SC Privacy Policy

1. About this Policy
   1. The Supreme Committee for Delivery & Legacy (SC, we, us) is committed to protecting and respecting your privacy. SC was established in the State of Qatar by Emiri Decree No. (27) of 2011 as amended by Emiri Decree No. (3) of 2014 and its principal place of business is at Al Bidda Tower, P.O. Box 62022, Doha, State of Qatar.
   2. This Privacy Policy sets out the basis on which we will process any personal information that we may collect about you, including when you attend our Tournaments; visit our Platforms; or otherwise interact with us or use our services. “Tournaments”, “Platforms”, and other terms are defined in Annex A.
   3. We may provide further privacy notices to you at the point we collect your personal data, which will highlight any further information relating to our use of that personal data and, where applicable, provide you with the ability to opt in or out of selected uses. If you are a volunteer, a fan leader, or local country host (through our “Host a Fan” programme), separate privacy notices will apply to you, and these can be found on the specific website for your programme.
2. The information that we collect about you
   1. We may collect and/or process information about you when you engage with us, in particular, when you use our Accommodation Portal (Annex B); App (Annex C); Hayya Card (Annex D); Hayya Portal (Annex E); or Qatar 2022 Site (Annex F). Details of the personal data we process, the purposes for which we do so, and the third parties we share data with, are in these annexes.
   2. In general, however, we may collect and/or process the following categories of information about you:
      1. Information that you provide to us ► This includes information you provide when filling out application, registration or contact forms on our Platforms.
      2. Platform and communication usage ► Information that our Platforms collect about you, including details of your visits to the Platforms, your internet protocol (IP) address, domain name, browser version and operating system, traffic data, weblogs and other communication data, and the resources that you access. The Platforms may also download cookies to your device, as described in our separate Cookies Policy.
      3. Our correspondence ► If you contact us, we may keep a record of that correspondence.
      4. Your feedback ► Information which you provide to us from time to time by completing surveys or polls, and which we use to help us improve our offerings.
   3. We may also receive information about you from third parties who are legally entitled to disclose that information. If you wish to know more about how these third parties handle your personal information, please contact them directly.
   4. In general, we will not ask you to provide us with personal information about third parties. However, where you are a Fan Representative, or in the event that you voluntarily provide us with such information (e.g., when submitting details of your party/ family members), including where you are booking accommodation for other people, you confirm that you have obtained the consent of all relevant third parties to provide us with that information.
   5. We do not collect personal data from persons under the age of 18 (Minors) without their legal guardian’s consent. We take specific steps to protect the privacy of Minors who disclose their personal identifying information to us and we shall take all reasonable steps required of us to protect the rights of Minors and their privacy under applicable laws and regulations, including the laws of the State of Qatar.
3. What we do with your information?
   1. In this section, we set out the purposes for which we use personal data described in this Privacy Policy, and the “legal grounds” on which we rely to process your personal data for that purpose:
      1. To communicate effectively with you and conduct our operations ► To ensure that our Platforms function well and the Tournaments (and all ancillary events) run smoothly; to register and manage your accounts on the Platforms; to respond to your queries; to communicate and develop our relationship with you; and to carry out our obligations arising from any arrangements between you and us.
         Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you)
      2. To provide you with marketing materials ► To provide you with updates and offers, where you have chosen to receive these. We may use your information for marketing our own and our selected business partners’ products, services, events and opportunities to you by post, email, SMS, phone, in-app marketing, and through social media channels. Where required by law, we will ask for your consent at the time we collect your data to conduct any of these types of marketing. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by contacting us as set out in the “Marketing” section below.
         Lawful bases: consent, legitimate interests (to keep you updated with news in relation to our products, services, events and opportunities)
      3. For research and development purposes ► To analyse your personal information and use of our Platforms in order to better understand your and other Fans’ preferences and requirements, so as to better develop and organise our products, services and events.
         Lawful bases: legitimate interests (to allow us to improve our products, services and events)
      4. To inform you of changes ► To notify you about changes to our products, services and events.
         Lawful bases: legitimate interests (to notify you about changes to our products, services and events)
      5. To ensure Platform content is relevant ► To provide you with a personalised browsing experience when using the Platforms, including by ensuring that content from our Platforms is presented in the most effective manner for you and for your device. This may include passing your data to business partners, suppliers and/or service providers.
         Lawful bases: legitimate interests (to allow us to provide you with relevant content and services on the Websites)
      6. To re-organise or make changes to our business ► In the event that we undergo a re-organisation, we may need to transfer some or all of your personal data to the relevant third party (or its advisors) as part of any due diligence process for the purpose of analysing any proposed re-organisation. We may also need to transfer your personal data to that re-organised entity or third party after the reorganisation for them to use for the same purposes as set out in this policy.
         Lawful bases: legitimate interests (in order to allow us to change our business)
      7. In connection with legal or regulatory obligations ► We may process your personal data to comply with our regulatory requirements, to dialogue with regulators, or to bring and defend claims, as applicable. This may include disclosing your personal data to third parties, the court service and/or regulators or law enforcement agencies in connection with enquiries, proceedings or investigations by such parties anywhere in the world or where compelled to do so.
         Lawful bases: legal obligations, legal claims, legitimate interests (to cooperate with law enforcement and regulatory authorities)
      8. To ensure the safety and security of our operations, premises and events ► To keep attendees of Tournaments safe and secure, including by investigating, preventing or taking action in relation to actual or suspected illegal activities, fraud, emergency situations involving potential threats to the physical safety of any persons or violations to our internal policies or terms of use; or to prevent the spread of viruses or infectious diseases.
         Lawful bases: legal obligations, legitimate interests (to prevent fraud and ensure physical, IT and network safety and security)
4. Sharing with third parties
   1. We may share your personal information with third parties and affiliates for the purposes we explain in this Privacy Policy. These third parties include:
      1. our service providers, such as those which host the Platforms or other information technology systems, or who otherwise hold or process your personal information on our behalf;
      2. contractors, agents, or advisors (e.g. legal, financial, business or other advisors) that perform activities on our behalf;
      3. government agencies, including the Ministry of Public Health, Ministry of Interior and the Ministry of Transport and Communications, so that they may carry out any checks required to ensure the safety and security of the Tournaments;
      4. to banks and payment service providers, who receive and process your details when making payments using the App or Hayya Card. We do not receive or store your payment details, and any queries relating to payments should be directed to the relevant bank/ payment service provider; and
      5. any organisation which takes over our operations, or relevant parts of them.
   2. In exceptional circumstances, we may be under a duty to disclose or share your personal data in order to comply with any legal obligation (including responding to requests from law enforcement authorities either within or outside of the State of Qatar) or in order to enforce or apply our Terms of Use, or the terms of other agreements that we are party to; or to protect our rights, property, or safety, or that of our partners, or other relevant third parties and affiliates. This includes exchanging information with other organisations for the purposes of fraud protection.
   3. The Platforms may contain links to other third party websites. If you follow a link to any of those third party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal data. Please check these policies before you submit any personal data to such third party websites.
5. Marketing
   1. As mentioned, we may use your data, or permit selected third parties or affiliates to use your data, to provide you with information about goods and services which may be of interest to you and we or they may contact you about these by post, email, SMS, phone, in-app marketing or through social media channels, provided that you give us consent for this (where consent is required by law).
   2. If, at any time after you have given us consent to do so, you no longer want us to use your data in this way, or to pass your details on to third parties or affiliates for marketing purposes, please get in touch with us using the details in the “Contacting us” section below.​​​​​
      ​​​​​​​
6. Profiling and automated decision making
   1. The advertisements and recommendations which we show you on our Platforms are chosen by analysing the personal information you provide to us, including information provided in your Hayya application, information you have provided about your preferences, your attendance at our Tournaments, the way in which you interact with our Platforms, and previous advertisements which you have clicked on. To choose advertisements which are tailored and most likely to be of interest to you, we compile and analyse information received from all our users to gain a better understanding of your preferences from users similar to you.
7. Storage and security
   1. All information you provide to us is stored on our subcontractors’ secure servers and accessed and used subject to our security policies and standards. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Platforms, you are responsible for keeping this password confidential and for complying with any other security procedures that we notify you of. We ask you not to share a password with anyone.
   2. No data transmission over the Internet or website can be guaranteed to be secure from intrusion. However, we maintain commercially reasonable physical, electronic and procedural safeguards to protect your personal data in accordance with data protection legislative requirements.
8. International transfer of your information
   1. Your personal information may be transferred to and/or stored in Qatar, or at another a destination located outside of your country. Such data may also be processed by persons operating overseas who work for us, or by our affiliates or one of our third party service providers.
   2. This may include transfers to countries whose privacy laws may be of a lower standard than those in your country. In those cases, we will ensure that our arrangements with our service providers or other third parties are governed by appropriate safeguards or agreements. Where we are required by law to do so we will provide a copy of such safeguards.
9. Retention and deletion of your information
   1. Our retention periods for personal data are based on business needs and legal requirements. We retain personal data for as long as is necessary for the processing purpose(s) for which the information was collected, and any other permissible, related purpose. For example, we may retain a copy of your Hayya application form and correspondence even if you are not granted a Hayya Card, until the time limit for claims arising from your application has expired, or to comply with regulatory requirements regarding the retention of such data. When personal data is no longer needed, we either irreversibly anonymise the data (and we may further retain and use the anonymised information) or securely destroy the data.
10. Your rights​​​​​​​
    1. Where processing of your personal information is based on your consent, you have the right to withdraw it at any time. Please note that the withdrawal of your consent will not affect the lawfulness of processing based on your consent as carried out before such withdrawal.
    2. We will use reasonable endeavours to ensure that your personal data is accurate. In order to assist us with this, you should notify us of any changes to the personal data that you have provided to us by contacting us as set out in the “Contacting Us” section below.
    3. Under certain conditions, you may have the right to require us to:
       1. provide you with a copy of information that you have provided to us;
       2. update any inaccuracies in the personal data we hold (please see paragraph 10.2 above);
       3. delete any personal data we no longer have a lawful ground to use;
       4. where processing is based on consent, to withdraw your consent so that we stop that particular processing (see paragraph 5 above in relation to marketing);
       5. to ask us to transmit the personal data you have provided to us and we still hold about you to a third party electronically;
       6. object to any processing based on the legitimate interests ground unless our reasons for undertaking that processing outweigh any prejudice to your data protection rights; and
       7. restrict how we use your information whilst a complaint is being investigated.
    4. Your exercise of these rights is subject to certain exemptions to safeguard the public interest (e.g. the prevention or detection of crime) and our interests (e.g., the maintenance of legal privilege). If you exercise any of these rights, please contact us (details in the “Contacting Us” section below). We will check your entitlement and respond in most cases within a month.
    5. You can also lodge a complaint about our processing of your personal information with the appropriate data protection authority in Qatar at the Ministry of Transport and Communications if you consider that the processing of your personal information infringes applicable law. In Qatar this is the competent department at the Ministry of Transport and Communications. In the UK it is the Information Commissioner’s Office, and a list of supervisory authorities in the EU can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en
11. Changes to this policy
    1. Any changes we make to this Privacy Policy in the future will be posted to the Platform(s) and are also available if you contact us. Please check back frequently to see any changes. If we change this Privacy Policy or our Cookies Policy, we will update the date it was last changed below. If these changes are material, we will indicate this clearly on our Platform(s).
12. Contacting us
    1. If you have any questions in relation to this policy, please email:
    2. For enquiries relating to the Arab Cup 2021TM: [email protected]
    3. For general enquiries relating to the FIFA World Cup Qatar 2022TM: [email protected]
    4. For enquiries relating to accommodation: [email protected]
    5. To change your preferences or withdraw your consent to marketing: [email protected]

 

ANNEX A

Definitions

1. In this Privacy Policy, the following words shall have the following meanings:
   1. App means the Hayya mobile application which is available at the App Store with the name Hayya to Qatar 2022TM.
   2. Accommodation Portal means the website through which accommodation bookings can be made, and which is hosted at https://www.qatar2022.qa/book.
   3. Fan means an individual who attends, or plans to attend, one of more of our Tournaments.
   4. Hayya Card means the physical or digital card which SC issues to you upon approval of your application for a Hayya Card.
   5. Hayya Portal means the website through which applications for a Hayya Card can be submitted, and which is hosted at https://www.qatar2022.qa/hayya/.
   6. Platform means the Accommodation Portal, the App, the Hayya Portal, the Qatar 2022 Site, or other platforms which SC may offer from time to time; and Platforms means two or more of these platforms (as the context requires).
   7. Qatar 2022 Site means the website hosted at https://qatar2022.qa.
   8. Tournament means the Arab Cup 2021TM or the FIFA World Cup Qatar 2022TM, and Tournaments means both of these events.

ANNEX B

Accommodation Portal

1. Additional information that we collect
   ​​​​​​​​​​​​​​​​​​​​​When you book accommodation using our Accommodation Portal, we may ask you to provide:
   1. Basic information about yourself and the named guest(s) using the accommodation as part of your booking, such as name, date of birth, address, email address, telephone or mobile number;
   2. nationality of you and the named guest(s) using the accommodation as part of your booking;
   3. Your choice of accommodation provider (e.g. preferred hotel, apartment/villa or cruise ship hotel) and the dates of your stay;
   4. The number of members in your party;
   5. Sensitive personal data, for example, information relating to your needs at the accommodation venue (e.g. requests for disabled access), should you choose to provide us with that information;
   6. Passport information (including First Name, Last Name, Date of Birth, Nationality, Passport Number, Place of Birth, Gender, Issue Date, Expiry Date, Place of Issue) for you and the named guest(s) using the accommodation as part of your booking; and
   7. Any other information required by our accommodation providers to administer your booking.
2. Additional purposes of use
   1. ​​​​​​​To consider and/or process your accommodation bookings ► To carry out all necessary checks regarding your application/ booking request; to liaise with hotels, cruise ship hotels, local hosts and other accommodation providers to organise your stay.
      Lawful bases: contract performance, legitimate interests (to enable us to consider your application/ booking request and provide our services to you)
   2. ​​​​​​​To manage the supply of accommodation during the Tournaments ► To aggregate your booking details together with that of other Fans, and analyse it so as to ensure that there is sufficient accommodation for Fans the duration of the Tournaments, and allocate appropriate accommodation based on available supply.
      Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you)
3. Additional third parties whom we share your data with
   1. Accommodation providers, such as hotels, apartments and villas and operators of cruise ship hotels;
   2. The Qatar Accommodation Agency, which we have appointed to manage the Accommodation Portal on our behalf, and which acts as SC’s data processor; and
   3. The Qatar National Tourism Council, which regulates hotels and other accommodation providers in Qatar.

Annex C

App

1. Additional information that we collect about you
   When you register for an account to use the App, we may collect:
   1. Basic information about yourself, such as your name, date of birth, address, email address, telephone or mobile number;
   2. Information about your Tournament itinerary, such as the matches which you have ticket(s) to attend;
   3. Information about your preferences, such as tourist attractions you might like to visit whilst you are in Qatar;
   4. Location data, if you have enabled location tracking within the App; and
   5. Sensitive personal data, for example, information relating to your needs at the stadium (e.g. requests for disabled access), should you choose to provide us with that information.
      
      ​​​​​​​We may collect this information both by way of you providing it to us (for example, through forms and questionnaires on the App), or through your browsing history on the App.
2. Additional purposes of use
   1. ​​​​​​​To provide you with updates and recommendations ► To provide you with information about recommended travel routes (e.g. based on traffic and crowding), changes to match schedules, and other information relevant to your stay in Qatar and attendance at the Tournament(s). Separately, we may provide you with marketing materials where you have chosen to receive these (see the section titled “What we do with your information?” in the main Privacy Policy).
      Lawful bases: consent, legitimate interests (to keep you updated with news in relation to your stay in Qatar and attendance at the Tournament(s))
   2. ​​​​​​​For crowd control and tournament management purposes ► If you have enabled location tracking, we may combine this data with that of other Fans to identify areas which are at risk of overcrowding, and release announcements recommending that Fans avoid those areas or use alternative routes.
      Lawful bases: consent, legitimate interests (to ensure the safety and security of attendees at the Tournaments)

​​​​​​​Annex D

Hayya Card

1. Additional information that we collect about you
   When you use or carry your Hayya Card, we may collect:
   1. Details of your check-ins, for example, the location (e.g. the gantry number) and time at which you check into one of our stadiums for a Tournament, using your Hayya Card; and
   2. Details of your travel journeys made using your Hayya Card (e.g. mode of transport and time of journey).
2. Additional purposes of use
   1. ​​​​​​​To verify your identity and access rights ► When you scan or present your Hayya Card, for example, at a gantry, we will use that data to confirm that you have a valid ticket to the match in question, or to access public transport during the Tournament(s).
      Lawful bases: contract performance, legitimate interests (to enable us to perform our obligations and provide our services to you)
   2. ​​​​​​​For crowd control and tournament management purposes ► We may combine location data from your Hayya Card data with that of other Fans to identify areas which are at risk of overcrowding, and release announcements recommending that Fans avoid those areas or use alternative routes.
      Lawful bases: legitimate interests (to ensure the safety and security of attendees at the Tournaments)

 

Annex E

Hayya Portal

1. Additional information that we collect about you
   When you use the Hayya Portal to apply for a Hayya Card, we may ask you to provide:
   1. Basic information about yourself, such as your name, date of birth, address, email address, telephone or mobile number;
   2. Details about your nationality and passport (e.g., passport number, expiry date);
   3. Details of any ticket(s) you may have to the Tournaments;
   4. Sensitive personal data, for example, information about whether you have any symptoms of an infectious disease, particularly where there is an ongoing epidemic or pandemic. We may also collect biometric information in your passport as needed to apply for an entry visa on your behalf. If you provide us with information relating to your needs at the Tournaments (e.g., requests for disabled access), we will also keep a record of that information.
      
      We may also receive information about you from the following third parties:
      1. Immigration information ► The Qatar Ministry of Interior (http://www.moi.gov.qa) may send us information that may inform our decision on whether to accept or reject your application for a Hayya Card; an
      2. Ticket information ► FIFA (https://www.fifa.com/) may share with us information about the ticket(s) which you have purchased to the Tournaments, including ticket number and information about you as the purchaser of the ticket.
      3. Single Sign-On (SSO) ► SSO is in place across FIFA’s ticketing portal (www.fifa.com) and SC’s Hayya Portal and Accommodation Portal. This means that if you sign into FIFA’s portal using your username and password, you will automatically be able to access the Hayya Portal and Accommodation Portal without having to re-enter your sign-in details. However, aside from the login username and password, and the ticket information described above, no other personal information is shared between the FIFA and SC portals using the SSO mechanism.
2. Additional purposes of use
   1. ​​​​​​​To consider your application for a Hayya Card ► To carry out all necessary checks regarding your application; to liaise with relevant government agencies to obtain approval for your visit to Qatar; to issue and deliver your Hayya Card.
      Lawful bases: contract performance, legitimate interests (to enable us to consider your application and provide our services to you)

Annex F

Qatar 2022 Site

1. Additional information that we collect about you
   ​​​​​​​In addition to the Accommodation Portal and Hayya Portal described above, the Qatar 2022 Site allows you to participate in various programmes and opportunities offered by SC, such as Challenge 22 (https://www.qatar2022.qa/en/opportunities/challenge-22/apply); or our Community Engagement and Supplier registration programmes. When you choose to participate in these programmes or opportunities, we may ask you to provide:
   1. Basic information about yourself, such as your name, email address, and telephone or mobile number;
   2. If you are applying on behalf of a company, we may ask you to provide your company’s name and registration number, and your job title at the company;
   3. We may also ask for information about why you or your company wants to participate in the programme or opportunity, which may comprise business rather than personal information. This includes pitch decks promoting your company, and details of other grants that may have been awarded to your company in the past.
      
      Through the Qatar 2022 Site, you may also register to receive updates on SC and the Tournaments. Please see the section on “Marketing” in the main Privacy Policy for more information about how we use your date for this purpose.
2. Additional purposes of use​​​​​​​
   1. To consider you/ your company’s application ► To carry out all necessary checks regarding your application; to communicate with you regarding your application; and if you are successful, to enter into a contract for services with you and/or award you a grant.
      Lawful bases: contract performance, legitimate interests (to enable us to consider your application and provide our services to you)