Player Privacy Policy

Welcome to the Oval Insights Limited’s (Oval) player privacy policy.

This player privacy policy sets out how Oval collects, processes and shares personal data collected from sporting events, and other personal data relating to the players competing at such sporting events (Players), and other participants, including but not limited to, managers, coaches and referees (Associated Persons).

If you are not a Player or an Associated Person, please refer to Oval’s General Privacy Policy for our policy on how Oval may collect, process and share your personal data and your data subject rights and how you can exercise them. If you are a Player or an Associated Person, information on your data subject rights and how you can exercise them is also set out in Oval’s General Privacy Policy.

Where a Player or Associated Person is (or is a representative of) a customer or client of Oval, Oval may also collect, process and/or share that person’s personal data in the context of them being (or being a representative of) a customer or client of Oval, in which case Oval’s General Privacy Policy will apply.

1. Important information and who we are

Oval collects, collates and provides sports data to third parties including parties operating in the sports, entertainment, media and betting sectors. In providing our services, we act as a “controller” of the personal data of both Players and Associated Persons, under the applicable data protection law.

We have appointed a data privacy manager (DPM) who is responsible for overseeing questions in relation to this Player Privacy Policy. If you have any questions about this policy or wish to exercise rights of access to your personal date (or any other legal rights), please contact our DPM, James Tozer (jt@prospectsportinginsights.co.uk).

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

We keep this Player Privacy Policy under regular review.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you if you are a Player or Associated Person in the following sports:

Rugby Union;
Rugby League; and
Australian Rules Football.

The data which we collect on Players and Associated Persons will vary depending on which sport they participate in. For Players we may collect the following personal data:

Photographs;
Video footage (including their image and any associated audio data);
Forename;
Surname;
Nickname;
Gender;
Date of birth and age;
Place of birth;
Nationality;
Player position;
Team affiliation history;
Player match history;
Player/shirt number; and
Player social media.

We may also collect information relating to Player performance, including performance and behaviour during a sporting event, such as points scored, carries, tackles.

For Associated Persons we may collect the following information:

Forename;
Surname;
Match history;
Individual performance;
Behaviour during the event;
Individual’s career history; and
Video footage (including their image and associated audio data).

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your performance data with that of other Players to provide information about a teams performance. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this policy.

We may also collect Special Categories of Personal Data about Players and Associated Persons (this includes details about your race or ethnicity, religious, philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). For example, we may record when a Player is substituted because of an injury. Special Categories of Personal Data require a higher level of protection under applicable data protection law. In order to process this personal data, we will rely on the data being manifestly made public by the data subject as our condition for processing (Article 9(2)(e) UK GDPR).

3. How is your personal data collected?

The personal data collected, used, stored and transferred by us is generally publicly available. We may collect data from the following sources:

Cameras livestreaming the sports event (both operated by Oval and third parties);
Statisticians who have recorded the data manually live at the sports venue (either engaged directly by Oval, or the rightsholder of the data);
Live feed and media analysts;
Information provided to us by relevant third parties, including clubs, leagues and third party data collectors (including GPS data); and
Expert opinions (including from Associated Persons and ex-Associated Persons).

4. How we use your personal data

We will only use your personal data when the law allows us and for the purpose for which it was collected as set out below. We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
Providing sports data to our clients and customers (including rightsholders, unions, clubs, clubs owners and/or investors, betting companies, gaming companies and media companies).	For Players: Photographs; Video footage (including their image and any associated audio data); Forename; Surname; Nickname; Gender; Date of birth and age; Place of birth; Nationality; Player position; Team affiliation history; Player match history; Player/shirt number; Player social media; Performance data (including injuries); Biometric data; and Open source information. For Associated Persons: Forename; Surname; Match history; Individual performance; Behaviour during the event; Individual’s career history; Video footage (including their image and associated audio data); and Open source information.	Necessary for other’s and our legitimate interests in the provision of sports data for organisations, news and supporter engagement.
Maintaining integrity and preventing corruption in the sport.	For Players: Forename; Surname; Video stream; Photographs; Player position; Match history; Behaviour; Performance; Social media; and Open source information. For Associated Persons: Forename; Surname; Video stream; Career history; Behaviour; Performance; Match history; Social media; and Open source information.	Necessary for other’s and our legitimate interests to offer services to the betting industry.
Providing sports data to organisations such as governing bodies, leagues and regulators.	For Players: Forename; Surname; Nickname; Photograph; Contact Details; Gender; Date of Birth; Place of Birth; Nationality; Player Position; Team affiliation history; and Player/shirt number. For Associated Persons: Forename; Surname; Photograph; Contact details; Gender; Date of Birth; Place of Birth; and Nationality.	Necessary for other’s and our legitimate interests in enabling sporting bodies to manage club, team and member data.

Where it is stated above that the use of your personal data is in our legitimate interests, we mean that the interest of our business, or other businesses have in investing in or providing professional sports related products and services. We will always consider the impact of using your personal data for our or another’s legitimate interests prior to doing so. We will not use your personal data where the impact on you would be disproportionate to our or another’s legitimate interests (unless we have obtained your consent or are required to do so by law).

Legitimate interest means the interest of our business in conducting and managing our business to enable us to give clients and customers the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Further information on our assessment of the impact of our use of your personal data can be obtained by contacting our DPM.

5. Disclosures of your personal data

We may share your personal data with the parties set out below for the purposes set out in the table above.

Internal third parties, meaning other companies in the Oval Group and who are based
in the UK and provide IT and system administration services and undertake leadership
External third parties, meaning any of:
- Clients and customers, including: (i) betting companies and businesses (including bookies, punters and persons providing services to the same); (ii) sporting clubs, leagues and other bodies (including persons providing services to the same such as managers, coaches, scouts and agents); (iii) media companies (including broadcasters, website developers and other related service providers); (iv) gaming companies (including computer game developers and producers, fantasy league and player market providers, and other operators, rightsholders, sponsors and stakeholders.
- Service providers who provide IT and system administration services.
- Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
- HM Revenue & Customs, regulators and other authorities (including nongovernmental bodies such as World Rugby) based in the United Kingdom who require reporting of processing activities in certain circumstances.
- Police, law enforcement and security services: to assist with any investigation, or prevention of crime.
Other third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

We share your personal data within the Oval Group. This may involve transferring your data outside the UK.

Many of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same level of protection as it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purpose of providing services to our customers and clients as well as satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

9. Your legal rights

Please refer to the ‘Your Legal Rights’ section in Oval’s General Privacy Policy for details of your data subject rights and how you can exercise them.