Privacy policy

CWC2027 Ticket Ballot – Privacy Notice

1. Who we are and what this notice covers

2027 Cricket World Cup NPC ("the Company", "we", "us") is the responsible party for personal information you give us when you register for and enter the ICC Men's Cricket World Cup 2027 ticket ballot (the "Ballot").

Our official ticketing provider, TicketPro Group (Pty) Ltd, runs the ballot platform and processes your information on our behalf as an operator under a written agreement.

This notice covers ballot registration, entry, the draw, results notification, payment by successful entrants and ticket delivery. Once you buy tickets, the Ticket Terms and Conditions / general CWC2027 privacy policy also applies.

2. Personal information we collect

We collect only what we need to run a fair ballot and issue tickets.

Identity

Examples: Full name, date of birth, ID or passport number, nationality.

Source: You.

Contact

Examples: Email address, mobile number, country and postal address.

Source: You.

Account

Examples: Username, password (stored encrypted).

Source: You.

Ballot entry

Examples: Matches and ticket categories selected, number of tickets, entry time, draw outcome.

Source: You and the draw.

Payment (successful entrants only)

Examples: Payment status and reference; card details are handled by the payment provider, not stored by us.

Source: You and the payment provider.

Technical and security

Examples: IP address, device and browser details, log data, CAPTCHA and bot-detection signals.

Source: Automatically.

Communications

Examples: Queries to the contact centre, complaints, dispute records.

Source: You.

Preferences

Examples: Marketing consent choices.

Source: You.

We do not ask for special personal information (such as health, religion or biometrics) to enter the Ballot.

How we collect it. Most information comes directly from you when you register, enter, or contact us. Technical data is collected automatically through cookies, server logs and similar tools. We may receive limited information from third parties, such as payment status from the payment provider and fraud signals from bot-protection services.

The personal information provided as part of the Ballot process will be collected and used solely for purposes related to the administration of the Ticket Ballot, ticket allocation, communication with applicants, fraud prevention, security verification, and compliance with applicable legal and regulatory requirements. By submitting an application, you confirm that the information provided is accurate and that you consent to the processing of your personal information for these purposes.

Cookies. The ballot site uses session cookies (deleted when you close your browser) and persistent cookies (kept until they expire or you delete them). Essential cookies keep you signed in and protect the ballot from bots; analytics cookies are used only if you accept them in the cookie banner.

If you don't provide it. Fields marked as required are needed to verify eligibility and run the draw. Without them we cannot accept your entry.

Your information only. You may only submit your own information, except where a parent or guardian adds a child's name (section 11). Please keep your details up to date in your account so we can reach you if you are successful.

De-identified data. We may use statistics that cannot identify you, such as entry numbers per fixture, for reporting and planning. If such data is ever combined with information that identifies you, we treat it as personal information under this notice. CWC2027 Ticket Ballot _Privacy …

3. Why we use it and our lawful basis

We process your information only for the purposes below, each on a lawful ground under section 11 of POPIA.

Create your account and record your ballot entry

Lawful basis: Performance of the ballot terms you accept.

Run the draw and notify you of the result

Lawful basis: Performance of the ballot terms.

Take payment and issue tickets to successful entrants

Lawful basis: Performance of a contract.

Verify identity and eligibility, including host-nation allocations

Lawful basis: Performance of the ballot terms; legitimate interest in a fair ballot.

Detect duplicate, bot and fraudulent entries

Lawful basis: Legitimate interest in ballot integrity.

Answer queries, complaints and disputes

Lawful basis: Legitimate interest; performance of the ballot terms.

Stadium safety, access control and ticket-resale protection

Lawful basis: Legitimate interest; legal obligations.

Meet legal, tax, audit and regulatory duties

Lawful basis: Compliance with law.

Send marketing about CWC2027, and share your details with Cricket South Africa, the ICC, the IBC or partners if you choose

Lawful basis: Your consent (see section 7).

We will not use your information for an unrelated purpose without telling you and, where required, asking for your consent. CWC2027 Ticket Ballot _Privacy …

4. How the draw uses your information

The draw is a random computer selection among valid entries; your personal characteristics do not affect your chances.

Before the draw, we run automated and manual checks to remove duplicate, bot or fraudulent entries. An entry flagged by these checks is reviewed by a person before it is disqualified.

Under section 71 of POPIA, you may ask us to explain a result and make representations about it. Contact us using section 12 within [14] days of the result notification.

5. Who we share it with

We never sell your personal information. We share it only with the parties below, each bound by confidentiality and data-protection terms.

Our operators may process your information only on our written instructions and may not use it for their own purposes, including their own marketing.

TicketPro Group (Pty) Ltd – ticketing provider

Information received: All ballot and account data.

Purpose: Runs the ballot platform, contact centre and ticket issuance for us.

Independent ballot auditor

Information received: Pseudonymised entry and draw records.

Purpose: Verifies the draw was fair.

Stadium operators and venue security

Information received: Ticket-holder name and ticket details.

Purpose: Access control and safety on matchday.

IT, hosting and fraud-prevention suppliers

Information received: Data they need to provide their service.

Purpose: Secure hosting and bot protection.

Police, courts and regulators

Information received: Only what the law requires.

Purpose: Legal obligations.

ICC Business Corporation FZ LLC (IBC)

Information received: All ballot and account data.

Purpose: Owns the tournament.

International Cricket Council (ICC)

Information received: All ballot and account data.

Purpose: Owns the tournament. CWC2027 Ticket Ballot _Privacy …

6. Cross-border transfers

Some recipients sit outside South Africa, including the ICC (UAE), IBC (UAE), InCrowd (United Kingdom) and cloud hosting providers. Tournament co-hosts Zimbabwe and Namibia may also receive ticket-holder data for their venues.

We transfer information abroad only where section 72 of POPIA allows it: the recipient is bound by law or a binding agreement giving adequate protection, or the transfer is needed to perform the ballot terms with you. In practice we rely on one of these safeguards: a country recognised as giving adequate protection; standard data-protection clauses in our contract with the recipient; or, for US providers, certification under the EU-US Data Privacy Framework. Contact us for details of the safeguard used for a specific transfer.

7. Marketing and your choices

Entering the Ballot does not sign you up for marketing. We send marketing only if you tick the opt-in box at registration, in line with section 69 of POPIA.

Every marketing message has an unsubscribe link, and you can also opt out in your account settings. Service messages about your entry, the draw result, payment and tickets are not marketing and will still be sent. CWC2027 Ticket Ballot _Privacy …

8. How long we keep it

We keep information only as long as we need it, then delete or de-identify it. Proposed periods, to be confirmed by legal:

Unsuccessful entries: 6 months after the tournament ends, to handle queries and audit the draw.

Successful entries and ticket records: 5 years after the transaction, for tax and financial records.

Draw and audit records: 5 years after the tournament, pseudonymised.

Contact-centre and dispute records: 3 years after the query is closed.

Security and bot-detection logs: 12 months.

Marketing consent records: Until you withdraw consent, plus 2 years as proof of consent.

We set these periods by weighing how much and how sensitive the information is, the risk of harm if it were misused, whether we still need it for its purpose, and what the law requires. Some laws, such as tax and anti-fraud rules, may require us to keep records even after you ask us to delete them; we will tell you if this applies.

Your account stays open until the end of the tournament ticketing period unless you ask us to close it.

9. Security and breach notification

We and our operators protect your information with encryption in transit and at rest, access controls, multi-factor authentication for staff, monitoring and regular security testing of the ballot platform.

Access is limited to staff and operators who need it for their work, all bound by confidentiality.

Keeping your account safe. Keep your password to yourself. We will never ask for it by phone, SMS or email. Official ballot messages come only from treat anything else claiming to be the ballot as suspicious.

If we believe your information has been accessed by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires. The notice will explain what happened and what you can do to protect yourself.

If you think your account has been compromised, change your password immediately and email tickets@cwc2027.co.za. CWC2027 Ticket Ballot _Privacy …

10. Privacy Notice Disclaimer

The CWC2027, ICC, and the authorised service providers will implement appropriate security measures to protect personal information. However, no electronic system can be guaranteed to be completely secure. To the extent permitted by law, the organisers shall not be liable for unauthorised access, loss, alteration, disclosure, or misuse of personal information resulting from circumstances beyond their reasonable control, provided that reasonable safeguards have been implemented. Personal information will be retained only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

10. Your rights

Under POPIA you have the right to:

- Ask whether we hold your information and request a copy.

- Have inaccurate or incomplete information corrected; you can update most details yourself in your account.

- Ask us to delete information we no longer have a lawful reason to keep.

- Object to processing based on our legitimate interests, and to direct marketing at any time.

- Withdraw consent at any time; this does not affect processing already done.

- Ask for an explanation of, and make representations about, the draw outcome (section 4).

- Complain to the Information Regulator (section 12).

How to use your rights. Email tickets@cwc2027.co.za. We will verify your identity before acting, so that your information is not given to anyone else. Most requests are free; we may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive, and PAIA fees may apply to access requests.

We aim to reply within 30 days. If a request is complex, we will tell you and keep you updated. Deleting your information before the draw will withdraw your ballot entry. CWC2027 Ticket Ballot _Privacy …

11. Children

You must be 18 or older to register and enter the Ballot. Tickets for children are bought by an adult account holder, who may give the child's name where named tickets are required.

Where a parent or guardian gives a child's information, they consent on the child's behalf as section 35 of POPIA requires. We use it only to issue and control that ticket.

12. Contact us and complaints

Contact: tickets@cwc2027.co.za

2027 Cricket World Cup NPC

86 5th Street

Corner of 5th Street & Glenhove Street

Melrose Estate

Johannesburg

2196

Please use this address for all privacy questions and requests; it reaches our Information Officer.

If you are unhappy with how we handled your information, please contact us first. You may also complain at any time to the Information Regulator (South Africa), or, if you are in the UK or EU, to the UK Information Commissioner's Office or your local data-protection authority. The South African regulator is at inforegulator.org.za.

Changes to this notice: we may update this notice during the ballot and ticketing period. We will post the new version here with its effective date and email you about any material change. Earlier versions are available on request.

Links to other sites. The ballot site may link to third-party sites, such as the ICC app or payment pages. Their own privacy notices apply there, and we are not responsible for how they handle your information. CWC2027 Ticket Ballot _Privacy …

13. Disclaimer and Limitation of Liability

By registering for and participating in the ICC Cricket World Cup 2027 Ticket Ballot ("Ballot"), you acknowledge and agree that participation in the Ballot does not guarantee that you will receive the right to purchase, reserve, or obtain any tickets for any match or event. Successful applicants will be selected in accordance with the Ballot process and subject to ticket availability, eligibility requirements, and any applicable terms and conditions.

While reasonable measures will be taken to ensure that the Ballot is conducted fairly and securely, the CWC2027, ICC, Ticketing Service Provider, and their respective affiliates, employees, agents, and contractors shall not be liable for any loss, disappointment, expense, damage, system interruption, technical failure, unsuccessful application, delayed communication, or inability to participate in the Ballot arising from circumstances beyond their reasonable control.

Participation in the Ballot is at the applicant's own risk, and no warranty or representation is given that access to the Ballot platform will be uninterrupted, error-free, or free from technical issues.

Effective date: 1 October 2026 · Version [1.0]