WHO WE ARE
This Notice tells you what to expect in relation to personal information about you which is collected, handled and processed by Middlesbrough Football & Athletic Company (1986) Limited, Riverside Stadium, Middlesbrough, TS3 6RS (“the Club” or “MFC” or “We”) as Data Controller.
We are committed to protecting your data and respecting your privacy.
We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect with your data.
We handle and process data in accordance with the General Data Protection Regulation 2018 (“GDPR”), Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.
INFORMATION WE MAY COLLECT
You give us information when you contact us with an enquiry; use or register on the Website; forward an item to a friend; purchase a ticket or merchandise; fill out a survey or other form; request us to provide you with information; enter a competition or prize draw or engage in a promotion or survey; post information to public areas of the Website; book an event or hospitality, by phone or email or online via our Website or via our App; sign up a Digital Account or update preferences on our Website; contact us via email, mobile messaging or when posting on or communicating via our social medial platforms; become a sponsor or advertiser; become a mascot or provide content for our Match Day Programme or by communicating with us via any other channel.
The information we may collect, hold and process about you, provided by you, may include:
• Email address
• Telephone number(s)
• Bank details and/or payment details
• Date of birth
• Dietary requirements
• Health, fitness, medical and genetic information
• Billing information
• Vehicle registration number, make and model
• Details of other people within your group booking including name and age
• Purchase/transaction and ticketing history (including seat location)
• Encrypted record of login password
• Your preference for how we communicate with you about our activities
• IP address
• Location details
• Details of your visits to our website including but not limited to traffic data, location data and other communication data and resources you have accessed
• Information that is available publicly, including social media username if you interact with us through social media channels
• Record of incidents, accidents and treatment received
We maintain a record of your transaction history, but we never store your payment card number (although we may keep a secure record of the last four digits only to help us identify transactions).
We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you relevant information. We may track subsequent online actions such as ticket or retail purchases and enquiries.
With regard to each of your visits to our Website we collect the following information:
• technical information, including the Internet protocol (IP) address used to connect your computer/device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
We may monitor or record calls for security and training purposes and to improve the quality of our services.
Your image and vehicle number plate may be recorded by CCTV when you visit any of our sites for safety and security purposes and to improve the service we can provide to you. This footage may also be used to exercise and defend our legal rights. Where necessary this footage will also be shared with the authorities and/or governing bodies for law enforcement purposes.
HOW WE USE YOUR INFORMATION
The above information is used to:
• provide our products and services to you and enable us to process, administer and manage your orders, contracts, accounts
• create an account so that we understand and respect your preferences
• establish dietary requirements and provide suitable catering options for you and your guests (where applicable)
• inform you about changes to our products and services or new products and services
• inform you about renewals and additional matches to which you may have the opportunity to purchase tickets
• communicate information about any agreement you may have with us or have enquired about
• inform you about offers, events and promotions that may be of interest to you
• improve the services the Club offers you (which may sometimes include undertaking customer research)
• keep a record of your relationship with us and how you prefer to be contacted
• analyse your personal information to create a profile of your interests and preferences so we can contact you with information most relevant to you
• ensure that content from our Website is presented in the most effective manner for you and for your computer
• administer our Website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
• administer prize draws and competitions you have entered
• allow you to participate in interactive features of our service, when you choose to do so
• as part of our efforts to keep our site safe and secure
• resolve an enquiry or progress a complaint
• comply with legal and regulatory obligations placed on the Club
• comply with Government guidance for public health reasons including NHS contact tracing
We use profiling and segmentation to ensure communications are relevant to you. For this purpose we may analyse geographic, demographic and other information relating to you to enable us to understand your preferences.
The Club and/or its media, commercial or charity partners may from time to time create images and/or audio-visual footages of you and your guests at the Ground. The Club is the owner of all rights in such footages and shall be entitled to use such footage on any media platform for the following purposes:
• Promotional, marketing and commercial purposes
• Training for Club employees and third parties who work with the Club
• Broadcasting and editorial purposes
HOW WE KEEP YOUR INFORMATION SAFE
All personal information we hold is stored on our secured servers in the UK and EU.
Access to our information is strictly controlled. We may disclose your details to police, regulatory bodies, local authorities, football governing bodies and the Independent Football Ombudsman or legal advisors if so required.
If any of the organisations to which we disclose your personal information is situated outside the European Economic Area (EEA) we would take reasonable steps to ensure that your information is properly protected including safeguards such as using contractual provisions to ensure your information is properly protected.
DISCLOSURE OF YOUR INFORMATION
Any third party providers used by us to fulfil our contractual obligations to you will only collect, use, store and disclose your information in the manner and to the extent necessary for them to provide their services to us. We have written agreements in place with each third party to ensure that your information is kept securely, is not used for any other purpose and is deleted when no longer required.
Such third party providers may include:
• Ticketing system provider – SeatGeek Sport Limited
• Email distribution service
• Mailing house
• SMS distribution service
• Marketing service provider
• Online retail provider
• Online audio and video player
• Club fixture calendar provider
• App provider
• IT companies who support our Website and other business services
• professional advisors and insurers
• MFC Foundation – administration, support and programme delivery services
• Analytical or search engine provider to assist us with the improvement or optimisation of our Website and services
• Credit reference agency for the purpose of assessing your credit score where this is a condition of us entering into a contract with you
We may share personal information with other organisations such as the Premier League, the English Football League, the Football Association and other governing bodies to ensure compliance with, and improvement of terms of condition of entry, assist with research and reporting on attendance and improve strategic planning and business decisions and to protect the rights of the governing bodies in and the Club.
We never sell personal information to third parties.
Our Website may, from time to time, contain links to and from the websites of our commercial partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
WHAT IS THE LEGAL BASIS FOR PROCESSING THE INFORMATION
The legal basis for collecting and processing your data may be:
• Consent – you may have given us your consent to use your data for example when you tick a box to receive marketing emails, offers and newsletters. You can withdraw your consent at any time.
• Contractual obligation – to enter into a contract with us we need your personal information (including financial information) to process and fulfil the contract for example to purchase a ticket or view digital content.
• Legal obligation – if required by law to process personal information for example to comply with health and safety and equality obligations or to provide information to the police to prevent fraud or criminal activity.
• Legitimate interest – for a genuine business reason that does not override your rights, freedom or interests for example administrative purposes, or using your purchase history to send you personalised offers.
• Public task – if we are required to carry out a specific task in the public interest as laid down by law.
CHILDREN AND YOUNG PEOPLE’S PRIVACY NOTICE
We understand that children and young people under the age of 14 years (“Children”) may visit our Website or otherwise interact with us. Children may need their parent or guardian’s permission to use or access certain areas of our Website or receive certain information through the Website.
Children may also be asked to confirm they have that permission and we reserve the right to verify parental or guardian consent where required.
We do not actively market to Children. We do not share Children’s personal information for any commercial purpose.
You have the right at any time to ask for a copy of the information we hold about you and confirmation of how it is being processed. You will be required to verify your identity when making a request. If you would like to make a request for information please:
Email firstname.lastname@example.org or
Send a request in writing to: Data Protection Officer, Middlesbrough Football Club, Riverside Stadium, Middlesbrough, TS3 6RS.
You also have the right to:
• request that we correct inaccuracies to your information. You must notify us of any updates, amendments or corrections to previously collected personal information in writing to the Club or by email or by updating your single sign on account online at our Website. We encourage you to keep the personal information we hold on you up to date and accurate;
• request that we delete some or all of your personal information for example if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it;
• request that we stop or limit the processing of your information where you think the information we hold is inaccurate (until the accuracy is proved or updated); if you have objected to the processing (when it was necessary for legitimate interests); if you have consented to the use of it; or if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it;
• (in certain circumstances) move, copy or transfer your personal information to another organisation or to yourself. This applies only to personal information you have provided us with and is being processed by us with your consent or for performance of a contract and is processed automatically;
• (in certain circumstances) you have the right to object to certain types of processing of your personal information when it is based on legitimate interests, when it is processed for direct marketing including profiling, or when it is processed for the purpose of statistics.
HOW LONG DO WE KEEP YOUR INFORMATION?
Your personal information will be retained for no longer than is necessary to fulfil the purpose for which we collected it or as required to satisfy any legal or reporting obligation or to resolve a dispute or enforce an agreement.
When We no longer require your personal information, We will dispose of it in line with approved company processes. If personal data is retained for legal or reporting obligations it will be archived and reduced to the minimum.
If you have provided us with your consent to process your personal information you have the right to withdraw this at any time. In order to do so you should contact us by emailing email@example.com.
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us by contacting:
Data Protection Officer
Middlesbrough Football Club
You also have the right to contact the Information Commissioners Office
CHANGES TO THIS NOTICE
Our policies are constantly under review and this Privacy Notice may be changed by us at any time. Any changes shall be posted on the Website (www.mfc.co.uk) and we recommend that you check regularly to review the latest version.