Privacy Policy /

1. Introduction

In this privacy policy "we", "us", "our" and "Melbourne Storm" means Melbourne Storm Rugby League Club Ltd (ACN 081 369 468), its associates, related entities and subsidiaries. Please read this Privacy Policy carefully as it describes how we collect, use and handle your Personal Information.

Capitalised terms in this Privacy Policy have the meaning given to such terms in the National Rugby League’s (NRL) Privacy Policy located at https://www.nrl.com/privacy-policy.

Melbourne Storm recognises the importance of your privacy and your right to control your Personal Information and is committed to complying with applicable privacy laws (including the Privacy Act and GDPR). We will only request Personal Information that is reasonably necessary for us to perform our functions and activities as a Club. Please be aware, you are under no obligation to provide us with your Personal Information, but if you choose not to provide your Personal Information, you may not be able to take advantage of one or more of the features we offer.

On request and wherever it is lawful and practicable, we will offer you the opportunity of not identifying yourself, or of using a pseudonym, when entering transactions, or otherwise dealing with, Melbourne Storm.

2. How we share your information as part of the Rugby League Exchange

Melbourne Storm is always seeking to better understand our player and fan preferences including by analysing your Personal Information to understand trends and interests. Melbourne Storm has, in conjunction with the NRL, other Clubs, Queensland Rugby League (QRL), New South Wales Rugby League (NSWRL), Country League of New South Wales and selected third parties, established a data storage architecture for processing Personal Information with this aim (Rugby League Exchange).

The NRL will be responsible for the maintenance and administration of the Rugby League Exchange. Melbourne Storm will share your Personal Information with the NRL as part of the Rugby League Exchange so that they can analyse fan behaviour and preferences to improve fan support, fan offerings, provide more targeted content and products and any other purposes described in the NRL's Privacy Policy. We encourage you to read the NRL's Privacy Policy to understand how your Personal Information will be handled in relation to the Rugby League Exchange.

3. What types of personal information may we collect?

The types of Personal Information Melbourne Storm may collect depends on the purposes for which such information is collected but may include (without limitation):

(a) your name, gender, date of birth, occupation, residential address, email address, telephone number and other contact details;

(b) memberships, subscriptions and attendance history at Melbourne Storm matches (whether you have used your membership to purchase tickets, or as a casual ticket purchaser);

(c) purchasing history, preferences and financial details which we collect when you buy tickets, purchase merchandise and/or as part of competitions and promotions; and

(d) demographic and psychographic profiling.

Melbourne Storm will generally not collect Sensitive Information from you. However, where Melbourne Storm seeks to collect Sensitive Information from you, it will do so in accordance with applicable privacy laws (including the Privacy Act and GDPR), for instance by obtaining your express consent for such a collection.

In addition to Personal Information, we use cookies, web beacons and other technologies on our website to collect information about your usage of our services (for instance, third party websites you visit to better understand your preferences and what types of products and services you may be interested in.

4. How do we collect your personal information?

Where it is reasonable and practicable to do so, Melbourne Storm will collect Personal Information directly from you as follows (without limitation):

(a) when you order merchandise through our online store located;

(b) when you participate in our promotional activities and competitions;

(c) when you become a Melbourne Storm member or update your details with us;

(d) when you purchase tickets to a Melbourne Storm event such as a home match or an awards night; and

(e) when you transact with us in any way including, without limitation, through corporate or commercial transactions.

In addition to collecting Personal Information directly from you, we may also collect Personal Information from:

(a) the NRL, Queensland Rugby League, New South Wales Rugby League and selected third parties (for instance, Ticketek and Ticketmaster); or

(b) our related bodies corporate, other business partners and affiliates.

5. Why do we collect, use, hold and disclose your personal information?

Melbourne Storm generally only collects, uses, discloses or holds Personal Information that is reasonably necessary for us to perform one or more functions or activities as a club including (without limitation):

(a) organisation, conduct and promotion of events involving Melbourne Storm (for instance, providing you information about upcoming training sessions or deals for the next home matches);

(b) promotion and sale of Melbourne Storm merchandise;

(c) fulfillment of Melbourne Storm membership services;

(d) direct marketing of Melbourne Storm, and of our related entities’ or business partners’, products or services unless you have indicated that you do not want to receive such communications; and

(e) updating any records we hold about you.

We only use, disclose or hold your Personal Information for the primary purpose for which it was collected, a related secondary purpose, in accordance with any express consent you grant us or as otherwise lawfully required (e.g. where your Personal Information is requested by a law enforcement agency).

6. Who do we disclose your personal information to?

Melbourne Storm may provide your Personal Information to third parties as part of our functions and activities including (without limitation):

(a) delivery, courier and postal organizations: we may disclose your Personal Information to delivery, courier and postal organizations in order to deliver merchandise you order;

(b) the NRL, other Clubs, QRL, NSWRL, Country League of New South Wales and selected third parties (for instance, Ticketek and Ticketmaster): we may disclose your Personal Information as part of the Rugby League Exchange. The NRL and selected third parties may send you information about products and services which the NRL believes will be of interest to you. If you do not wish to receive information from the NRL, please opt out from such promotional and marketing information via your NRL account, links in emails and other communication we send to you from time to time or contact the NRL's Privacy Officer in accordance with the NRL Privacy Policy;

(c) law enforcement and emergency services agencies: we may disclose your Personal Information where required or authorised to do so by law, including in emergency situations and to assist law enforcement agencies with active investigations. We will always ensure that those to whom we disclose your Personal Information have the legal right to receive it;

(d) marketing and promotions: we engage email marketing providers, market research companies, promotions management and other data analytics companies to perform direct marketing on our behalf. You will always have the right to opt out of receiving promotional materials from us; and

(e) Third party service providers: we may disclose your Personal Information to third parties including email marketing providers, market research companies, promotions management and other data analytics companies to perform direct marketing on our behalf; and

(f) Our related entities, business partners or other affiliates: we may disclose your Personal Information to our related entities, business partners and other affiliates to perform direct marketing of Melbourne Storm, and of our related entities’ or business partners’, products or services unless you have an indicated you do not wish to receive these communications.

7. Disclosure of personal information to overseas recipients

Melbourne Storm may be required to disclose your Personal Information to overseas recipients but only for the purposes expressly listed under item 5 of this Privacy Policy.

8. Data quality and security

We understand you have entrusted us with the protection of your Personal Information. As such, we will take reasonable steps, with the assistance of the NRL, to protect your Personal Information from misuse, loss, unauthorized access, modification or disclosure. This includes engaging reputable third party service providers and ensuring that we engage (where possible and practical to do so) in best practice security systems and procedures.

9. Access to and correction of personal information

You can access, review and manage your Personal Information through:

(a) your NRL Account (using your login credentials);

(b) communications preferences via links in emails and other communications we send to you from time to time; or

(c) contacting our Privacy Officer (see clause 11).

You will be responsible for ensuring your Personal Information remains accurate, complete and up to date. Please ensure that any written request for access or correction addressed to our Privacy Officer provides adequate detail that identifies what Personal Information you want access to or corrected. Where your request will require us to incur costs, we may charge you an access fee to cover those costs (for instance, reasonable staff costs in searching for, locating and retrieving the requested Personal Information). We will inform you of any such charges prior to them being incurred.

In certain circumstances, we may refuse to provide you access to your Personal Information. Where we refuse you access, we will provide you with a written explanation as to the reasons for the rejection (for instance, we may refuse to disclose Personal Information to you where such access would have an unreasonable impact on the privacy of other individuals).

10. Transborder data flows

10.1 Subject to clauses 10.2 and 10.3, Melbourne Storm will not transfer your Personal Information to an overseas recipient unless it has first taken steps reasonable in the circumstances to ensure that the Personal Information that it transfers will not be held, used or disclosed by the recipient of the information inconsistently with, or otherwise in breach of, applicable privacy laws (including the Privacy Act and GDPR). For example, Melbourne Storm may adopt appropriate contractual clauses with overseas recipients that ensure their compliance with applicable privacy laws (including the Privacy Act and GDPR.

10.2 We may disclose your Personal Information to overseas recipients for things such as processing membership and hosting services, most likely in China, the United States and New Zealand, although countries where such recipients are located may vary.

10.3 Melbourne Storm may transfer Personal Information about you to someone who is in a foreign country if:

(a) Melbourne Storm reasonably believes that the recipient is subject to a law or binding scheme that has the effect of protecting the information in a way that is, overall, substantially similar to applicable privacy laws (including the Privacy Act and GDPR) and there are mechanisms available to you to enforce that protection or scheme; and

(b) you expressly consent to the transfer after the Melbourne Storm has informed you that the applicable privacy laws (including the Privacy Act and GDPR) will no longer apply if you provide your express consent.

11. Notifiable data breaches scheme

In the event of any loss, or unauthorised access or disclosure of your Personal Information that is likely to result in serious harm to you, Melbourne Storm, with the assistance of the NRL, will investigate and notify you and where applicable the relevant supervisory authority (e.g. the Australian Information Commissioner) within 72 hours of becoming aware of the loss, or unauthorised access or disclosure, in accordance with applicable privacy laws (including the Privacy Act and GDPR).

12. Inquires Procedure

All complaints and inquiries concerning your Personal Information, including in respect of alleged breaches of this Privacy Policy and/or applicable privacy laws (including the Privacy Act and GDPR), should be directed to Melbourne Storm’s Privacy Officer:

The Privacy Officer
PO Box 155
Richmond Vic 3121

At all times, privacy complaints and inquiries will be treated seriously, dealt with promptly and confidentially, and will not affect your existing obligations or commercial arrangements with the Melbourne Storm.

13. Privacy Policy Updates

This Privacy Policy was last updated in September 2019. We may update this Privacy Policy from time to time, in which case we will post the updated version of the Privacy Policy on our website but may not personally notify you. As such, please check back periodically to see if our Privacy Policy has been updated.