The terms “personal data” or “personal information” are used to describe any information about an individual from which that person can be identified. Full-Time collects and processes personal data about players, team and league administrators and referees.  

Whilst you may provide your data directly, information collected on Full-Time is often collected and provided by third parties, in particular:

(1) Where you are a player, your initial registration information may be entered into the system by a club official at your current club or by a league user, although this will initially be collected from you.

(2) Where you are a referee, your initial registration information may be entered into the system by a league official, and information about your performance will be inputted into Full-Time by league or team officials.

(3) Where you are a team administrator (including those set up to receive SMS notifications or automated emails), or a league administrator, your initial registration information may be entered into the system by a team or league administrator.

Depending on the nature your relationship with the leagues and clubs, the data collected and processed in Full-Time may include:

CATEGORY OF DATA	TYPE OF DATA
Identity Data	such as your first and last name, date of birth and gender;
Contact Data	such as your home address, email address and telephone number(s);
Profile Data	such as your FAN number and password;
Image Data	such as a photograph for your profile;
Football Data	such as your football club, your role within a club, disciplinary and performance data;
Technical Data	such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and information about how you use our website, products and services.

In the event that you choose to provide us with unsolicited personal data, this personal data will be handled with the same care as any other personal data we process and in accordance with data protection legislation as laid out in this notice.

We will also collect personal information about website usage through cookies in accordance with our Cookie Policy.

The tables below set out how The FA, CFAs, other Football Associations, your club and league might use your personal data and our lawful basis for doing so:

Use	Lawful bases
Managing teams and fixtures and to communicate with you, or about you, in relation to your role with the club (including via The FA’s Matchday app), for example, regarding fixtures, training sessions and events.	Legitimate Interest (administer its club and teams).
To administer and ensure eligibility of players and club officials involved in games and leagues.	Legitimate Interest (administer its club and teams).
Producing and publishing, where it chooses to do so, match reports	Legitimate Interest (administer its club and teams).

For further information on how your club processes your personal data more generally, please contact your club, or visit their respective privacy policy. 

Use	Lawful bases
To communicate with you, or about you, in relation to your role with your club/team.	Legitimate Interest (administer its league and teams).
To administer and ensure eligibility of players and club officials involved in their league.	Legitimate Interest (administer its league and teams).
To comply with the FA Handbook and rules and regulations regarding league sanctioning and registration.	Legitimate Interest (administer its club and teams and comply with The FA rules and regulations).
To ensure compliance with any league rules on club affiliation and registration of players.	Legitimate Interest (administer the game and enforce their rules).

For further information on how your league processes your personal data more generally, please contact your league, or visit their respective privacy policy. 

Use	Lawful bases
To provide support to users of the Full-Time system and to reduce duplication and inaccuracy across different FA systems (in particular, Whole Game System). This involves sharing details of which clubs you play for, your date of birth and contact details.	Legitimate interest (to administer the game and carry out our role as a governing body).

For further information on how we process your personal data more generally, please visit our main privacy policy at www.thefa.com/public/privacy.

We might have to share your personal data with the parties set out below for some of the purposes outlined in the section above:

• Clubs: where you are a registered player, some of your registration information will be available to the Player Registration Officer (“PRO”) of any club that tries to register you as a player. If a PRO adds you to a club, this will be visible to you when you are logged on to Whole Game System.

• Football parties: your data maybe shared with County FAs and Other Football Associations where necessary for any of the purposes set out above, and with referees who need to populate their discipline records.

• Law enforcement or other government and regulatory agencies: your data may be shared where required by law or on the request of the police or another relevant authority in circumstances where we consider it necessary to share the information (e.g. to assist a criminal investigation or where you or someone else is at risk of harm). 

• Service Providers: your data may be shared with third party service providers, who will process it on behalf of the controllers for the purposes identified above, for example, providers of payment processing services.

We may also receive requests from third parties requesting the disclosure of personal data. We will only fulfil such requests where we are permitted to do so in accordance with applicable law or regulation.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes (unless you have provided your consent) – we only permit them to process your personal data for specified purposes and in accordance with our instructions.

Occasionally we may transfer personal data outside the UK where necessary to provide you with a service or to fulfil one of our functions. Whenever we do this, we will ensure that the transfer is compliant with UK data protection laws and that your personal data is treated securely and transferred via a legally approved mechanism.

We take the protection of your privacy extremely seriously and do our utmost to ensure that our security systems are able to protect your personal data. Data protection laws require us to ensure that we have effective security procedures in place regarding the storage and disclosure of personal data to guard against unauthorised loss or access. 

Your data is protected by industry-standard security and procedures to protect it from unauthorised misuse and loss. We have an established set of protocols to respond to suspected personal data breaches and will notify you and the Information Commissioner’s Office (or any other applicable regulator) of a breach where we are legally required to do so.

We will only retain your personal data for as long as it is necessary for the purpose we collected it for, or where we’re required to keep it for any legal, accounting or reporting requirements. We retain your personal data as follows:

CATEGORY	DURATION
Clubs	For as long as you are a member of the club.  Note that your club may hold data offline for longer, for which you would need to discuss with your club or visit their privacy policy.
FA and leagues	As long as you are an active user of our sites and for 5 seasons after this.  For the avoidance of doubt, activities that will result in your account being deemed active include, but are not limited to, being registered as a member of a club or logging onto your account. For more information on how the FA retains your account data, please visit our privacy policy at www.thefa.com/public/privacy.

Where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.

Under certain circumstances, you may have the following rights in relation to your personal data:

Right	What does this mean?
1	A right to access the personal data we hold about you (known as a "data subject access request").
2	A right to request that we rectify any inaccurate personal data we hold about you.  This right is qualified and we will need to verify the accuracy of any new data you provide.
3	A right to request that we erase personal data we hold about you where we no longer need to process it. This right will only apply where, for example, we no longer need the personal data we collected; or where we collected data based on your consent and you withdraw that consent. Please note: we may not be able to comply with your request for legal reasons. Where these apply, we will explain them to you when we respond to your request.
4	A right to restrict processing of personal data we hold about you. This right allows you to limit the way that we use your data and is an alternative to requesting the erasure of your data. You have the right to restrict the processing of your personal data for a particular reason. This may be where you have issues with the content of the information we hold or how we have processed your data. In most cases we will not be required to restrict our processing of your personal data indefinitely, but will need to have the restriction in place for a certain period of time. If there are legal reasons that mean we can’t comply, we will explain them to you when we respond to your request.
5	A right to receive personal data you have provided to us, in a structured, commonly used and machine readable format. You can also require us to transfer this personal data to another organisation.
6	A right to object to our processing of personal data we hold , which applies when we use your data for marketing, or where we are relying on a legitimate interest (or those of a third party), and you object as you feel it impacts on your rights and freedoms. In some cases, we may demonstrate that we have legitimate grounds to continue processing your data which override your rights and freedoms.
7	A right to withdraw your consent, where we are relying on it to use your personal data. We will advise you if withdrawal of consent means that we are unable to provide certain services to you.
8	A right to ask us not to make automated decisions about you.

If you wish to make a request to The FA, you can do so via our online form, which can be found here. If you have any questions or queries about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.

If you wish to make a request to a league or club, you should contact them separately. 

You also have the right to lodge a complaint with the UK Information Commissioner's Office and details can be found here. The ICO recommend that you should first discuss any concerns with the organisation before going to them, so please do contact us in the first instance to see if we can help to put things right.