Alpha Zulu Limited, trading as AZ Sport, registered in England & Wales, Company No. 11553138

Registered office: 320 Garratt Lane, London, SW18 4EJ, United Kingdom

 

1. WHO WE ARE

The website azsport.io (the “Website”) is owned and operated by Alpha Zulu Limited, trading as AZ Sport (“AZ Sport”, “we”, “us”, “our”), a company registered in England and Wales under company number 11553138, registered office 320 Garratt Lane, London, SW18 4EJ, United Kingdom.

AZ Sport is the data controller of the personal data described in this policy. We are registered with the UK Information Commissioner’s Office (ICO) under registration number C1986935.

This policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

2. SCOPE

This policy applies to personal data we process when you visit the Website, make an enquiry or booking, attend an event under one of our bookings, register as a guest, communicate with us by email, telephone or WhatsApp, or receive marketing from us. It applies to clients, their guests, prospective clients and suppliers’ contacts.

 

3. WHAT PERSONAL DATA WE COLLECT

• Identity data: name, title, date of birth, nationality and, where required for event accreditation or identity verification, passport or identity document details.
• Contact data: email address, telephone number, postal address, company name and role.
• Booking and guest data: event and package details, guest names and contact details, seating or suite allocations, dietary requirements and accessibility needs.
• Financial data: bank account details used for invoicing and refunds, billing address and transaction history. We do not accept online payments through the Website and we do not collect or store payment card details.
• Communications data: the content of emails, calls, WhatsApp messages and forms you send us.
• Compliance data: information collected for anti-money laundering (AML), sanctions screening and fraud prevention, including identity verification records and source-of-funds information where applicable.
• Technical data: IP address, browser type, device information and Website usage data collected through cookies and similar technologies (see Section 11).
• Marketing data: your preferences for receiving marketing from us and your interaction with our communications.

      Dietary and accessibility information can reveal health or religious information, which is special category data. We process it only to deliver the hospitality services you request, on the basis of your explicit consent given when you provide it.

 

4. HOW WE COLLECT YOUR DATA

• Directly from you, when you enquire, book, complete a guest registration form or communicate with us.
• From the client who books on your behalf, where you attend an event as a guest.
• From event organisers and official hospitality providers in connection with your booking.
• From publicly available sources and third-party screening providers, for AML, sanctions and fraud checks.
• Automatically, through cookies and similar technologies when you use the Website.

      If you provide us with personal data about your guests, you confirm that you are entitled to do so and that you have made this policy available to them.

 

5. HOW WE USE YOUR DATA AND OUR LAWFUL BASES

Purpose	Lawful basis
Responding to enquiries and providing quotations	Steps prior to entering a contract; legitimate interests
Processing and delivering bookings, including ticket delivery and guest registration	Performance of a contract
Passing guest details to event organisers and official hospitality providers for accreditation and event access	Performance of a contract; legitimate interests
Invoicing, payment reconciliation and refunds	Performance of a contract; legal obligation
AML checks, sanctions screening and fraud prevention	Legal obligation; legitimate interests
Handling complaints and reports of illegal activity	Legitimate interests; legal obligation
Catering for dietary requirements and accessibility needs	Explicit consent
Sending marketing about events and hospitality we think will interest you	Consent, or legitimate interests for similar services to existing clients (with opt-out in every message)
Operating, securing and improving the Website	Legitimate interests
Keeping business records and defending legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they are not overridden. You can ask us for details of any balancing assessment using the contact details in Section 13.

 

6. WHO WE SHARE YOUR DATA WITH

• Event organisers and official hospitality providers: including On Location and FIFA entities for bookings within the FIFA World Cup 2026™ Official Hospitality Programme, and other organisers, venues and suppliers, for accreditation, guest registration, ticket issuance, and event access and security.
• Service providers: that host and support our systems, including CRM, email, forms, website hosting and marketing platforms, acting as our processors under contract.
• Banks and payment providers: to receive your bank transfers and process refunds.
• Professional advisers: lawyers, accountants, auditors and insurers where necessary.
• Screening providers: for identity verification, AML and sanctions checks where applicable.
• Authorities: law enforcement, regulators and courts where we are legally required to disclose.
• Business transfers: a buyer or prospective buyer of our business, under confidentiality obligations.

      We do not sell personal data.

 

7. INTERNATIONAL TRANSFERS

Some recipients are located outside the UK. In particular, event organisers, official hospitality providers and venues for the FIFA World Cup 2026™ are located in the United States, Canada and Mexico, and some of our service providers process data in the EEA or the United States.

Where we transfer personal data outside the UK, we rely on UK adequacy regulations where they apply, or we put in place appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Some transfers to event organisers are necessary for the performance of your contract with us. You can request a copy of the relevant safeguards using the contact details in Section 13.

 

8. HOW LONG WE KEEP YOUR DATA

• Booking, invoicing and financial records: 7 years from the end of the financial year they relate to, for tax and accounting obligations.
• AML and identity verification records: 5 years from the end of the business relationship, or longer where required by law.
• Guest registration data: for the duration of the event cycle and any period required by the event organiser, then deleted or anonymised.
• Enquiries that do not lead to a booking: up to 24 months from last contact.
• Marketing data: until you withdraw consent or object, plus a suppression record to make sure we respect your choice.

      When data is no longer needed, we delete it or anonymise it securely.

 

9. HOW WE PROTECT YOUR DATA

The Website is served over SSL/TLS encryption. We restrict access to personal data to those who need it, use reputable providers with appropriate security certifications, apply email authentication controls (SPF, DKIM, DMARC) to reduce spoofing and phishing, and maintain confidentiality obligations with staff and processors. No system is completely secure, but we take proportionate technical and organisational measures to protect your data and we will notify you and the ICO of any breach where the law requires it.

 

10. YOUR RIGHTS

Under the UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased in certain circumstances.
• Restrict our processing in certain circumstances.
• Receive your data in a portable format where processing is based on contract or consent.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where processing is based on consent, without affecting processing already carried out.

     To exercise any of these rights, contact us using the details in Section 13. We will respond within one month. We may need to verify your identity before acting on a request. These rights are not absolute and may be limited where the law allows, for example where we must retain records for AML purposes.

 

11. COOKIES

The Website uses cookies and similar technologies. Strictly necessary cookies enable the Website to function and are set without consent. Analytics and marketing cookies, where used, are set only with your consent, which you can give or withdraw through the cookie banner or your browser settings. Blocking some cookies may affect how the Website works. Details of the cookies in use are shown in the cookie banner on the Website.

 

12. CHILDREN

Our services are directed at adults and corporate clients. We do not knowingly market to or collect personal data directly from anyone under 18, except guest details (such as a name and age category) provided by an adult client where a minor attends an event as part of a booking

 

13. CONTACT US

 

Alpha Zulu Limited trading as AZ Sport

320 Garratt Lane, London, SW18 4EJ, United Kingdom

Company No. 11553138

Privacy contact email: engage@azsport.io.

 

14. COMPLAINTS

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

 

15. CHANGES TO THIS POLICY

We may update this policy from time to time. The version published on the Website is the current version, and the date of the latest update is shown at the top of this policy. Material changes will be highlighted on the Website.

Version 1.0, July 2026