Accreditation and Authorisation Privacy Policy

This policy applies with respect to the personal information of photographers, journalists, technicians and other individuals ("you", "your") that have been or are being used for the purposes of applying for and/or receiving (i) professional accreditation to attend Premier League or English Football League (EFL) matches (“Accreditation”), or (ii) authorisation for access to specific Premier League or English Football League (EFL) stadia to fulfil a particular function (“Authorisation for Access”).

DATA CONTROLLER
For the purpose of the General Data Protection Regulation and Data Protection Act 2018 (the "DP Laws"), the controller of your personal information is Football DataCo Limited of Brunel Building, 57 North Wharf Road, London W2 1HQ  ("we", "us", "our").

We are committed to protecting and respecting your privacy and this policy sets out the basis on which we will deal with any such personal information as is referred to above.

PERSONAL INFORMATION WE MAY PROCESS
We receive and process the following information about you:

  • Your name;
  • Your job/role;
  • Your date of birth; 
  • Employer or, for freelancers, entities that engage you;
  • Employer’s address;
  • Your address;
  • Your email address;
  • Employer’s phone number;
  • Your photograph;
  • Your UK Press, AIPS UK and/or Premier League/English Football League (EFL) Photo ID card holder reference number;
  • Your digital photograph ID;
  • Other related details such as requests to attend matches; attendance records; communications with clubs, DataCo and/or any other relevant third parties; photographer bib numbers, insurance policy documents; relevant invoices etc; and/or
  • Any other personal information which is reasonably required in order for us or a third party to comply with any applicable law, request from law enforcement or court order, where we believe that we may receive and use that data in compliance with the DP Laws.

USES MADE OF PERSONAL INFORMATION
We use information held about you in the following ways:

  • To enable you to be considered for, and potentially to receive, Accreditation or Authorisation for Access, and any other relevant communications;
  • To provide you with information or updates regarding Accreditation, Authorisations for Access, applications for the same or the internet press booking system operated by DataCo to facilitate those processes (“i-PBS”) and/or any other mobile application DataCo has in place to provide these facilities;
  • To administer the Accreditation and Authorisation for Access processes and i-PBS itself, including Football Stadia where Premier League and/or EFL matches take place, as well as for any related disciplinary purposes;
  • To enable: (i) your employer or, (ii) for freelancers, the entity that engages you, or (iii) where you work for an organisation that is a supplier to a rights holding broadcaster, such broadcaster, to administer the details held about you on our system, and to manage your selection for Accreditation or Authorisation for Access. Please note that where (iii) applies, these details may include attendance reports and your email address. 
  • For internal operations, including troubleshooting, data analysis, testing, research and statistical purposes; and
  • To assist third parties with security and crime detection and prevention efforts.
The legal conditions we rely upon to process your personal information are: (i) that (subject to our discretion) granting you Accreditation or Authorisation for Access is required in order to give effect to your contract of employment or engagement, and our scrutiny of your personal information is reasonably necessary in that context; and (ii) that we have a legitimate interest in safeguarding the integrity of, and access to, the intellectual property associated with professional football, and that verifying your identity is reasonably necessary in order for us to run a secure Accreditation or Authorisation for Access process associated with that purpose, without any undue impact on your rights or freedoms.

If you would like to find out more about the legal condition for which we process your personal information, please contact us at privacy@football-dataco.com.

DISCLOSURE OF YOUR INFORMATION
We share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

We share your information with third parties, namely:

  • The clubs and stadia owners responsible for considering and approving or disapproving applications for Authorisation for Access; 
  • The broadcasters who are registered with us and have access to our system; 
  • The Football Association Premier League Limited, The Football League Limited and other footballing bodies, which may include such overseas bodies;
  • Your employer or, for freelancers, the entity that engages you;
  • For freelancers only, other entities that from time to time engage you;
  • With third parties who help manage our business, such as IT service providers who help manage our IT and back office systems, for example, our third party database system supplier, Oppsport Software Limited; and
  • The police and other law enforcement, security or similar bodies or agencies, both within and outside the UK, provided we receive evidence we deem sufficient to justify such disclosure.

We may disclose your personal information to third parties if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or the terms and conditions of any agreement we enter into.

If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose personal information to a potential or actual third party purchaser of our business or assets.

WHERE WE STORE YOUR PERSONAL INFORMATION
While it is unlikely, it is possible that the personal information that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of the entities referred to in the previous section (“Disclosure of Your Information”). We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Where personal information is transferred outside of the EEA, we will ensure there is a mechanism in place to protect your data to an adequate standard (for example, through the use of a data transfer agreement or certification schemes such as the EU - US Privacy Shield), or that a relevant exemption exists. You have a right to contact us for more information about the safeguards we put in place (including a copy of the relevant contractual commitments) to ensure the adequate protection of your personal information when it is transferred outside of the EEA as mentioned above.
RETENTION
We generally keep personal data only for as long as required to fulfil the purposes for which it was collected (e.g. to process your application for Accreditation or Authorisation for Access. However, in some circumstances, we may retain personal data for other periods of time, for instance where we are required to do so in accordance with legal, tax or accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request.
MARKETING
We will not process your personal information for marketing purposes, although we, the clubs or leagues referred to above may for example share press releases that we or they deem relevant to the general media situation.

YOUR RIGHTS
Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have the following rights in relation to your personal information:

  • Right to access: you have a right to request that we provide you with a copy of your personal information that we hold and you have the right to be informed of; (a) the source of your personal information; (b) the purposes, legal basis and methods of processing; (c) the data controller’s identity; and (d) the entities or categories of entities to whom your personal information may be transferred.
  • Right of rectification and erasure: you have a right to request that we rectify inaccurate personal information. You can also request that we erase your personal information in limited circumstances where: (i) it is no longer needed for the purposes for which it was collected; (ii) you have withdrawn your consent (where the data processing was based on consent); (iii) following a successful right to object (see right to object); or (iv) it has been processed unlawfully. We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation or for the establishment, exercise or defense of legal claims. 
  • To transfer your personal information: you can ask us to provide your personal information to you in a structured, commonly used, machine-readable format, or you can ask to have it transferred directly to another data controller, but in each case only where: (i) the processing is based on your consent or on the performance of a contract with you; and (ii) the processing is carried out by automated means. 
  • Right to restrict the processing of your personal information: you can ask us to restrict your personal information, but only where: (i) its accuracy is contested, to allow us to verify its accuracy; (ii) the processing is unlawful, but you do not want it erased; or (iii) it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending. We can continue to use your personal information following a request for restriction, to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person. 
  • Right to object to the processing of your personal information: you can object to any processing of your personal information which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests. If you raise an objection,  we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. 
  • Right to object to how we use your personal information for direct marketing purposes: You can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information  to unaffiliated third parties for the purposes of direct marketing or any other purposes.
  • Right to obtain a copy of personal information safeguards used for transfers outside your jurisdiction: you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside of the EEA. We may redact data transfer agreements to protect commercial terms.
  • Right to lodge a complaint with your local supervisory authority: you have a right to lodge a complaint with your local supervisory authority (for example, the Information Commissioner's Office) if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.
If you wish to access any of the above-mentioned rights, we reserve the right to ask you (or the person making the request on your behalf) to confirm your identity (or, as applicable, their identity), and (as applicable) their authorisation to act on your behalf, in particular before disclosing personal information to you (or the third party on your behalf).  We reserve the right to refuse, or to charge a reasonable fee for, any request which we consider to be manifestly unfounded or excessive.

You can exercise your rights by contacting us at privacy@football-dataco.com. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request. We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
UPDATES AND THIRD PARTY WEBSITES
We may amend this privacy policy from time to time to keep it up to date with legal requirements and the way we operate our business, and will place any updates on this webpage. Please regularly check these pages for the latest version of this notice.  If we make fundamental changes to this privacy notice, we will seek to inform you by notice on our website or email.  You might find external links to third party websites on our website, for example, the Premier League. This privacy policy does not apply to your use of a third party site.
CONTACT US
If you have any questions, concerns or complaints regarding our compliance with this privacy policy, the information we hold about you or if you wish to exercise your rights, we encourage you to first contact us at privacy@football-dataco.com. We will investigate and attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by data protection laws.