PRIVACYPOLICY

This Privacy Policy applies to the processing of personal data of users ("you") who access and use the Ahlan Website privacy@asiancup2027.sa and/or Ahlan Mobile Application ("Ahlan Platforms"). By using the Ahlan Platforms, you acknowledge that you have read and understood the practices described in this Privacy Policy.

The LOC acts as the Data Controller for all personal data processed through the Ahlan Platforms, except where explicitly stated otherwise.

The Ahlan Platforms enable you to participate in the AFC Asian Cup 2027 related activities and engage with us in various ways, including for example, engaging with us to arrange match-day transportation, fan accommodation, ticketing services via third-parties or viewing, uploading and sharing content, and receiving tournament information, including news, schedules, results, venue details and updates related to the AFC Asian Cup 2027. We are committed to protecting your personal data and complying with all applicable data protection laws and regulations. This Privacy Policy explains what personal data we collect, for what purpose, to whom we disclose the data, and for how long we keep it. It also describes your rights and how you can exercise or invoke them. As users of the Ahlan Platforms, we may communicate with you through various channels, including email, in-app notifications, telephone and other electronic communications, in accordance with your preference and applicable laws.

Who are we

The AFC Asian Cup 2027 Local Organizing Committee Company (the "LOC", "we", "us", or "our") are a company established under the laws of the Kingdom of Saudi Arabia under commercial registration number 1010866736 and having its registered address at Al Mathar Al Shamali Dist. Musa Bin Nusair St., Riyadh, Kingdom of Saudi Arabia. The Ahlan Platforms enable you to participate in the AFC Asian Cup 2027 related activities and engage with us in various ways, including for example, engaging with us to arrange match-day transportation, fan accommodation, ticketing services via third-parties or viewing, uploading and sharing content, and receiving tournament information, including news, schedules, results, venue details and updates related to the AFC Asian Cup 2027. We are committed to protecting your personal data and complying with all applicable data protection laws and regulations. This Privacy Policy explains what personal data we collect, for what purpose, to whom we disclose the data, and for how long we keep it. It also describes your rights and how you can exercise or invoke them. As users of the Ahlan Platforms, we may communicate with you through various channels, including email, in-app notifications, telephone and other electronic communications, in accordance with your preference and applicable laws.

What personal data we collect and process

This Privacy Policy applies to our collection and processing of your personal data through the Ahlan Platforms and during the course of our business.

By “personal data” we mean any information that can be used on its own or together with other information to identify a person. This includes data such as names, ID numbers, passport details, contact details, addresses, photos, videos, financial details such as bank or card numbers, and any other information linked to an individual.

We will usually collect your personal data directly from you when you provide it through your interactions with the Ahlan Platforms. In some cases, we may also collect your personal data indirectly through the use of cookies, tracking technologies, automated collection software and website analytics, either on the Ahlan Platforms or through integration with third party services. We will treat such personal data with the same level of care and control we apply to personal data collected directly from you. If you provide us with personal data relating to someone else, you confirm to us that you have the permission of such person to do so. If that person is under the age of 18, you confirm that you have parental/guardian consent to do so.

Please refer to the below table to see what personal data we collect and when we collect it:

When we collect your personal data	What personal data we collect
When you create an account on the Ahlan Platforms	Your identification data: First name, last name, date of birth, gender, nationality and identification code. Your account data: Username, password, preferences (such as languages, marketing communications, and any relevant special requests). Your device data: Information about the devices you are using to access the Ahlan Platforms, including unique device identifiers. Your contact data: Email address, mobile number.
When you update your profile or engage with the Ahlan Platforms features	Your profile data: Display name, preferences, in-app selections, settings.
When you contact us or request support	Your communication data: Content of emails or messages, contact information, nature of your enquiry or feedback.
When you subscribe to newsletters or marketing updates	Your marketing preferences: Opt-in/opt-out status, selected communication channels.
When you use the Ahlan Platforms	Your technical data: IP address, device type, browser type, operating system, screen resolution. Your usage data: Page views, session duration, feature use.
When you enable location-based features (optional)	Your location data: Approximate location derived from IP address or device settings (e.g. city).
When you use the Ahlan Platforms to request or obtain the issuance of a visa from the Ministry of Foreign Affairs	Your identification data: First name, last name, date of birth, gender, nationality, passport number, and any additional information required by MoFA for visa processing (e.g., supporting identification documents). Your contact data: Email address, mobile number.
When you make accommodation, travel, hospitality, transportation, or other event‑related bookings through the Ahlan Platforms	Booking data: Travel dates, accommodation choices, transportation requests, ticket selections, and related preferences. Financial data: Payment method details where required (e.g., card type, masked card details, transaction confirmations). Partner‑required data: Information required by authorised service providers to complete your booking.
When you complete surveys, feedback forms, or user‑experience questionnaires hosted on the Ahlan Platforms	Survey response data: Your answers to survey questions, feedback, ratings, preferences, and any additional information you voluntarily provide. Contact information (only where applicable): Email address or mobile number if you choose to provide these within the survey or where required for follow‑up on your response.

Why and on what legal basis we collect and use your personal Data

We process your personal data for the following purposes and rely on the legal bases set out below:

Purpose of use	Legal basis for processing
Services management: To operate and administer the Ahlan Platforms, including enabling account registration and access to features such as enhanced content.	Performance of a contract – necessary to provide the Ahlan Platform’s functionality and services to users.
User engagement: To provide users with event-related content, updates, and functionality such as live scores, venue details, and profile preferences.	Performance of a contract – necessary for delivering the features users sign up for. Legitimate interests – to enhance user experience and engagement.
Customer support and communication: To respond to enquiries, complaints, or technical issues and to keep users informed about service-related updates.	Performance of a contract – necessary for addressing user requests and ensuring service availability. Legitimate interest – to maintain user trust and satisfaction.
Marketing communications: To send you newsletters, promotional materials, and other marketing content (such as alerting you of products or offers). You may unsubscribe from our marketing communications at any time by using the “unsubscribe” link on each communication, or by adjusting your preferences on your account with us.	Consent – for direct electronic marketing and to enhance customer relationship management in order to best serve customers with information and content tailored to their preferences.
Analytics and Service Improvement: To analyse usage patterns, track user interactions, and improve the performance and functionality of the Ahlan Platforms.	Legitimate interests – to understand how users interact with the Ahlan Platforms and improve functionality and performance.
Security and Fraud Prevention: To maintain the security and integrity of the Ahlan Platforms and investigate any suspected misuse or breach.	Legitimate interests – to detect and prevent fraudulent or harmful activity. Legal obligation – where we are required to report or act on incidents.
Legal and Regulatory Compliance: To comply with applicable legal obligations, respond to lawful requests, and enforce our rights.	Legal obligation – required under applicable laws and regulations (e.g. consumer protection, data protection and cybersecurity).
Visa request facilitation: To collect, and securely transmit your identification and passport information to the Ministry of Sport, acting solely as a data conduit, for onward transfer to the Ministry of Foreign Affairs (MOFA) to review and process your visa application. The Ministry of Sport does not access, analyse, store, or use your personal data beyond performing this secure transmission function.	Performance of a contract – necessary to fulfil your request for visa‑related services and to enable the issuance of a visa. Legal obligation – required to comply with applicable governmental and regulatory requirements regarding visa issuance and necessary routing of data through government entities.
Visa request facilitation: To process and transmit your identification and passport details to the Ministry of Foreign Affairs to facilitate your request for a visa.	Performance of a contract – necessary to fulfil your request for visa‑related services and to enable the issuance of a visa. Legal obligation – required to comply with applicable governmental and regulatory requirements.
Travel and accommodation bookings: To process accommodation, travel, hospitality, transportation, and related event bookings made through the Ahlan Platforms.	Performance of a contract – necessary to fulfil and manage booking requests made by users. Legitimate interests – to coordinate with partners required to provide booking‑related services.
Surveys and feedback collection: To collect and analyse user feedback, satisfaction levels, preferences, and insights through surveys and questionnaires.	Consent – where surveys request optional personal data (e.g., contact information for follow‑up or prize draws) or where participation is voluntary and based on opt‑in. Legitimate interests – to understand user behaviour, improve the Ahlan Platforms, enhance service delivery, and support operational decision‑making.

Under the purposes described above, the collection of your personal data is mandatory where it is necessary for us to operate and maintain the functionality of the Ahlan Platforms, ensure their security and performance, and provide you with relevant information about our services, events, and features. Without this data, we may not be able to deliver key aspects of the Ahlan Platforms experience or respond to your requests effectively.

If we intend to collect your personal data for any additional purposes, such as optional surveys, marketing campaigns, or promotional activities, we will inform you of those specific purposes separately. In such cases, providing your data will be optional, and, where necessary, your consent will be sought in accordance with applicable data protection laws.

Where an individual does not have legal capacity under the applicable laws of the Kingdom of Saudi Arabia, any processing of their personal data requires the consent of a parent or legal guardian. We may request verification of such consent where necessary to ensure compliance with the applicable laws.

Sensitive Data

Certain services available through the Ahlan Platforms may require the processing of information relating to accessibility and disability needs, including but not limited to:

the category of disability (e.g., mobility, visual, hearing, cognitive, communication, or medical‑related conditions),
accessibility or assistance requirements (such as wheelchair access, mobility support, visual/hearing assistance, interpreter services),
the need for assistive devices or specific accommodation arrangements, and
any additional information you voluntarily provide to help us facilitate appropriate support.

This information constitutes health data, which is classified as sensitive personal data under applicable data protection law. We collect and process this data only with your explicit consent, and solely for the purpose of enabling us to provide reasonable accommodations, accessibility features, or support services during AFC Asian Cup 2027 events.

We apply enhanced safeguards to protect sensitive personal data, including access controls, minimisation, proportionate retention periods, and additional security measures in accordance with applicable data protection law.

Who do we share your personal data with

We only share information if necessary and in compliance with applicable laws and regulations, including:

third party service providers and subcontractors who provide a service to us and help us run our business efficiently (such as marketing and advertising, data processing, IT and office services), including but not limited to: (i) Webook who provides ticket purchasing services, (ii) Al Mosafer who provides travel and accommodation booking services; (iii) Opta Sports who provides live match data; (iv) Ministry of Sports who acts as a secure data conduit for transmitting required identification and passport information to the Ministry of Foreign Affairs; (v) the Ministry of Foreign Affairs who provides visa processing services; and (vi) Formbricks who processes user surveys on our behalf.
event partners or affiliates, where relevant to your use of the Ahlan Platforms;
any member of our group; and
any competent authorities if we are legally required to comply with a request for data.

We will not use any of your personal data for commercial purposes or share it with any third party outside the purpose of the AFC Asian Cup 2027 without your permission unless it is collected without identifiers on an aggregated basis for analytical purposes, studies, or reports with adherence to personal data protection laws and regulations in the Kingdom of Saudi Arabia.

Where we need to transfer your personal data outside of the Kingdom of Saudi Arabia, for example with our partners, we will ensure that we only do so in accordance with applicable data protection laws. This includes only transferring your personal data to a destination which is deemed to be adequate by competent authorities, and, where necessary, using additional safeguards such as approved standard contractual clauses.

How We Protect and Store Your Personal Data

We implement appropriate and proportionate physical, administrative, and technical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, misuse, loss, or destruction.

These safeguards include, without limitation:

Encryption of personal data in transit and at rest using industry-standard protocols
Role-based access controls (RBAC) and least-privilege access principles
Multi-factor authentication (MFA) for privileged and administrative access
Secure hosting environments with network segmentation and firewalls
Continuous monitoring, logging, and threat detection mechanisms
Regular vulnerability assessments, penetration testing, and security reviews
Secure software development lifecycle (SSDLC) practices

Personal data is stored only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, contractual, accounting, or reporting requirements. Retention periods are determined based on the nature of the data, applicable laws and regulations, and operational necessity. Once the applicable retention period expires, personal data will be securely deleted or anonymized.

Where we are required to delete or destroy personal data — whether upon your valid request, expiration of retention periods, or other lawful grounds — we will do so using secure and irreversible methods, which may include:

Permanent deletion from production and backup systems in accordance with defined retention policies
Secure data overwriting and cryptographic erasure
Anonymization or irreversible pseudonymization
Physical destruction of hard-copy records (e.g., cross-cut shredding or certified disposal services)
Secure disposal of storage media in accordance with recognized industry standards

We continuously review and enhance our security controls to ensure alignment with applicable data protection laws, regulatory requirements, and evolving cybersecurity best practices.

What are your rights

Depending on your jurisdiction, you may have the following rights:

Right to be informed: You have the right to be informed about how we collect, process and disclose your personal data, including the purposes and legal basis of processing. You can access such details through this Privacy Policy or by contacting us using the information set out in the ‘Who can you contact’ section below.
Right to access data: You have the right to request access to your personal data.
Right to request access: You have the right to request access to your personal data held by us in a readable and clear format if technically feasible.
Right to request correction: You have the right to ask us to correct, update, or complete the personal data we are processing about you.
Right to request destruction: You have the right, under certain circumstances, to request that we delete your personal data.
Right to withdraw consent: Where we have processed your personal data solely based on consent, you have the right to revoke this consent at any time. You can do this by contacting us using the details set out in the ‘Who can you contact’ section below.
Right to submit a complaint: You have the right to submit a complaint about our use of your personal data or to submit a complaint to the competent authority, the details of which are set out below in the ‘who can you contact’ section of this Privacy Policy.
Right to claim compensation: You have the right to claim compensation for any material or moral damage if you believe that we have caused you harm as a result of violating applicable data protection laws in respect of your personal data.

Unless otherwise stipulated by law, you will not be required to pay any fees for exercising your rights. If you choose to exercise any of your rights, we will respond as soon as reasonably possible and in line with applicable data protection laws. In some cases, we may need to request additional information to verify your identity or to better understand the nature of your request. If you wish to exercise your rights, please contact us via the communication channels set out in ‘Who can you contact’ section below.

Who can you contact

If you have any queries regarding this Privacy Policy, or are seeking to enquire about your rights as set out above, please contact us via privacy@asiancup2027.sa.

If you wish to make a complaint about our use of your personal data, we suggest that you first contact our privacy@asiancup2027.sa on the details above. We will investigate and attempt to resolve any complaints and disputes, and we will endeavor to help you exercise your rights within a reasonable timeframe.

You are also entitled to make a complaint to the competent government authority(ies). In the Kingdom of Saudi Arabia, the competent authority is the Saudi Data & Artificial Intelligence Authority (SDAIA), and complaints can be submitted via the National Data Governance Platform: dgp.sdaia.gov.sa.

Changes to the Privacy Policy

To ensure that we continue to offer the best possible experience and the highest level of protection to you, we reserve the right to update this Privacy Policy as and when necessary, for example, in compliance with any new laws and regulations. Any update to this Privacy Policy will be available on this website. We therefore recommend you check it periodically. This version was last updated on 10 March 2026.

Our use of cookies

We use cookies, pixels, and other mechanisms to improve your experience on the Ahlan Platforms. For more information about the use of cookies on the Ahlan Platforms and how you can manage your cookie preferences see https://www.asiancup2027.sa/cookie-policy. You may disable cookies in your browser settings, but this may affect certain functionalities of the website.

Link to other websites

The Ahlan Platforms may contain links to third party sites, which may be subject to separate privacy notices or policies. These sites are not under our control, and we are not responsible for any third party privacy notices or policies. It is your responsibility as a user to ensure that you are aware of or seek out information regarding any applicable policies of third party sites which you choose to access.