Privacy Policy

Privacy Policy 

Introduction 

In this Privacy Notice, references to “we”, “us”, “our” or “ECFC” are to Exeter City A.F.C. Limited registered in England and Wales with company number 00097808 whose registered office is at St James Park, Stadium Way, Exeter, Devon, England, EX4 6PX.

“Personal Data” means any information relating to you, an identified or identifiable natural person.

We are the “data controller”, meaning that we are responsible for determining the purposes and means of ECFC’s processing of your Personal Data.

We are committed to protecting your privacy and to complying with our legal obligations when using your Personal Data. This Privacy Notice explains how we aim to fulfil this commitment, so please read this document carefully. 

What Personal Data do we collect?

When you interact with us (when using our digital platforms or otherwise), we may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together as follows:

• Identity – includes first name, surname, gender, date of birth

• Contact – includes email address, phone number(s) and address

• Financial – includes payment card details, billing address, purchase information, payment history

• Profile – includes username, profile image

• Transaction – includes details about payments to and from you and other details of products and services you have purchased from us

• Market and communications – includes your preferences in receiving marketing from us and our third parties and your communication preferences

• Usage – includes information about how you use our digital platforms, including time spent on page, click-throughs, download errors

• Technical – includes IP address, browser type, hardware type, network and software identifiers, device information, operating system and system configuration

We may also collect, use and share aggregated data such as statistical or demographic data which is not Personal Data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' usage data to calculate the percentage of users accessing a specific online feature in order to analyse general trends in how users are interacting with our digital platform to help improve the digital platform and our service offering.

How do we collect your Personal Data?

We use different methods to collect data from and about you including through:

• Your interactions with us – you may give us your Personal Data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide when you:

  • Buy or subscribe to any of our products or services;

  • Create an account on any of our digital platforms;

  • Request marketing to be sent to you;

  • Enter a competition, promotion or survey; 

  • Give us feedback or contact us. 

• Automated technologies or interactions – as you interact with our digital platforms, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this Personal Data by using cookies and other similar technologies. We may also receive technical data about you if you visit other digital platforms employing our cookies. Click here to view our Cookie Policy.

• Third parties[ or publicly available sources] – we may receive Personal Data about you from various third parties  [and public sources] as set out below:

  • Identity and contact data is collected from publicly available sources such as Companies House and the Electoral Register based inside the UK;

  • Contact, financial and transaction data is collected from providers of technical, payment and delivery services such as Shopify based outside the UK;

  • Technical data is collected from the following parties:

    • analytics providers such as Google based outside the UK; 

    • advertising networks such as Google Ads Manager or Facebook Business Manager based outside the UK; and

    • search information providers such as Google based outside the UK.

 How do we use your Personal Data?

The law requires us to have a legal basis for collecting and using your Personal Data. We rely on one or more of the following legal bases:

• Performance of a contract with you – where we need to perform the contract we are about to enter into or have entered into with you.

• Legitimate interests – we may use your Personal Data where it is necessary to conduct our business and pursue our legitimate interests. We make sure we consider and balance any potential impact on you and your rights before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

• Legal obligation – we may use your Personal Data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

• Consent – we rely on consent only where we have obtained your active agreement to use your Personal Data for a specified purpose, for example if you subscribe to a newsletter.

We have set out, below, a description of the ways we plan to use the various categories of your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

During the registration and transaction process on our digital platforms when your Personal Data is collected, you will be asked to indicate your preferences for receiving direct marketing communications from us.

We may also analyse your identity, contact, technical, usage and profile data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications. 

Who do we share your Personal Data with?

ECFC may on occasions pass your Personal Data to third party suppliers who provide services to us (for example in relation to ticketing, payment processing, stadium access, retail operations, recruitment, logistics, legal and accountancy, website and mobile app operations and functionality, database management and marketing). ECFC requires these parties to agree to process this information based on our instructions and requirements consistent with this Privacy Notice and GDPR (which may include anonymisation and/or aggregation in a way which means you cannot be identified).

We may pass on your Personal Data to government or regulatory authorities or law enforcement officials to assist with their requests and comply with our legal obligations.

ECFC may also disclose your Personal Data to other football clubs and the football authorities to the extent necessary to comply with any football regulations or any investigations in relation to incidents at our matches.

We will not pass on your Personal Data to any third party to market their products/services to you unless we have obtained your consent.

Do we send your Personal Data outside the UK?

Whenever we transfer your Personal Data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring safeguards are in place:

• We may use specific standard contractual terms approved for use in the UK which give the transferred Personal Data the same protection as it has in the UK, namely the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers. To obtain a copy of these contractual safeguards, please contact us. 

• We will otherwise only transfer your Personal Data to countries that have been deemed by the UK to provide an adequate level of protection for Personal Data, namely:

• The European Economic Area

What is our Personal Data retention policy?

We will keep your Personal Data for as long as you are a registered user of one of our digital platforms, or for as long as is reasonably necessary for us to fulfil the purposes we collected it for provide products or services for you, and for a limited period of time afterwards.

Once you no longer wish to be engaged with ECFC we may still need to keep hold of your data if there is a legal reason for doing so (such as for tax purposes where you have made purchases through one of our digital platforms or where we need to resolve any disputes with you).

To determine the appropriate retention period for Personal Data, we consider, amongst other things, the amount and nature of the Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

How do we keep your Personal Data secure?

We adopt industry standard security processes to ensure your data is kept safe and secure and to prevent unauthorised or accidental access or use or loss of your data. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.

Despite the security measures we implement, please be aware that the transmission of data via the internet is not completely secure. As such, we cannot guarantee that information transmitted to us via the internet will be completely secure and any transmission is at your own risk.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your rights as a data subject

At any point whilst ECFC is in possession of or processing your Personal Data, you may have the following rights:

• Right of access – you have the right to request a copy of the Personal Data that we hold about you.

• Right of rectification – you have a right to correct Personal Data that we hold about you that is inaccurate or incomplete.

• Right to be forgotten – in certain circumstances you can ask for the Personal Data we hold about you to be erased from our records.

• Right to restriction of processing – where certain conditions apply you have a right to restrict or suspend the processing of your Personal Data.

• Right of portability – you have the right to have certain Personal Data we hold about you transferred to another organisation.

• Right to object – you have the absolute right to object to certain types of processing such as direct marketing, and you have the right to object to processing we undertake based on our legitimate interests.

• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

• Right to withdraw consent – you have the right to withdraw consent at any time where we are relying on consent to process your Personal Data; however, if you withdraw your consent, we may not be able to provide certain products or services to you – we will advise you if this is the case at the time you withdraw your consent.

If you want to exercise any of these rights, please Contact Us. You don’t have to pay a fee to exercise your rights, unless your request is clearly unfounded, repetitive or excessive (in which case we can charge a reasonable fee). Alternatively, we may refuse to comply with your request in these circumstances.

Where your request is legitimate, we will try to respond within one month (unless there is a legal reason to take longer, such as where your request is particularly complex). In this case, we will notify you and keep you updated. 

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

In addition to the above, you may get in touch with the ICO (Information Commissioner’s Office) if you are concerned about the way in which we are handling your Personal Data. However, where possible, we would really appreciate you speaking with us first if you have any concerns.

Our digital platforms may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party digital platforms and are not responsible for their privacy statements. When you leave our digital platform, we encourage you to read the privacy policy of every digital platform you visit.

How to opt-out of ECFC marketing

To unsubscribe from ECFC newsletters or any other marketing emails, you simply need to log into the digital platform and uncheck the relevant boxes to adjust your marketing preferences, alternatively, click on the unsubscribe button at the bottom of the relevant communication you have received, then untick any mailing lists that you don’t want to subscribe to.

Alternatively, please email media@ecfc.co.uk to opt-out of these communications.

If you opt out of receiving marketing communications, you will still receive communications that we consider are essential for administrative or customer service purposes including, for example, order confirmations, ticket updates, and checking that your contact details are correct.

Your duty to inform us of changes 

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your dealings with us, for example a new address or email address.

Changes to this Privacy Notice

If we amend our Privacy Notice, it will be published on the relevant ECFC digital platform(s) so please check back regularly to see if there have been any updates. If we make any substantial changes, we may also email you if it’s appropriate.

Contact details

If you would like to discuss anything in this Privacy Notice or if you want to exercise your rights, please get in touch:

By Post:

Exeter City Football Club Limited, attention of the Data Protection Lead

St James Park, 

Stadium Way, 

Exeter, 

Devon, 

England,

EX4 6PX

By Email: customerservices@exetercityfc.co.uk