Matchday Privacy Policy

Summary of how Matchday uses your data

OVERVIEW

Welcome to the Matchday app and websites (“Matchday”) privacy policy. This policy will inform you about how the Football Association Limited (“The FA”, “us” or “we”), leagues and clubs will make use of your personal data collected or stored in Matchday.

It applies to personal data provided to us, both by you and by third parties, and supplements any other privacy policies provided by The FA, leagues and clubs, which may apply.

Matchday uses information from other FA systems: Full-Time and the Whole Game System. The Full-Time Privacy Policy details how The FA and others use participant data for, among other uses, recording of performance and collating details on fixtures and results. The Whole Game System Privacy Policy details how The FA and others use participant data for, among other uses, club and player registration and refereeing reports. This privacy policy focuses on the use of data relating to players and club officials as held in Matchday.

WHAT INFORMATION DO YOU PROVIDE TO US?

The terms “personal data” or “personal information” are used to describe any information about an individual from which that person can be identified. Matchday collects and processes personal data about players, parents and club officials.

Whilst you may provide your data directly, information collected on Matchday is often collected and provided by third parties, in particular:

(1) Where you are a player, your initial registration information may be entered into the system by a club official at your current club, although this will initially be collected from you. Information about your discipline record and any misconduct charge will be provided by a referee directly into Matchday.

(2) Where you are a club official, information may be initially entered into the system by another club official (in particular, a Club Secretary). Information about whether you have completed relevant training or checks may also be provided by Full Time and/or Whole Game System. The Full Time Privacy Policy and the Whole Game System Privacy Policy provide more details about how data is shared.

Depending on the nature your relationship with the leagues and clubs and The FA, the data collected and processed in Matchday may include:

CATEGORY OF DATA	TYPE OF DATA
Identity Data	such as your first and last name, date of birth, gender and any parental relationship;
Contact Data	such as your home address, email address and telephone number(s);
Profile Data	such as your FAN number and password;
Image Data	such as a photograph for your profile;
Football Data	such as your previous and current football club, your role within a club, disciplinary and performance data;
Financial Data	such as your bank account and payment card details (via Barclays Smartpay);
Safeguarding Data	such as mandatory or recommended criminal record checks, including DBS checks, training courses undertaken and any safeguarding investigations that may have been conducted; and
Technical Data	such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and information about how you use our website, products and services.

In the event that you choose to provide us with unsolicited personal data, this personal data will be handled with the same care as any other personal data we process and in accordance with data protection legislation as laid out in this notice.

We will also collect personal information about website usage through cookies in accordance with our Cookie Policy.

HOW DO WE AND OTHER PARTIES USE YOUR PERSONAL DATA?

The tables below set out how The FA, your club and league might use your personal data and the lawful basis for doing so:

Your Club

Use	Lawful bases
To search for and add new players and club officials to their club and teams.	Legitimate Interest (administer its club and teams).
Managing teams and fixtures and to communicate with you, or about you, in relation to your role with the club (including via The FA’s Matchday app), for example, regarding fixtures, training sessions and events.	Legitimate Interest (administer its club and teams).
To administer and ensure eligibility of players and club officials involved in games and leagues.	Legitimate Interest (administer its club and teams).
To ensure children and individuals at risk in the game are appropriately protected from harm, including conducting safeguarding activities and checks to ensure mandatory training and criminal record checks have been completed.	Legitimate Interest (administer its club and teams and carry out its safeguarding responsibilities). Consent (where advised).
To comply with the FA Handbook and rules and regulations regarding the affiliation of clubs and registration of players.	Legitimate Interest (administer its club and teams and comply with The FA rules and regulations).

For further information on how your club processes your personal data more generally, please contact your club, or visit their respective privacy policy.

Your League

Use	Lawful bases
To communicate with you, or about you, in relation to your role with your club/team.	Legitimate Interest (administer its league and teams).
To administer and ensure eligibility of players and club officials involved in their league.	Legitimate Interest (administer its league and teams).
To comply with the FA Handbook and rules and regulations regarding league sanctioning and registration.	Legitimate Interest (administer its club and teams and comply with The FA rules and regulations).
To ensure compliance with any league rules on club affiliation and registration of players.	Legitimate Interest (administer the game and enforce their rules).
To ensure children and individuals at risk in the game are appropriately protected from harm, including conducting safeguarding activities and checks to ensure mandatory training and criminal record checks have been completed.	Legitimate Interest (administer its league and teams and carry out its safeguarding responsibilities).

For further information on how your league processes your personal data more generally, please contact your league, or visit their respective privacy policy.

The FA

Use	Lawful bases
Communicating with you or about you to administer the game, including informing you of a change in registration and responding to any questions you send to Matchday’s administrators.	Legitimate interest (to administer the game and carry out our role as a governing body).
To carry out appropriate research, including asking your opinion on FA initiatives.	Legitimate interest (to develop and improve football in England).
Providing reward packages (including, but not limited to, football equipment and apparel) to FA affiliated clubs, teams, players or parents of youth players.	Legitimate interest (to develop and improve football in England).
To administer and ensure eligibility of players and club officials involved in England.	Legitimate interest (to administer the game and enforce our rules and regulations).
To ensure compliance with FA Handbook and its rules and regulations on the sanctioning of leagues, affiliation of clubs and registration of players.	Legitimate interest (to administer the game and enforce our rules and regulations).
To maintain records of the game as regulated by The FA, in particular maintain details of discipline and applying appropriate fines and/or suspensions.	Legitimate interest (administer the game and carry out its role as a governing body).
To manage and improve the Matchday system and troubleshoot problems.	Legitimate interest (to protect and improve the Matchday system).
Where you are a club official, certain contact details may also be shared publicly through publication on The FA’s Just Play website in order to enable players to contact your club, provided that you have chosen to make such details available.	Legitimate interest (to administer the game and to develop and improve football in England).
To send you marketing communications.	Consent.
In response to requests by legal advisers, government or law enforcement authorities conducting an investigation.	Legitimate interest (prevention and detection of crime). Legal obligation.

For further information on how we process your personal data more generally, please visit our main privacy policy at www.thefa.com/public/privacy.

HOW DO WE SHARE YOUR INFORMATION?

We might have to share your personal data with the parties set out below for some of the purposes outlined in the section above:

• Clubs: where you are a registered player, some of your registration information will be available to the Player Registration Officer (“PRO”) and club officials of any club that tries to register you as a player. If a PRO adds you to a club, this will be visible to you when you are logged on to Whole Game System.

• Football parties: your data maybe shared with County FAs and Other Football Associations where necessary for any of the purposes set out above, and with referees who need to populate their discipline records.

• Law enforcement or other government and regulatory agencies: your data may be shared where required by law or on the request of the police or another relevant authority in circumstances where we consider it necessary to share the information (e.g. to assist a criminal investigation or where you or someone else is at risk of harm).

• Service Providers: your data may be shared with third party service providers, who will process it on behalf of the controllers for the purposes identified above, for example, providers of payment processing services.

We may also receive requests from third parties requesting the disclosure of personal data. We will only fulfil such requests where we are permitted to do so in accordance with applicable law or regulation.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes (unless you have provided your consent) – we only permit them to process your personal data for specified purposes and in accordance with our instructions.

WHAT ABOUT INTERNATIONAL DATA TRANSFERS?

Occasionally we may transfer personal data outside the UK where necessary to provide you with a service or to fulfil one of our functions. Whenever we do this, we will ensure that the transfer is compliant with UK data protection laws and that your personal data is treated securely and transferred via a legally approved mechanism.

HOW WILL WE PROTECT INFORMATION ABOUT YOU?

We take the protection of your privacy extremely seriously and do our utmost to ensure that our security systems are able to protect your personal data. Data protection laws require us to ensure that we have effective security procedures in place regarding the storage and disclosure of personal data to guard against unauthorised loss or access.

Your data is protected by industry-standard security and procedures to protect it from unauthorised misuse and loss. We have an established set of protocols to respond to suspected personal data breaches and will notify you and the Information Commissioner’s Office (or any other applicable regulator) of a breach where we are legally required to do so.

HOW LONG DO WE RETAIN YOUR DATA FOR?

We will only retain your personal data for as long as it is necessary for the purpose we collected it for, or where we’re required to keep it for any legal, accounting or reporting requirements. We retain your personal data as follows:

CATEGORY	DURATION
Clubs	For as long as you are a member of the club. Note that your club may hold data offline for longer, for which you would need to discuss with your club or visit their privacy policy.
FA and Leagues	As long as you are an active user of our sites and for 5 seasons after this. For the avoidance of doubt, activities that will result in your account being deemed active include, but are not limited to, being registered as a member of a club or logging onto your account. For more information on how the FA retains your account data, please visit our privacy policy at www.thefa.com/public/privacy.

Where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.

WHAT RIGHTS DO YOU HAVE IN RELATION TO YOUR PERSONAL DATA?

Under certain circumstances, you may have the following rights in relation to your personal data:

Right	What does this mean?
1	A right to access the personal data we hold about you (known as a "data subject access request").
2	A right to request that we rectify any inaccurate personal data we hold about you. This right is qualified and we will need to verify the accuracy of any new data you provide.
3	A right to request that we erase personal data we hold about you where we no longer need to process it. This right will only apply where, for example, we no longer need the personal data we collected; or where we collected data based on your consent and you withdraw that consent. Please note: we may not be able to comply with your request for legal reasons. Where these apply, we will explain them to you when we respond to your request.
4	A right to restrict processing of personal data we hold about you. This right allows you to limit the way that we use your data and is an alternative to requesting the erasure of your data. You have the right to restrict the processing of your personal data for a particular reason. This may be where you have issues with the content of the information we hold or how we have processed your data. In most cases we will not be required to restrict our processing of your personal data indefinitely, but will need to have the restriction in place for a certain period of time. If there are legal reasons that mean we can’t comply, we will explain them to you when we respond to your request.
5	A right to receive personal data you have provided to us, in a structured, commonly used and machine readable format. You can also require us to transfer this personal data to another organisation.
6	A right to object to our processing of personal data we hold , which applies when we use your data for marketing, or where we are relying on a legitimate interest (or those of a third party), and you object as you feel it impacts on your rights and freedoms. In some cases, we may demonstrate that we have legitimate grounds to continue processing your data which override your rights and freedoms.
7	A right to withdraw your consent, where we are relying on it to use your personal data. We will advise you if withdrawal of consent means that we are unable to provide certain services to you.
8	A right to ask us not to make automated decisions about you.

HOW CAN YOU CONTACT US?

If you wish to make a request to The FA, you can do so via our online form, which can be found here. If you have any questions or queries about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.

If you wish to make a request to a league or club, you should contact them separately.

You also have the right to lodge a complaint with the UK Information Commissioner's Office and details can be found here. The ICO recommend that you should first discuss any concerns with the organisation before going to them, so please do contact us in the first instance to see if we can help to put things right.