Privacy Notice

1. Data User Identity

Total Sports Asia Sdn Bhd ("TSA", "we", "us", "our") is the data user responsible for the personal data collected through this portal. TSA is the licensed commercial rights operator for the FIFA World Cup 2026 in Malaysia.

Data Protection Officer contact: privacy@totalsportsasia.com

2. Notice and Choice

We collect personal data only for the purposes described in this notice. By submitting a registration through this portal, you acknowledge that you have read and understood this notice and consent to the processing of your personal data as described.

You have the right to withhold or withdraw consent. However, withholding or withdrawing consent may mean we are unable to process your public viewing permit application.

3. Categories of Data Collected

We collect the following categories of personal and business data:

• Identity data: Full name, position, business registration number (SSM)
• Contact data: Email address, phone number (WhatsApp)
• Business data: Organisation name, business type, venue name, venue address, state, venue capacity
• Application data: Matches intended to screen, estimated audience size, commercial arrangements (entry fees, F&B), sponsorship interest
• Technical data: IP address (hashed), submission timestamp, browser/device information collected automatically by Cloudflare infrastructure

4. Purposes of Processing

We process your personal data for the following purposes:

• Processing and evaluating your public viewing permit application
• Communicating with you about your application status and licensing terms
• Issuing written authorisation for permitted public viewings
• Compliance with FIFA's commercial rights framework and obligations to FIFA as rights grantor
• Compliance with applicable Malaysian laws and regulations
• Notifying you of TSA promotional opportunities, where you have opted in
• Internal record-keeping and audit

5. Disclosure of Data

Your personal data may be shared with:

• FIFA and authorised FIFA entities — as required under the commercial rights agreement for reporting and compliance purposes
• Malaysian regulatory authorities — where required by law (e.g., MCMC, Jabatan Penyiaran, KKMM)
• TSA's authorised service providers — including email delivery providers (Resend / Brevo), Cloudflare (infrastructure and security), operating strictly under data processing agreements
• TSA's legal advisers — in connection with enforcement or dispute resolution, where necessary

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

We retain personal data for a period of 24 months following the conclusion of the FIFA World Cup 2026 (approximately July 2028), unless a longer retention period is required by applicable law or ongoing legal proceedings. After the retention period, data is securely deleted or anonymised.

Technical logs (IP hashes, timestamps) are retained for 90 days for security and audit purposes.

7. Data Integrity

We take reasonable steps to ensure that personal data is accurate, complete, and up to date for the purposes for which it is used. If you believe any information we hold about you is inaccurate, please contact us using the details below.

8. Access and Correction Rights

Under the Personal Data Protection Act 2010, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate, incomplete, or out-of-date data
• Withdraw consent to the processing of your personal data (subject to legal and contractual obligations)

To exercise these rights, submit a written request to our Data Protection Officer at privacy@totalsportsasia.com. We will respond within 21 days.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• HTTPS enforcement and TLS encryption in transit
• Cloudflare WAF, DDoS protection, and Bot Fight Mode
• Server-side input validation and sanitisation
• Access controls limiting data access to authorised personnel only
• IP hashing before storage in rate-limiting systems

10. Cookies and Analytics

This site uses Cloudflare Web Analytics, which is cookieless and does not track individuals across sessions or websites. No consent banner is required. We do not deploy any advertising pixels, remarketing tags, or third-party tracking cookies.

11. Contact

For any queries relating to this Privacy Notice or the exercise of your data subject rights:

Data Protection Officer
Total Sports Asia Sdn Bhd
Email: privacy@totalsportsasia.com