Player and Related Persons Privacy Policy

This policy explains how Football DataCo uses personal information of football players (including youth players), managers and match officials (“you”, “your”) associated with the Leagues (as defined below) in accordance with the United Kingdom General Data Protection Regulation as defined in the Data Protection Act 2018 (as amended) (the “DPA") and other applicable data protection legislation including the DPA (together, the “Data Protection Law”).

This Policy applies to our use of your personal data, but other organisations such as The Football Association Premier League Limited (“PremierLeague”), The Football League Limited (“EFL”), The Scottish Professional Football League Limited (“SPFL”) (together the “Leagues”)and the Premier League's, EFL’s and SPFL’s member football clubs from time to time (together the “Clubs” and each a “Club”) (as applicable) are also likely to collect and use your personal data. You should refer to their respective privacy policies to understand how your personal data is processed by these organisations.

DATA CONTROLLER

For the purpose of the Data Protection Law, the controller of your personal information is Football DataCo Limited of Brunel Building, 57 North Wharf Road,London, W2 1HQ (“we“, “us”, “our”). This means we are responsible for deciding how we use your personal data and, in accordance with the Data Protection Law, we will ensure that the personal data we hold about you is, at all times:

used fairly, lawfully, and transparently;
collected for limited, specific purposes only;
adequate, relevant to and limited to what is necessary for those purposes;
kept accurate and up-to-date;
not kept for longer than is necessary; and
held securely.

We shall be accountable for and able to demonstrate our compliance with our obligations under the Data Protection Law, and this Policy is one of the ways in which we do that.

We have appointed a third party service provider, SecondSpectrum, Inc. (“Second Spectrum”) in relation to certain of our processing, as explained further below. When acting as our service provider, Second Spectrum shall be a data processor in respect of your personal data processed under this Policy. If it also acts as a Licensee (as defined below), Second Spectrum shall be a separate data controller, and shall be accountable for its compliance with the Data Protection Law under its own privacy policy.We have also appointed a third party database system supplier, OppSport Software Limited (“OppSport”) in relation to certain of our processing, as explained further below. OppSport shall be a data processor in respect of your personal data processed under this Policy.

For more information, please refer to "Disclosure of your personal data" below

PERSONAL DATA WE MAY PROCESS ABOUT YOU
‍
Personal data means any information from which you can be identified. It does not include data where your identity has been removed (i.e.anonymous data).

We create, receive, transfer or use (and/or instruct Second Spectrum and/or OppSport each acting as our data processor to create, receive, transfer or use) the following information about you:

Tracking Data: On our behalf Second Spectrum creates live on-field tracking and performance data (for example, position, distance run and passes made) through its attendance at football matches and/or through video footage of such matches. Second Spectrum usually creates Tracking Data for Premier League and EFL Championship matches, but it may also create Tracking Data for the EFL’s League Cup and Trophy and The Football Association Challenge Cup (“FA Cup”) matches if requested by the Premier League or EFL on behalf of Clubs. Tracking Data therefore usually includes personal data of Premier League and EFL Championship Club players only but it may also include personal data of football players outside of the Premier League and EFL Championship Clubs where such players participate in the EFL League Cup or Trophy or the FA Cup.
Insight Data: On our behalf Second Spectrum creates performance data derived from the analysis of synchronised Tracking Data and Event Data. Insight Data includes personal data of Premier League Club players only.
Media Data: On our behalf Second Spectrum may process video footage of football matches as set out above.

We also grant rights to third party licensees (“Licensees”) who may then also collect, receive, transfer and use information about you, including:

Event Data: Although we do not collect other match event data (for example, goals scored or fouls conceded) this Event Data is created by our Licensee Perform Content Limited (“StatsPerform”). We may receive this Event Data for the purposes of (a) use alongside Tracking Data within our quality control software tool for evaluating the latency, timing accuracy and consistency of the Tracking Data we procure; and (b) recording it in our archive (please refer to Use made of your personal data below). Event Data may include the personal data of any League players.
Betting Data: Although we do not collect or create any event-based betting data or other data used in-play for betting products this Betting Data is created by our Licensee Genius Sports Group Limited trading as Betgenius (“Betgenius”). Betting Data may include personal data of any League players from 2018/19 season to the present date, and is made up of a player’s participation in a particular match and associated data with such player’s participation, e.g. the club they play for, the player receiving a booking or scoring a goal.

Each Licensee shall act as a controller in relation to the categories of data which it processes as set out above, and shall be accountable for its compliance with the Data Protection Law under its own privacy policy. For more information about how your data is processed by the Licensees, you should refer to the Licensees’ websites available at: StatsPerform – https://www.statsperform.com/; and BetGenius – https://geniussports.com/home/sports-players-privacy-notice/

Under the Data Protection Law there are “special categories”of more sensitive data such as details about your race or ethnicity or information about your health and genetic data and biometric data for the purpose of uniquely identifying a natural person (“Special Category Data”)and personal data relating to criminal convictions and offences (“Criminal Offence Data”) which require a higher level of protection (collectively referred to in this Policy as “Sensitive Personal Data”). We do not collect Criminal Offence Data, and we do not generally collect, use or storeSpecial Category Data, save to the extent that data about on-pitch incidents referring to injury could amount to health data, such data having already been made public by the relevant individual through their participation in a League match.

We may also receive additional personal data about you from other organisations who have collected personal data from you in relation to your participation in the FA Cup.

We may also receive personal data about you aspart of the legal processes we undertake to protect our contractual and intellectual property rights, such as copyright, database and other media rights, or those of the Leagues, Clubs and/or other licensees/commercial partners. For example, we may receive it when we take action against persons collecting or creating data on an unauthorised basis.

USES MADE OF PERSONAL DATA‍

We only collect and use personal data in accordance with the Data Protection Law. The Data Protection Law says we can collect and use personal data on the following bases:

if it is necessary for us to be able to perform an agreement with you;
if it is necessary for our legitimate interests (and your interests and fundamental rights do not override those interests);
if we have your consent (which you can withdraw at any time); or
to comply with a legal obligation i.e. rules laid down by courts, statute or regulation.

For the most part, we collect and use personal data because it is necessary for our "legitimate interests", that is, to provide football data-related services to our partners (including the Leagues and Clubs) and to grant rights to our Licensees (including Stats Perform and Betgenius) for their subsequent use.

It is also necessary in our and the public’s legitimate interests to use your personal data to preserve the history of football, in particular, where data is transferred to our “archive”. An archive is a collection of data which is no longer necessary to achieve the purposes for which the information was originally collected or which is no longer used for general business activities, but which is used in the public interest and/or for historical, scientific or statistical purposes. Such an archive allows us to fulfil our responsibilities to the Leagues and to football in the public interest by securing the permanent availability of a historical record of data (currently only Event Data and Tracking Data) for future legitimate commercial or non-commercial purposes, including for example access by academics, researchers and others. We maintain appropriate measures to keep archived personal data secure, in accordance with the Data Protection Law. Please refer to Retention below.

Before using your personal data for our legitimate interests, we make sure that we take into account any potential impact that such use may have on you to ensure that your interests and fundamental rights and freedoms do not override those interests. In other words, we have determined that we have a legitimate need to process your personal data and we are not aware of any reasons that, on balance, mean we should not be doing so. If you have concerns about our processing please refer to Your Rights below or contact us atprivacy@football-dataco.com.

We may use your personal data in connection with legal and regulatory matters such as our maintenance of business records, compliance with external reporting requirements and internal policies and procedures and responses to requests by government, law enforcement, regulators, courts, rights holders or other third parties including in respect of the use or misuse of intellectual property, such as our media rights, or those of our licensees/commercial partners (including the Leagues and Clubs). For example, we may need to use your personal data when we take action against persons collecting and creating data on an unauthorised basis. We use this data on the basis that it is necessary for our legitimate interests and the wider public interest in protecting, defending and enforcing rights and interests within football in this way and also so that we can comply with legal obligations.

We only use Special Category Data in accordance with the Data Protection Law so to the extent that data about on-pitch incidents referring to injury could amount to health data we only use such data on the basis that is has already been made public by that player through their participation in a League or other applicable match (although FDC’s current data collection mandate requires Opta to capture the reason for a substitution (i.e. tactical or injury) but not specific injury information) and, where it forms part of an archive as described above, because it is necessary for such archiving purposes in the public interest and/or historical research purposes. Some Tracking Data results from specific technical processing relating to the physical, physiological or behavioural characteristics of players, but this is not used by FDC or the Licensees to identify or confirm the identity of players. Accordingly, even if such data were biometric data, it is not being processed as Special Category Data.If we ask you to provide consent to us, we will inform you specifically when we seek to obtain this from you as well as informing you of your ability to withdraw that consent at any time and any potential consequences that may arise as a result of not providing the personal data that is requested. Unless otherwise required or permitted by law, before using your personal data for a purpose unrelated to those set out above, we will notify you and explain the purpose and legal basis which allows us to do so. If you would like to find out more about the legal condition for which we process your personal information, please contact us at privacy@football-dataco.com.

DISCLOSURE OF YOUR DATA‍

We may share your information with other parties (usually through Second Spectrum acting as our data processor) as set out below.

We may share your data with the following:

Leagues and Clubs: We may provide Tracking Data, Event Data and Insight Data to the Leagues and to the Clubs, who may then use that data to create their own data-sets, or appoint analytics service providers to do so, or use such data in connection with their own rights enforcement and/or football regulatory requirements or obligations;
Analytics service providers: We may provide Tracking Data, Event Data and Insight Data to licensed service providers who provide performance analysis services to football clubs and other clients. As part of our licensing of such services, we may also license video footage for use by such service providers (which will be provided directly by other data controllers of that footage such as the Leagues or their media partners). The service providers may create their own data-sets which may be transferred to their clients;
Licensees: We may provide: (a) Tracking and Event Data to Stats Perform; and (b) Event Data to Betgenius; for their commercial, statistical and analysis purposes as discussed above;
Other stakeholders: We may provide Tracking Data, Event Data and Insight Data to football authorities such as the Football Association (FA), the Scottish Football Association (SFA),the Professional Footballer’s Association (PFA), the Union of European Football Associations (UEFA), the Fédération Internationale de Football Association (FIFA) and the Professional Game Match Officials Limited (PGMOL) were this to become necessary in connection with their regulatory obligations or requirements; and
Enforcement: We may provide Tracking Data, Event Data and Insight Data or other personal information, including in relation to persons collecting or creating unauthorised data, to our legal and other advisers in connection with enforcement of our rights as described above and/or to the police and other law enforcement, security or similar bodies or agencies, both within and outside the UK, where we receive evidence we deem sufficient to justify such disclosure.

Each of the above recipients is a separate data controller, and shall be accountable for its compliance with the Data Protection Law under its own privacy policy.

As part of our contractual arrangements with the Leagues, the Clubs and the Licensees, there are certain rights that are reserved to us which permit us to share Event Data and Insight Data with third parties connected to or partnered with the Leagues and the Clubs. In accordance with these contractual rights, we may transfer (including through Second Spectrum acting as our data processor) Tracking Data, Event Data and/or InsightData with other commercial parties, but we do not do so currently.

We may share your information with third parties who help manage our business, such as the service providers who help host and maintain our IT and back office systems, in addition to Second Spectrum and OppSport, (each acting as our data processor). Our service providers only use your personal data in accordance with our strict instructions to provide the relevant services and are not permitted to use your personal data for their own purposes, unless authorised by us to do so.

Notwithstanding anything else in this Policy, we may share anonymous information with third parties for research, marketing, analytics and other purposes, provided such information does not identify a particular individual and the individual cannot be re-identified.

We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation.

If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose personal information to a potential or actual third party purchaser of our business or assets.

WHERE WE TRANSFER YOUR PERSONAL INFORMATION INTERNATIONALLY

Some or all of the personal information that we collect from you may be transferred to, and stored at, a location outside the UK and the European Economic Area (“EEA”). For example, we transfer Tracking Data and Match Data to non-EEA analytics service providers. It may also be processed by staff operating outside the EEA who work for us or for one of the entities referred to in the previous section (Disclosure of your personal data). We will take necessary steps to ensure that transfers of personal data are handled in accordance with thisPolicy and with the Data Protection Law. Where personal information is transferred outside the UK and EEA, we will ensure that such transfers are limited to countries which are recognised as providing an adequate level of legal protection by the UK and/or the European Commission or where one of the safeguards approved by the Information Commissioner’s Office (ICO) in the UK and/or the European Commission is in place. You can find further information about these safeguards at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/ and: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en. In the event that there is any change in the law such that one or all of the safeguards are no longer valid or applicable, we will ensure that we are satisfied that alternative arrangements/safeguards are in place to protect your privacy rights as required by the Data Protection Law. If you have any questions about how we transfer your personal data, please contact us at privacy@football-dataco.com

SECURITY

‍‍We will use strict procedures and security features to try to prevent any loss or unauthorised use, access to or disclosure of your personal data (“DataSecurity Breach”). We have put in place procedures to deal with any suspected Data Security Breach and will notify you and any applicable regulator where we are legally required to do so.In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only use your personal data on our instructions and they are subject to a duty of confidentiality. In relation to Second Spectrum, OppSport or other third party service providers whom we appoint to process your personal data on our behalf, we take steps to ensure that those service providers are contractually bound to protect your personal data..

RETENTION

We generally keep personal data only for as long as required to fulfil the purposes for which it was collected. However, in some circumstances we may retain personal data for other periods of time, for instance where we are required to do so in accordance with legal, tax or accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request. We may also retain some personal data in an archive (as set out above). To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. In accordance with our internal Data Retention Policy and the Data Protection Law, after the applicable retention period has ended, your personal data will be securely deleted or destroyed, anonymised (for example, where the data will be used in aggregated/generic form for statistical purposes), or transferred to an archive. We maintain appropriate measures to keep archived personal data secure, in accordance with the Data Protection Law. Specific details of retention periods for different aspects of your personal data are available upon request by using the contact details provided below

YOUR RIGHTS
‍
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have the following rights in relation to your personal information:

Right to access: you have a right to request that we provide you with a copy of your personal information that we hold and you have the right to be informed of: (i) the source of your personal information; (ii) the purposes, legal basis and methods of processing; (iii) the data controller’s identity; and (iv) the entities or categories of entities to whom your personal information may be transferred.
Right of rectification and erasure: you have a right to request that we rectify inaccurate personal information. You can also request that we erase your personal information in limited circumstances where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see right to object); or (iv) it has been processed unlawfully. We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims
To transfer your personal information: you can ask us to provide your personal information to you in a structured, commonly used, machine readable format, or you can ask to have it transferred directly to another data controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means.
Right to restrict the processing of your personal information: you can ask us to restrict your personal information, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; or (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your personal information following a request for restriction, to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person.
Right to object to the processing of your personal information: you can object to any processing of your personal information which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
Right to object to how we use your personal information for direct marketing purposes: you can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction: you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the UK/EEA. We may redact data transfer agreements to protect commercial terms.
Right to lodge a complaint with your local supervisory authority: you have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time. In the UK you can also complain to the ICO. The ICO's contact details as are follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; Tel: 0303 123 1113 (local rate) or 01625 545 745; https://ico.org.uk/global/contact-us/.

You also have a right of data portability to receive personal data in a structured, commonly used and machine readable format (or to ask us to transfer it to a third party); but note that this only applies to personal data: (a) which you have provided to us (so not to inferred or observed data); and (b) which we are processing on the basis of your consent or under contract and where the processing is automated (so this will not apply to most of the personal data we are processing about you).

If you wish to access any of the above-mentioned rights, we reserve the right to ask you (or the person making the request on your behalf) to confirm your identity (or, as applicable, their identity), and (as applicable) their authorisation to act on your behalf, in particular before disclosing personal information to you (or the third party on your behalf). We reserve the right to refuse, or to charge a reasonable fee for, any request which we consider to be manifestly unfounded or excessive.

You can exercise your rights by contacting us at privacy@football-dataco.com. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

UPDATES
‍
‍We may amend this Policy from time to time to keep it up to date with legal requirements and the way we operate our business, and will place any updates on our Website. Please regularly check our Website for the latest version of this Policy. If we make fundamental changes to this Policy we will seek to inform you by notice on our Website or e-mail. This version is dated August 2023.

CONTACT
‍
If you have any questions, concerns or complaints regarding our compliance with this Policy, the information we hold about you or if you wish to exercise your rights, we encourage you to first contact us at privacy@football-dataco.com. We will investigate and attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by the Data Protection Law.