Summary of how Whole Game System uses your data
- Whole Game System is a web-based system used by The Football Association Limited (“The FA”), County Football Associations (“County FAs”), Other Football Associations (as defined in The FA’s rules), leagues and clubs for a number of their football administration functions. It is particularly used for club and player registration and refereeing reports.
- Data may be provided by you or a club official or by a referee submitting a report, depending on your role in football. Information is shared between clubs, leagues, County Fas, Other Football Associations and The FA in order to facilitate the national game.
- If you are registering a third party into Whole Game System, you must make sure they are aware of this, and direct them to view this privacy policy. Where given an appropriate email address, The FA will take steps to ensure individuals are aware of their registration and are provided with this privacy policy.
- If you are a referee, you might be asked to place sensitive data into the system in order to allow The FA to carry out diversity monitoring. However, this information is stored and then processed by The FA anonymously. Limited sensitive data is also collected about players who are registered for disability teams, given that the registration indicates that the player is disabled in some way.
- Some information stored in Whole Game System, particularly about discipline (including yellow cards, red cards and suspensions), may be retained indefinitely in order to maintain a record of the game.
- Our privacy policy sets out more details of your data protection rights, including your right to object to certain processing.
What does this privacy policy cover?
This privacy policy describes how The FA, County FAs, Other Football Associations, leagues and clubs will make use of your data when collected or stored in Whole Game System, The FA’s football administration system.
Whole Game System collects information in relation to a number of different types of users. If you are an intermediary, or a referee, the collection and use of your data by The FA, County FAs and Other Football Associations through Whole Game System is discussed in more detail in the Intermediaries Privacy Policy and Match Officials Privacy Policy respectively. This privacy policy focuses on the use of data relating to players, parents and club officials as held in Whole Game System. If you use your FA number (FAN) to log in on another FA website, this will be processed in accordance with The FA Website Privacy Policy.
This privacy policy describes your data protection rights, including a right to object to some of the processing which any of the data controllers mentioned above carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.
What information does Whole Game System collect?
Whole Game System collects and processes personal data about players, parents and club officials. This will include, depending on your role:
Players/Parents:
- your name, FAN and password;
- your date of birth and gender;
- current and previous club affiliations and teams – this could include information on whether you are or have been registered to a disabled team;
- your (or your parent’s) contact details, including email address, phone number and physical address as provided by you or your parent;
- any parental relationship you have to another individual in Whole Game System;
- your photograph, where required by your league or County FA or Other Football Association;
- details of any ID checks carried out by your club (if required by your league or County FA or Other Football Association);
- details of any discipline or misconduct as submitted by a referee; and/or
- details of any appeals against charges or suspensions made on your behalf by a club official.
Club Officials:
- your name, FAN and password;
- your date of birth and gender;
- your role within the Club;
- current and previous club affiliations;
- your contact details, including email address, phone number and physical address as provided by you;
- details of whether you have completed any mandatory or recommended checks or training, such as DBS checks, and when these expire; and
- where you use a personal account to make payment, card details are collected and processed using Barclays Smartpay.
Club officials may be asked to undergo criminal records checks to meet safeguarding requirements. The processes around this are covered in The FA’s Safeguarding Privacy Policy.
Further details in respect of how The FA processes information collected about referees and intermediaries are set out in the relevant policies mentioned above. Please note that if you are a referee, you might be asked to place sensitive data into the system in order to allow The FA to carry out diversity monitoring. However, this information is stored and then processed by The FA anonymously.
What information is provided by third parties in Whole Game System?
Information is often provided by third parties in Whole Game System. In particular:
- Where you are a player, your registration information may be entered into the system by a club official at your current club, although this will initially be collected from you. Information about your discipline record and any misconduct charge will be provided by a referee directly into Whole Game System.
- Where you are a club official, information may be initially entered into the system by another club official (in particular, a Club Secretary). Information about whether you have completed relevant training or checks may also be provided by third parties.
How do various parties use this information, and what is the legal basis for this use?
Your club(s) will use this information for the following purposes:
- As required by your club to administer its club and teams, in particular:
- searching and adding new players to their clubs and teams where you have already been registered on Whole Game System by another club;
- communicating with you or about you where necessary to administer the club, such as inputting information to register you as a player or club official for that season;
- administering and ensuring the eligibility of players and club officials involved in games and leagues the club is involved in – this may involve the receipt of and provision of limited amounts of sensitive data in relation to disabled players, where they are registered for a disabled league or team;
- using The FA’s Matchday App to communicate with you and organise fixtures, training sessions and events, including selection of teams;
- ensuring that children and individuals at risk in the game are appropriately protected from harm, including safeguarding activities and checks of whether appropriate mandatory training and checks have been carried out; and
- complying with the current FA Handbook and FA, County FA, Other Football Association and league regulations and rules on the affiliation of clubs and registration of players.
Your leagues will use this information for the following purposes:
- As required by your league to administer its league and teams, in particular:
- communicating with you or about you where necessary to administer the league, such as communicating directly with club officials;
- administering and ensuring the eligibility of players and club officials involved in its league – this may involve the receipt of limited amounts of sensitive data in relation to disabled players, where they are registered for a disabled league or team;
- ensuring that children and individuals at risk in the game are appropriately protected from harm, including safeguarding activities and checks of whether appropriate mandatory training and checks have been carried out by club officials in its leagues; and
- complying with the current FA Handbook, FA, County FA and Other Football Association rules and regulations on league sanctioning and registration, and ensuring compliance with any league rules on club affiliation and registration of players.
Your County FA or Other Football Association will use this information for the following purposes:
- To fulfil a contract, or take steps linked to a contract: this is relevant where you make a payment as a club official using your personal card details on Whole Game System, in taking your payment and providing you with a receipt of payment.
- As required by your County FA or Other Football Association to administer the game and pursue its legitimate interests, in particular:
- communicating with you or about you where necessary to administer the game, such as informing you of a change in registration or informing your clubs of your suspension for an upcoming fixture;
- communicating with you to make you aware of or ask for your opinion on County FA or Other Football Association initiatives;
- administering and ensuring the eligibility of players and club officials involved in games governed by the County FA or Other Football Association – this may involve the receipt of limited amounts of sensitive data in relation to disabled players, where they are registered for a disabled league or team;
- maintaining records of the game as played in that county, in particular maintaining details of discipline and applying appropriate fines and/or suspensions;
- ensuring that children and individuals at risk in the game are appropriately protected from harm, including safeguarding activities, and checks of whether appropriate mandatory training and checks have been carried out;
- if you provide a credit or debit card as payment, checking the validity of the sort code, account number and card number you submit through a third party in order to prevent fraud (see data sharing below); and
- complying with the current FA Handbook and rules on the sanctioning of leagues, affiliation of clubs and registration of players and ensuring compliance with any County FA or Other Football Association rules and regulations on league sanctioning, club affiliation and player registration.
The FA will use this information for the following purposes:
- As required by The FA to conduct its business and pursue its legitimate interests, in particular:
- communicating with you or about you where necessary to administer the game , including informing you of a change in registration and responding to any questions you send to Whole Game System’s administrators;
- communicating with you to make you aware of or ask for your opinion on Football Association initiatives;
- administering and ensuring the eligibility of players and club officials involved in English football – this may involve the receipt of limited amounts of sensitive data in relation to disabled players, where they are registered for a disabled league or team;
- maintaining records of the game as regulated by The FA, in particular maintaining details of discipline and misconduct;
- monitoring use of Whole Game System, and using this to help it monitor, improve and protect its content, services and sites, and investigate any complaints received from you or from others about Whole Game System or how Whole Game System has been used;
- ensuring compliance with the current FA Handbook and regulations on the sanctioning of leagues, affiliation of clubs and registration of players;
- providing reward packages (including but not limited to football equipment and apparel) to FA Charter Standard accredited clubs;
- communicating with you to ask for your opinion on FA initiatives; and
- where you are a club official, certain contact details may also be shared publicly through publication on The FA’s Just Play website in order to enable players to contact your club, provided that you have chosen to make such details available.
- Where you give your consent:
- The FA will send you direct marketing in relation to its relevant products and services, or other products and services provided by The FA or The FA’s official partners and suppliers – this is described in the FA Website Privacy Policy, together with information on your rights. You saw this when you first registered for a FAN.
- The FA places cookies and uses similar technologies in accordance with its Cookies Policy and the information provided to you when those technologies are used.
- For purposes which are required by law:
- in response to requests by government or law enforcement authorities conducting an investigation.
Withdrawing consent
Wherever The FA relies on your consent, you will always be able to withdraw that consent, although it may have other legal grounds for processing your data for other purposes, such as those set out above.
What cookies and/or tracking technologies does The FA use?
When you visit one of our websites, we may also collect, process and use informing about you and your use of the website, including any forums you visit and how you arrived at our site. Such information may be collected through "traffic data" and may entail the use of "cookies" or other tracking technologies, IP addresses or other numeric codes used to identify your computer. For more information on Cookies please click on the link to our Cookies Policy.
Apple iOS and Android Devices
If you access an FA application from these devices you consent to cookies being stored to your device (and other tracking technologies being used to read data from your device) for the following purposes: keeping you logged in, ensuring that an appropriate version of content is presented, analytics and advertising. Many of these cookies and technologies are essential to the operation of the application. It is not currently possible to opt out or remove these cookies (or prevent use of these technologies) from the device without deleting the application.
How is data shared, where and when?
Where you are registered as a player, some of your registration information will be available to the Player Registration Officer (“PRO”) of any club that tries to register you as a player. In particular, your name, FAN and date of birth will be visible to all PROs. If a PRO adds you to a club, this will be visible to you when you are logged on to Whole Game System. Clubs should also inform you if you have been added. For all players under 16, PROs are required to certify that they have parental consent to add youth players to their team. Unless your existing teams have waived their notice requirements, your existing team would be told about this new registration. Photographs are never shared with a different club.
Information about players is also shared amongst the relevant leagues, County FAs and Other Football Associations for the reasons set out above, and with referees who need to populate their discipline reports. The FA will also have access to data for the purposes set out above.
Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of the parties’ legal or legitimate interests in compliance with applicable laws.
Personal data will also be shared with third party service providers, who will process it on behalf of the controllers for the purposes identified above. Such third parties include providers of payment processing services.
If at any point your information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data will be adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor's Processor Binding Corporate Rules.
What rights do I have?
You have the right to ask any of the relevant data controllers for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where one of the data controllers doesn’t have to process the data to meet a contractual or other legal requirement, or where it is using the data for direct marketing).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask a data controller to delete information which it is required by law to keep or has compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.
In some instances, you will need to contact more than one of the data controllers to ensure your rights are met, as they may have access to different data and have different reasons for holding the data. As the main provider of the system, The FA will be in the best position to provide you with a number of these rights, particularly access to all information held about you in Whole Game System and to correct any underlying data connected to your FAN.
To exercise any of these rights, you can get in touch with The FA – or its data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.
With the exception of photographs where particular leagues do not require the provision of photographs, the provision of optional contact details or use of club official personal payment cards, the provision of player registration and club official data is mandatory to allow the national game to be appropriately administered. If relevant data is not provided, the various data controllers will not be able to administer the game or their club, league or county, ensure the safety, welfare and eligibility of all players and manage and respect the game’s disciplinary processes. All other provision of your information is optional. If you or your club fails to provide optional contact information, this might mean the various data controllers cannot inform you of important changes or get in contact with you to seek your opinion.
How do I get in touch with you, or your data protection officer?
If you wish to make a data privacy request, you can do so via our online form, which can be found here. We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@thefa.com or by writing to: Data Protection Officer, Wembley Stadium, PO Box 1966, London, SW1P 9EQ. You can also get in touch directly with your club through your club secretary, your league through your league secretary, your County FA through the contact details found at the following website: //www.thefa.com/about-football-association/who-we-are/county-fas, or an Other Football Association through the relevant website of the Other Football Association.
Which club, league or County FA or Other Football Association is my data controller?
The data controllers for your information are any club, league, County FA or Other Football Association you play in or for. The FA is also a data controller for all data within Whole Game System. You can check which clubs, leagues, County FAs or Other Football Association you are affiliated with by logging in to Whole Game System. You can also control the extent to which you are registered with clubs or leagues through the Club Requests section of Whole Game System. As mentioned above, information about players is available to PROs at other clubs where your details match their search queries.
How long will you retain my data?
Where a club processes registration data, it will do this for as long as you are a member of the club. It may hold your data offline for longer – it will inform you of this separately. You can restrict online access on Whole Game System by exercising your registration rights through the system.
Subject to the below, The FA, County FAs, Other Football Associations and leagues retain your information on Whole Game System for five full seasons after your account has become inactive on Whole Game System. For the avoidance of doubt, activities that will result in your account being deemed active include, but are not limited to, being registered as a member of a club or logging onto your account.
The FA, your County FA and Other Football Association will also retain limited information about discipline (including yellow cards, red cards and suspensions) indefinitely in order to maintain a record of the game. For more information on how we hold your other disciplinary data, please see:
You can contact The FA if you no longer wish to participate in the game, and you can change your details by logging in to Whole Game System.
Where your data is held on FA systems, then at the end of the retention periods set out above, we will not irrevocably delete your information for another 3 months – your data will be held in an inactive form for this time to ensure that any consequential links across our systems remain intact in the event that your data is removed in a particular location.
