Privacy Policy

This privacy policy explains how The R&A uses your personal data when you interact with us via our Websites (www.randa.org, www.theopen.com, www.aigwomensopen.com and www.oneclub.golf) or otherwise, including when you use any of our mobile applications, purchase tickets for or attend any of our professional championships or amateur events, or when you apply to work or volunteer at The R&A.

We keep this privacy policy under regular review and will place any updates on our Websites. This privacy policy was last updated in October 2023.

Who are we?

The R&A comprises R&A Championships Limited (SC247047), R&A Group Services Limited (SC247048), R&A Rules Limited (SC247046), R&A Golf and Leisure Limited (SC366854), R&A Trust Company (No. 1) Limited (SC247045), R&A Trust Company (No.2) Limited (SC247049), The R&A Foundation (SC247050) and Golf Museum Services Limited (SC488042) (together "The R&A", "we", "us" and "our"). This privacy policy applies to any and all of the organisations within The R&A.

A number of The R&A’s activities are subject to dedicated privacy policies. These will usually be signposted on the relevant Websites or forms that you complete. A list of these privacy policies is set out at the end of this privacy policy.

How we collect information about you

We may collect personal data about you in a number of ways, including when you:

interact with The R&A via the Websites or any of our mobile applications, such as The Open app, the AIG Women’s Open app, the mobile ticketing apps for The Open and AIG Women’s Open and the Rules of Golf app, including in relation to any user account you may hold with us;
make an order or transaction through our Websites or otherwise;
visit our premises or attend any of our professional championships or amateur events;
apply to join the One Club;
sign up to receive marketing communications;
enter prize draws or competitions;
provide feedback to us or make an enquiry or complaint;
choose to complete any surveys we send you or take part in any focus groups;
interact with The R&A Foundation, including if you choose to make a donation;
register for and participate in Rules learning programmes, seminars and other Rules events; and
apply to work or volunteer at The R&A or any of our professional championships or amateur events.

We also collect certain non-personal data when you visit and use any of our Websites, mobile applications or access Wi-Fi at our premises and championships. For example, we may collect and store your IP address, reference site domain name, and demographic information. We may also collect information including, but not limited to, traffic data, location data and usage while on any of the Websites or when using our apps or Wi-Fi. We will only collect such data in aggregate form (so that no individual user is identified).

What personal data do we collect and how do we use it?

Orders and transactions

We collect your name, contact and payment details and other personal data you provide when you make an order or transaction, including when you: (i) purchase tickets or hospitality for any of our professional championships or amateur events; (ii) enter the ticket ballot for The Open; (iii) purchase or sell tickets through The Open ticket resale platform; and (iv) purchase goods from us, whether online or at any of our professional championships or amateur events. We may also receive personal data from our authorised providers (if you purchase tickets or hospitality through them) and from third parties who purchase tickets or hospitality on your behalf.

We use this personal data to process your order or purchase. Where you have purchased goods or services from one of our Websites, we will retain your payment details for as long as necessary to process any refund that may be due to you. This processing of your information is necessary for the performance of our sales contract with you.

We will retain the information you provide to us for your purchase for a period of 10 years from the date of your purchase to understand audiences for our championships and events and to improve efficiencies at our championships in general and at particular venues. This processing of your personal data is necessary for our legitimate interests of understanding our customers and providing better products and services for our customers. We will not store your payment details for this purpose.

We use software that collects personal data that you provide in relation to enquiries, orders or transactions that you start on any of the Websites but which you then abandon or do not complete – i.e. data may be captured regardless of whether you click "next" or "submit" on the relevant page. We may use this information to contact you by email about that enquiry, order or transaction. Such contact will be to determine if we can offer any assistance to help you complete the enquiry, order or transaction, or if we can provide alternative products or services that may be of greater interest to you. We will not store your payment details for this purpose. The legal basis for processing your personal data in this way is that it is necessary for our legitimate interests to promote our products and services to you. When we collect your information, we will give you the option not to receive these emails. Otherwise, we will retain your personal data for 10 years for our legitimate interests of understanding our customers and users of our Websites.

Visiting our premises and attending our Championships

When you visit our premises or attend any of our professional championships or amateur events, we may collect footage of you through the use of CCTV cameras. We use CCTV footage to manage crime and safety and to investigate any accidents or incidents which may occur. We may share your personal data with our insurers, police and other relevant authorities for these purposes.

When you register to use Wi-Fi at our professional championships or amateur events or at our premises, we collect the type of device and IMEI number of the device you use to connect to the Wi-Fi. We collect these to ensure we only present you with the registration page once for the Wi-Fi. Otherwise, each time your device drops off and back onto the Wi-Fi, we would need to ask you to register again. We will retain this information for one year from the date of collection. The legal basis for processing your personal data in this way is that it is necessary for our legitimate interests to provide the best possible customer experience.

One Club

We process the personal data you provide on registration with the One Club to maintain your One Club membership and to provide you with the benefits and services you expect from your One Club membership. This processing is necessary for the performance of our contract with you for your One Club membership in accordance with the One Club Membership terms and conditions. We retain your personal data and process it for as long as you are a member of the One Club. The R&A cannot administer your One Club membership if you do not provide the information required by the registration process.

Marketing communications

We may use the personal data we collect as part of our customer relationship with you to inform you by email about exclusive offers and promotions we think may be of interest to you. When we collect your personal data, we will give you the option not to receive these emails. You can change your mind at any time by contacting us or clicking "unsubscribe" in the emails we send you. This is necessary for our legitimate interests for promoting our products and services.

We may also collect your name and email address and other personal data you provide when you register to receive our emails or alerts. We will use this information to send you the emails or alerts you have requested. We will send you these with your consent which we obtain at the point you request these regular updates. You may withdraw your consent to processing your personal data for this purpose at any time by contacting us or by clicking "unsubscribe" in the communications we send you or updating your preferences in our online preference centre. We will retain this information until you withdraw your consent.

If you have consented to receive marketing emails from the official patrons and partners of our professional championships or amateur events, we may share your personal data with those official patrons and partners for those purposes.

Prize Draws and Competitions

We collect and use personal data that you provide to us when you enter one of our competitions to administer the competition including to communicate with you, whether your entry has been successful or not, and fulfilment of prizes. Our legal basis for this processing is your consent which you give on entering the competition. We will retain your information for as long as is necessary for those purposes. If you withdraw your consent, we cannot process your competition entry.

Enquiries, providing feedback or complaints

We collect your name, contact details and other personal data you provide when you make an enquiry or provide feedback to The R&A. We may collect this information via completion of online forms or by corresponding or speaking with us by telephone, email, letter, in person or otherwise. We will use your personal data to process your enquiry, to follow up on your feedback and to resolve any complaint.

When you make an enquiry, we may share your contact details and information about your enquiry with the national and/or local golf bodies for your country of residence or your golf club if we decide that organisation is best placed to respond to your enquiry. This is to ensure that your enquiry is processed efficiently and by the appropriate person.

We will keep your personal data for a period of 12 months from the date of your enquiry, feedback or complaint or the date of our last correspondence with you. This is to allow us to be able to respond to any follow up queries or subsequent correspondence from you on your enquiry, feedback or complaint. This processing is necessary for our legitimate interests in providing a better experience for you and others who interact with The R&A and in improving our customer service and our business operations.

The R&A Foundation

We may collect your name, contact details, financial information and other personal data when you interact with The R&A Foundation, including when you make a donation. In most cases, we collect this information from you directly. We will use your personal data to handle your enquiry, to process your donation, to keep you informed about your donation and, where appropriate, to carry out due diligence checks.

Our legal basis for this processing is the performance of our contract with you (if you make a donation), to comply with our legal obligations and where it is in our legitimate interests to pursue our charitable objectives.

We may share your data with HMRC if you have agreed to us claiming Gift Aid on your behalf in connection with a donation. This is necessary to comply with our legal obligations.

If you are based in a jurisdiction outside of the UK, your donation may be processed by Chapel & York on our behalf. Where your donation is processed by Chapel & York on our behalf, you will be asked to provide personal data to Chapel & York directly for this purpose.

The R&A Rules Academy, Learning Programmes and Seminars

We collect personal data from you when you register:

to participate in The R&A Rules Academy;
for learning programmes on the Rules online learning platform; or
to participate in any of our Rules seminars or other Rules events.

Where appropriate, we will collect payment information from you and use this to process payment due to us. We will retain your payment details for as long as is necessary to process the payment and any refund due to you.

Once enrolled on a learning programme, we will use your personal data to deliver the programme to you and to provide you with information about your qualification. This processing is necessary for the performance of our contract with you for your participation on the programme.

We may confirm your examination mark to a third party wishing to verify your examination mark. We will retain your personal data (but not your payment details) indefinitely, unless you decide to close your account, in which case we will delete your account immediately and you will have to complete the registration process again if you wish to participate in the Rules Academy or use the Rules online learning platform. We have a legitimate interest in retaining this information indefinitely so that we can inform you and relevant third parties about your qualifications.

When you use the Rules online learning platform or participate in The R&A’s Rules Academy or in any of our Rules seminars, your contact details and other relevant information, including exam results, may be accessed by the national and/or local golf bodies for your country of residence. That national or local golf body may use your contact details to contact you about rules seminars, volunteering opportunities and golf events relevant to you. It is in the legitimate interests for those national and local golf bodies to use your data in this way for the purposes of developing the sport of golf in their territory. For more information about how the national and local golf bodies in your territory may use and protect your personal data, please see their privacy policies.

If you have an account for the Rules online learning platform, certain personal data such as your qualifications and learning history may be processed by the technology supplier of the Rules online learning platform.

Your interactions with The R&A

The R&A may use your personal data to obtain a profile of your different interactions with us and to understand your preferences. This is necessary for our legitimate interests of personalising your experience and for tailoring the content, offers and promotions we send to you.

When you visit our Websites or receive emails from us we may automatically collect the following technical information:

the Internet protocol (IP) address used to connect your computer device to the Internet
your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Websites (including date and time);
page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call us;
information provided by cookies. Our Websites use cookies to improve the user's experience while visiting our Websites. Please refer to the cookies policy on each Website for more information:
when we email you, such emails may contain tracking facilities. Activity is tracked and stored in a database for future analysis and evaluation. Such tracked activity may include but is not restricted to: the opening of emails, forwarding of emails, the clicking of links within the email content, times, dates and frequency of activity.

We may collect information in an aggregated form (so that no individual user is identified) for statistical analysis to allow us to understand our customers and improve our services and performance including the functionality of our Websites and user experience.

The legal basis for processing your personal data (as well as pseudonymised or anonymised information generated from your personal data) in this way is that it is necessary for our legitimate interests of providing a better experience for you and other users of our Websites, promoting our products and services and understanding our customers and users of our Websites. We will retain this information for as long as is necessary for the relevant activity.

Applying to our Scholarship Programmes or for Grant Funding

If you apply to any of our scholarship programmes, such as the R&A Foundation Scholarship Programme or Greenkeeping Scholarship Programme, or for any grants that we may offer, The R&A will process the information that you provide on the application form or otherwise to process your application, to contact you in connection with your application and, if you are successful to provide you with the scholarship award or grant funding, as applicable.

Our legal basis for processing your personal data provided on the application is that it is necessary for our relationship with you established by your application. The R&A cannot process your application if you do not provide the information required by the form.

Where appropriate, we may share personal data that you provide to us with the further or higher education institute at which you are enrolled who will assist The R&A with the application process.

If your application is successful, The R&A will process your personal data to provide you with the award. We will retain your personal data for seven years from the date of the award. Our legal basis for retaining your personal data is that it is necessary for The R&A’s legitimate interest in administering the programmes, monitoring applications and handling any enquiries in the event of any dispute concerning the grant of a scholarship or concerning a successful decision to enrol you on any of the programmes.

We retain unsuccessful applications for a period of five years from the date of the decision not to progress your application for our legitimate interests of being able to respond to any follow up queries on the application and for the purposes of any subsequent applications.

Applying to Work or Volunteer at The R&A

We collect personal data from you if you apply to work at The R&A. We will only use the information you supply to us to process your application, to make a decision about your recruitment or appointment and to monitor recruitment statistics. This may include checking you are legally entitled to work in the UK.

We use your personal data collected during the application process on the following legal bases:

where it is necessary to process your application or to comply with a legal or regulatory obligation; or
where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests. Those legitimate interests include demonstrating compliance with legal, regulatory and corporate governance obligations, use as part of investigations by regulatory bodies, or in connection with legal proceedings and requests, good employment practice and ensuring safe working practices.

We may collect information about criminal convictions as part of the recruitment process, but we will only do so if it is appropriate given the nature of the role and where we are legally able to do so.

We will share your personal data in accordance with the section below “Who we share your information with”. Where we want to disclose information to other third parties, for example where we want to take up a reference or undertake criminal records checks (where appropriate) through Disclosure Scotland, we will not do so without informing you beforehand unless the disclosure is required by law.

Personal data about unsuccessful candidates will be held for six months from the decision not to progress their applications in case of a future vacancy which we may invite them to apply for, following which we will delete it. We will retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.

Once a person has taken up employment with The R&A, we will record, process, keep, and securely hold personal data as part of your employee record in accordance with our Employee Privacy Policy (a copy of which will be provided to you when you start with us).

If you have applied as a volunteer or temporary worker at an R&A championship or team event, and you are successful, we will record, process, keep and securely hold personal data as part of your volunteering / work record in accordance with the section below “Volunteers and Temporary Workers at R&A Championships and Events”.

Volunteers and Temporary Workers at R&A Championships and Events

This section of the privacy policy describes how The R&A collects and uses your personal data during and after your engagement with The R&A. It applies to all volunteers and temporary workers for roles at R&A championships and events.

The kind of information we hold about you

We typically collect personal data from you through the recruitment process and in the course of your engagement with us, as well as from publicly accessible sources, via our IT and other systems and third parties such as employment agencies.

We may collect, store, and use your personal data, including:

Personal details such as name, address, date of birth, photographs, telephone numbers, personal email addresses, next of kin, driving licence details and emergency contact information.
Financial details such as your National Insurance number, bank account details, payroll records, tax information, pay and/or expenses.
Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter).
Work records (including any terms issued to you and time/attendance records) and CCTV footage.
Information about your use of our information and communications systems.
Images of you taken at a Championship.
We may also collect, store and use "special categories" of more sensitive personal data (which requires a higher level of protection) such as health information and information about criminal convictions and offences.

How we use information about you and our legal bases for doing that

We will use personal data (or special categories of personal data) about you:

To pay you, deduct tax and National Insurance contributions or reimburse expenses.
For operational reasons, to maintain records and ascertain compliance with policies.
To promote the championships and events where we use images and footage of you taken at an R&A championship or team event.
To ascertain your fitness to work, managing sickness, and health and safety obligations.
To ensure information security and to protect our networks/systems and personal data of employees and customers/clients.
For equal opportunities monitoring and to conduct statistical analysis.
We will only use your personal data when the law allows us to. Most commonly:
Where we need to perform our contract with you, or to comply with a legal or regulatory obligation (e.g. our obligations to you as your employer under employment protection and health safety legislation).
Where it is necessary for our legitimate interests or those of a third party and your interests and fundamental rights do not override those interests. Those legitimate interests include demonstrating compliance with legal, regulatory and corporate governance obligations, as part of investigations by regulatory bodies, or in connection with legal proceedings and requests, good employment practice and ensuring safe working practices.
We may also use your personal data in the following situations, which will be rare:
Where we need to protect your interests (or someone else's interests).
Where it is needed in the public interest or for official purposes.
We may also process special categories of personal data about you as follows:
In limited circumstances, with your explicit consent.
Where we need to comply with a legal or regulatory obligation (e.g. our obligations to you as your employer under employment protection and health safety legislation).
Where it is needed in the public interest, such as for equal opportunities monitoring, or where it is needed to assess your working capacity on health grounds.

How long we retain information about you

We will only retain your personal data for as long as necessary for the purposes we collected it for.

Once you are no longer a volunteer or temporary worker for The R&A, we will record, keep, and securely hold the information provided as part of your application and during your engagement in our Human Resources files for a period of six years after the end of your service with The R&A. This includes your application form, CV, references, contact information, and details of the terms of your engagement, your role, working hours, attendance, pay (if applicable), dates of engagement, any illness records, accidents or injuries. This will also include confirmation of criminal records checks carried out by Disclosure Scotland (which is only requested in limited circumstances).

Retaining this information is necessary to meet our legitimate interests of maintaining work records and good working practice, for dealing with any legal claims and for meeting any legal, regulatory and/or governance obligations.

We will retain details of payments made through our payroll system will for 7 years after the date on which your engagement ends, in line with HMRC requirements.

Information we receive about you from other sources

We work with third parties (including, for example, business partners, contractors in technical, payment and delivery services, advertising networks, analytics providers and search information providers) and may receive information about you from them. We may also receive information if you have provided permission to other organisations to share it with us. Before providing permission to such third party organisations to share your personal data, you should check their privacy notices carefully.

We may receive information from publicly available sources (where possible) to keep your information up to date, for example, from the Post Office’s National Change of Address Database. We may occasionally purchase the contact details of people who might be interested in hearing from us. Before purchasing such information, we will check the wording used when your information was originally collected, to make sure that we only contact people who have actively expressed an interest in receiving information from third parties.

Where you are a registered user of Facebook, we will use your email address in an encrypted format to enable Facebook to find other registered users of their services that share similar interests to you based on: (1) information that we observe about you from your different interactions with us; and (2) the information Facebook holds about you.

Our legal basis for processing information shared with us in this way is that it is necessary for the purposes of The R&A’s legitimate interest in understanding how our business is performing and considering how to improve our performance. We will retain information that we receive in this way for as long as long as necessary for the purposes for which we received it.

Who we share your information with

We may share your personal data with our suppliers and service providers, national and/or local golf bodies, golf clubs and other group companies of The R&A for the purposes set out in this privacy policy only. We may also share your personal data with our insurers, professional advisers, relevant regulators, police and other law enforcement agencies or where the disclosure is required by law. Otherwise, we will not share your personal data with any other third parties without your consent.

Where disclosure to third parties is required by law, our legal basis for processing your information in this way is that it is necessary to comply with a legal obligation that we are subject to.

Retention of your personal data

We will only retain your personal data for as long as necessary for the purposes we collected it for and for as long afterwards as is necessary to comply with our legal obligations or as is necessary in our legitimate interests to retain it. Therefore, some information may be kept for more or less time depending on how long we reasonably feel it is required for. We have provided information about our retention periods in relation to certain pieces of personal data above. We review these retention periods on a regular basis.

If you ask us to delete your information in accordance with your rights set out below, we will retain basic information on a suppression list to record your request and to avoid sending you unwanted materials in the future.

Links to other websites

Our Websites contain links to other websites which are not operated by us. We have no control over the contents of those sites or resources, and accept no responsibility for them or for any loss or damage that may arise from your use of them. The operators of other sites may collect information from you which will be used by them in accordance with their own data protection policy or privacy policy. This privacy policy applies only to our Websites. We are not responsible for the privacy practices within any other websites. You should always be aware of this when you leave our Websites and we encourage you to read the privacy policy on any other website that you visit.

Overseas transfers

Your personal data may be transferred to, and stored in, countries outside of the UK and EU for the above purposes. The R&A will take steps to ensure your personal data is adequately protected in countries outside of the UK and EU. Please contact us if you would like more details on safeguards used by The R&A to protect personal data for these transfers.

Your data protection rights

Data protection legislation in the UK and EU provides individuals with certain rights regarding the use of their personal data. If you would like to contact us to exercise your rights, please contact us using the contact details at the end of this privacy policy.

You have the right to:

access the personal data that we hold about you in many circumstances;
ask us to delete or correct any personal data that we hold about you;
prevent us processing your personal data;
port your personal data in certain circumstances;
not be subject to a solely automated decision;
withdraw any consent that you have given. This does not affect the lawfulness of processing based on consent before withdrawal; and
lodge a complaint with the UK regulator, the Information Commissioner’s Office, if you have concerns about how we use your personal data. Please see ico.org.uk/concerns/ to find out more.

Contact Information

If you would like to contact us about this privacy policy, you can do so by:

emailing us at privacy@randa.org; or
writing to us at F.A.O. Data Privacy Manager, The R&A, Beach House, Golf Place, St Andrews, Fife, KY16 9JA.

EU Representative

We have appointed Saltire Data Protection Services Limited to act as our representative in the European Union as required under Article 27 EU GDPR. You can always contact us directly if you are located in the EU and wish to raise any issues or queries you may have relating to the processing of your personal data. However, if you wish to contact Saltire Data Protection Services Limited you can do so by clicking this link to a contact form https://app.saltiredataprotection.eu/enquiry/rs/randa.

Dedicated Privacy Policies

Other privacy policies which may be relevant to you are as follows: