Privacy Policy

This website, www.rwcexperiences.com, is operated by Sports Travel and Hospitality Group trading as Rugby World Cup Experiences (“STH”, “we”, “us”, “our”).

We are committed to safeguarding your privacy and we ask that you read this Privacy Policy carefully as it contains important information on:

The personal information we collect about you;
What we do with your personal information; and
Who your personal information will be shared with.

1. WHO WE ARE

1.1 STH is made up of:

Sports Travel and Hospitality Limited a company incorporated under English law (Company No. 07322743) with its registered office at One Southampton Row, London WC1B 5HA, England.

Sports Travel and Hospitality Australia Pty Ltd a company incorporated under Australian law (ACN 638 319 543) with its registered office at Suite 2 – Level 12, 276 Flinders St Melbourne VIC 3000; and

Sports Travel and Hospitality New Zealand Limited a company incorporated under New Zealand law (company no. 3880562) with its registered office at Level 4, 205 Queen St, Auckland 1010.

1.2 The data controller is the organisation which you interact with in relation to the personal information that you submit or that we collect from you via the Site.

1.3 STH is part of an international group of companies. Our parent Company is Sodexo Limited and its parent Sodexo SA was founded in 1966 in France. We don’t routinely share personal information between our group companies, and we’ve set out more details about when we do in the section titled “Disclosure of your Information”. To find out more about us visit our website https://uk.sodexo.com/home.html and search under the other locations tab.

1.4 STH is the organisation responsible for the collection and processing of personal information collected through or in relation to this Site. However, Your information may also be shared with a) Rugby World Cup (England 2025) Limited (“RWC”), the local operating entity and organiser of Rugby World Cup 2025 Tournament to be held in England in 2025 (RWC25) and b) World Rugby Events DAC (World Rugby), who has granted RWC the authority to organise RWC25, in their capacity as separate data controllers to STH for purposes related to the administration, management, servicing and fulfilment of your tickets and packages for RWC25 and facilitating your attendance at RWC25 (including health and safety), as well as to obtain a better understanding of overall fan engagement, understanding performance of their websites, activities and activations related to RWC25. You can view the World Rugby Privacy Statement here.

1.5 Your information may also be shared with World Rugby, in relation to marketing opt-in data only, in circumstances where you have agreed to receive marketing communications directly from World Rugby. In such circumstances, your information will be processed in accordance with World Rugby’s Privacy Policy.

2. INFORMATION THAT WE COLLECT FROM YOU

We will collect and process the following personal information about you:

2.1 Personal information you give us. This is personal information about you which you give us by filling in forms on the Site or by corresponding with us by phone, email or otherwise. For instance, if you submit your information on the Contact Us or Sign Up page of the Site, you will be asked to provide certain personal information about yourself including your name and contact details and we will collect and keep this information. Also, if you choose to subscribe to our newsletters and updates you may provide your contact information and information about your preferences.

2.2 Please see our Cookie policy for information about Cookies.

2.3 Personal information we receive from other sources. We may obtain your personal information from other sources. For instance, if you have submitted personal information to any of our group companies, we may obtain information about you from them and combine it with personal information that you submit via this Site. We may also work with third parties such as payment service providers, credit reference agencies, list brokers and advertising networks and we may receive your personal information from them and combine it with personal information that you provide to us. We also use a variety of publicly available third party sources (such as Linked In) and general information researched on the internet in order to carry out basic research to enable us to reach out to businesses who we think will be interested in our Site and services. We will only collect corporate contact details (such as business email addresses) when carrying out such research.

2.4 Where you submit personal information to us about another person, such as personal information about your guests for a product that you have purchased, you must only do so where you have their consent. We will use that information in accordance with this Privacy Policy.

2.5 “Special categories” of particularly sensitive personal information require higher levels of protection. Special categories of data include details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We need to have further justification for collecting, storing and using this type of personal information. We have in place appropriate safeguards which we are required by law to maintain when processing such data.

We will process the following special categories of personal information, on the basis of your explicit written consent:

dietary requirement/food allergies; and
special access/assistance you may require.

3. USE OF PERSONAL INFORMATION

3.1 Personal information you give to us. We will use this information:

to provide you with the information, products and services you have requested from us;
to carry out our obligations arising from any contracts entered into between you and us;
to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about;
if you are a business contact, to provide you with information about our goods and services which we think will be of interest and relevance to you;
to manage our relationship with you or your business;
to notify you about changes to our services;
to develop and carry out marketing activities (see marketing section below for more information);
to study how our customers use products and services from us and other organisations;
to develop and manage our brands, products and services;
to manage how we work with other companies that provide services to us and our customers;
to detect, investigate, report, and seek to prevent fraud and other crimes;
to obey laws and regulations that apply to us;
to respond to complaints and seek to resolve them;
to exercise our rights set out in agreements or contracts; and
to run our business in an efficient and proper way.

3.2 Personal information we collect about you. We may use the personal information that we collect about you for some or all of the following purposes:

to administer the Site and the operation of our business;
to make improvements to the Site so we can present it in the best possible manner for you;
as part of our efforts to maintain the safety and security of the Site;
to make suggestions and recommendations to users of our Site about products or services that may interest them.

3.3 Personal information we receive from other sources. We may combine this information with information you give to us and information we collect about you. We will use this information and the combined information for the purposes set out above (depending on the types of information we receive).

3.4 Marketing. When you sign up to receive Rugby World Cup Experiences and STH news and information or use the Site, we will use your personal information to create a profile based on the information we hold about you. This is necessary for the purposes of our legitimate interests in ensuring we have accurate information about you. We create a profile for you based on your preferences in order to provide you with the best experience and to send you personalised marketing communications and newsletters. This is necessary for the purposes of our legitimate interests in ensuring that we provide you a personalised experience and provide you with the most relevant products.

If you have given us your consent to send you marketing communications (including by email, text, SMS, social media, on-screen message/push notification) or if we are permitted by law to send such communications without obtaining your consent, we use the information that you have provided to us or which we have collected about you (for instance from publicly available third party sources such as Linked In and general information researched on the internet) for sending you personalised marketing messages about our products or services, events, and promotions for the RWC as well as other STH products, services events or promotions.

4. LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION

4.1 We will only process your personal information where we have a legal basis to do so. The legal basis will depend on the purposes for which we have collected and use your personal information. In almost every case the legal basis will be one of the following:

Consent: For example, where you have provided your consent to receive certain marketing from us. You can withdraw your consent at any time, including by clicking on the “unsubscribe” link at the bottom of any marketing email we send you.
Our legitimate business interests: Where it is necessary for us to understand our customers, promote our services and operate effectively as a leading sports travel and hospitality provider offering premium spectator experiences at global sporting events, provided in each case that this is done in a legitimate way which does not unduly affect your privacy and other rights. For example, we will rely on this legal basis when we market to corporate contacts and when we conduct certain market analysis to understand our customers in sufficient detail so we can create new services and improve the profile of our business.
Performance of a contract with you (or in order to take steps prior to entering into a contract with you): For example, where you have purchased a product or service from us and we need to use your contact details and payment information in order to process your order.
Compliance with law: Where we are subject to a legal obligation and need to use your personal information in order to comply with that obligation.

5. DISCOLOSURE OF YOUR PERSONAL INFORMATION

We may disclose your personal information to third parties, as set out below, and in accordance with your local data protection laws.

The security and confidentiality of your personal information is of great importance to us. This is why we restrict access to your personal information only to members of our staff and only to the extent strictly necessary to process your orders or to provide the requested services. We ensure that persons authorised to process your personal information have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

We will not disclose your personal information to any unauthorised third parties. We may, however, share your personal information with entities within Sports Travel Hospitality Group, the Sodexo Group and with authorized service providers whom we may call upon for the purpose of providing our services. We may also disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 736 of the UK Companies Act 2006. This information is not routinely shared. It may be shared for the provision of joint services, for example IT support and shared systems, Legal advice, debt recovery or HR support. It may also be shared for statistical analysis.

Your personal information will be used by us and those third parties for the purposes set out above in the “Use of Personal Information” section.

Your personal information may be disclosed to the following types of third parties:

5.1 We may share your information with sports rights holders, including World Rugby and RWC. Because this Site offers travel and hospitality products delivered by us and third party partners to various sporting events, we may be required to share your personal information with the third party provider, event organiser or venue operator of the event you have purchased in relation to.

5.2 Your personal data may also be shared with selected IT providers, such as third party cloud platform providers, in order to administer the purposes set out above.

5.3 We may also, in the usual course of our business and for the purposes of the processing, share your personal information with personnel of:

our related entities and brands;
travel service providers such as travel wholesalers, tour operators, airlines, hotels, car rental companies, transfer handlers and other related service providers;
a prospective purchaser, in connection with a merger, acquisition, reorganisation or sale of Sports Travel and Hospitality Limited or any of our subsidiaries, business lines, related bodies corporate and franchisees, or of assets of Sports Travel and Hospitality Limited or any such subsidiaries, business lines, or related bodies corporate and franchisees;
a person making your travel or hospitality booking on your behalf, where you are travelling on a booking made on your behalf by another person (for example, a family member, friend or work colleague);
your employer, where you are an employee of one of our corporate, business or government clients and you are participating in an event or travelling for work purposes;
a person who can verify to us that they have a relationship with you (e.g. a family member) where you are not contactable, the person correctly answers our required security questions and the request is, in our opinion, in your interest (for example, where the person is concerned for your welfare or needs to undertake action on your behalf due to unforeseen circumstances);
as required or authorised by applicable law, and to comply with our legal obligations;
customs and immigration to comply with our legal obligations and any applicable customs/immigration requirements relating to your travel;
government agencies and public authorities, to comply with a valid and authorized request, including a court order or other valid legal process;
various regulatory bodies and law enforcement officials and agencies, including to protect against fraud and for related security purposes; and
enforcement agencies where we suspect that unlawful activity has been or may be engaged in and the personal information is a necessary part of our investigation or reporting of the matter.
other third parties selected by us including:
1. suppliers and sub-contractors whom disclosure is necessary for the performance of any contract we enter into with them or you (this may include payment service providers, service contractors, and marketing fulfilment partners) or any other data processor who undertakes any data processing on our behalf;
2. analytics and search engine providers that assist us in the improvement and optimisation of our site; and

credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.

5.4 We may also disclose your personal information:

to third parties in order to enforce or apply the Sites terms of use or our terms and conditions of supply;
to advertisers, advertising networks and other third parties chosen by us; or
to third parties in order to protect the rights, property, or safety of STH, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

5.5 Other than as expressly set out in this Privacy Policy or as otherwise required or permitted by law, we will not share, sell or distribute any of the personal information you provide to us without your consent.

6. INTERNATIONAL TRANSFERS

We may disclose your personal information to certain overseas recipients, as set out below, which we will do in accordance with your local data protection laws.

It is possible that information will be transferred to an overseas recipient (other than any of our overseas related entities) located in a jurisdiction where you will not be able to seek redress under your local data protection laws and that does not have an equivalent level of data protection as in your jurisdiction. To the extent permitted by your local data protection laws, we will not be liable for how these overseas recipients handle, store and process your personal information. By providing your personal information to us for the purpose of booking and otherwise arranging travel/hospitality related products and services for you, you consent to our disclosure of your personal information to these overseas recipients for that purpose.

Where such a transfer occurs, we will take steps which are reasonably necessary to ensure that appropriate safeguards are in place to protect your personal information and to make sure it is treated securely and in accordance with this Privacy Policy. For countries that have not received an ‘adequacy decision’ from the UK Secretary of State, we rely on approved data transfer mechanisms (such as the UK Addendum to the EU “Standard Contractual Clauses” and the UK extensions to the EU-US “Data Privacy Framework”) to ensure your information is subject to appropriate safeguards in the recipient country. If you are located in the UK you may contact us for a copy of the safeguards which we have put in place to protect your personal information and privacy rights in these circumstances.

6.1 Our overseas related entities

STH operates a global business, as well as operating in the United Kingdom, STH has operations in New Zealand and Australia. Your personal information may be disclosed to our overseas related entities in connection with facilitation of your travel/hospitality booking and/or to enable the performance of administrative, advisory and technical services, including the storage and processing of such information. We have also implemented appropriate safeguards to ensure an adequate level of protection of your Personal data, even if the Personal data is processed by another Sodexo entity that did not collect your Personal data originally.

Sodexo has implemented the Sodexo’s Binding Corporate Rules (BCRs) within Sodexo Group. Therefore, even if the third countries in which Sodexo entities operate are located outside of the European Economic Area, your Personal data is protected in the same way that they would have been by any entity located within the European Economic Area.

6.2 Travel service providers located overseas

In providing our services to you, it may be necessary for us to disclose personal information to relevant overseas travel service providers. We deal with many different travel service providers all over the world, so the location of a travel service provider relevant to your personal information will depend on the travel services being provided. The relevant travel service providers will in most cases receive your personal information in the country in which they will provide the services to you or in which their business or management is based.

6.3 Our third party service providers located overseas

We may also disclose your personal information to third parties located overseas for the purpose of performing services for us, including the storage and processing of such information. Generally, we will only disclose your personal information to these overseas recipients in connection with facilitation of your travel/hospitality booking and/or to enable the performance of administrative and technical services by them on our behalf.

We deal with many different service providers all over the world, so it is not possible for us to set out in this policy all of the different countries to which we may send your personal information. However, if you have any specific questions about where or to whom your personal information will be sent, please email DataProtection.UKandIE@sodexo.com.

7. STORING PERSONAL INFORMATION

7.1 We collect personal information from wherever users are situated, but our Site servers are situated in the UK. The personal information that we collect will therefore be transferred to the UK from any other country in which you may be located and will be subject to UK data protection laws rather than the laws of the country in which you are resident.

7.2 We implement appropriate technological and operational security measures to protect your information which is in our control against any unauthorised access or unlawful use. Unfortunately, information transmitted via the internet cannot be completely secure and so we cannot guarantee the security of your data transmitted to our site. Any transmission of data to us via the internet is at your own risk.

7.3 Our Site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.

Please check these policies before you submit any personal information to these websites.

7.4 We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us. If we have not been in contact with you for 6 years then your account may be classed as dormant or your personal information may be deleted in line with our data retention policy. We will email to remind you before deletion so please check your inbox regularly to see if we have sent you any emails about this.

8. STORAGE LIMITATION AND ACCURACY

8.1 We will keep Personal Data that is processed accurate and, where necessary, up to date.

8.2 We will store your Personal data only for as long as necessary to fulfil the purposes for which it was collected and processed. This period may be extended, if applicable, for any amount of time prescribed by any legal or regulatory provisions that may apply.

8.3 To determine the retention period of your Personal data, we take into consideration several criteria such as:

The purpose for which we hold your Personal data (e.g., when you purchase products on our Sites, we keep your Personal data for the duration of our contractual relationship).
Our legal and regulatory obligations in relation to that Personal data (e.g. accounting reporting obligations).
Whether you are an active user of our services, you continue to receive marketing communications, or you regularly browse or purchase off our Sites or whether you do not open our emails or visit our Sites; For instance, if you have agreed to receive marketing communications, we keep your Personal data until you: (i) unsubscribe from receiving marketing communications (ii) request we delete your Personal data, or (iii) after a period of inactivity (i.e. where you have not interacted with us for a period of time). This period is defined in accordance with local regulations and guidance.
Any specific requests from you in relation to the deletion of your Personal data or account.
Any statutory limitation periods allowing us to manage our own rights, for example the defence of any legal claims in case of litigation; and
Any local regulations or guidance (e.g., regarding cookies).

9. YOUR RIGHTS

We are committed to ensuring protection of your rights under applicable laws. You will find below a summary of your different rights:

Right of access

You can request access to your personal information. You may also request rectification of inaccurate personal information, or to have incomplete personal information completed.

You can request any available information as to the source of the personal information, and you may also request a copy of your personal information being processed by us.

Right to be forgotten

Your right to be forgotten entitles you to request the erasure of your personal information in cases where:

the data is no longer necessary in relation for the purposes of its collection or processing;
you choose to withdraw your consent;
you object to the processing by automated means using technical specifications;
your personal information has been unlawfully processed;
there is a legal obligation to erase your personal information; or
erasure is required to ensure compliance with applicable laws.

Right to restriction of processing

You may request the restriction of processing in the cases where:

you contest the accuracy of the personal information;
we no longer need the personal information, for the purposes of the processing; or
you have objected to processing for legitimate reasons.

Right to data portability

You can request, where applicable, the portability of your personal information that you have provided to us, in a structured, commonly used, and machine-readable format you have the right to transmit this data to another controller without hindrance from us where:

the processing of your personal information is based on consent or on a contract; and
the processing is carried out by automated means.

You can also request to transmit directly your personal information to a third party of your choice (where technically feasible).

Right to object to processing for the purposes of direct marketing

You may object (including the right to “opt-out”) to the processing of your personal information (notably to profiling or to marketing communications). When we process your personal information on the basis of your consent, you can withdraw your consent at any time.

Right not to be subject to automated decisions

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to lodge a complaint to the competent Supervisory Authority

If you have a privacy-related complaint against us, you may make your complaint by email to DataProtection.UKandIE@sodexo.com. If you are unsatisfied with our response, you may then seek further recourse by contacting the competent supervisory authority or the competent court. You can notably contact the relevant supervisory authority, the Information Commissioner’s Office (the “ICO”, www.ico.org.uk) for the United Kingdom, the Office of the Privacy Commissioner https://www.privacy.org.nz/ for New Zealand or the Office of the Australian Information Commissioner https://www.oaic.gov.au/ for Australia.

We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you wish to exercise any of these rights please conduct us using the contact details below.

We may need to request specific information from you to help us confirm your identity and to enable you to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances. We will try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. CHANGES TO OUR PRIVACY POLICY

We reserve the right to make changes to the Privacy Policy from time to time. Any material changes to our Privacy Policy will be posted to the Site and, where appropriate, through e-mail notification.

11. CONTACT US

If you have any requests concerning personal information or any other queries about this Privacy Policy please contact us by sending an email to DataProtection.UKandIE@sodexo.com.