PRIVACY POLICY

1 OUR APPROACH

1.1 This Privacy Policy (the “Policy”) sets out how we, the Independent Review Panel set up by the governing bodies of international tennis, the ATP, the WTA, the ITF and the Grand Slam Board, (further referred to as “IRP”, “our” or “we”) process the personal data of our website visitors and customers in the European Union (“User”).

1.2 If you have any questions about this Policy, please contact our data protection officer (“DPO”) at Tennis.IRP@crsblaw.com .

2 WHAT IS PERSONALLY IDENTIFIABLE INFORMATION (PII) / PERSONAL DATA?

2.1 Personal data or PII means any information relating to a person who can be identified either directly or indirectly; it may include name, address, email address, phone number, credit / debit card number, IP address, location data, purchase history (“Personal Data”).

3 PURPOSES FOR WHICH WE PROCESS PERSONAL DATA

3.1 IRP will only process your Personal Data, in accordance with applicable law, for the following purposes:

3.1.1 enabling our service providers to carry out certain functions on our behalf, including verification, technical, logistical or other functions, as may be required;

3.1.2 ensuring the security of our website, preventing or detecting fraud or abuses of our website;

3.1.3 developing and improving our website and services, for example, by reviewing visits to our website and its various subpages, demand for specific goods and services and User comments;

3.1.4 to comply with applicable law, for example, in response to a request from a court or regulatory body, where such request is made in accordance with the law;

3.2 Your consent, as the Data Subject, to the processing as specified in this Policy is the primary legal ground for our processing of your Personal Data. However, there may be circumstances where we may also rely on other valid legal grounds for the processing of your Personal Data, such as:

3.2.1 your request for content or services necessitating steps including processing of your Personal Data to be taken prior to entering into contract with you and any processing that is necessary for the performance of such contract; and

3.2.2 legitimate interests pursued by IPR as a business, except where such interests are overridden by your interests and fundamental rights.

3.2.3 compliance with a legal obligation to which IPR is subject.

4 DISCLOSURE OF CUSTOMER INFORMATION

4.1 There are circumstances where we wish to disclose or are compelled to disclose your Personal Data to third parties. This will only take place in accordance with the applicable law and for the purposes listed above. These scenarios include disclosure:

4.1.1 to our subsidiaries, branches or associated offices;

4.1.2 to our outsourced service providers or suppliers to facilitate the provision of our services or goods to our Users,;

4.1.3 to third party service providers and consultants in order to protect the security or integrity of our business, including our databases and systems and for business continuity reasons;

4.1.4 to another legal entity, on a temporary or permanent basis, for the purposes of a joint venture, collaboration, financing, sale, merger, reorganisation, change of legal form, dissolution or similar event. In the case of a merger or sale, your Personal Data will be permanently transferred to a successor company;

4.1.5 to public authorities where we are required by law to do so; and

4.1.6 to any other third party where you have provided your consent.

5 INTERNATIONAL TRANSFER OF PERSONAL DATA

5.1 We may transfer your Personal Data to a third party in countries outside the country in which it was originally collected for further processing in accordance with the purposes set out in paragraph 3 above. In particular, your Personal Data may be transferred through the Independent Review Panel to the governing bodies of international tennis, the ATP, the WTA, the ITF and the Grand Slam Board, some of which are located abroad. In these circumstances we will, as required by applicable law, ensure that your privacy rights are adequately protected by appropriate technical, organisation, contractual or other lawful means. Please contact the DPO for a copy of the safeguards which we have put in place to protect your Personal Data and privacy rights in these circumstances.

6 RETENTION OF PERSONAL DATA

6.1 Your Personal Data will be retained until as long is reasonably necessary for the purposes listed above or as required by applicable local law. Please contact the DPO for further details of applicable retention periods.

6.2 We may keep an anonymised form of your Personal Data, which will no longer refer to you, for statistical purposes without time limits, to the extent that we have a legitimate and lawful interest in doing so.

7 DATA SUBJECT RIGHTS

7.1 Data protection law provides Data Subjects with numerous rights, including the right to: access, rectify, erase, restrict, transport, and object to the processing of, their Personal Data. Data Subjects also have the right to lodge a complaint with the relevant data protection authority if they believe that their Personal Data is not being processed in accordance with applicable data protection law.

8 CHILDREN

Please note that this website is not intended for children under the age of 16.

9 LINKED WEBSITES

Please note that any websites that may be linked to our websites are subject to their own privacy policy.