WTA CREDENTIAL ELIGIBILITY SYSTEM PRIVACY POLICY

Effective as of February 13, 2023

This Privacy Notice explains how we collect, use, store, process, and disclose your Personal Data through the Credential Eligibility System Website ("the Site"). This includes information you provide when you register to use the Site, when updating your account information, and when using the Site. This Privacy Notice should be read in conjunction with any applicable Terms of Use for the Site.

About the Site and WTA

  1. This Privacy Notice is issued on behalf of WTA Tour, Inc. and its corporate affiliates (referred to collectively in this Privacy Notice as "we", "us", "our" and other similar pronouns).
  2. WTA provides the Site as a free service to WTA tournaments ("Tournaments"), WTA staff, and other tournament participants. Collectively, such Tournament users, staff, and other tournament participants shall be referred to as "Users", "you", or "your" and other similar pronouns in this Privacy Notice.
  3. The Site is an authorization tool for WTA staff and other tournament participants. Collectively, such Tournament users, WTA staff, and other tournament participants shall be referred to as “Users,” “you,” or “your” in these Terms of Use.
  4. When we process your Personal Data, we do so as a "data controller" under applicable data protection laws, meaning that we are responsible for deciding how and why we hold and use your Personal Data. In some cases you may provide your Personal Data directly to Tournaments through the Site, and in such cases the Tournament shall also be a "data controller" under applicable data protection laws.

Contact Us

If you have any questions or comments regarding our privacy practices, or to exercise any of your rights as described in this privacy notice or under data protection laws, you may contact us using the contact details below. If you are located in the European Economic Area ("EEA"), you may contact our appointed representative in the EEA about any data protection queries.

WTA Tour, Inc.

100 Second Avenue South, Suite 300-N

St. Petersburg, FL 33701 USA

Email: legal@wtatennis.com

Phone: +1.727.895.5000

In the EEA:

WTA Tour, Inc.

c/o Willans Data Protection Limited

2 Pembroke House

28-32 Upper Pembroke Street

Dublin, Ireland D02 EK84

Email:   WTA@willansdps.com

Website: Make a data request (willansdataprotectionservices.com)

Phone: 00 353 1 447 0402

In the UK:

WTA Tour, Inc.


c/o Willians Data Protection Limited
34 Imperial Square, Cheltenham
Gloucestershire GL50 1QZ, United Kingdom
Email: WTA@willansdps.com
Website: Make a data request (willansdataprotectionservices.com)
Phone: + 44 (0)1242 514000

How We Collect and Use Your Data

  1. "Personal Data" is information that can be used to identify you as an individual. We may ask you to provide all or some of the following categories of data, for the purposes set out in the table below, which also explains our legal basis for doing so:

Data We Collect

How We Use Your Data

Legal Basis

1. When you use the Site in order to obtain a credential, we collect personal information, including your:

·       Full name.

·       Email address.

·       Account password.

·       Date of birth.

·       Photograph.

·       City and country of birth.

·       Residence.

·       Parents’ full names.

·       Gender.

·       Phone number.

·       Nationality.

·       Passport number and country.

·       Information from consumer reports.

·       Driving history.

·       Social security number or identification number and related records.

·       Criminal history (including convictions, arrest records, and any charges against you).

We use this data to:

·       Enable you to obtain a credential.

·       It is necessary for us to process your Personal Data in this way in order to enter into and perform our contract with you.

·       It is in our legitimate interests to help us improve the services we provide to our members.

2. Data you provide when we communicate with each other through the Site regarding your account or credentials:

·       Your contact details.

·       The details of your communications with us and the content you provide, and

our messages to you.

We use this data to:

·       Respond to your requests or answer your queries.

·       Manage your requests for a credential.

·       Share any information as necessary with third parties (described below) in the course of facilitating your request.

·       Monitor communications for quality purposes.

·       Improve our services based on the information you provide.

·       To notify you of changes to the Site.

It is in our legitimate interests to:

·       Understand your concerns and respond appropriately.

·       Ensure quality.

·       Protect our rights.

·       Improve our services and the Site.

·       It is necessary for us to process your Personal Data in this way in order to perform our contract with you.

Where we rely on legitimate interests as a lawful basis, we will carry out a balancing test to ensure that your interests, rights, and freedoms do not override our legitimate interests. If you want further information on the balancing test we have carried out, you can request this from us using the contact details set out above.

If you do not provide your Personal Data, you may not be able to register for a Site account and it may not be possible for us to provide you with the requested services or content on the Site.

  1. Data collected automatically: our servers automatically collect your IP address when you access the Site, and we may associate that with your domain name or that of your Internet access provider. We may also capture certain "clickstream data" pertaining to your usage of the Site. Clickstream data includes, for example, information about your computer or device, web browser, and operating system and their settings, the referring page that linked you to the Site, and the pages or content you see or click on during your visit and when and for how long you do so.

Among other things, this information enables us to: improve and develop the Site and identify issues with the Site; understand user behavior and how users interact with the Site; and analyze traffic. We have a legitimate interest in collecting and using this information, so that we may understand how users use the Site, and so that we may make improvements to the Site.

  1. Disclosure of Personal Data and Usage Information to Third Parties
  • We share the Personal Data we collect on the Site with others for a variety of reasons, as described in this Privacy Notice. In addition to the kinds of information sharing you might expect, such as sharing with our employees, contractors, and third-party service providers (such as software developers) who process your Personal Data in order to provide services to us, we may share your information with any designated agencies conducting security clearances on its behalf for individuals to be credentialed at WTA tournaments, including Castle Branch, Inc. (“Castle Branch”), 1844 Sir Tyler Drive, Wilmington, NC 28405 (Castle Branch along with any other such agencies referred to herein as the “Agency”).
  • with tournament directors, supervisors, and other tournament staff in order to manage your requests for credentials.
  • with the International Tennis Integrity Agency for the purpose of assisting with their anti-corruption investigations. You can read the International Tennis Integrity Agency’s privacy policy here: https://www.itia.tennis/privacy-policy/.
  • when we believe in good faith that disclosure is necessary to protect or enforce our rights or property (or those of our members), protect your safety or the safety of others, investigate fraud or respond to a government, judicial or other legal request, or to comply with the law.
  • with our affiliated companies or in connection with a corporate change or dissolution, including for example a merger, acquisition, reorganization, consolidation, bankruptcy, liquidation, sale of assets, or wind down of business.
  • with our professional advisers including lawyers, auditors, and insurers.

The WTA agrees to treat any and all information it receives in the credentialing process in strict confidence, such that no information shall be divulged by the WTA to any third party other than the party(ies) authorized to receive and/or process my information as detailed herein unless, and only to the extent, required by law.

Your Rights

European Rights

: To the extent that the GDPR applies, you have certain rights in relation to your Personal Data. The availability of these rights and the ways in which you can use them are set out below in more detail. Some of these rights will only apply in certain circumstances.
  • Access:You may obtain a copy of any consumer report produced or maintained by Agency. You may ask us if we are processing your Personal Data and, if we are, you can request access to that data.
  • Correction:If you believe any information in Agency’s possession is inaccurate, you may contact Agency directly to discuss correcting, amending or deleting the incorrect information. European Union consumers may be charged a fee no greater than $12 USD to cover delivery expenses, and this report will be forwarded by Agency within 30 days. You may ask us to correct or remove Personal Data you think is inaccurate.
  • Erasure:If you are a European Union consumer who feels that your privacy rights may have been violated, you may contact either Agency or the European Data Protection Authorities directly. You may ask us to delete or remove your Personal Data in certain circumstances.
  • Restriction: You may ask us to restrict or suspend the processing of your Personal Data in certain circumstances.
  • Transfer: You may request the transfer of certain of your Personal Data to another party. This right to data portability only applies where your Personal Data is processed by us with your consent or for the performance of a contract, and when processing is carried out by automated means.
  • Objection: You have the right to object at any time to our processing of your Personal Data for direct marketing purposes. Where we process your data based on our legitimate interests (or those of a third party), you also have the right to object, on grounds relating to your particular situation, at any time to processing of your Personal Data which is based on our legitimate interests. However we may be entitled to continue processing your data if our legitimate interests outweigh your interests, rights, and freedoms, or where the data is relevant to legal claims.

California Rights

: This section applies to California residents only. A noted above, we collect Personal Data you provide to us and through auto-collection means. Pursuant to the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), California Residents have the right to request that we disclose the following information about our collection and use of personal information:
  • To Know: You have a the right to request that we disclose (i) the categories of personal information collected, (ii) the sources from which your personal information is collected, (iii) our business or commercial purpose for collecting, selling, or sharing your personal information, (iv) the categories of third parties to whom we disclose your personal information, and (v) the specific pieces of information we collect about you.
  • Deletion: You have the right to request that we delete any personal information about you that we have collected.
  • Opt-In/ Opt-Out: You have the right to direct us not to sell or share your personal information.
  • No Retaliation After Opt-Out: We shall not discriminate against you because you exercised any of your rights.
  • Correction: You have the right to request that we maintain accurate personal information about you, and to correct inaccurate personal information.
  • Limit Use/Disclosure: You have the right to direct us to limit our use of your sensitive personal information to that use which is necessary to perform the services reasonably expected by an average consumer who requests such services.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply. We may refuse a request for erasure, for example, where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise, or defense of legal claims. We may refuse to comply with an access or correction request if the request is manifestly unfounded or excessive or repetitive in nature.

Exercising Your Rights

You can exercise any of your rights as described in this privacy notice and under data protection laws by contacting us as provided in the Contact Us section above. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Save as described in this privacy notice or provided under data protection laws, there is no charge for the exercise of your legal rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either: (a) charge a reasonable fee (taking into account the administrative costs of providing the information or taking the action requested); or (b) refuse to act on the request.

Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm your identity.

International Transfers

The Personal Data you provide through the Site may be transferred to, and stored in, locations outside of the country where it was collected. By providing Personal Data in connection with the Site, you acknowledge and agree that such Personal Data may be transferred to the offices and servers of WTA and our authorized third-party service providers located in the United States.

Where personal data is transferred to and stored in a country not determined by the European Commission as providing adequate levels of protection for personal information, we take steps to provide appropriate safeguards to protect your personal information, including:

  • entering into standard contractual clauses approved by the European Commission, obliging recipients to protect your personal information.

In the absence of an adequacy decision or of appropriate safeguards as referenced above, we will only transfer personal data to a location outside of the EEA where one of the following applies:

  • the transfer is necessary for the performance of our contractual engagement with you,
  • the transfer is necessary for the establishment, exercise or defense of legal claims, or
  • you have provided explicit consent to the transfer.

How long do we keep your Personal Data

Your Personal Data will not be kept for longer than is necessary for the purposes for which it was collected and processed. The criteria we use for retaining different types of Personal Data, will depend on the following:

  • if you have a Site account, we will retain your information on the Site for as long as you maintain such account,
  • if we have a relationship with you outside of the Site, we may maintain the same or similar data about you based on that relationship,
  • guidance from the applicable regulatory authority, and industry best practice recommendations,
  • legal and regulatory requirements. For example, we may need to retain Personal Data for up to seven (7) years after we cease providing services to you, where necessary to comply with our legal obligations, resolve disputes, or enforce our terms and conditions.

Children's Privacy

If you are under 16 years old, you should only submit Personal Data to us with your parent or guardian’s permission.

Third Party Websites and the Site Public Forms

The Site may contain links, banners, widgets, or advertisements that lead to other websites. The privacy notices posted on those websites (not this Privacy Notice) will govern the collection and use of your data on them. In some cases, those websites are operated by third parties and not the WTA, and in such cases those third parties are responsible for the collection and use of your data. We encourage you to read the privacy notices of each website you visit after leaving the Site to learn about how your data is handled on those websites.

This Privacy Notice only governs the data we collect while you are using your WTA Site account. If you provide Personal Data to Tournaments or others outside of your WTA Site account (including via services that may appear similar to the Site, such as Tournament public forms or ATP’s tournament management system), the privacy notices posted in connection with those services (not this Privacy Notice) will govern the collection and use of your data. WTA does not operate, and is not responsible for the ATP’s tournament management system.

Security

While we endeavor to protect the security and integrity of your Personal Data collected via the Site, we cannot guarantee that any information, during transmission through the Internet or while stored on our system or otherwise in our care, will be absolutely safe from intrusion by others, such as hackers.

If you create an account on the Site, you are responsible for maintaining the strict confidentiality of your account credentials (including username and password), and you shall be responsible for any activity that occurs using your account credentials, whether or not you authorized such activity. Please notify us of any unauthorized use of your password or account or any other breach of security as soon as possible.

If at any time during or after our relationship we believe that the security of your Personal Data in our care may have been compromised, we may seek to notify you of that development, as promptly as possible under the circumstances. If we have your e-mail address, we may notify you by e-mail to the most recent e-mail address you have provided us in your account profile. Please keep your e-mail address in your account up to date. You can change that e-mail address anytime in your account profile. To receive these notices, you must check your e-mail account. You consent to our use of e-mail as a means of such notification.

Questions and Complaints

If you have a question or complaint regarding our Privacy Notice or practices, please contact us in the first instance as provided in “Contact Us” above.

If you are in located in the EEA, you also have the right to complain to the relevant supervisory authority in the EEA. In the UK, this is the Information Commissioner’s Office (https://ico.org.uk/).

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. When we do, we will let you know by posting the changed Privacy Notice on this page with a new last updated date. In some cases, we may also tell you about changes by additional means, such as by sending an e-mail to the e-mail address we have on file for you. In some cases, we may request your consent to the changes.