Your information
Privacy & cookies
This notice explains how Sarsfields Rugby Events CLG uses and protects personal information for the Lynch Cup website and tournament.
Last updated: 10 August 2026
Who we are
Sarsfields Rugby Events CLG is the data controller for personal information processed through the Lynch Cup website and tournament administration.
For privacy questions or requests, email info@sarsfieldsrugby.ie.
Information we use
Depending on how you take part, we may use:
- your name, email address, confirmation that you are 18 or over, club, team, competition choices and player or manager role;
- registration, invitation, team membership, waiver acceptance and typed legal-name records;
- photographs or team images submitted to us or taken at the event;
- payment order references, amounts, status and provider identifiers, but not your complete card details;
- for afterparty purchases and admission, the purchaser name and email, ticket holder label, registration role labels, confirmation that guests are 23 or over, ticket state and entrance-check history;
- staff and volunteer account names, roles, runner assignments and activity recorded in the tournament audit trail; and
- essential technical and security information, such as session identifiers, limited server logs and protected forms of IP addresses used for rate limiting and abuse prevention; and
- if you opt in while signed in, an encrypted browser push subscription, your device-level reminder choices and aggregate push-service delivery states.
The Lynch Cup does not ask participants to disclose their sexual orientation, gender identity or health information, and we do not infer those details from participation in an inclusive event.
Why we use it
| Purpose | Legal basis |
|---|---|
| Register participants, manage teams, communicate essential event information and deliver the tournament | Taking steps at your request and performing our agreement with you |
| Send optional match reminders and public tournament notices to a signed-in participant’s subscribed browser | Your requested notification service, which you can change or withdraw on each device |
| Operate fixtures, results, staff access, safety, security, fraud prevention and accountable event administration | Our legitimate interests in running a safe, reliable and fair tournament |
| Process and reconcile entry and afterparty payments, issue digital tickets and check admission at the entrance | Performing our agreement and meeting financial and accounting obligations |
| Keep limited waiver and transaction evidence and respond to legal claims | Our legitimate interests and applicable legal obligations |
| Use posed, featured or submitted promotional images | Your consent, where consent is requested |
| Take general event photography after giving advance notice and providing a practical opt-out | Our legitimate interests in documenting and promoting the event, balanced against your rights |
Team-level fixtures, results and standings may remain as part of the tournament record. We do not publish participant names by default.
Who receives information
Access is limited to authorised Sarsfields Rugby Events CLG organisers and volunteers who need it for their role. We may also use carefully selected providers for website hosting, encrypted backups, email delivery and payment processing.
Resend may deliver registration and sign-in emails. When online payment is offered, SumUp hosts the payment page and handles card information directly; the Lynch Cup application receives payment references and status rather than complete card details.
If you choose a configured wallet option, Apple or Google receives the pass information needed to save and display that ticket. Wallet delivery is optional: the website QR code and fallback code remain available without it.
If you enable Web Push, your browser’s push provider receives the public alert text and the technical subscription needed to route it to that browser. Provider involvement depends on the browser and operating system you use. We do not put player names, email addresses, roster or payment information in push messages.
We do not sell personal information. If a provider transfers information outside the European Economic Area, we require an appropriate legal safeguard such as an adequacy decision or standard contractual clauses.
How long we keep information
We retain each category only for its stated purpose. Our standard schedule is:
| Record | Standard retention |
|---|---|
| Unfinished verification and sign-in requests | Deleted within 30 days after expiry |
| Operational registration, email, team and roster information | 12 months after the event |
| Afterparty ticket delivery, credential state and admission history, excluding accounting records | 12 months after the event |
| Minimal waiver and legal-claim evidence | 6 years after the event, or longer while a claim remains active |
| Payment and accounting records | 6 years after the relevant financial year |
| Security and organiser audit records | 2 years after the event |
| Push subscriptions, preferences and aggregate delivery history | Active only while the linked participant session remains valid; operational history is deleted within 12 months after the event |
| Unpublished uploaded photographs | 90 days after the event |
| Published promotional photographs | 3 years, or earlier where consent is withdrawn and consent is the legal basis |
| Rolling encrypted backups | 90 days |
| Team-level fixtures, results and standings without participant-identifying information | May be retained indefinitely as a historical record |
We may suspend normal deletion where information is required for an active complaint, investigation or legal claim. When the hold ends, the normal schedule resumes.
Optional match alerts
Your browser will ask for permission only after you choose Turn on alerts in the signed-in team area. This initially turns on match reminders and tournament updates; you can then switch either type off independently.
You can disable delivery and ask the browser to remove its subscription from the same controls. Signing out or ending your session also stops alerts linked to that session. App alerts are best-effort and are never the only safety-critical event communication channel. These operational notices are not marketing consent.
Cookies
Ordinary public browsing does not set cookies. We use only first-party, strictly necessary cookies when someone signs in, claims tournament access, purchases afterparty admission or opens a secure ticket link. They are protected with secure, HTTP-only and strict same-site settings in production.
| Cookie | Purpose | Expiry |
|---|---|---|
lynch_cup_session | Keeps an authorised tournament organiser signed in | 12 hours |
lynch_cup_person_session | Keeps a verified participant or manager signed in | 30 days after the tournament ends |
lynch_cup_runner_session | Keeps an assigned score runner signed in | 2 hours after the tournament ends |
lynch_cup_afterparty_access | Opens one paid public afterparty order and its tickets in this browser; the database stores only a hash of its bearer value | 30 days |
We do not currently use analytics, advertising, marketing or social-media tracking cookies. Because the cookies above are necessary to provide requested sign-in access, we do not display a cookie-consent banner. We will update this notice and request consent before introducing any non-essential cookies.
Photography
We give advance notice when official photography or filming will take place. You can tell the event team that you do not want to be included. Where we ask for consent for a posed, featured or submitted image, you may withdraw that consent by emailing info@sarsfieldsrugby.ie. Withdrawal does not affect use that was lawful before it was received.
How we protect information
Private contact, roster and waiver values are encrypted at rest. Access is role-based, sign-in credentials and session identifiers are protected, organiser activity is audited, and backups are encrypted. No internet service can be guaranteed completely secure, but we use proportionate technical and organisational safeguards and restrict access to those who need it.
Your rights
Depending on the circumstances, you may ask us for access to your information, correction, deletion, restriction, portability, or to object to processing. Where we rely on consent, you can withdraw it at any time. We do not use automated decision-making or profiling.
Email info@sarsfieldsrugby.ie to make a request. We may need to confirm your identity. You may also make a complaint to the Irish Data Protection Commission.
Changes to this notice
We will update this page if the way we use personal information or cookies changes. Material changes will be brought to participants’ attention where appropriate.