Summary of how The Football Association (“The FA”) uses your data
- The FA processes information about intermediaries in order to register and regulate those who act as intermediaries in football. Initial information is collected through Whole Game System (“WGS”), and checks made to ensure that intermediaries meet the standards set by The FA (the “Test of Good Character”). Those who wish to represent minors (players aged under 18) also need to undergo an enhanced Disclosure and Barring Service (“DBS”) check.
- Where intermediaries are accepted onto the register, this will be displayed on an FA website listing all registered intermediaries. This will display whether the intermediary is entitled to act on behalf of minors.
- Data held by The FA may be shared with FIFA and UEFA, located in Switzerland, as well as leagues and statutory and/or other regulatory bodies.
- Our privacy policy sets out more details of this processing, including details of your data protection rights, including your right to object to certain processing.
What does this policy cover?
This policy describes how The FA will make use of your data when registering and regulating intermediaries in English football. We will also process data about you as a participant in football, and in accordance with our Participants Privacy Policy Where you interact with young players, your data will also be processed in accordance with our Safeguarding Privacy Policy .
This policy describes your data protection rights, including a right to object to some of the processing which The FA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.
What information does The FA collect about intermediaries?
The FA collects information you provide as part of your intermediary application, which includes information such as your FA number (FAN), your contact information, payment details and responses you provide to the Test of Good Character questions. The FA may also collect information you provide as part of any investigation into your conduct or the conduct of other Participants (as defined in The FA rules from time to time).
What information is provided by third parties about intermediaries?
Information is obtained through a DBS check for all intermediaries seeking to register. Where an intermediary wishes to work with minors, information is obtained through an enhanced DBS check. This will include details of relevant criminal convictions. The FA uses GB Group to obtain this DBS information.
Information about the use of an intermediary will be provided by a club involved in a player’s transfer, including details of the transfer the intermediary is involved in and the amount of money they are due as a result of the transfer.
Information regarding the conduct and affairs of an intermediary may be provided by clubs, players, other Participants (as defined in The FA rules from time to time) or third parties (such as other regulatory bodies or law enforcement agencies).
How does The FA use this information, and what is the legal basis for this use?
The FA will use this information for the following purposes:
- As required by The FA to conduct its business and pursue its legitimate interests, in particular:
- communicating with you or about you where necessary to administer the game and enforce The FA’s rules and regulations, particularly The FA Regulations on Working with Intermediaries, including advising you of renewals and informing clubs of your registered status;
- administering the systems holding intermediary data, including WGS and IMS;
- enforcing The FA Regulations on Working with Intermediaries, including the processing of criminal offences and potentially sensitive data provided by you or by GB Group to protect the integrity of the game and maintain appropriate standards of behaviour;
- publishing details of registered intermediaries as required by The FA Regulations on Working with Intermediaries; and
- acting as a clearing house for payments to intermediaries, and processing payments due to you as a result of your involvement in a player’s transfer.
- For purposes which are required by law:
- in response to requests by government or law enforcement authorities conducting an investigation; and
- in order to meet requirements to ensure the safeguarding of young people through carrying out enhanced DBS checks, which may include the processing of criminal offence data.
How is data shared, where and when?
Information may be passed to clubs, leagues, UEFA and FIFA in relation to the registration of intermediaries to work in the English transfer market and as a result of your involvement in transfers relating to players of particular clubs.
Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of the parties’ legal or legitimate interests in compliance with applicable laws.
Personal data will also be shared with third party service providers, who will process it on behalf of the controllers for the purposes identified above. Such third parties include, for example, providers of online payment systems.
In sharing your data with UEFA and FIFA, your data will be transferred to Switzerland. This data is adequately protected as Switzerland is recognised by the European Commission as providing adequate protection under its data protection laws.
What rights do I have?
You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.
To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This likely to be the Information Commissioner’s Office in the UK.
Information that is provided in order to manage your registration as an intermediary is mandatory. If relevant data is not provided, you cannot be registered as an intermediary.
How do I get in touch with you, or your data protection officer?
If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ.
How long will you retain my data?
The FA retains all information relating to intermediaries for as long as you remain registered as an intermediary. The FA will also retain information after your registration lapses or is rejected as follows:
- information relating to failed registrations, and in particular the reasons for failure will be retained for 5 full seasons following the end of the season in which the application for the failed registration is made;
- information relating to any decisions taken to remove registration or to enforce FA rules or regulations against you will be retained depending on the reason for removal of your registration or enforcement of FA rules and regulations against you, in accordance with The FA’s Safeguarding Privacy Policy, Anti-doping Privacy Policy , Participants Privacy Policy or WGS Privacy Policy (as applicable to the relevant decision);
- information after optional withdrawal from registration will be retained for five full seasons after the end of the season in which the optional withdrawal from registration has been made;
- information relating to DBS checks will be retained in order to validate the information contained within the DBS check and, if relevant, for the duration of any investigation or case in accordance with our Participants Privacy Policy and
- where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.
