Player and Related Persons Privacy Policy

This Policy explains how Football DataCo uses personal data of football players (including youth players), managers and match officials (“you”, “your”) associated with the Leagues (as defined below) in accordance with the United Kingdom General Data Protection Regulation ("UK GDPR") as defined in the Data Protection Act 2018 (as amended) (the “DPA") and other applicable data protection legislation including the DPA (together, the “Data Protection Law”).

This Policy applies to our use of your personal data, but other organisations such as The Football Association Premier League Limited (“Premier League”), The Football League Limited (“EFL”), The Scottish Professional Football League Limited (“SPFL”) (together the “Leagues”) and the Premier League's, EFL’s and SPFL’s member football clubs from time to time (together the “Clubs” and each a “Club”) (as applicable) are also likely to collect and use your personal data, which may include any personal data contained within Tracking Data, Event Data and InSight Data (each as defined below) provided to the Leagues by Football Dataco in its capacity as official data licensee to the Leagues.

For a summary of the Football DataCo data ecosystem and its benefits please also read the FAQ available here and in the Premier League Player app.

DATA CONTROLLER

For the purpose of the Data Protection Law, the controller of your personal data is Football DataCo Limited of Brunel Building, 57 North Wharf Road, London, W2 1HQ (“we“, “us”, “our”). This means we are responsible for deciding how we use your personal data and, in accordance with the Data Protection Law, we will ensure that the personal data we hold about you is, at all times:

  • used fairly, lawfully, and transparently;
  • collected for limited, specific purposes only;
  • adequate, relevant to and limited to what is necessary for those purposes;
  • kept accurate and up-to-date;
  • not kept for longer than is necessary; and
  • held securely.

We shall be accountable for and able to demonstrate our compliance with our obligations under the Data Protection Law, and this Policy is one of the ways in which we do that.

We have appointed a third-party service provider, Genius Sports UK Limited (“Genius”), in relation to certain of our processing, as explained further below. When acting as our service provider, where Genius creates or processes Tracking Data and/or Media Data in accordance with our instructions and on our behalf, it acts as our data processor. In such circumstances, we will remain the data controller and Genius will process your personal data under this Policy. When developing and improving its technology, and also when it acts as a Licensee (as defined in the next section Personal data we may process about you below), Genius shall be a separate data controller and shall be accountable for its compliance with the Data Protection Law under its own privacy policy (please refer to the next section Personal data we may process about you below). We have also appointed a third-party database system supplier, OppSport Software Limited (“OppSport”) in relation to certain of our processing, as explained further below. Where OppSport processes data in accordance with our instructions and on our behalf, it acts as our data processor, we will remain the data controller and OppSport will process your personal data under this Policy.

For more information, please refer to "Disclosure of your personal data" below.

We have designed this Policy to be user friendly and set out below an index of contents so you can easily find the information you are looking for [by clicking on the relevant heading]. We have clearly labelled sections of this Policy to make it easy for you to navigate to the information that may be most relevant to you.




PERSONAL DATA WE MAY PROCESS ABOUT YOU
‍
Personal data means any information from which you can be identified. It does not include data where your identity has been removed (i.e. anonymous data).

We create, receive, transfer or use (and/or instruct Genius and/or OppSport each acting as our data processor to create, receive, transfer or use) the following information about you:

  • Tracking Data: On our behalf Genius creates live on-field tracking and performance data (for example, position, distance run and passes made and also pose, skeletal and so-called Mesh data (i.e. specific points on or representations of the body) enabling a player's interactions with the ball to be identified and digital visualisation of a player's pose and/or position to be created (including for use in recreation of match events)) through its attendance at football matches and/or through video footage of such matches. At present, Mesh data is only created by Genius for the use in, by or at the direction of the Premier League and its Clubs. The systems used by the EFL and SPFL do not allow use or creation of Mesh data. Genius usually creates Tracking Data for Premier League and EFL Championship matches, but it may also create Tracking Data for the EFL’s League Cup and Trophy and The Football Association Challenge Cup (“FA Cup”) matches if requested by the Premier League or EFL on behalf of Clubs. Tracking Data therefore usually includes personal data of Premier League and EFL Championship Club players only but it may also include personal data of football players outside of the Premier League and EFL Championship Clubs where such players participate in the EFL League Cup or Trophy or the FA Cup.
  • Media Data: On our behalf Genius may process video footage of football matches as set out above.

We may also engage other third-party providers to supply similar services and engage in such processing in accordance with our instructions and on our behalf under this Policy on a limited basis for trial and/or research and development purposes.

We also grant rights to third party licensees (“Licensees”) who may then also collect, receive, transfer and use information about you, including:

  • Event Data: We may collect, or engage other parties to collect, other match event data (for example, goals scored or fouls conceded) and this Event Data is primarily created by our Licensee Perform Content Services Limited, trading as Opta, a member of the Stats Perform group of companies (“StatsPerform”). We may receive this Event Data for the purposes of: (a) use alongside Tracking Data within our quality control software tool for evaluating the latency, timing accuracy and consistency of the Tracking Data we procure; (b) our own research and development and internal use; and (c) recording it in our archive (please refer to the Uses made of your personal data section below). Event Data may include the personal data of any League players. StatsPerform also creates InSight Data: which is performance data derived from the analysis of synchronised Event Data together with Tracking Data (see above). InSight Data includes the personal data of Premier League Club players only.
  • Betting Data: Although we do not collect or create any event-based betting data or other data used in-play for betting products, this Betting Data is created by our Licensee, Genius. Betting Data may include personal data of any League players from 2018/19 season to the present date and is made up of a player’s participation in a particular match and associated data with such player’s participation, e.g. the Club they play for, the player receiving a booking or scoring a goal.

Each Licensee shall act as a controller in relation to the categories of data which it processes as set out above, and shall be accountable for its compliance with the Data Protection Law under its own privacy policy. For more information about how your data is processed by the Licensees, you should refer to the Licensees’ websites available at: StatsPerform – https://www.statsperform.com/; and BetGenius – https://geniussports.com/home/sports-players-privacy-notice/

Each Licensee shall act as a controller in relation to the categories of data which it processes as set out above and shall be accountable for its compliance with the Data Protection Law under its own privacy policy (see links below). Where Genius acts as controller in other circumstances (as described in the section Data Controller above) it shall also be accountable for its compliance with the Data Protection Law under the Genius privacy policy. For more information about how your data is processed by StatsPerform and Genius when acting as controller, you should refer to their own privacy policies on their websites available at: https://www.statsperform.com/privacy-notice-for-athletes; and
https://geniussports.com/policies/sports-player-privacy-notice/.

Under the Data Protection Law there are “special categories” of more sensitive data such as details about your race or ethnicity or information about your health and genetic data and biometric data for the purpose of uniquely identifying a natural person (“Special Category Data”) and personal data relating to criminal convictions and offences (“Criminal Offence Data”) which require a higher level of protection (collectively referred to in this Policy as “Sensitive Personal Data”). We do not collect, use or store Criminal Offence Data about you, and we do not generally collect, use or store Special Category Data, save to the extent that data about on-pitch incidents referring to injury could amount to health data, such data having already been made public by the relevant individual through their participation in a League match.

We may also receive additional personal data about you from other organisations who have collected personal data from you in relation to your participation in the FA Cup.

We may also receive personal data about you as part of the legal processes we undertake to protect our contractual and intellectual property rights, such as copyright, database and other media rights, or those of the Leagues, Clubs and/or other licensees/commercial partners. For example, we may receive it when we take action against persons collecting or creating data on an unauthorised basis.




USES MADE OF PERSONAL DATA‍

We only collect and use personal data in accordance with the Data Protection Law. The Data Protection Law says we can collect and use personal data on the following bases:

  • if it is necessary for us to be able to perform an agreement with you;
  • if it is necessary for our legitimate interests (and your interests and fundamental rights do not override those interests);
  • if we have your consent (which you can withdraw at any time); and/or
  • to comply with a legal obligation (i.e. rules laid down by courts, statute or regulation).
For the most part, we collect and use personal data because it is necessary for our "legitimate interests", that is, to provide football data-related services to our partners (including the Leagues and Clubs) and to grant rights to our Licensees (including Stats Perform and Genius) for their subsequent use. To the extent that processing is necessary for the purposes of crime detection, investigation or prevention (as described in Annex 1 to UK GDPR, as inserted by the Data (Use and Access) Act 2025), we have a recognised legitimate interest lawful basis under Article 6(1)(ea) of UK GDPR (please refer to how we process in relation to legal and regulatory matters below, as well as enforcement in the next section Disclosure of your personal data).

It is also necessary in our and the public’s legitimate interests to use your personal data to preserve the history of football, in particular, where data is transferred to our “archive”. An archive is a collection of data which is no longer necessary to achieve the purposes for which the information was originally collected or which is no longer used for general business activities, but which is used in the public interest and/or for historical, scientific or statistical purposes. Such an archive allows us to fulfil our responsibilities to the Leagues and to football in the public interest by securing the permanent availability of a historical record of data (currently only Event Data and Tracking Data) for future legitimate commercial or non-commercial purposes, including for example access by academics, researchers and others. We maintain appropriate measures to keep archived personal data secure, in accordance with the Data Protection Law. Please refer to the Retention section below.

Before using your personal data for our legitimate interests, we make sure that we take into account any potential impact that such use may have on you to ensure that your interests and fundamental rights and freedoms do not override those interests. In other words, we have determined that we have a legitimate need to process your personal data and we are not aware of any reasons that, on balance, mean we should not be doing so. If you have concerns about our processing please refer to the Your Rights section below or contact us at privacy@football-dataco.com.

We may use your personal data in connection with legal and regulatory matters such as our maintenance of business records, compliance with external reporting requirements and internal policies and procedures and responses to requests by government, law enforcement, regulators, courts, rights holders or other third parties including in respect of the use or misuse of intellectual property, such as our media rights, or those of our licensees/commercial partners (including the Leagues and Clubs). For example, we may need to use your personal data when we take action against persons collecting and creating data on an unauthorised basis. We use this data on the basis that it is necessary for our legitimate interests and the wider public interest in protecting, defending and enforcing rights and interests within football in this way and also so that we can comply with legal obligations.

We only use Special Category Data in accordance with the Data Protection Law so to the extent that data about on-pitch incidents referring to injury could amount to health data we only use such data on the basis that it has already been made public by that player through their participation in a League or other applicable match (although our current data collection mandate requires StatsPerform to capture the reason for a substitution (i.e. tactical or injury) this does not specify injury information) and, where it forms part of an archive as described above, because it is necessary for such archiving purposes in the public interest and/or for historical, scientific or statistical purposes. Some Tracking Data results from specific technical processing relating to the physical, physiological or behavioural characteristics of players, but this is not used by us or the Licensees to identify or confirm the identity of players. Accordingly, even if such data were biometric data, it is not being processed as Special Category Data.

If we ask you to provide consent to us, we will inform you specifically when we seek to obtain this from you as well as informing you of your ability to withdraw that consent at any time and any potential consequences that may arise as a result of not providing the personal data that is requested. Unless otherwise required or permitted by law, before using your personal data for a purpose unrelated to those set out above, we will notify you and explain the purpose and legal basis which allows us to do so. If you would like to find out more about the legal bases on which we process your personal data, please contact us at privacy@football-dataco.com.




DISCLOSURE OF YOUR DATA‍

We may share your personal data with other parties (usually through Genius acting as our data processor) as set out below. Once such personal data is shared, each of the below recipients is a separate data controller in respect of any further processing of such personal data and shall be accountable for its compliance with the Data Protection Law under its own privacy policy.

We may share your data with the following:

  • Leagues and Clubs: We may provide Tracking Data, Event Data and InSight Data to the Leagues and to the Clubs, who may then use that data to create their own data-sets, or appoint analytics service providers to do so, or use such data in connection with their own rights enforcement and/or football regulatory requirements or obligations;
  • Analytics service providers: We may provide Tracking Data, Event Data and InSight Data to licensed service providers who provide performance analysis services to football clubs and other clients. As part of our licensing of such services, we may also license video footage for use by such service providers (which will be provided directly by other data controllers of that footage such as the Leagues or their media partners). The service providers may create their own data-sets which may be transferred to their clients;
  • Broadcasting service providers: We may provide Tracking Data and Event Data to licensed providers/partners who provide broadcasting and streaming services to the Leagues, in order to enhance the services provided;
  • Officiating services providers: We may provide: (a) Tracking Data, Event Data and video footage in respect of Premier League matches to Genius for its provision of officiating services to the Premier League; and (b) Tracking Data, Event Data and video footage in respect of Premier League matches to Hawk-Eye Innovations Limited for its provision of officiating services to the Premier League;
  • Licensees: We may provide: (a) Tracking and Event Data to Stats Perform; and (b) Event Data, Tracking Data, Insight Data and video footage to Genius; for their commercial, statistical and analysis purposes as discussed above;
  • Other stakeholders: We may provide Tracking Data, Event Data and InSight Data to football authorities such as the Football Association (FA), the Scottish Football Association (SFA),the Professional Footballer’s Association (PFA), the Union of European Football Associations (UEFA), the Fédération Internationale de Football Association (FIFA) and the Professional Game Match Officials Limited (Pro Ref) were this to become necessary in connection with their regulatory obligations or requirements; and
  • Enforcement: We may provide Tracking Data, Event Data and InSight Data or other personal data, including in relation to persons collecting or creating unauthorised data, to our legal and other advisers in connection with enforcement of our rights as described above and/or to the police and other law enforcement, security or similar bodies or agencies, both within and outside the UK, where we receive evidence we deem sufficient to justify such disclosure.

As part of our contractual arrangements with the Leagues, the Clubs and the Licensees, there are certain rights that are reserved to us which permit us to share Event Data, Tracking Data and InSight Data with third parties connected to or partnered with the Leagues and the Clubs. In accordance with these contractual rights, we may transfer (including through Genius acting as our data processor) Tracking Data, Event Data and/or InSight Data with other commercial parties.

We may share your personal data with third parties who help manage our business, such as the service providers who help host and maintain our IT and back office systems, in addition to Genius and OppSport, (each acting as our data processor). Our service providers only use your personal data in accordance with our strict instructions to provide the relevant services and are not permitted to use your personal data for their own purposes, unless authorised by us to do so.

Notwithstanding anything else in this Policy, we may share anonymous information with third parties for research, marketing, analytics and other purposes, provided such information does not identify a particular individual and the individual cannot be re-identified.

We may also disclose your personal data to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose personal data to a potential or actual third party purchaser of our business or assets.




ENGLISH NATIONAL FOOTBALL DATABASE
‍
In 2025, we acquired the database of the English National Football Archive ("ENFA"), which contains historical data on match-by-match line-ups for EFL and Premier League Clubs and other teams from league, cup and additional matches from the 1888-89 Season to the 2023-24 Season (inclusive). Accordingly, some of your personal data may have transferred to us from the previous controllers of the ENFA, whether as a player, match official or manager. Your name may be referenced in connection with (where relevant) your match appearance, your Club, position, goals scored, bookings and substitutions. Such data is retained for archiving purposes, to keep a record of the history of football (pleased refer to the Uses made of personal data section above for further details of our archiving activities).



WHERE WE TRANSFER YOUR PERSONAL DATA INTERNATIONALLY
‍
Some or all of the personal data that we collect from you may be transferred to, and stored at, a location outside the UK and the European Economic Area (“EEA”). For example, we transfer Tracking Data and Match Data to non-EEA analytics service providers. It may also be processed by staff operating outside the EEA who work for us or for one of the entities referred to in the previous section (Disclosure of your personal data). We will take necessary steps to ensure that transfers of personal data are handled in accordance with this Policy and with the Data Protection Law. Where personal data is transferred outside the UK and EEA, we will ensure that such transfers are limited to countries which are recognised as providing an adequate level of legal protection by the UK and/or the European Commission or where one of the safeguards approved by the Information Commissioner’s Office (ICO) in the UK and/or the European Commission is in place. You can find further information about these safeguards at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/ and: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en. In the event that there is any change in the law such that one or all of the safeguards are no longer valid or applicable, we will ensure that we are satisfied that alternative arrangements/safeguards are in place to protect your privacy rights as required by the Data Protection Law. If you have any questions about how we transfer your personal data, please contact us at privacy@football-dataco.com.



SECURITY OF YOUR PERSONAL DATA

‍We will use strict procedures and security features to try to prevent any loss or unauthorised use, access to or disclosure of your personal data (“Data Security Breach”). We have put in place procedures to deal with any suspected Data Security Breach and will notify you and any applicable regulator where we are legally required to do so. In addition, we limit access to your personal data to those employees, contractors and other third parties who have a business need to know. They will only use your personal data on our instructions and they are subject to a duty of confidentiality. In relation to Genius, OppSport or other third party service providers whom we appoint to process your personal data on our behalf, we take steps to ensure that those service providers are contractually bound to protect your personal data.



RETENTION OF YOUR PERSONAL DATA
‍
We generally keep personal data only for as long as required to fulfil the purposes for which it was collected. However, in some circumstances we may retain personal data for other periods of time, for instance where we are required to do so in accordance with legal, tax or accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request. We may also retain some personal data in an archive (please refer to the Uses made of personal data section as set out above). To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. In accordance with our internal Data Retention Policy and the Data Protection Law, after the applicable retention period has ended, your personal data will be securely deleted or destroyed, anonymised (for example, where the data will be used in aggregated/generic form for statistical purposes), or transferred to an archive. We maintain appropriate measures to keep archived personal data secure, in accordance with the Data Protection Law. Specific details of retention periods for different aspects of your personal data are available upon request by contacting us at privacy@football-dataco.com.




YOUR RIGHTS

Subject to certain exemptions, including in relation to archives, and in some cases dependent upon the processing activity we are undertaking, you have the following rights in relation to your personal data:

  • Right to access: you have a right to request that we provide you with a copy of your personal data that we hold following our reasonable and proportionate searches and you have the right to be informed of: (i) the source of your personal data; (ii) the purposes, lawful basis and methods of processing; (iii) the data controller’s identity; and (iv) the entities or categories of entities to whom your personal data may be transferred;
  • Right of rectification and erasure: you have a right to request that we rectify inaccurate personal data. You can also request that we erase your personal data in limited circumstances where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see Right to object below); or (iv) it has been processed unlawfully. We are not required to comply with your request to erase personal data if the processing of your personal data is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
  • Right to restrict the processing of your personal data: you can ask us to restrict your personal data, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; or (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your personal data following a request for restriction, to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person;
  • Right to object to the processing of your personal data: you can object to any processing of your personal data which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms;
  • Right to object to the use your personal data for direct marketing purposes: you can object to or request that we change the manner in which we contact you for marketing purposes;
  • Right to obtain a copy of personal data safeguards used for transfers outside your jurisdiction: you can ask to obtain a copy of, or reference to, the safeguards under which your personal data is transferred outside of the UK/EEA. We may redact data transfer agreements to protect commercial terms; and
  • Right to lodge a complaint with us as controller and/or the ICO: you have a right both to lodge a complaint with us as well as the ICO if you have concerns about how we are processing your personal data. We ask that you please attempt to resolve any issues with us first, although you have a right to contact the ICO at any time. To lodge a complaint with us please use our contact details below. We will acknowledge your complaint within 30 days and investigate and respond without undue delay. The ICO's contact details are as follows: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; Tel: 0303 123 1113; https://ico.org.uk/global/contact-us/.
You also have a right of data portability to receive personal data in a structured, commonly used and machine readable format (or to ask us to transfer it to a third party data controller); but note that this only applies to personal data: (a) which you have provided to us (so not to inferred or observed data); and (b) which we are processing: (i) on the basis of your consent or on the performance of a contract with you; and (ii) where the processing is automated (so this will not apply to most, if not all, of the personal data we are processing about you).

If you wish to access any of the above-mentioned rights, we reserve the right to ask you (or the person making the request on your behalf) to confirm your identity (or, as applicable, their identity), and (as applicable) their authorisation to act on your behalf, in particular before disclosing personal data to you (or the third party on your behalf). We reserve the right to refuse, or to charge a reasonable fee for, any request which we consider to be manifestly unfounded or excessive.

You can exercise your rights by contacting us at privacy@football-dataco.com. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.



UPDATES TO THIS POLICY
‍
We may amend this Policy from time to time to keep it up to date with legal requirements and the way we operate our business, and will place any updates on our Website. Please regularly check our Website for the latest version of this Policy. If we make fundamental changes to this Policy we will seek to inform you by notice on our Website. This version is dated August 2026.



CONTACT US
‍
If you have any questions, concerns or complaints regarding our compliance with this Policy, the information we hold about you or if you wish to exercise your rights, we encourage you to first contact us at privacy@football-dataco.com. We will investigate and attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by the Data Protection Law.