PARTICIPANT PRIVACY POLICY

Last updated: June 7, 2026

Introduction

This Participant Privacy Notice explains how the Esports Foundation ("EF", "we", "us", or "our") collects, uses, discloses, and protects the personal data of players who participate in or register for the Esports World Cup and related activities. This Notice applies in addition to any applicable website or application privacy policy and specifically governs personal data processed in connection with tournament participation, accreditation, event operations, integrity processes, media activities, security operations, and related services.

This Participant Privacy Notice applies to players whose personal data is collected or processed in connection with Esports World Cup activities, including where personal data is collected:

• directly from players; or
• indirectly through clubs, teams, publishers, tournament partners, or third‑party service providers acting on EF’s behalf

Where this Participant Privacy Notice refers to “you” or “your”, it means the player whose personal data is processed.

We are committed to protecting your personal data and complying with all applicable data protection legislation, including the Personal Data Protection Law of the Kingdom of Saudi Arabia ("PDPL") and its Implementing Regulations and Data Transfer Regulations, and, where applicable, the General Data Protection Regulation (EU) 2016/679 ("GDPR").

This Participant Privacy Notice describes what personal data we collect, the purposes for which we process it, with whom we share it, how long we retain it, and the rights available to you in relation to your personal data.

Who we are

The Esports Foundation is a non-profit foundation established under the laws of the Kingdom of Saudi Arabia.

Registered Address: 3936 Al Nakheel District, Unit Number 5, 12382-6651 Riyadh, Saudi Arabia

Contact Email: privacy@esportsfoundation.com

For the purposes of applicable data protection legislation, EF acts as the controller responsible for the processing of your personal data as described in this Participant Privacy Notice.

Depending on the relevant processing activity, EF may also act:

• as an independent data controller;
• as a joint controller together with tournament organizers, publishers, operational partners, or service providers; or
• as a data processor acting on behalf of another party.

When this Participant Privacy Notice is provided

This Participant Privacy Notice is intended to be:

• made available to you at the point of collecting your personal data, including where your personal data is collected by an external vendor or service provider acting on our behalf; and
• supplemented, where necessary, by specific information notices that apply to particular processing activities (such as tournament management, video recording and broadcasting, travel and accreditation, or surveys).

Where a specific information notice applies, that notice supplements this Participant Privacy Notice and prevails in relation to the relevant processing activity.

What personal data we collect and process

We collect and process various categories of personal data depending on the nature of your participation and engagement with us. EF processes only the minimum personal data necessary for each purpose.

By “personal data” we mean any information that can be used on its own or together with other information to identify a person. This includes data such as names, ID numbers, contact details, addresses, photos, videos, financial details such as bank account details, and any other information linked to an individual.

We collect and process the following personal data about you:

• Identification data: such as your name, date of birth, nationality, gender, photograph, passport or ID details, and in-game nicknames or usernames.
• Contact data: such as your email address, postal address, telephone number, and country of residence
• Player and participation data: such as team affiliation, player category, tournament registration details, eligibility status, and match scheduling and participation information
• Competition and tournament data: such as performance data, rankings, results, prize entitlements, and in‑game statistics generated during competitions, integrity and compliance information,eligibility verification records;
• Travel and accreditation data: such as VISA, travel documents, accommodation details, accreditation details, dietary preferences, and information required by applicable local authorities to facilitate your entry into the host country and participation in EWC events.
• Financial data: such as bank account details and payment information for prize payments and incentives.
• Communication data: such as the content of emails, messages, and other correspondence with us, including the nature of your enquiries or feedback.
• Marketing and engagement data: such as your marketing preferences, opt-in or optout status, selected communication channels, survey responses, feedback, and engagement data from outreach initiatives.
• Visual and audio data: such as photographs, video recordings, and audio recordings captured during events.
• Sensitive personal data: in limited circumstances, we may be required to collect sensitive personal data, such as health information or religious affiliation, where this is strictly required by applicable laws or authorities (for example, for VISA applications, security requirements, or medical emergencies). Such data will only be processed where a lawful basis applies and with appropriate safeguards in place. Where sensitive personal data is processed, EF will rely on a lawful basis permitted under applicable law, including explicit consent, legal obligations, medical necessity, or substantial public interest where applicable.
• Technical and Security Information: device identifiers, access logs, venue access records, CCTV footage, security monitoring information , integrity monitoring information, anti-cheat related logs or system information where applicable, IP addresses, system usage logs.

The collection of your personal data is mandatory where it is necessary for us to manage your participation in the Esports World Cup, comply with legal requirements, ensure safety and security, and communicate with you about your participation. Without this data, we may not be able to facilitate your participation in the event.

Where we collect personal data for optional purposes, such as surveys, marketing communications, or promotional activities, we will inform you separately and seek your explicit consent where required. Providing such data is optional and will not affect your participation rights.

How we collect your personal data

We collect your personal data from the following sources:

Directly from you: when you register to participate in the Esports World Cup, complete registration forms, sign up to receive communications from us, respond to surveys, enter competitions or challenges, or otherwise communicate with us.

From external vendors and service providers: we use external vendors and third party service providers who collect personal data on our behalf at the point of collection. These vendors are contractually required to provide you with this Participant Privacy Notice and, where required, obtain your consent (including your explicit consent for marketing communications) before or at the time of collection.

From third parties: we may receive your personal data from club operators, team managers, publishers, sponsors, travel agencies, ticketing providers, and other parties with whom you have an existing relationship and who are authorised to share your personal data with us for the purposes of facilitating your participation in the Esports World Cup.

Automatically: through the use of cookies, tracking technologies, and website analytics when
you access our digital platforms.

• Through roster submission and accreditation systems.
• Through security, integrity, and anti-cheat systems.
• Through media production and broadcasting activities.

If you are a team manager or other personnel submitting personal data on behalf of players, it is your responsibility to ensure that each affected player receives this Participant Privacy Notice and that you have obtained the necessary authorisation to provide their personal data to us.

Purposes and legal bases for processing

We process your personal data for the following purposes and rely on the legal bases set out below:

Marketing communications

EF will send marketing communications or information about unrelated club or promotional activities only where you have provided your explicit consent, in accordance with applicable data protection laws.

Where marketing consent is collected by an external vendor or service provider acting on EF’s behalf, that vendor must:

• present this Participant Privacy Notice clearly at the point of collection; and
• obtain your marketing consent through a clear, separate, and affirmative opt‑in mechanism.

You may withdraw your marketing consent at any time by using the unsubscribe link included in any marketing communication or by contacting EF using the contact details set out in the ‘How to contact us’ section of this Participant Privacy Notice.

Who we share your personal data with

We may share your personal data with the following categories of recipients, to the extent necessary to achieve the purposes described in this Participant Privacy Notice:

Third party service providers and subcontractors: who provide services to us, including IT and office services, data processing, marketing and advertising services, travel agencies, hotels, airlines, and ticketing platforms. These include EFG (ESL Faceit Group), who provide customer relationship management and related outsourcing services.

External vendors: who collect personal data on our behalf at the point of collection, who are contractually required to comply with applicable data protection laws and provide you with this Participant Privacy Notice.

Event partners and sponsors: publishers, sponsors, and other event partners where relevant to your participation in the Esports World Cup and related activities

Vanguard and SEF: as the main service providers of EF, who provide assistance in meeting legal requirements for safety and security, and facilitate VISA applications and entry into the host country

Competent authorities: government authorities, including security inspectors, customs officials, and medical staff, as required by applicable law for VISA applications, security purposes, and event safety. We may also share your personal data with any competent authority where we are legally required to comply with a request for data.

IT service providers: providers of IT solutions, including Google (for file sharing and collaboration tools), Atlassian, SAP, and other IT suppliers, integrity, anti-cheat and compliance service providers, cloud hosting, IT and platform providers, accreditation, venue access and operational security providers;

Broadcasting platforms: third-party platforms for broadcasting videos, including Twitch and YouTube.

PR and media agencies: agencies involved in public relations and media activities.

Group entities: any member of the EF group.

Personal data may also be shared internally within EF and affiliated operational teams on a need-to-know basis for operational, integrity, compliance, security, legal, and tournament administration purposes.

We will not use your personal data for commercial purposes unrelated to our events or share it with third parties outside the purposes described in this Participant Privacy Notice without your permission, unless required by applicable law or where the personal data is aggregated or anonymised for analytical purposes.

International personal data transfers

EF is located in the Kingdom of Saudi Arabia. Your personal data may be transferred to, and processed in, countries outside the Kingdom of Saudi Arabia or, where the GDPR applies, outside the European Economic Area.

Where personal data is transferred internationally, EF will ensure that such transfers are carried out in accordance with applicable data protection laws. This includes transferring personal data only to destinations that provide an adequate level of protection or, where required, implementing appropriate safeguards such as approved Standard Contractual Clauses or equivalent mechanisms, ensuring compliance with applicable transfer regulations, and limiting transfers to what is necessary to achieve the relevant purpose. Personal data may be transferred internationally in connection with tournament operations, international tournament venues, publishers, production partners and operational support providers. Where required, EF conducts transfer assessments and implements supplementary safeguards to ensure that transferred personal data receives an equivalent level of protection.

How we protect your personal data

We implement reasonable physical, administrative, and technical safeguards to help us protect your personal data from unauthorised access, use, disclosure, loss, destruction, or damage but can make limited guarantees. These measures include encryption, access controls, monitoring systems, security testing, incident response procedures, and regular security assessments. EF maintains incident response and security management procedures designed to detect, investigate and respond to potential incidents involving personal data.

How long we retain your personal data

We will retain your personal data for as long as necessary for the purposes for which it was collected, and for satisfying any legal, regulatory, accounting, or reporting requirements.

In general, we may retain your personal data for the duration of our event and for a reasonable period thereafter to manage any follow-up activities, prize distributions, or ongoing engagements. Specific retention periods include:

Tournament and participation data: for the duration of the event and a reasonable period thereafter to fulfil the purposes for which it was collected, plus any additional period required by applicable statutes of limitation or legal retention requirements.

Passport copies and high-risk data: deleted as soon as the event is over and the specific purpose for which it was collected has been fulfilled.

Anti-cheating records: retained for up to five years, being the longest realistic ban period, to detect and investigate potential breaches.

Marketing preferences: until you withdraw your consent or unsubscribe from marketing communications.

Integrity investigation and security-related records: retained where reasonably necessary for tournament integrity, security, dispute management, legal compliance, or enforcement purposes

Where personal data must be deleted or destroyed, EF will apply reasonable technical and organisational measures designed to securely delete, anonymise, overwrite, erase, or otherwise destroy personal data where appropriate.

Your rights

Depending on your jurisdiction, you have the following rights in relation to your personal data:

• Right to be informed: You have the right to be informed how we collect, process and disclose your personal data, including the purposes and legal basis of processing. You can access such details through this Participant Privacy Notice or by contacting us using the information set out in the ‘How to contact us’ section below.
• Right to access personal data: You have the right to access your personal data held by us in accordance with applicable laws and regulations.
• Right to request a copy of personal data: You have the right to request a copy of your personal data held by us in a readable and clear format, where technically feasible.
• Right to request correction: You have the right to ask us to correct, update, or complete the personal data we are processing about you
• Right to request destruction: You have the right, under certain circumstances, to request that we delete your personal data.
• Right to restriction: You have the right to request restriction of processing in certain circumstances.
• Right to object: You have the right to object to certain processing, including based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where we have processed your personal data solely based on consent, you have the right to revoke this consent at any time. You can do this by contacting us using the details set out in the ‘How to contact us’ section below.
• Right to submit a complaint: You have the right to submit a complaint about our use of your personal data or to submit a complaint to the competent authority, the details of which are set out below in the ‘How to make a complaint’ section of this Participant Privacy Notice.

Unless otherwise stipulated by law, you will not be required to pay any fees for exercising your rights. If you choose to exercise any of your rights, we will respond as soon as reasonably possible and in line with applicable data protection laws. In some cases, we may need to request additional information to verify your identity or to better understand the nature of your request.

If you wish to exercise any of your rights, or if you have any questions regarding this Participant Privacy Notice, please contact us via the communication channels set out in the ‘How to contact us’ section of this Participant Privacy Notice.

Certain rights may be limited where processing is necessary for tournament integrity, fraud prevention, anti-cheat enforcement, security purposes, legal obligations, contractual obligations, or the establishment, exercise or defence of legal claims.

How to make a complaint

If you wish to make a complaint about our use of your personal data, we suggest that you first contact us at the details below. We will investigate and attempt to resolve any complaints and disputes, and we will endeavour to help you exercise your rights within a reasonable timeframe.

You are also entitled to make a complaint to the competent government authority.

In the Kingdom of Saudi Arabia: The competent authority is the Saudi Data & Artificial Intelligence Authority (SDAIA). Complaints can be submitted via the National Data Governance Platform: dgp.sdaia.gov.sa.

In the EEA: You may lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

Given the international nature of the Esports World Cup and the potential use of multiple international venues, EF may implement additional operational, contractual, technical or organisational measures where required to support compliance with applicable local legal or regulatory obligations.

How to contact us

If you have any questions about this Participant Privacy Notice or how EF processes your personal data, you can contact us at:

Esports Foundation
3936 Al Nakheel District, Unit Number 5
12382 6651, Riyadh
Kingdom of Saudi Arabia

Email: privacy@esportsfoundation.com

You may also contact our Data Protection Officer: Kholod Alqahtani, Data Governance Manager, privacy@esportsfoundation.com

Changes to this Participant Privacy Notice

We may update this Participant Privacy Notice from time to time to reflect changes in our practices, legal or regulatory requirements, or to ensure that we continue to provide accurate and transparent information. The “Last Updated” date at the top of this Policy indicates when it was most recently revised.

We encourage you to review this Participant Privacy Notice periodically to stay informed about how we protect your information. Where required by applicable law, we will notify you of any material changes.