets out the same matters listed in clause 8.5(b).

 

9. Transborder data flows

9.1 Subject to clauses 9.2 and 9.3, we will not transfer your Personal Information to an overseas recipient unless we have first taken steps reasonable in the circumstances to ensure that the Personal Information that we transfer will not be held, used or disclosed by the recipient of the information inconsistently with, or otherwise in breach of, applicable privacy laws (including the Privacy Act and GDPR). For example, we may adopt appropriate contractual clauses with overseas recipients that ensure their compliance with applicable privacy laws (including the Privacy Act and GDPR.

 

9.2 We may disclose your Personal Information to overseas recipients for things such as processing ticketing and hosting services, most likely in China, Singapore, the United States and New Zealand, although countries where such recipients are located may vary.

 

9.3 We may transfer Personal Information about you to someone who is in a foreign country if:

 

(a) We reasonably believe that the recipient is subject to a law or binding scheme that has the effect of protecting the information in a way that is, overall, substantially similar to applicable privacy laws (including the Privacy Act and GDPR) and there are mechanisms available to you to enforce that protection or scheme; and

(b) you expressly consent to the transfer after we have informed you that the applicable privacy laws (including the Privacy Act and GDPR) will no longer apply if you provide your express consent.

 

10. Notifiable data breaches scheme

In the event of any loss, or unauthorised access or disclosure of your Personal Information that is likely to result in serious harm to you, we will investigate and notify you and where applicable the relevant supervisory authority (e.g. the Australian Information Commissioner) within 72 hours of becoming aware of the loss, or unauthorised access or disclosure, in accordance with applicable privacy laws (including the Privacy Act and GDPR).

 

11. Inquiries procedure

11.1 All complaints and inquiries concerning your Personal Information, including in respect of alleged breaches of this Privacy Policy or applicable privacy laws (including the Privacy Act and GDPR), should be directed to the NRL Privacy Officer:

 

The Privacy Officer

Rugby League Central

Driver Avenue

Moore Park NSW, Australia 2021

(02) 9359 8611

privacyofficer@nrl.com.au

 

11.2 At all times, privacy complaints will be treated seriously, dealt with promptly and confidentially, and will not affect your existing obligations or commercial arrangements with us.

 

12. Privacy Policy updates

This Privacy Policy was updated in October 2025. We may update this Privacy Policy from time to time, in which case we will post the updated version of the Privacy Policy on our website. As such, please check back periodically to see if our Privacy Policy has been updated.

 

13. Definitions

In this Policy:

 

Country means any country participating in the RLWC.

 

GDPR means the European Union General Data Protection Regulation.

 

Match means a game of Rugby League football played during the RLWC.

 

Minor means any person younger than 16 years of age.

 

NRL Privacy Officer means the person appointed by the NRL from time to time to deal with complaints and inquiries under this Privacy Policy.

 

Personal Information means any information or an opinion about an identified natural person, or a natural person who is reasonably identifiable whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.

 

Privacy Act means the Privacy Act 1988 (Cth).

 

Privacy Policy means this document as updated from time to time and made available on the NRL's website.

 

Rugby League Administrators mean the ARLC,  NRL and/or IRL (as the case may be).

 

RLWC Partners means any entity that has a commercial agreement or arrangement with the ARLC or IRL (as the case may be), and which you may also have a relationship with.

 

Sensitive Information means information or an opinion about a natural person's racial or ethnic origin, political opinions. membership of political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record that is also Personal Information as well as health information, genetic information, biometric information for the purposes of verification/identification and biometric templates about a natural person.