WHO WE ARE

This Notice tells you what to expect in relation to personal information about you which is collected, handled and processed by Middlesbrough Football & Athletic Company (1986) Limited, Riverside Stadium, Middlesbrough, TS3 6RS (“the Club” or “MFC” or “We”) as Data Controller. 

We are committed to protecting your data and respecting your privacy. 

We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect with your data.  We handle and process data in accordance with the General Data Protection Regulation 2018 (“GDPR”) and the Data Protection Act 2018.  

 

INFORMATION WE MAY COLLECT 

As part of the recruitment process, you give us information when you apply for a job; complete an application form or submit a CV; attend an interview; accept a job offer and provide details for your contract of employment and to enable us to pay you and for general administrative purposes or when you complete an employee survey or form.  This information may be provided in person, or via a form, phone, email or online; or by communicating with us via any other channel.

The information about you that we may collect, hold and process may include:

  • Name and contact information including postal addresses, email addresses and phone numbers
  • National Insurance numbers or other national government identifiers
  • Date of birth
  • Gender
  • Financial account information such as bank account details and payroll information
  • Pension and Insurance enrolment information.
  • Health, fitness, medical and genetic information
  • ID documentation including birth certificate, passport, driving licence or work permit information
  • Proof of right to work in the UK
  • Marital status, dependants and beneficiaries
  • Next of kin and emergency contact information
  • Salary, annual leave and benefit information
  • Compensation history
  • Education, qualifications, skills, experience and employment history
  • Employment records (including professional memberships, references, work history, and proof of work eligibility)
  • Photograph
  • IP address
  • Location detail
  • Other personal details included in a CV or cover letter or that you have otherwise voluntarily provided.

The sensitive personal information that we may also collect includes:

  • Racial or ethnic origin
  • Political opinions
  • Religious and philosophical beliefs
  • Trade union membership
  • Health and disability
  • Sex life, sexual orientation or gender reassignment
  • Genetic and biometric data
  • Pregnancy and maternity

We may collect information about you from third parties such as:

  • Recruitment and employment agencies
  • HMRC
  • Department of work and pensions
  • DVLA
  • NHS
  • Government contact tracing service
  • Previous employers and referees provided to us by you
  • Disclosure and Barring Service
  • Public sources such as LinkedIn, FaceBook and other social media platforms

We keep a record of the emails sent between you and MFC.

We may monitor or record calls for security and training purposes and to improve our business processes.

Your image and vehicle number plate may be recorded by CCTV when you visit any of our sites for safety and security purposes and to improve the service we can provide to you.  This footage may also be used to exercise and defend our legal rights.  Where necessary this footage will also be shared with the authorities for law enforcement purposes.

 

HOW WE USE YOUR INFORMATION

The above information is used to:

  • Enable us to process your application properly and to assess your suitability for the role
  • Allow us to manage the recruitment process access and confirm candidate’s suitability for employment and decide whom to offer a job to
  • Allow us to make reasonable adjustments in respect of any disability you have informed us of
  • Allow us to monitor the effectiveness of our equal opportunities policy
  • Administer and manage the employment contract
  • Payroll, pension and benefits administration
  • Background checks
  • Compliance with applicable laws, court orders or other legal or tax requirements
  • Obtain government or other third party funding and apply the apprenticeship levy

 

HOW WE KEEP YOUR INFORMATION SAFE

All personal information we hold is stored on our secured servers in the UK and EU.

Access to our information is strictly controlled.  We may disclose your details to police, regulatory bodies, local authorities, football governing bodies or legal and professional advisors and insurers if so required.  If any of the organisations to which we disclose your personal information is situated outside the European Economic Area (EEA) we would take reasonable steps to ensure that your information is properly protected including safeguards such as using contractual provisions to ensure your information is properly protected.  

 

DISCLOSURE OF YOUR INFORMATION

We do not share your information with any third party without your agreement unless we are under a duty to disclose or share your personal data in order to comply with any legal, regulatory or tax obligation, or in order to enforce or apply our terms the employment contract; or to protect the rights, property, or safety of MFC or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and with the NHS for the purpose of contact tracing. 

If your application for employment is successful and We make you an offer of employment, We will at that stage share your data with former employers to obtain references for you, employment background check providers to obtain necessary background checks and the Disclosure and Barring Service to obtain necessary criminal records checks.

Any third party providers used by us to fulfil our contractual obligations to you will only collect, use, store and disclose your information in the manner and to the extent necessary for them to provide their services to us.  We have written agreements in place with each third party to ensure that your information is kept securely, is not used for any other purpose and is deleted when no longer required.

Such third party providers may include:

  • Cornerstone IT
  • HMRC
  • HSE

We may share personal information with other organisations such as the Premier League, the English Football League, and other governing bodies for compliance purposes, research, reporting and improvement of strategic planning and business decisions or funding.

We never sell personal information to third parties.  

 

WHAT IS THE LEGAL BASIS FOR PROCESSING THE INFORMATION

The legal basis for collecting and processing your data may be:

  • Consent – you may have given us your consent to use your data.  You can withdraw your consent at any time.
  • Contractual obligation – pre-contract checks and entering into and performance of the employment contract with us means we need your personal information (including financial information).
  • Legal obligation – if required by law to process personal information for example to comply with employment, social security or social protection law, health and safety and equality obligations, to provide information to the police to prevent fraud or criminal activity and to comply with our HMRC obligations.
  • Legitimate interest – for a genuine business reason that does not override your rights, freedom or interests for example administrative purposes. 
  • To protect another person’s vital interest.
  • For carrying our public functions or for public interest.

 

YOUR RIGHTS

You have the right at any time to ask for a copy of the information we hold about you and confirmation of how it is being processed.  You will be required to verify your identity when making a request.  If you would like to make a request for information please:

Email - data@mfc.co.uk or Send a request in writing to Data Protection Officer, Middlesbrough Football Club, Riverside Stadium, Middlesbrough, TS3 6RS. 

You also have the right to:

  • request that we correct inaccuracies to your information or complete your information if incomplete.  You must notify us of any updates, amendments or corrections to previously collected personal information in writing to HR.  This can be via email.  We require you to keep the personal information we hold on you up to date and accurate;
  • request that we delete some or all of your personal information for example if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it;
  • request that we stop or limit the processing of your information where you think the information we hold is inaccurate (until the accuracy is proved or updated); if you have objected to the processing (when it was necessary for legitimate interests); if you have consented to the use of it; or if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it;
  • (in certain circumstances) move, copy or transfer your personal information to another organisation or to yourself.  This applies only to personal information you have provided us with and is being processed by us with your consent or for performance of a contract and is processed automatically;
  • (in certain circumstances) you have the right to object to certain types of processing of your personal information when it is based on legitimate interests, when it is processed for direct marketing including profiling, or when it is processed for the purpose of statistics.

 

HOW LONG DO WE KEEP YOUR INFORMATION?

Your personal information will be retained for no longer than is necessary to fulfil the purpose for which we collected it or as required to satisfy any legal or reporting obligation or to resolve a dispute or enforce an agreement. 

When We no longer require your personal information, We will dispose of it in line with approved company processes.  If personal data is retained for legal or reporting obligations it will be archived and reduced to the minimum information required.

 

WITHDRAWING CONSENT

If you have provided us with your consent to process your personal information you have the right to withdraw this at any time.  In order to do so you should contact us by emailing data@mfc.co.uk.

 

CONTACT US 

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us by contacting:

Data Protection Officer, Middlesbrough Football Club, Riverside Stadium, Middlesbrough, TS3 6RS

data@mfc.co.uk

You also have the right to contact the Information Commissioners Office at https:\\ico.org.uk\concerns\

 

 

CHANGES TO THIS NOTICE 

Our policies are constantly under review and this Privacy Notice may be changed by us at any time.  Any significant changes shall be notified to you.