Expression of interest privacy notice

What the form collects

The EOI age range is boys and girls aged 13 to 16 on the first day of their selected clinic. The form collects the player’s first name, age on that day, clinic choice, preferred position, secondary position, and a summary of their current team, achievements and level of rugby league experience. That required summary is limited to 500 characters. The form also collects the parent or guardian’s name, email and optional phone number, and records the required guardian, privacy and EOI acknowledgements.

A separate additional-information field is optional and limited to 500 characters. It may be used for concise rugby league information such as representative teams, goals, current strengths, non-medical areas the player wants to improve, or other context for Sam’s human review. The optional field is not required to submit an EOI.

The form does not ask for medical or injury information, diagnoses, disability information, addresses, the child’s phone number or email address, identity documents, payment details, kit sizes or marketing consent. Do not enter that information, or sensitive personal information about any other person, in either free-text field.

Why it is collected

The player profile information is used only to support Sam’s human review of the EOI. The guardian contact information is used to administer the EOI and contact the parent or guardian about this Combine. An EOI is not registration, selection or a confirmed place. No automatic ranking or selection is performed. If the required details are not supplied, the organiser cannot review or respond to the EOI.

Storage, processing and access

If the form opens, submissions are stored in the site’s restricted Cloudflare D1 database provided through OpenAI Sites. That restricted register is the canonical EOI record. Hosting, support or processing may occur outside Australia. A specific processing country is not guaranteed by this website.

The owner-only review area requires ChatGPT sign-in and separate server-side reviewer authorisation. Access is limited to authorised event administration. Records are not provided to the venue, any school, sponsors, advertising audiences or the NRL/NRLW through this form, and must not be copied into public files, site source, campaign analytics, Google Drive or Notion.

When controlled PDF delivery is enabled, the website creates a PDF review copy containing the submitted player information, guardian contact details, receipt and recorded acknowledgements. It sends two separate one-recipient emails through Resend: one to Graham Card and one to Sam Elvy. No CC or BCC recipient is used. No PDF copy or email receipt is sent to the applicant or guardian, and the PDF is not an acceptance, registration or confirmed place.

Resend states that it stores account data, email content, attachments, logs and webhook payloads in the United States. On the Resend Free plan, email and log data are retained for 30 days. Recipient email providers may also transmit, process or store those emails and attachments outside Australia. The emailed PDFs and any downloaded copies are additional operational copies, not the canonical record. The same EOI retention schedule applies to those copies, but their deletion is a separate manual responsibility for the authorised recipients. Deleting the restricted database record does not automatically delete an inbox or downloaded copy.

One-way network identifiers are used only for abuse prevention. They are assigned a time-limited expiry, and expired rows are cleared during later form activity. Raw network addresses are not stored in the EOI tables. The website uses server-side validation, rate limits, signed form tokens and restricted reviewer access.

Retention, correction and deletion

Declined or withdrawn EOIs become due for deletion within 30 days of that outcome. Invited EOIs become due within 30 days after the owner records registration completion or closure. Every remaining EOI has a final deletion deadline of 31 March 2027 at 11:59 pm, Queensland time. Deletion is controlled and audited by the authorised owner.

To request access, correction, withdrawal, deletion or make a privacy complaint, contact the configured privacy address and quote the EOI receipt. A stored EOI is not edited in place. For a verified correction, the authorised owner deletes the incorrect EOI through the controlled process and the guardian submits a replacement. The organiser may need to verify the request through the guardian email used for the EOI, but will not request unnecessary identity documents. Do not email health information, identity documents or payment information.