FWC2026, US, INC. (“FIFA26,” “we,” “us,” and “our”) values your privacy and is committed to protecting your Personal Data. This Privacy Notice (“Notice”) explains how we collect, use, store, and protect Personal Data through the use of facial recognition technology (“FRT”) at the designated FIFA Clubs in connection with the FIFA World Cup 2026™ (hereinafter the “Competition”).

For the purposes of this Notice, FWC2026, US, Inc. acts as the controller of the Personal Data processed through this facial recognition technology.

This Notice should be read together with the applicable registration privacy notice, which provides additional informations regarding the collection and use of registration information.

This Notice applies to registered guests staying at designated FIFA26 VIP Hotels, accompanying guests or other Individuals whose Personal Data may be captured through the operation of FRT and any other hotel staff or other authorized Individuals, where applicable.

This Notice should be read together with the applicable registration privacy notice, which iprovides additional information regarding the collection and use of registration information.

This Notice applies only to the facial recognition processing described in this document.

For the purposes of this Notice:

If you have any questions about this Notice, you can contact us using the details provided at the end of this Notice.

Facial recognition technology is deployed only at designated FIFA Clubs.

When an Individual enters the designated area, a camera captures a live facial image. The system generates a mathematical biometric template (sometimes referred to as a facial template) from the captured image and compares it against the reference photograph associated with the Individual through event registration or other authorised FIFA and/or FIFA26 systems.

If a match is identified within configured confidence thresholds, the registered Individual can be identified. Where no suitable match is found, the Individual is treated as an unknown person. The system does not automatically deny entry or services or make decisions without human involvement. Where appropriate, FIFA26 personnel (or any other hotel staff, as applicable) may manually verify the Individual's identity.

The biometric template is a mathematical representation of facial characteristics and cannot reasonably be used to recreate the original facial image.

We use FRT for the following purposes:

FRT is not used to make automated decisions that produce legal or similarly significant effects without appropriate human involvement. We process Personal Data through FRT only for the purposes described in this Notice and in accordance with applicable law.

FRT is used only at designated VIP Club entry points. Individuals within the camera’s field of view may have their facial image captured and processed through the FRT system. Areas where FRT is in use are identified through appropriate signage and a link or QR code directing Individuals to this Privacy Notice.

Depending on your interaction with the system, we may process:

Registration information collected as part of the registration process is processed through the FRT solution for identification and matching purposes. The processing of this information is also subject to the applicable registration privacy notice.

These records may be used to support system performance, quality assurance, security, and audit activities.

Where a registered guest is accompanied by another individual, the accompanying individual may also have their facial image and associated biometric data processed through the operation of the FRT system.

We do not use FRT to infer or analyse sensitive characteristics about you, except where required or permitted by applicable law.

We maintain appropriate technical and organisational measures designed to protect Personal Data, including encryption, role-based access controls, audit logging and configured matching thresholds designed to minimise false matches.

Personal Data is not used to train, improve, or develop facial recognition models.

FRT is configured with recognition thresholds designed to minimise incorrect matches.

If an individual is not recognised or a potential misidentification occurs, the system alerts authorised personnel who perform a manual review before taking any operational action.

Access to Personal Data is limited to authorised personnel with a business need to know. This may include authorized FIFA26/FIFA personnel, authorized system administrators, authorised service providers supporting the solution.

We generally do not disclose Personal Data processed through the FRT solution to third parties unless there is a lawful, necessary and appropriate reason to do so, such as safety and security, prevention, detection, or investigation of unlawful activity, legal claims, disputes, or proceedings or compliance with applicable law or lawful requests from competent authorities. 

This may include disclosure to law enforcement agencies, regulators or other public authorities, courts or tribunals, legal advisers, service providers acting on our behalf or other persons where required or permitted by law.

Personal data processed through the FRT solution is stored and processed in the United States. This includes biometric data generated through the FRT solution and registration information used for identity verification.

Personal Data is retained only for as long as necessary to support the purposes described in this Notice.

Facial images captured by the FRT solution and the biometric templates created from those images are used for matching purposes and are deleted after the matching process is completed. Temporary processing data may remain in the system for a limited period and no longer than one day.

Registration information used for matching purposes, including name, participant category, and reference photographs, will be retained within the FRT solution until the conclusion of the Competition (31 July 2026) and deleted thereafter, unless longer retention is required for an investigation, legal claim, legal requirement, or similar matter.

Individuals may request the earlier deletion of their Personal Data, which will be assessed in light of applicable legal obligations, legitimate business needs, and operational requirements.

Subject to applicable law, you may have certain rights in relation to your Personal Data. These may include the right to request access to your Personal Data, request correction of inaccurate Personal Data, request deletion of your Personal Data where provided by law, submit a complaint to an applicable privacy or data protection authority, and exercise other rights available under applicable law.

Where you submit a request relating to FRT processing, we may ask you to provide information necessary to verify your identity and help us identify the relevant records. This may include your name, the hotel location, and the approximate date and time of your visit.

We will assess requests in accordance with applicable law and our legal obligations.

If you have questions about this Notice or our processing of your Personal Data, please contact:

Data Protection Office: dataprotection@fifa.org | Data Protection Portal

You may also have the right to contact your local privacy or data protection authority.

We may update this Notice from time to time. The latest version will be available here.

We will not use or share your Personal Data for materially different purposes than those described in this Notice without first taking reasonable steps to notify you and request your consent in accordance with the applicable laws.

This Notice is effective as of July 10th, 2026.