This privacy notice outlines the ways in which the Everton Football Club Company Limited (“Everton”), and, where lawful and appropriate, Everton Group companies including Everton Football Club Women Limited, Everton Stadium Development Limited and Everton in the Community, uses personal data about its supporters.

Everton is registered with the Information Commissioner’s Office to process personal data, registration number Z5476849.

This privacy notice should be read alongside the website Terms and Conditions, cookie notice and other privacy notices which are made available.

1 Who Are We?

Formed in 1878 and a founder of the Football League, Everton Football Club have competed in the top tier of English football more often than any other club and unbroken since 1954. Everton play their homes at Goodison Park, Liverpool, L4 4EL.

Everton is affectionately known as the People’s Club and the Toffees.

Everton has a long and vibrant history; being the first for many achievements including:

• First club to go on an overseas football tour
• First club to construct a purpose-built football stadium and first club to have a four-sided stadium with two tier stands
• First club to issue a regular match programme for home fixtures
• First club to play 100 seasons in the top-flight
• First club to break the £100,000 transfer threshold when Alan Ball moved from Blackpool for £110,000 in 1966.
• First club to have its own online social networking site.
• First club to sell tickets via text message.

 

Everton Football Club Company Limited is a company registered in England with company number 36624, and whose registered office is at Goodison Park, Goodison Road, Liverpool, L4 4EL.

Everton is the Data Controller for the purpose of the Data Protection Act 2018 and the retained UK Law version of the General Data Protection Regulation (EU 2016/679) (collectively “Data Protection Legislation”).

To safeguard your information and protect your information rights, Everton has appointed a Data Protection Officer (DPO) as your single point of contact. The DPO can be contacted on:

Data Protection Officer
Everton Football Club
Goodison Park
Liverpool
L4 4EL
dataprotectionofficer@evertonfc.com

2 What information do we collect and record?

We collect information about you when you engage with our services by registering an online account, visiting our websites, making a purchase, contacting us  with an enquiry or concern, participating in an Everton event, competition or promotion or engaging with Everton channels on social media platforms.

We collect and process the following personal data from you:

• Identify and Contact Data – including your name, address, email address, telephone number, date of birth, and other personal data concerning your preferences relevant to our services. We may collect physical data such as when you have attended matches, tours and events, and data collected through the use of CCTV.
• Financial and Payment Data – including your bank account number, card number, sort code, security code and other data necessary for processing payments and fraud prevention.
• Usage and Preferences – including when you want to receive promotions and news from us (“marketing preferences”), how you engage with our services including which webpages or social media posts you have interacted with, and whether you have opened and read the emails you receive from us. This may also involves analysis of your characteristics to help us better understand our supporters and their behaviours.
• Technical Data – including information collected during visits to our online services such as Internet Protocol (IP) address, device type, time-zone setting, operating system, page views and searches, account username and password. To learn more about our use of cookies or similar technologies please view our cookie notice.
• Sensitive Personal Data – including disability or special requirement data to support your access requirements and make necessary adjustments to improve your experiences. This may include from time to time, equality and diversity data such as your ethnicity, sexual orientation and gender. Completion of equality surveys is entirely voluntary and can be completed anonymously. Everton will not record equality information on your account without your consent.
• We may also collect match day records or other data concerning supporter behaviour and conduct, such as reports of abuse, behaviour and other risk factors.

 

When you register with Everton you are required to provide your name, address, age and contact details. This ensures that we can create a unique record for you and you are given a customer reference number.

Whenever you purchase from the club, we will collect your payment information.  Everton maintain accreditation under the Payment Card Industry Data Security Standard to keep your financial information secure.

Everton may record telephone calls; this is to help keep an accurate record of conversations, staff training and conduct. If telephone calls are not recorded, a written record of the conversation may be kept instead.

With your consent we will send you the latest Everton information and news, including ticket updates, transfers, promotions and offers from our Sponsors and Partners - plus all the key news from the training ground and Goodison.

The Everton website – www.evertonfc.com – uses cookies; these are small pieces of information that are stored by the user’s device and record how people use the website. Some cookies are essential for site maintenance, such as remembering items in your basket for purchases and remembering that you are logged in. Other cookies track your choices to help us personalise the content you receive.

For full information on our cookie use, please see our cookie notice.

3 Why do we collect your information?

Consent in data protection is often misunderstood. For consent to processing to be valid, there must be a genuine choice, fully understood, separate from other conditions and you should be able to withdraw consent at any time. For example, whilst an account registration and season ticket purchase is freely made, this personal data is not processed by ‘consent’. The personal information is necessary to maintain your account or season ticket and because you must comply with the season ticket Terms and Conditions. In this example, you would be unable to withdraw consent and so the appropriate reason for processing the personal data is for the performance of a contract.

There are some circumstances for which your information is processed with your consent.

• Choosing which marketing you wish to receive from us
• Participating in equality and diversity data collection

Everton also routinely collects your information for the following purposes:

• To fulfil a contract. This includes:
  • To register you as a supporter of Everton
  • For you to purchase tickets for matches, events and memberships
  • To process payments for tickets, memberships, merchandise or other goods and services promoted by Everton.
  • To operate competitions and promotions
• Our Legal or Regulatory Obligations. This includes:
  • Health and safety requirements, in particular regarding Goodison Park and Walton Hall Park
  • Compliance with the Premier League rules and regulations
• Our Legitimate Interests. Everton are required to demonstrate that information processed for legitimate interests is appropriate, reasonably expected and respective of individual’s privacy. Legitimate processing includes:
  • Marketing is a legitimate interest activity of Everton and includes understanding our supporters, maintaining a database of all supporters and their marketing preferences. Without keeping a database, Everton would be unable to provide offers and promotions to interested individuals. You can opt-in or out of marketing and manage your contact preferences at any time; your information is not shared with partners or sponsors without your consent and there is minimal risk to your privacy.
  • Crime prevention and detection, in particular the operation of security and the use of CCTV. Crime prevention and detection is a legitimate interest of Everton in order to protect its property from theft, damage and vandalism. It also protects the safety of staff, other fans and members of the public. The use of CCTV supports this interest. There is signage in and around all sites which operate CCTV and you have a right to request information; this helps to protect your privacy and information rights. CCTV imaging is accessed by authorised Everton employees and within a secure viewing area.
  • Premier League initiatives, including the Advanced Equality Standard, and for demonstrating competition integrity. This information would usually be anonymised, but access to identifying information may be required for audit purposes. Adherence to Premier League competition integrity rules is a legitimate interest of Everton in order to maintain its position within the Premier League and avoid monetary or other penalties for breach of the rules, which is likely to affect the Club’s ability to compete.
  • Public safety and stadium safety. Maintaining a safe and secure environment, in particular at Goodison Park, is a legitimate interest of the Club and promotes a positive experience for all staff and supporters. This may involve collection of fan intelligence data to risk assess crowd safety events, including supporters obtaining tickets in the opposition allocation.
  • Information security, including scanning of electronic information for malware or cyber security risks.
  • Business services, such as customer support. Everton is committed to providing a safe and enjoyable experience for all stakeholders; this requires an effective service for the management of complaints, compliments and concerns.
  • Media, including match day footage. Photographic images and/or recordings (and/or stills taken from video recordings) may be taken within the stadium footprint and at other Everton events and also be used, by way of example and without limitation, in televised coverage of the match or by or on behalf of the Club, Premier League or any Football Authority (or their commercial partners) for marketing, training, or promotional purposes, including use on social media. Except where you are not the subject of the media data, for example in general crowd shots, we will make reasonable efforts to gain the consent of that person before publishing such images, however, if this is not possible, then entry into the stadium, an event or by making such information public by engaging with Everton social media channels shall be deemed acceptance unless Everton is notified of an objection in writing.
• Substantial Public Interest permits the processing of sensitive personal information. Such processing may include
  • Preventing or Detecting Unlawful Acts, in particular planned or actual supporter violence.
  • Upholding the Premier League commitment regarding abusive and discriminatory conduct.
  • Fan intelligence on reasonably suspected or actual violence or committing of offences
  • The safeguarding of children and individuals at risk
  • Public health protection, including provisions for the safety of supporters and reduction in transmission of COVID-19.
• Processing required by law or regarding legal claims. This includes:
  • Compliance with a court order
  • Legal requirements such as anti-money laundering, fraud prevention and detection, anti-slavery and Data Protection Legislation. This can include automated checks of personal data you provide about your identity against relevant databases and contacting you to confirm your identity or making records of our communications with you for compliance purposes.
  • If the processing is necessary for the establishment, exercise or defence of legal claims.

 

Any additional and non-routine uses will be notified to you as appropriate.

4 How do we collect information about you?

The personal data we collect is primarily collected directly from you when you interact with our services. This includes when you:

• Register an account
• Make a purchase
• Attend an event

• Request information, marketing and other communications to be sent to you;
• Enter a competition, promotion or survey, or provide us with your feedback; and
• Otherwise interact or correspond with us (including via email, social media or telephone).

We may also collect information from family and friends if, for example they register on your behalf or purchase items for you.

Everton may use third parties to enrich the data which we collect through our own activities with information from other sources in order to hold more accurate and complete records and to better understand our fans. This may include publicly accessible registers and information which you make publicly available, including on social media platforms. The data collection activities of any third parties are subject to their terms and privacy notice, however all processing by Everton is in accordance with our terms and privacy notices.

We may also receive personal data as part of the legal processes we undertake to protect our brand and other intellectual property, or those of our licensees/commercial partners.

5 What if you do not provide information to us?

Many of our services require your personal information in order to access them, for example an account cannot be set up without you providing your name, date of birth and contact information, similarly purchases are likely to require your payment information. If you do not provide your personal information you will not be able to access these services.

Some services may be available without your personal information if payment is made by cash; subject to Everton’s Terms and Conditions.

Other processing, for purposes outlined above, may be undertaken by Everton for which we do not require your consent or information from you.

We try to give you as much choice as possible on what personal information we hold about you without this affecting your experience.

6 Who do we share information with?

Everton will share information in the following circumstances:

• With our Group Companies when this is required as part of shared services
• With third party service providers, such as email exchange and data storage; this will include companies such as Microsoft, Salesforce and Amazon Web Services. Everton retains ownership and authority of our data.
• With third parties working on behalf of Everton; for example, Fanatics (International) Ltd who provide our retail services and Sodexo, who provide the Club’s catering and hospitality services. These companies are permitted to work under the instruction of Everton and cannot use or access your information for their own purposes, unless you engage directly with them.
• With regulatory and other similar bodes including the Premier League and Football Authorities.
• From time to time, it is necessary to share information with other clubs, for the purpose of public and crowd safety. This may include duplicate ticket enquiries and fan intelligence.
• We may also share your information with regulatory bodies and other similar bodies and associations (such as the Premier League and the Football Association).
• The disclosure is required by law; for example, under a Court Order
• In the public interest or in connection with a legal claim and the request is reasonable
• With the Police for crime prevention and detection

We will ask permission to share your information with our official partners and third parties. You can choose to share information in your mailing preferences.

We would also like to contact you with news and how you can get involved with Everton in the Community, Everton’s Official Charity. You can opt-in through your mailing preferences on your online account.

7 International Transfers

Data protection and privacy laws vary across the world; the laws in Europe, including the UK, are deemed to be among the strongest for upholding an individual’s rights. Everton may transfer personal data outside of the UK to other countries which are deemed to provide an adequate level of data protection. We will only transfer personal information to such countries when it is necessary for the services we provide to you, or for other purposes outlined in this privacy notice.

We only transfer personal information to countries not deemed adequate when it is necessary for the services we provide to you, or the data is otherwise subject to safeguards that assure the protection of your personal information,

For individuals not based within the UK, the Club is required to transfer data to the country you reside in to communicate with you; this may be a country which is not adequate for data protection purposes.

The international transfer of your personal information by Everton does not affect your rights within the UK.

8 How long do we keep your information?

Information is retained in accordance with the Everton Information Retention Policy, as updated from time to time.

Supporter data collected for the various purposes will routinely be held for 6 full seasons after the last engagement with the Club, whether that be a login, purchase or other activity on an account. This is to ensure that a transaction history is maintained for our fans, balanced against our obligation not to keep information longer than necessary. In the case of legal action, bans, enforcement or other concerns, the data will be retained for a period appropriate for the sanction, for example personal information in connection with a lifetime stadium ban would be kept beyond 6 years; safeguarding information may be retained for 30 years.

Fans can request that their data is kept for longer or erased earlier by contacting the Data Protection Officer – see section 10 What rights do you have? for further information.

9 Children’s Information

Under Data Protection Legislation, children are given additional protections, in particular with online services such as social media and forums. Everton do not intend for anyone 12 and under to use forums on the website. These are restricted based on the user’s age.

Anyone aged 13 and over can access the full website – with age appropriate restrictions on marketing and offers. Everton encourage anyone aged 13-15 to inform their parents or guardians that they have signed up to help understand the risks of using social media and forums.

You should also consider your rights including the right to erase data, especially as you turn 16. More information please see section 10 What rights do you have?

10 What rights do you have?

You have a number of rights under Data Protection legislation.

Your rights are:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to object
• Right to restrict processing
• Right to data portability

Please note that not all rights apply in all circumstances.

All requests to exercise your rights must be resolved by Everton within one month, unless an extension of up to two additional months is applied, or a different timeframe is stated below.

Right to be informed

You have a right to be informed about uses of your information with an emphasis on transparency. This notice, in support of other privacy notices published by Everton ensures that your right to be informed is met.

Right of access

You have a right to receive:

• Confirmation of what information is recorded about you
• Confirmation of how your information is used
• Access to your information

You will be required to provide proof of identification and may be asked to specify exactly what information you require.

To request information please contact the Data Protection Officer.

Right to rectification

Rectification refers to correcting factual inaccuracies or incomplete data which is held by Everton. You are able to update certain data within your online account.

To rectify your information you may also contact the Data Protection Officer.

Right to erasure

In some circumstances you can request that your information is deleted.

This right will apply if you have consented to your information being used and have later withdrawn consent, or the information has been processed as part of the legitimate interests of Everton.

There may be consequences of erasing your data, such as not receiving the latest Everton news, offers and stadium information, being unable to make further purchases or access member only content . Please carefully consider why you want to erase data and what the impact will be. There would be no way to retrieve your data once it is deleted.

To erase your personal information, or discuss this right further, please contact the Data Protection Officer.

There are exceptions to this right which would be explained to you, including information required to exercise or defend a legal claim or information required for contractual purposes.

Right to object

You can object to your information being used for:

• Marketing
• Scientific or historical research
• Statistical purposes

You can object to marketing and opt-out at any time in your account preferences. Marketing will stop immediately.

To object to research or statistical processing, or if you want to object to marketing in writing, please contact the Data Protection Officer.

Right to restrict processing

The right to restrict processing means that if you have disputed the accuracy of information, objected to its use or want Everton to retain your information, you can request is it stored but no other uses are permitted.

To request restriction to processing, please contact the Data Protection Officer.

Right to data portability

The right to data portability allows you to obtain your personal data from an organisation and reuse this for your own interests with other, similar organisations. It is intended to allow consumers to understand their usage of services and get the best deal.

The right to data portability is unlikely to apply to information held by Everton, however you will be informed when the right does apply.

11 Is there any automated processing of your information?

In order to provide you with a personalised experience, Everton will analyse your account information, including your:

• Address
• Age
• Gender
• Transaction history, such as ticket purchases

Everton do not profile against data that is defined as sensitive under UK GDPR, such as ethnicity, sexual orientation and health or disability. We may however identify fan groups for satisfaction surveys and consultations. We will then only contact you if we have permission to do so and completion of satisfaction surveys is entirely optional. There is no significant impact caused by this profiling or automated decision making.

You can ensure the information held by Everton is correct by updating your personal information in your account setting at any time. You can also opt-out of marketing activities which use profiling.

If you apply for a season ticket or other purchase which requires a direct debit and credit check, the credit check will involve an automated decision making by a credit agency appointed by Everton. Credit checks will only be undertaken with your consent when entering into a contract and you have the right to request an individual review of the outcome with the credit agency.

12  Further Enquires and Complaints?

General enquiries about how your information is used, or for further privacy notices, please contact the Data Protection Officer:

Data Protection Officer
Everton Football Club
Goodison Park
Liverpool
L4 4EL
dataprotectionofficer@evertonfc.com

The Information Commissioner’s Office is the UK's independent body set up to uphold information rights and regulate the UK General Data Protection Regulation.

If you have a complaint which has not been resolved to your satisfaction by Everton you are able to complain directly to the Information Commissioner’s Office.

Further information about their work and the legislation they cover is available from www.ico.org.uk or by contacting them on the helpdesk number 0303 123 1113.

13 Definition of Terms

In order to help you understand how your personal information is processed, we have developed a series of Privacy Notices.

The notices are currently in 2 tiers, based on the intended audience and level of detail.

·	Tier 1 -	A single, detailed notice of information rights and Everton’s general data protection activities
·	Tier 2 -	Activity specific notices with precise information on what personal data is and is not processed.

This document is the Tier 1 Notice. Please refer this to this for definition of terms and general uses of information.

 

Data Controller	The organisation which determines the processing of Personal Data. The Data Controller is the legally responsible organisation.
Data Processor	An organisation which the Data Controller appoints to provide a service on its behalf. The Data Processor must follow the legal instruction of the Controller.
Data Subject	The individual who personal data is about. The individual must be identifiable from the data.
Data Protection Officer	The person appointed by the Data Controller as the single point of contact for data protection enquiries. The Data Protection Officer acts independently and monitors compliance with data protection obligations
Data Processing	The activities which relate to Personal Data. Data Processing includes: ·       Obtaining, recording or holding the information ·       Organisation, adaption or alteration ·       Retrieval, consultation or use ·       Disclosure by transmission, dissemination or otherwise making available ·       Alignment, combination, blocking, erasure or destruction of the information or data;
Information Commissioner’s Office	The regulator of information rights in the United Kingdom. The ICO website is - https://ico.org.uk/
Personal Data	Data which relates to an individual and enables them to be identified