Huddersfield Town

This Privacy Notice applies to Huddersfield Town Association Football Club Limited and the football club’s Academy. Both are referred to in this Privacy Notice as the Club.

This Privacy Notice set out important information about how the Club (“us” / “we” / “our”) holds and processes your personal data and information (“data”) and your rights in relation to your data.  It sets out the Club’s obligations and duties under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (Legislation).

The Club’s website is owned and operated by the English Football League. Whilst the Club provides the content for the website, the English Football League monitors and administers the website and it is they who obtain and process the data of those who visit the Club’s website.

Please see the EFL’s Privacy Notice on the Club’s website which details the website terms of use and how your data is used if you visit the Club’s website.

Huddersfield Town Association Football Club Limited (“HTAFC”) is registered with the Information Commissioners Office. HTAFC’s registration number is Z3065994.

HTAFC is a limited company. Its registered office address is The John Smith's Stadium, Stadium Way, Huddersfield, HD1 6PX and company registration number is 01771361.

The person responsible for data protection at the Club is David Threlfall-Sykes (“Data Compliance Manager”) who can be contacted by email at data@htafc.com or by writing to our registered office address above.

The Club is a "data controller". This means that under the Legislation the Club is responsible for deciding how we hold and use data about you. The Club is required under the Legislation to provide you with the information contained in this Privacy Notice. We have a duty to keep your data secure and we will do so.

The Club complies with its obligations under the Legislation by ensuring that your data:

- is processed by the Club lawfully, fairly and in a transparent manner
- is only collected for specified, explicit and legitimate purposes and not processed or used by the Club in a manner that is not compatible with these purposes
- will be adequate, relevant and limited to what is necessary in relation to the purpose for which the Club holds the data
- is accurate and kept up to date and erased or rectified without delay
- will be kept in a form which permits identification of the individual concerned for no longer than is necessary for the purposes for which the data was obtained and processed by the Club
- is processed in a secure manner

The Club has determined the lawful basis for the processing of the different types of data that it holds. Data held is divided into different categories dependent upon the reason why the Club holds it. Some data held will overlap, for example where the Club holds data about an individual for ticketing purposes, the same individual may also have purchased something from the Club’s shop.

Please see below (A) to (E) inclusive the different reasons the Club holds data, in each case setting out what that data is, the lawful basis, the purpose we hold the data, how long we hold it for, and where the data is held.

(A) Ticket sales

(1) Data the Club holds
The Club holds data about those individuals who have purchased tickets to attend HTAFC football matches. This may be season cards or ad hoc ticket purchases. The data the Club holds comprises the individual’s name, suffix, email address, contact address, telephone contact numbers, and details of their booking history for tickets. Each individual is also given a reference number by way of a unique identifier.

(2) Lawful basis
The lawful basis upon which the Club processes this data is that it is necessary for the purposes of a contract between the Club and the individual buying the tickets.

(3) Purpose
The purpose that the Club holds this data is to issue tickets, season cards and car park passes.

(4) How long the data is held for and why
For both season card holders and anyone else who buys tickets on an ad hoc basis, if there is no interaction with the Club, such as purchases or opening marketing emails, for a period of two years then that individual’s data is removed from the general data list, although it remains retained by the Club for reference purposes for a further three years after that. The reason the data is retained for this period is to assist the Club in determining who may be given first refusal for tickets or events in the future should the Club need to make such a determination.

(5) Where the data is held
This data is not held by the Club. The data is held by Ticketmaster as a data processor on behalf of the Club. The Club has written terms in place as required by the Legislation which set out Ticketmaster’s obligations as a data processor for the Club.

(B) Marketing

(1) Data the Club holds
The data that the Club collects for the purpose of issuing tickets (as set out above under “Ticket Sales”) and also for the purpose of retail sales (as set out below under “Retail Sales”) is also used by the Club for marketing purposes.

(2) Lawful basis
The lawful basis upon which the Club uses the data is with the consent of the individual whose data the Club holds.

The Club obtains the individual’s consent to use their data for these purposes when selling tickets or goods.

Each marketing email sent on behalf of the Club gives individuals the opportunity to subsequently opt out if they do not wish to receive further marketing.

(3) Purpose
The purpose the Club use this data is for marketing. The data is used to analyse an individual’s preferences and then use the data to supply information to those individuals about things that may be of interest to them.

(4) How long the data is held for and why
The data used for this purpose is held indefinitely unless and until an individual opts out and withdraws his or her consent. It is then blacklisted for the purpose of marketing.

(5) Where the data is held
This data is not held by the Club. The data is held by Ticketmaster as a data processor on behalf of the Club. The Club has written terms in place as required by the Legislation which set out Ticketmaster’s obligations as a data processor for the Club.

In turn, Ticketmaster share this data with Sports Alliance who are a relationship management partner of the Club. There is a written sub-processor agreement in place between Ticketmaster and Sports Alliance.

Sports Alliance access the data held by Ticketmaster and use the data for the purpose of marketing.

(C) Retail sales

(1)Data the Club holds
The Club holds data about those individuals who have purchased items from the Club shop and / or via the Club’s website. The data the Club processes comprises the buyer’s name, email address, contact address, telephone contact numbers, card payment details, and details of what they have purchased.

(2) Lawful basis
The lawful basis upon which the Club processes this data is that some of it is necessary for the purposes of a contract between the Club and the individual making the purchase. When used for marketing purposes the lawful basis is the individual’s consent (please see (B) Marketing above).

(3) Purpose
The purpose the Club holds this data is for a sale of goods to the customer but also for general marketing purposes (please see (B) Marketing above).

(4) How long the data is held for and why
The card payment details used by the individual to make a purchase are not retained by the Club.

The data is retained by the Club for a period of two years but if no interaction with the Club, such as buying tickets, purchasing goods or opening marketing emails, within that period then after two years an individual’s data is removed from the general data list, although it remains retained by the Club for reference purposes for a further three years after that. The reason the data is retained for this period is to assist the Club in determining who may be given first refusal for tickets or events in the future should the Club need to make such a determination.

(5) Where the data is held
The data is not held by the Club. Retail and Sports Systems act as a data processor on behalf of the Club to obtain the data and they pass the data (except the card payment details) to Ticketmaster. Retail and Sports Systems also obtain and use individuals’ card payment information for the purpose of processing payment by payment card companies. The card payment details are not retained by the Club, Retails and Sports Systems or any third party.

The data is held by Ticketmaster as a data processor on behalf of the Club. The Club has written terms in place as required by the Legislation which set out Ticketmaster’s obligations as a data processor for the Club.

Retail and Sports Systems do not retain any of the Club’s data. They merely process the data upon the Club’s and Ticketmaster’s behalf. The Club has written terms in place as required by the Legislation which set out Retail and Sports System’s obligations as a data processor for the Club.

(D) Lottery and competitions

(1) Data the Club holds
The Club run lotteries, competitions and also offer membership of the Blue and White Foundation for payment of a small subscription fee. The data held is the name, address, telephone number and email address of those entering the lottery, competition or membership of the Foundation.

(2) Lawful basis
The lawful basis upon which the Club holds this data is for the purposes of the contract, either for the competition game or membership of the Foundation.

(3) Purpose
This data is used solely for the purposes of the competitions and notifying those who win and, for the Foundation, for membership purposes.

(4) How long the data is held for and why
The data is held indefinitely for those entering a lottery or competition and is deleted if an individual choses to opt out at any stage.

The data is held for so long as someone remains a member of the Foundation. It is deleted if they cease to become a member, unless they continue to enter lotteries or competitions in which case it is held indefinitely and is deleted if an individual choses to opt out at any stage.

(5) Where the data is held
The data is held by the Club on secure servers.

(E) General and sponsorship

(1) Data the Club holds
The Club holds data of other companies, businesses, organisations or associations who supply goods and / or services to the Club, sponsorship, or otherwise with whom the Club has a professional relationship or potentially common interest.

For these third parties, the Club processes business / organisation names, contact names, addresses, email addresses, telephone numbers and (where the Club obtains sponsorship or goods and / or services, details of orders placed, values, and quotations).

The Club does not consider that the data in this section necessarily amounts to personal data as it is data relating to businesses rather than individuals themselves but includes the same in this Privacy Notice as a matter of good practice.

(2) Lawful basis
The Club holds this data as it considers it necessary in its legitimate interests to enhance and preserve such relationships.

(3) Purpose
The purpose the Club holds this data is for business efficacy, for the provision of the supply of goods and / or services either to or by the Club, and also where relevant for the purpose of sponsorship.

(4) How long the data is held for and why
The Club retains this data indefinitely. It will be deleted by the Club if any individual or business should ask that the Club do so.

(5) Where the data is held
The data is held by the Club on secure servers.

As set out above, the Club has data processing agreements in place with Ticketmaster, Sports Alliance and Retail and Sports Systems as they process data on behalf of the Club.

In addition, the Club may share data it holds and processes for ticket sales, marketing, retail sales, and lottery and competitions with the Huddersfield Town Foundation Limited, which is a registered company and charity. The Club has a written agreement in place with the Foundation which is a data processor acting on the Club’s instructions.

We may also share data with our legal advisers and accountants where we deem it necessary to do so.

Your data will not otherwise be shared with any other third party without your consent.

Your data will not be held or processed outside the United Kingdom.

We do not deal with the automated processing of data.

Under the Legislation you have certain rights in relation to the data that the Club holds, or may hold, about you.

You should note that personal data is information the Club holds by which you can be identified and which relates to you.

(1) We are obliged to ensure that the data we hold about you is correct. You have the right to ask for the data to be rectified if it is not.
(2) You have the right to seek to restrict the processing of your data in some circumstances.
(3) Where we rely on legitimate interests as the basis for processing your data, you may ask for the data to be erased and if there is no overriding legitimate interest for us to continue the processing then we will do so.
(4) You can also object to the processing of your data where we rely on legitimate interests as the basis for processing.
(5) You have the right to seek confirmation of the fact that we are processing your data, and to ask what that data comprises.
(6) You have a right to access your data and to ask us to provide you with copies of your data.
(7) Where we process your data as a result of your consent, you have the right to remove that consent at any time and we will stop processing the data for that purpose.

If you would like to exercise any of your rights, please email data@htafc.com or write to us at our registered address given at the top of this Notice. We will then consider your request and action the same as necessary although in some circumstances we may have a legitimate reason for not being able to action your request. If this should be the case then we will notify you of the reason why.

We will also likely ask you to provide evidence of your identity before we are able to process and deal with your request.

If you have any cause for complaint, or do not believe that we are processing your data fairly or in line with our obligations as a data controller, then we would ask that you contact us in the first instance with your concerns although you are not obliged to do so and you may contact the Information Commissioner’s Office whose details can be found at www.ico.org.uk

We regularly review the data that we hold and also the content of this Privacy Notice. This Privacy Notice may therefore be updated by us at any time.

Huddersfield Town Association Football Club Limited

September 2021