Summary of how we use your data
- The FA uses your personal data for the purposes of managing its business and managing or performing your employment contract or, where you are another category of worker, for the management of its contract with you or your employer
- Data is shared with our service providers and with relevant benefits providers and advisors. We may also share data with relevant survey firms so that they can obtain your feedback. Where you are a temporary or contract worker employed by a third party service provider, relevant information will be shared with that third party as necessary to manage your employment
- Where we rely on your consent, such as where you ask us to provide a reference, you can withdraw this consent at any time
- We ask you to provide various details about protected characteristics so that we can monitor diversity. This can include sensitive personal data (such as details of any disability, ethnicity or sexual orientation). This is optional, and is only used to monitor diversity – it will not be used for any other purpose. We also process details of your health to ensure that we provide any reasonable adjustments required by law, to complete health and safety reports, and to comply with laws on maternity leave and sick leave
- You can find further information on this processing, including details of your data protection rights and your right to object to certain processing, in our privacy policy
What does this Policy cover?
This policy describes how The Football Association Limited and other companies in The FA Group (also referred to as "The FA", "we" or "us") will make use of your data when managing your role as an employee or worker at The FA.
It also describes your data protection rights, including a right to object to some of the processing carried out by The FA. Further information about your rights, and how to exercise them, can be found in the “What rights do I have?” section.
What personal data does The FA collect?
As a data controller, we may collect and process the following types of personal data about you in connection with your employment or other working relationship with The FA (to the extent permitted by law and as appropriate to your role):
- Contact information: such as your name, age, date of birth, home address and postcode, personal email address, phone numbers and other similar information
- Identification information: such as your gender, employee ID number, , passport number, National Insurance Number, citizenship and immigration status. We may also request copies of identity documentation, as permitted and required in order to check your right to work, and where permitted, the optional collection of diversity information for monitoring purposes
- Financial information: such as your bank account and payment details, tax codes, salary and other compensation
- Information relating to company benefits and resources: such as work expenses, your registered company benefits (including the details of any beneficiaries and family members), your use of company equipment and resources, travel preferences, emergency contacts, marital status, guarantees or relocation assistance, and information concerning your physical and mental health
- Employment-related information: such as your job title, professional experience, education, performance history, training records, absence records, skills, trade union membership, career plans, conduct (including, where relevant, alleged or previous criminal activity), driving license details and relevant information that may be revealed by an appropriate background check
- Any other information you submit to us (including during the course of any correspondence with us): such as signatures, photographs, opinions, your location (if you choose to enable it on a company device) and any other information you provide
We also process information about you that arises in the course of your duties, such as performance reviews, appraisals, disciplinary proceedings, employment records, and employment requirements/ adjustments arising from any sickness or disability.
What information does The FA receive from third parties?
On occasion we receive personal data from third party sources, such as (i) details of a certification or qualification you obtained, (ii) feedback concerning your performance or training you attended, (iii) information provided to us by your current or previous employer, and (iv) data sent to us by health professionals, HM Revenue and Customs, other government authorities and/or financial institutions.
Although we may also engage survey providers to carry out satisfaction and other surveys, we will only receive anonymised results from such providers (unless we clearly state otherwise).
How does The FA use this personal data and what is the legal basis for its use?
The FA collects, uses and stores your personal data for the following purposes:
- Where necessary to establish and perform your employment contract, maintain or terminate the employment relationship, and enable you to perform your job. This includes:
- administration of payroll and benefits, absence, compensation and expense management;
- managing our personnel, for example, performance and talent management;
- allowing you to access medical insurance, pension schemes and other benefits offered by The FA and other providers. Some benefits may require you to provide personal data concerning family members, partners or next of kin, in which case you must inform them before providing the data to us; and
- arranging professional travel and relevant insurance.
- Where necessary to comply with a legal obligation, such as:
- making deductions from payroll for tax and social security purposes and providing information to tax and social security authorities as required by law;
- managing statutory sick pay and maternity pay;
- maintaining statutory records such as health & safety records; and
- complying with the security and identification verification protocols.
- As required by The FA to conduct our business and pursue our legitimate interests, in particular:
- managing our relationship with contractors or other workers where we do not have a direct contract with that individual. This will include managing absence and performance, and arranging appropriate travel and insurance;
- developing and rewarding our personnel, including training and leadership development, succession management, award recognition and employee surveys;
- planning our business;
- protecting our legitimate business interests and legal rights. This includes (but is not limited to) use in connection with legal claims, compliance, regulation, audits, investigations and disciplinary procedures (including disclosure of such information in connection with legal process or litigation) and use of other ethics and compliance reporting tools;
- managing the performance and security of our equipment, facilities, intellectual property and electronic platforms. This includes administering access rights, carrying out CCTV monitoring, monitoring compliance with information security and other company policies, and where permitted by local law and in accordance with relevant policies, for investigations and disciplinary actions;
- publishing internal directories and providing other internal communications tools. This includes the information you provide for your internal company profile (including your photo); and
- analysing and monitoring the diversity of the workforce in accordance with applicable laws. This includes for example, compliance with equal opportunity employment law.
- Where you have given your consent:
- we provide references to third parties you have requested; and
- we will process data as described in any future consent you give us.
Where we process your sensitive data, this will typically be carried out for all the purposes above to ensure that we comply with employment laws. In addition, we process diversity information for the purposes of ensuring equality of opportunity, and will not use this information to take decisions about you. We may also process sensitive data for the purposes of preventing and detecting unlawful activity, for example in our monitoring of our IT systems and physical premises through use of CCTV and access card use.
Withdrawing consent
Where we rely on your consent to process data, you will always be permitted to withdraw such consent (although we may have other legal grounds for processing your data, such as those outlined above). You can withdraw your consent at any time by contacting us on the details provided in the “How do I get in touch with you?” section. Any circumstances in which we seek your consent will be truly voluntary, and there will be no detriment to you if you refuse consent.
How will The FA share your personal date?
Where necessary, we may share your data across members of The FA Group in order to manage your employment and/or carry out the processing described above.
We will share your personal data with companies providing services under contract to The FA, such as training providers and IT service providers, including those who host our software. Your personal data will also be shared with trusted third parties, such as our professional advisers and auditors, insurers, banks, and other organisations which advise us.
If you are a temporary or contract worker employed by a third party service provider, relevant information will be shared with that third party where necessary to manage your employment.
We will share personal data with third party benefits providers, including for the purposes of obtaining health insurance, childcare vouchers and other applicable benefits providers. We may also share details with survey service providers where we want to obtain employee feedback.
Your personal data will also be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law, or if required for the legal protection of our legitimate interests in compliance with applicable laws.
In the event that The FA is sold or integrated with another business, your details will be disclosed to our advisers and the advisers of any prospective purchaser. Such details will also be passed to the new owners of the business.
What rights do I have?
You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format. You also have the right to ask us to share (port) this data to another controller.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling the request would reveal personal data about another person, if it would infringe the rights of a third party (including our rights), or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the General Data Protection Regulation (EU) 2016/679 (GDPR) and in the Data Protection Act 2018. We will inform you of any relevant exemptions that we have relied upon when responding to any request you make.
To exercise any of these rights, you can get in touch with us (or our data protection officer) using the details provided in the “How do I get in touch with you?” section. If you have any unresolved concerns, you have the right to complain to the Information Commissioner’s Office in the UK.
We will inform you in circumstances where data collection is mandatory. For example, this will include information that is necessary to perform our contract with you (or your employer), providing payments for services, and information needed to check your right to work and to manage your performance. Failure to provide information may be a breach of your agreement with us, and may have disciplinary consequences.
How do I get in touch with you, or your data protection officer?
If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.
Which FA entity is my data controller, and which affiliates might my data be shared with?
The data controller for your information is the FA Group entity with which you have a relationship, either as an employee, or as a contractor or other worker. This could be one of Football Association Limited, Wembley National Stadium Limited or National Football Centre Limited. We may also share your details across The FA Group as necessary for the purposes set out above.
How long will you retain my data?
We will hold details relating to your employment for the length of your employment, and for at least 6 years following the termination of your employment.
We may also hold other information about you where required by law, such as for health and safety or accounting records, or where necessary for safeguarding matters. In these cases, we will hold the information for as long as necessary for these purposes or as required by law, and we will ensure that your data is reviewed over time to ensure that it is not held where no longer necessary.
Where a claim is being made (or is considered highly likely to be made), we may extend our retention periods in order to appropriately protect our legal position. Otherwise, after the relevant periods set out above, we will securely destroy your personal information in accordance with our data retention policy.
To view our careers page, please see https://careers.thefa.com.
