Who we are
The Royal College Rugby Matches Organizing Committee ("we", "us", "our") operates this website on behalf of the Royal College Union for the purpose of managing ticket draw registrations for the 80th Bradby Shield, Colombo Leg.
Under Sri Lanka's Personal Data Protection Act No. 9 of 2022 (PDPA), we are the data controller responsible for the personal information you provide through this platform.
Personal data we process
We collect the minimum data necessary to run the draw securely. We do not collect data for advertising, profiling, or any purpose beyond this event.
Membership number - To verify your Royal College Union membership.
Full name - Retrieved from the RCU membership database upon lookup.
Mobile phone number - To send OTP verification codes and draw notifications via SMS.
NIC number - To confirm your identity at registration.
Email address - Optional. Used only to deliver your QR pass and draw notifications.
IP address - Logged automatically for security and fraud prevention.
Event data - Draw number, QR token, check-in status, and timestamps.
Why we collect it
All processing is limited to operating the draw. We do not use your data for any other purpose.
Event registration - To issue your draw number and QR pass. Legal basis: contract performance.
Identity verification - To confirm RCU membership and that you own the phone number provided. Legal basis: contract performance and legitimate interest in fraud prevention.
Draw participation - To enter your number in the draw and notify you if selected. Legal basis: contract performance.
Security & audit - To maintain an audit trail of registrations and check-ins. Legal basis: legitimate interest in event integrity.
Who we share your data with
We do not sell or rent your personal data. We share it only with the service providers necessary to operate this platform:
Supabase - Database hosting. Your registration data is stored on Supabase-managed infrastructure.
Resend - Email delivery. Used to send your QR pass if you provide an email address.
SMS provider - Used to send OTP codes and draw result notifications to your mobile number.
Data transfers outside Sri Lanka
Some service providers (including Supabase and Resend) process data on servers outside Sri Lanka, including the United States and Singapore. These transfers are made under appropriate contractual safeguards consistent with the PDPA.
We do not transfer data to jurisdictions that do not provide adequate data protection.
How long we keep your data
Registration data (name, phone, NIC, draw number, QR token) is retained for up to 12 months after the event date, then permanently deleted.
Audit logs containing IP addresses and event metadata are retained for up to 6 months after the event.
You may request earlier deletion at any time - see Your Rights below.
Your rights under the PDPA
Under the Personal Data Protection Act No. 9 of 2022, you have the following rights in relation to your personal data:
Access - Request a copy of the personal data we hold about you.
Rectification - Ask us to correct inaccurate or incomplete information.
Erasure - Request deletion of your personal data, subject to any legal retention obligations.
Object - Object to processing carried out on the basis of legitimate interest.
Withdraw consent - Where processing is based on consent, you may withdraw it at any time, free of charge.
Complain to the DPA - Lodge a complaint with the Data Protection Authority of Sri Lanka at dpa.gov.lk.
Contact & Data Protection Officer
Exercise your rights or ask a question
To exercise any of your rights, request access to your data, or raise a privacy concern, contact us:
bradbydraw@gmail.com
You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka (dpa.gov.lk) if you believe your data rights have not been upheld.
This policy may be updated from time to time. The date above reflects when it was last revised. Continued use of the platform constitutes acceptance of the revised policy.