Cricket South Africa — Accreditation Privacy Notice

Version 1.0 · Effective 1 August 2026 · 2026/2027 Season and thereafter

• Responsible party: Cricket South Africa (NPC) ("CSA")
• Information Officer: Tjaart Van der Walt, Cricket South Africa
• Accreditation queries and data requests: accreditation@cricket.co.za
• Address: 86 5th Street, Corner of 5th Street and Glenhove Street, Melrose Estate, Johannesburg, 2196

In short: we use your details and your photograph only to accredit you for the Event and to manage access and security. The full detail is below.

1. Who we are

Cricket South Africa (NPC) ("CSA", "we", "us") is the responsible party for the personal information collected when you apply for, or hold, accreditation for a CSA match, series, tournament, tour or other event (an "Event"). CSA is the national governing body of cricket in South Africa. This notice explains what we collect, why, who we share it with, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

2. What personal information we collect

Depending on your role, we collect:

• Identity and contact details: your name, ID or passport number, email address and telephone number.
• A recent head-and-shoulders photograph, used on your accreditation pass and to identify you.
• Accreditation details: your organisation, role or category, the zones you require, and your application status.
• Details supplied by others: where you apply through, or are captured by, a key contact or authority, the details they supply about you.
• Consent and usage records: records of your consent, and information generated when you use the accreditation portal (login and security logs).

A photograph used to identify you, and any information about a person under 18, is special personal information under POPIA and is treated with additional care (see section 5).

3. Why we collect it (purpose)

We process your personal information to assess, process and issue your accreditation for the Event, to manage access and security at Venues, to communicate with you about your application and the collection of your pass, and to meet our legal, security and governance obligations. Providing the information is required for accreditation. If it is not supplied, or is inaccurate, we may be unable to issue you a pass.

4. Our lawful basis

We rely on your consent, on the necessity of processing to conclude and perform the accreditation arrangement, on compliance with our legal obligations, and on the legitimate interests of CSA, the Organiser and Host Stadiums in running safe, secure and properly accredited Events.

5. Special personal information, and children

Photographs and biometrics: we capture and use your photograph to identify you and to produce your pass, on the basis of your explicit consent.

Children (under 18): where an applicant is a minor, we collect and process their personal information only with the consent of a parent or legal guardian, and in line with CSA's Child Protection Safeguarding Policy.

6. Who we share it with

Your personal information may be shared with the Organiser, Cricket South Africa (CSA), any Host Stadium(s) and their employees, agents and contractors, and South African governmental departments and agencies, to enable them to exercise their responsibilities in relation to the Event. We also use a third-party service to print accreditation passes. Where we use operators (service providers) to process personal information on our behalf, they are bound to keep it secure and to process it only on our instructions.

7. Security screening

As part of accreditation, and as set out in the Accreditation Terms and Conditions, you consent to screening by relevant authorities (which may include national police, counter-terrorism and personnel security checks) and to the results being shared for security, disciplinary and administrative purposes with the parties listed in section 6 and relevant investigatory or regulatory bodies.

8. Cross-border transfers

Where an Event is hosted outside South Africa, or involves the ICC or an overseas host body, limited personal information may be transferred across borders for that Event. Any such transfer is made in accordance with POPIA.

9. How long we keep it

We keep your personal information only for as long as necessary, in line with CSA's IT Data Retention Policy and the Accreditation Data Retention Schedule. In summary:

• Accreditation application record (name, contact, role, zones): retained for the Event and up to 5 years thereafter, then de-identified; de-identified data may be kept indefinitely for analysis and reporting.
• Photograph and ID or passport number (special information): retained for the Season or Event and 24 months thereafter, then securely deleted.
• Consent records (self or guardian): retained as evidence of lawful processing for 5 years.
• Marketing and communication contact data: retained for a maximum of 5 years, or until you opt out.

10. How we protect it

CSA protects your personal information in line with its IT Information Security Policy. Measures include network segregation, controlled access on a need-to-know basis, Single Sign-On (Entra ID) and Multi-Factor Authentication, encryption of stored credentials, endpoint detection and response, firewalls, regular patching and vulnerability testing, and monitoring of network traffic. Security incidents are managed under CSA's incident response process.

11. Your rights

Under POPIA you have the right to be told what we hold about you, to access it, to have it corrected or deleted, to object to its processing, and to withdraw consent (which will not affect processing already carried out). To exercise any of these, contact the Information Officer at accreditation@cricket.co.za. Requests for access to records are handled under CSA's PAIA Manual.

12. Complaints

If you are unhappy with how we handle your personal information, please contact us first at accreditation@cricket.co.za. You also have the right to lodge a complaint with the Information Regulator:

• Information Regulator (South Africa)
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200; Toll-free: 0800 017 160
• POPIA complaints: POPIAComplaints@inforegulator.org.za (complaints are lodged via the Regulator's eServices portal)
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, 2017

13. Changes to this notice

We may update this notice from time to time. The current version is published on the CSA website and applies from the effective date shown above.