Data Controller	European T20 Premier League Limited
Registered Address	Unit 15C Kinsealy Business Park, Kinsealy, Dublin, Ireland
Privacy Contact	privacy@etpl.cricket
Lead Supervisory Authority	Irish Data Protection Commission (DPC) — www.dataprotection.ie
Governing Law	EU General Data Protection Regulation (EU GDPR) (Regulation 2016/679) and the Irish Data Protection Act 2018

1. Introduction and Purpose

European T20 Premier League Limited ("ETPL", "we", "us" or "our") is a company incorporated under the laws of Ireland. ETPL has been granted a sanction by the International Cricket Council (ICC) to develop, organise, promote and stage the professional T20 cricket tournament known as the European T20 Premier League (the "League"), with matches played in Ireland and the Netherlands.

We are committed to achieving the highest standards of transparency and accountability in respect of how we collect, use and protect personal data. This Privacy Policy explains how we process personal data when you interact with us, whether as a fan, website visitor, ticket buyer, commercial partner, job applicant or otherwise. It also explains your rights under the EU General Data Protection Regulation ("EU GDPR") (Regulation 2016/679) and the Irish Data Protection Act 2018.

This Privacy Policy does not cover the processing of personal data relating to professional players, officials or agents participating in the League. That processing is described in the ETPL Player Privacy Notice, which is available on our website.

Please read this policy carefully. If you have any questions, contact us at privacy@etpl.cricket.

2. Who We Are

ETPL is the data controller for the personal data described in this Privacy Policy. This means we determine the purposes and means by which your personal data is processed.

Where ETPL Franchises (the teams participating in the League) or other third parties independently determine the purposes and means of processing your personal data (for example, when you purchase merchandise directly from a Franchise or sign up to a Franchise's own mailing list), they will be the data controller in respect of that processing, and their own privacy policies will apply.

Where ETPL and a Franchise jointly operate a shared database — for example, a shared ticketing contacts database — ETPL and the relevant Franchise(s) may be joint controllers of that data. We will make this clear at the point of collection.

3. Personal Data We Collect

The personal data we collect depends on how you interact with us. We may collect and process the following categories of personal data:

Identity and Contact Data

Full name, title, gender and date of birth
Email address, postal address and telephone number(s)
Username, account ID and password (where you create an account with us)
Social media handle or profile information (where you interact with us via social media)

Ticketing and Transaction Data

Details of tickets purchased (including event, venue, seat location and date)
Payment and transaction details (including billing address and payment card details)
Proof of eligibility for concession tickets
Details of any merchandise, hospitality or other products or services purchased from us

Account and Preferences Data

Your preferences, interests and feedback
Consent and marketing preference records (including consents given, withheld or withdrawn)
Details of competitions, prize draws or promotions you have entered
Survey responses and other information you provide to us voluntarily

Technical and Usage Data

Internet Protocol (IP) address and device identifiers
Browser type, version and operating system
Pages visited, time spent on pages, links clicked and other browsing behaviour on our website
Location data (where you have enabled this on your device)
Cookie and tracking data (see Section 12 — Cookies)

Attendance and Safety Data

Details of your attendance at League events and matches
Disability, accessibility or other special requirements you disclose to us
Details of any incidents involving you at League events and any sanctions imposed (such as ejection or a ban)
CCTV footage and photographs taken at venues

Marketing and Communications Data

Your marketing preferences and communications history with us
Details of any direct marketing communications we have sent to you and whether they were opened or acted upon

Diversity and Inclusion Data

Equality, diversity and inclusion (EDI) information you choose to provide to us (such as ethnicity, gender, disability or other characteristics). This is special category data and will only be collected with your explicit consent or as otherwise permitted by law.

Job Applicant Data

CV, cover letter and employment history
Qualifications, skills and references
Any other information you provide as part of a job application

Commercial Partner and Supplier Data

Name and contact details of individuals at commercial partners, sponsors, broadcasters, suppliers and other organisations we work with
Correspondence and records of interactions with us

We do not collect special category personal data (such as health data, biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning sex life or sexual orientation) unless we have a specific legal basis to do so and it is necessary for an identified purpose. Where we do process special category data, we will notify you at the point of collection.

We do not collect personal data from children under the age of 16 without the consent of a parent or guardian. Our website and services are not directed at children under 16. If you believe we have inadvertently collected personal data from a child under 16, please contact us immediately at privacy@etpl.cricket.

4. How We Collect Your Personal Data

We collect personal data in the following ways:

Directly from you

When you register an account on our website or app
When you purchase tickets, merchandise, hospitality or other products or services from us
When you sign up to receive our newsletter or other marketing communications
When you enter a competition, prize draw or promotional activity
When you contact us by email, telephone, post, live chat or through social media
When you complete a survey or provide feedback
When you apply for a job with us
When you attend a League event and interact with us in person

Automatically

When you browse our website: through cookies, pixels, log files and similar technologies (see Section 12)
Through CCTV and photography at League venues and events

From third parties

From ETPL Franchises (where you interact with the League through a Franchise's channels)
From commercial partners, sponsors or broadcasters (where you have consented to your data being shared with us or where we have a legitimate basis to receive it)
From ticketing platforms and service providers
From analytics and data enrichment providers
From social media platforms (where you interact with our official accounts or where social media data is publicly available)
From law enforcement or regulatory bodies where required by law

5. How We Use Your Personal Data and Our Legal Bases

We only process your personal data where we have a lawful basis to do so under the EU GDPR. The table below sets out the purposes for which we process your personal data and the legal basis we rely on for each.

Purpose	Description	Legal Basis (EU GDPR)
Ticketing and event administration	Processing ticket purchases, managing bookings, processing payments, contacting you about events you have booked for, arranging accessibility provision and administering any refunds or cancellations.	Contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) for accessibility and health & safety; Legitimate interests (Art. 6(1)(f)) for fraud prevention
Account management	Creating and managing your online account, maintaining records of your preferences and consents, and providing customer support.	Contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f))
Direct marketing (email, SMS, post)	Sending you news, match information, promotional offers and updates about the League, where you have opted in. You can unsubscribe at any time.	Consent (Art. 6(1)(a))
Personalisation and profiling	Analysing your preferences and browsing behaviour to personalise your experience of our website and communications, and to deliver relevant content and advertising.	Consent (Art. 6(1)(a)); Legitimate interests (Art. 6(1)(f))
Analytics and service improvement	Understanding how visitors use our website and app, and improving our services and user experience.	Legitimate interests (Art. 6(1)(f))
Competitions, prize draws and promotions	Administering competitions, prize draws and promotional activities you enter.	Contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f))
Spectator and venue safety	Managing health and safety at League venues and events, including CCTV monitoring, incident management and enforcing bans.	Legal obligation (Art. 6(1)(c)); Legitimate interests (Art. 6(1)(f)); Vital interests (Art. 6(1)(d))
Record keeping and legal compliance	Maintaining financial records, complying with tax, accounting and regulatory obligations, and responding to requests from regulators or law enforcement.	Legal obligation (Art. 6(1)(c))
Broadcast and media	Using photographs, audio-visual materials and other content from League events for broadcast, publication and promotional purposes.	Legitimate interests (Art. 6(1)(f)); Consent (Art. 6(1)(a)) where required
Diversity monitoring	Monitoring equality, diversity and inclusion to ensure equal opportunities and comply with applicable law.	Explicit consent (Art. 9(2)(a)); Legal obligation (Art. 6(1)(c)); Substantial public interest (Art. 9(2)(g))
Commercial partner and supplier management	Managing our relationships with commercial partners, sponsors, broadcasters and suppliers, including processing contact details for individuals at those organisations.	Contract (Art. 6(1)(b)); Legitimate interests (Art. 6(1)(f))
Recruitment	Processing job applications, evaluating candidates and communicating with applicants.	Contract (Art. 6(1)(b)) (pre-contractual steps); Legitimate interests (Art. 6(1)(f))
Fraud prevention and security	Detecting and preventing fraud, unauthorised activity, and other misconduct.	Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c))
Legal claims	Establishing, exercising or defending legal claims.	Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests as our legal basis, we have carried out a balancing test and are satisfied that our legitimate interests are not overridden by your rights and freedoms. You can request further details of this assessment by contacting privacy@etpl.cricket.

6. Who We Share Your Personal Data With

We do not sell, rent or trade your personal data. We may share your personal data with the following categories of recipients, where necessary for the purposes described in this Privacy Policy:

ETPL Group and Franchises

Other ETPL group companies and ETPL Franchises participating in the League, for the purposes of administering and promoting the League and its matches.
Where ETPL and a Franchise are joint controllers of a shared database, both entities will have access to the relevant data in accordance with the joint controller arrangement.

Service Providers and Data Processors

Technology providers (including website hosting, app development and cloud storage providers)
Ticketing platform and payment processing providers
Email marketing and CRM platform providers
Analytics and audience insight providers
Advertising networks and social media platforms (for targeted advertising where you have consented)
Venue operators and event management companies
Security and identity verification providers
Legal, accountancy and other professional advisers

All service providers acting as data processors are bound by data processing agreements requiring them to process personal data only on our instructions and in accordance with EU GDPR requirements.

Cricket Governing Bodies and Partners

Cricket Ireland, Cricket Scotland and KNCB (as relevant national governing bodies)
The International Cricket Council (ICC) (where required for integrity, anti-corruption, or administrative purposes)
Commercial partners and sponsors of the League (where you have consented to receiving communications from them, or where we are contractually required to share data for promotional purposes)
Broadcasters and media organisations (for match footage, photography and other media content)

Legal and Regulatory Recipients

The Irish Data Protection Commission and other relevant supervisory authorities
Law enforcement agencies (where required by law or court order)
Tax authorities (including the Irish Revenue Commissioners and other relevant tax authorities)
Anti-corruption and integrity bodies (where relevant)
Courts and arbitral tribunals (where required for legal proceedings)

Corporate Transactions

In the event of a merger, acquisition, restructuring or sale of all or part of ETPL's business, personal data may be transferred to the relevant third party. We will notify you of any such change where required by law.

7. International Transfers of Personal Data

ETPL is based in Ireland and primarily processes personal data within the European Economic Area (EEA). However, some of our service providers, commercial partners, broadcasters and governing bodies are based outside the EEA, and some transfers of personal data outside the EEA may therefore be necessary.

Where we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place to protect your data, including:

Transfers to countries subject to an adequacy decision by the European Commission;
Entry into Standard Contractual Clauses (SCCs) approved by the European Commission; or
Other lawful transfer mechanisms permitted under Chapter V of the EU GDPR.

A copy of the relevant safeguards or further information about international transfers can be obtained by contacting privacy@etpl.cricket.

8. How Long We Keep Your Personal Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account legal, accounting and reporting requirements. Our key retention periods are:

Ticketing and transaction records	7 years from the date of transaction (to meet tax and accounting obligations).
Account data	For the duration of your account, plus 2 years after account closure or last active use.
Marketing consent records	For the duration of your consent, plus 3 years after withdrawal (to demonstrate compliance).
Correspondence and customer service records	3 years from the date of last interaction.
Event attendance records (including safety incidents)	7 years from the date of the event, unless a longer period is required for legal proceedings or regulatory purposes.
CCTV footage	30 days, unless retained for longer in connection with an incident, investigation or legal proceedings.
Broadcast and media footage	Indefinitely, as part of ETPL's archive of the League's history.
Diversity monitoring data	Aggregated and anonymised data may be retained indefinitely. Individual-level data will be deleted after 2 years.
Job applicant data	Unsuccessful applications: 12 months from the close of the application process. Successful applications: retained as part of the employee record.
Commercial partner and supplier contact data	For the duration of the commercial relationship, plus 3 years thereafter.

After the relevant retention period, personal data will be securely deleted or anonymised. Where anonymisation is not possible, data will be pseudonymised and access restricted to authorised personnel only.

9. Your Rights Under EU GDPR

Under the EU GDPR, you have the following rights in respect of your personal data. You can exercise these rights at any time by contacting us at privacy@etpl.cricket or at the postal address below.

Right of Access (Art. 15)	You have the right to request a copy of the personal data we hold about you (a 'subject access request'), along with information about how we use it.
Right to Rectification (Art. 16)	You have the right to ask us to correct personal data that is inaccurate or incomplete.
Right to Erasure (Art. 17)	You have the right to request that we delete your personal data in certain circumstances: for example, where it is no longer necessary for the purpose for which it was collected, or where you have withdrawn consent and there is no other legal basis for processing.
Right to Restriction of Processing (Art. 18)	You have the right to ask us to restrict the processing of your personal data in certain circumstances: for example, while we investigate an accuracy dispute.
Right to Data Portability (Art. 20)	Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transferred to another controller where technically feasible.
Right to Object (Art. 21)	You have the right to object to processing based on our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing immediately. For other objections, we will stop processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent	Where processing is based on consent, you may withdraw your consent at any time. This does not affect the lawfulness of processing before withdrawal.
Right Not to be Subject to Automated Decision-Making (Art. 22)	You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. ETPL does not currently make such automated decisions.

We will respond to all requests within one month of receipt. In complex cases or where we receive a large number of requests, we may extend this by up to two further months, in which case we will notify you. There is generally no charge for exercising your rights, but we may charge a reasonable fee for manifestly unfounded or excessive requests.

To protect your privacy and security, we may ask you to verify your identity before processing your request.

10. Direct Marketing

We will only send you direct marketing communications (by email, SMS, post or other electronic means) where you have given us your consent to do so, or where we have a legitimate interest in doing so (for example, where you have previously purchased a ticket from us and have not opted out of receiving similar communications from us).

You can withdraw your consent or opt out of direct marketing at any time by:

Clicking the 'unsubscribe' link in any marketing email;
Updating your preferences in your online account; or
Contacting us at privacy@etpl.cricket.

Opting out of marketing communications will not affect your ability to receive transactional communications (such as booking confirmations and event reminders) that are necessary for the administration of a contract between us.

11. Profiling and Automated Decision-Making

We may use profiling (automated processing of your personal data to evaluate certain aspects about you, such as your interests, preferences and browsing behaviour) for the purposes of personalising your experience and delivering relevant content and advertising.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects. Where we use profiling for personalisation and marketing purposes, we do so with your consent (which can be withdrawn at any time) or where we have a legitimate interest.

You can object to profiling at any time by contacting privacy@etpl.cricket.

12. Cookies

Our website uses cookies and similar tracking technologies (such as pixels and web beacons) to enhance your experience, to understand how our website is used, and for marketing purposes.

The types of cookies we use include:

Strictly necessary cookies: essential for the website to function (no consent required).
Performance/analytics cookies: help us understand how visitors use our website. Used with your consent.
Functionality cookies: remember your preferences (e.g. language). Used with your consent.
Targeting/advertising cookies: used to deliver relevant advertising. Used with your consent.

You can manage your cookie preferences at any time through our Cookie Preference Centre on the website, or through your browser settings. Withdrawing consent for non-essential cookies will not affect the functionality of strictly necessary cookies.

For full details of the cookies we use, please see our Cookie Policy.

13. Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:

Encryption of personal data in transit and at rest;
Access controls and multi-factor authentication;
Regular security testing and vulnerability assessments;
Staff training on data protection and information security;
Data processing agreements with all third-party processors.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Irish Data Protection Commission within 72 hours of becoming aware and, where required, will notify you directly without undue delay.

14. Third-Party Websites and Social Media

Our website may contain links to third-party websites, social media platforms and partner microsites. We are not responsible for the privacy practices of those websites and encourage you to read their privacy policies before providing any personal data to them.

If you interact with our official social media accounts (such as on Instagram, X/Twitter, Facebook, YouTube or LinkedIn), those platforms will process your data in accordance with their own privacy policies. We may use social media data for purposes such as audience analysis and targeted advertising where you have consented to this.

15. Complaints

If you have any concerns or complaints about how we are handling your personal data, please contact us in the first instance:

By email: privacy@etpl.cricket
By post: Privacy Officer, European T20 Premier League Limited, Unit 15C Kinsealy Business Park, Kinsealy, Dublin, Ireland

We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, or if you consider that our processing of your personal data is unlawful, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC), which is our lead supervisory authority:

Website: www.dataprotection.ie
Address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Phone: +353 (0) 761 104 800

If you are based in or your complaint concerns processing in the Netherlands, you may also contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

Website: www.autoriteitpersoonsgegevens.nl
Address: Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ Den Haag, Netherlands

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. When we make changes, we will update the 'Last updated' date at the top of this page.

Where changes are material, we will notify you by email (if we hold your email address) or by posting a prominent notice on our website prior to the change becoming effective. We encourage you to review this Privacy Policy periodically.

Your continued use of our website or services after any changes to this Privacy Policy will constitute your acknowledgement of those changes.

17. Contact Us

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

Data Controller	European T20 Premier League Limited
Address	Unit 15C Kinsealy Business Park, Kinsealy, Dublin, Ireland
Email	privacy@etpl.cricket
Website	www.etpl.cricket

European T20 Premier League Limited · Registered in Ireland · Regulated under the EU GDPR

CRICKET SCOTLAND