Accreditation and Authorisation Privacy Policy
This privacy policy (“policy”) applies with respect to the personal information of photographers, journalists, technicians and other individuals ("you", "your") that have been or are being used for the purposes of applying for and/or receiving (i) professional accreditation to attend Premier League or English Football League(EFL) matches (“Accreditation”), or (ii) authorisation for access to specific Premier League or EFL stadia to fulfil a particular function (“Authorisation for Access”).
WHO IS THE DATA CONTROLLER OF YOUR PERSONAL INFORMATION?
For the purpose of the UK General Data Protection Regulation and Data Protection Act 2018 (the "DP Laws"), the controller of your personal information is Football DataCo Limited (company registration number 1420887) of Brunel Building, 57 NorthWharf Road, London W2 1HQ ("we", "us", "our"). The purpose of this policy is to provide a clear explanation of when, why and how we collect and use your personal information as controller. The primary point of contact for all queries arising from this policy, including requests to exercise Your Rights, is our data protection team, who can be contacted at: privacy@football-dataco.com.
We are committed to protecting and respecting your privacy and this policy sets out the basis on which we will deal with any such personal information as is referred to above. We have designed this policy to be user friendly, and set out below an index of contents so you can easily find the information you are looking for by clicking on the relevant heading. We have clearly labelled sections of this policy to make it easy for you to navigate to the information that may be most relevant to you.
WHAT PERSONAL INFORMATION DO WE PROCESS?
We receive and process the following personal information about you:
- Your name;
- Your job/role;
- Your date of birth;
- Employer or, for freelancers, entities that engage you;
- Employer’s address;
- Your employee ID;
- Your employee role;
- Your address;
- Your email address;
- Employer’s phone number (or your personal phone number where you are a freelancer, where applicable);
- Your photograph;
- Your UK Press, AIPS UK and/or Premier League/EFL Photo ID card holder reference number;
- Your digital photograph ID or Third party ID;
- Your password(s);
- (where you request a car parking space) your vehicle make, model and registration number;
- Other related details such as requests to attend matches; attendance records; communications with clubs, DataCo and/or any other relevant third parties; photographer bib numbers, insurance policy documents; relevant invoices etc; and/or
- Any other personal information which we may collect for the purposes set out in this policy, or is reasonably required in order for us or a third party to comply with any applicable law, request from law enforcement or court order, where we believe that we may receive and use that data in compliance with the DP Laws.
We may also collect, use and share aggregated data such as statistical data from our accreditation portal for the purpose of management reporting. This data is not personal data as it does not directly (or indirectly) reveal your identity.
HOW DO WE USE YOUR PERSONAL INFORMATION?
We use personal information held about you in the following ways:
- To enable you to be considered for, and potentially to receive, Accreditation or Authorisation for Access, and any other relevant communications;
- To provide you with information or updates regarding Accreditation, Authorisations for Access, applications for the same or the internet press booking system operated by DataCo to facilitate those processes (“i-PBS”) and/or any other mobile application DataCo has in place to provide these facilities
- To administer the Accreditation and Authorisation for Access processes and i-PBS itself, including Football Stadia and clubs (and their partners) where Premier League and/or EFL matches take place, as well as for any related disciplinary purposes and matchday security purposes;
- To enable: (i) your employer, or (ii) for freelancers, the entity that engages you, or (iii) where you work for an organisation that is a supplier to a rights holding broadcaster, such broadcaster, to administer the details held about you on our system, and to manage your selection for Accreditation or Authorisation for Access. Please note that where (iii) applies, these details may include attendance reports and your email address;
- To manage any registered account you hold with us on i-PBS;
- For internal operations, including troubleshooting, data analysis, testing, research and statistical purposes; and
- To assist third parties with security and crime detection and prevention efforts.
WHAT ARE OUR LAWFUL BASES FOR PROCESSING YOUR PERSONAL INFORMATION?
We will only collect, use and share your personal information where we are satisfied that we have an appropriate lawful basis to do this. The lawful bases we rely upon to process your personal information are:
- that we have a legitimate interest in safeguarding the integrity of, and access to, the intellectual property associated with professional football, and that verifying your identity is reasonably necessary in order for us to run a secure Accreditation or Authorisation for Access process associated with that purpose, without any undue impact on your rights or freedoms; and;
- to comply with any legal or regulatory obligations to which we are subject.
WHO DO WE SHARE YOUR PERSONAL INFORMATION WITH?
We share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.
We share your information with third parties, namely:
- The clubs and stadia owners responsible for considering and approving or disapproving applications for Authorisation forAccess as well as for matchday security purposes;
- The broadcasters who are registered with us and have access to our system;
- The Football Association Premier League Limited, The Football League Limited and other footballing bodies, which may include such overseas bodies, for administering Accreditations (including access to i-PBS) and investigation purposes (for example, unauthorised access to matches);
- Your employer or, for freelancers, the entity that engages you;
- For freelancers only, other entities that from time to time engage you; and/or
- With third parties who help manage our business, such as IT service providers who help manage our IT and back office systems, for example, our third party database system supplier, OppSport Software Limited. OppSport Software Limited (or any other third party database system supplier) may subsequently share information with clubs (and their partners) for the purposes set out above.
We may disclose your personal information to other third parties, including governmental bodies, regulators, law enforcement (including the police, security or similar bodies or agencies (within and outside of the UK), courts/tribunals, and insurers, where we are required to do so:
- to comply with our legal obligations;
- the terms and conditions of any agreement we enter into;
- to exercise our legal rights;
- to safeguard and protect our business, employees, customers and other individuals; and/or
- for the prevention, detection and investigation or crime and the prosecution of offenders.
If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose personal information to a potential or actual third party purchaser of our business or assets.
HOW DO WE STORE YOUR PERSONAL INFORMATION?
We generally keep personal data only for as long as it is necessary to carry out the purposes listed in “How do we use your personal information?” above or is required by law.
In some circumstances, we may retain personal information for longer periods of time, for instance where we are required to do so in accordance with legal, tax or accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request.
Further, in specific circumstances we may retain your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings. Moreover, we may anonymise your personal data (so that it can no longer be associated with you) for reporting and statistical purposes, in which case we may use this information indefinitely without further notice to you.
We maintain a data retention policy which we apply to records in our care. Where your personal information is no longer required we will ensure it is either securely deleted or stored in a way which means it will no longer be used by the business.
INTERNATIONAL TRANSFERS OF YOUR PERSONAL INFORMATION
While it is unlikely, it is possible that the personal information that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (UK). It may also be processed by staff operating outside the UK who work for us or for one of the entities referred to in the previous section (“Disclosure of Your Information”). We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
Where personal information is transferred outside of the UK, we will take appropriate steps to ensure that any such transfers are in accordance with applicable law and carefully managed to protect your privacy rights and interests, and are limited to countries:
- which are recognised as providing an adequate level of legal protection,
- where we can be satisfied that alternative arrangements are in place to protect your privacy rights, such as the European Commission Standard Contractual Clauses (and UK Addendum, where applicable) or UK International Data Transfer Agreement, or
- where a relevant exemption exists.
You have a right to contact us at privacy@football-dataco.com for more information about the safeguards we put in place (including a copy of the relevant contractual commitments).
MARKETING
We will not process your personal information for marketing purposes, although we, the clubs or leagues referred to in “Who do we share your personal information with” above may for example share press releases that we or they deem relevant to the general media situation.
WHAT ARE YOUR RIGHTS?
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have the following rights in relation to your personal information:
- Right to access: you have a right to request that we provide you with a copy of your personal information that we hold and you have the right to be informed of; (a) the source of your personal information; (b) the purposes, lawful basis and methods of processing; (c) the data controller’s identity; and (d) the entities or categories of entities to whom your personal information may be transferred;
- Right of rectification and erasure: you have a right to request that we rectify inaccurate personal information. You can also request that we erase your personal information in limited circumstances where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see right to object); or (iv) it has been processed unlawfully. We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
- To transfer your personal information: you can ask us to provide your personal information to you in a structured, commonly used, machine‑readable format, or you can ask to have it transferred directly to another data controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means;
- Right to restrict the processing of your personal information: you can ask us to restrict your personal information, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; or (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your personal information following a request for restriction, to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person;
- Right to object to the processing of your personal information: you can object to any processing of your personal information where we are relying on our legitimate interests as our lawful basis for processing your personal information, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms;
- Right to object to how we use your personal information for direct marketing purposes: As set out above, we do not process your personal information for marketing purposes;
- Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction: you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the UK. We may redact data transfer agreements to protect commercial terms; and
- Right to lodge a complaint with your local supervisory authority: you have a right to lodge a complaint with the Information Commissioner's Office and you can contact them on 0303 123 1113 or via a live web chat (https://ico.org.uk/make-a-complaint/). However, if you have concerns about how we are processing your personal information we ask that you please attempt to resolve any issues with us first, although you have a right to contact the Information Commissioner’s Office at any time
If you wish to access any of the above-mentioned rights, we reserve the right to ask you (or the person making the request on your behalf) to confirm your identity (or, as applicable, their identity), and (as applicable) their authorisation to act on your behalf, in particular before disclosing personal information to you (or the third party on your behalf). Where we are entitled to do so under DP Laws, we reserve the right to refuse, or to charge a reasonable fee for, any request which we consider to be manifestly unfounded or excessive.
You can exercise your rights by contacting us at privacy@football-dataco.com. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
UPDATES TO THIS POLICY AND THIRD PARTY WEBSITES
We may amend this policy from time to time to keep it up to date with legal requirements and the way we operate our business, and will place any updates on this webpage. Please regularly check these pages for the latest version of this notice. If we make fundamental changes to this policy, we will seek to inform you by notice on our website or email.
You might find external links to third party websites on our website, for example, the Premier League. This policy does not apply to your use of a third party site.
HOW DO YOU CONTACT US?
If you have any questions, concerns or complaints regarding our compliance with this policy, the information we hold about you or if you wish to exercise your rights, we encourage you to first contact us at privacy@football-dataco.com. We will investigate and attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by DP Laws.