- WHO WE ARE
1.2 Seven League Limited is a digital sports consultancy specialising in sport and has been commissioned by the Fédération Internationale de Football Association (FIFA) as the international governing body of association football to promote engagement in connection with FIFA events and football more broadly and to oversee the movement, known as the ‘Fan Movement’.
1.3 Our company number is 07739615 and our registered address is The Windsor Centre, Windsor Street, London, England, N1 8QG. We are registered with the UK Information Commissioner’s Office with registration number ZA300498.
1.4 To contact us, please use the following information:
● Postal address: The Windsor Centre, Windsor Street, London, England, N1 8QG
- PURPOSE OF THIS POLICY
2.2 It is important that you read this Policy carefully together with any other privacy policies we may provide on occasions when we collect or process personal data about you, so you are fully aware how and why we are using your data. This Policy supplements these other policies and does not replace them.
2.3 If you are successfully recruited as a participant of the Fan Movement on or from our Website, our Fan Movement Privacy Notice will apply to your participation of the Fan Movement.
- THE DATA WE COLLECT ABOUT YOU
3.1 When you access the Website, other than as set out in paragraph 3.2 below, you may provide us with personal data, and we may collect, use, store and transfer such data which we have grouped together as follows:
● Technical data including your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions and other details about the devices you use to access this Website;
● Usage data including information about how you use our Website; and
● Enquiry data including records of communications you have with us.
3.2 When you apply to become a participant of the Fan Movement as part of the recruitment process on the Website, you may provide us with personal data, and we may collect, use, store and transfer such data which we have grouped together as follows:
● Identity data including your title, name, date of birth and gender;
● Contact data including your email address and telephone number(s);
● Social media account details including your social media identifiers, name (if publicly available), age (if publicly available), profile bio (if publicly available), location (if publicly available), details of posts and other activities you conduct through social media; and
● Parent/guardian contact data in order to obtain any necessary consent, if you are under the age of legal consent in your country.
3.3 We also collect, use and share aggregated data such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered to be personal data in law as it does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing specific features on the Website. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, the combined data will be personal data and we deal with it in accordance with this Policy.
3.4 We do not knowingly collect details about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, sexual orientation, or genetic or biometric data (known as “special categories of data”), or any information about criminal convictions or offences through the Website.
- HOW YOUR PERSONAL DATA IS COLLECTED
4.1 We collect your personal data in different ways, including:
● Direct interaction with you. You may give us identity and contact data by filling in online form(s) on the Website, including if you apply to become a participant of the Fan Movement on the Website, or by communicating with us by post, telephone, email or otherwise. This includes data you provide when you request information about our products and services, contact us, download resources, or use interactive features on the Website or social media applications.
● Third parties and publicly available sources. We may receive personal data about you from other parties and/or from public sources, as set out below: o technical data from analytics providers such as Google Analytics; and o publicly available information from social media platforms such as Facebook, Twitter and Instagram if you choose to apply to become a participant of the Fan Movement on the Website.
- HOW WE USE YOUR PERSONAL DATA
5.1 We will only use your personal data when the law allows us to do so. Our most common uses of your personal data will be:
● in order for us to perform a contract we are about to make or have made with you (or to take steps at your request before entering such a contract);
● if it is necessary for our legitimate interests and your interests and rights do not override those interests; and/or
● in order for us to comply with a legal or regulatory obligation.
5.2 The table below sets out all the ways in which we plan to use your personal data, which of the legal bases we rely on to do so and, where relevant, what the legitimate business interests are. We may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.
5.3 Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us using the details above if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table above.
5.4 We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
5.5 In the unlikely event that we need to use your personal data for an unrelated purpose, we will notify you and we will explain which legal basis allows us to do so.
6.1 You may receive marketing communications from us or FIFA if you have requested such information from us. We and/or FIFA will get your express opt-in consent before we send you marketing communications in any other circumstances.
6.2 You can ask us or FIFA to stop sending you marketing messages at any time by following the opt-out links in any marketing message sent to you. If you opt-out of receiving any marketing messages, this will not apply to personal data provided to us for other purposes, for example, as a result of your registration as a participant of the Fan Movement, the purchase of a product or service or other transaction.
- WHO WE SHARE YOUR DATA WITH
8.1 When using the Website, we may need to disclose your personal data to selected third parties in the following circumstances:
● if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation, we may share your personal data with a regulator or law enforcement agency;
● in the event that we sell any part of our business, in which case we may disclose your personal data to the prospective buyer of that part of our business to the extent that such disclosure is directly relevant to the sale; and
● professional advisers (acting as processors or joint controllers), including lawyers, accountants, auditors, bankers, insurers who provide legal, accountancy, audit, banking, insurance or consultancy, or other services to us and our group companies; and
● third party service providers which provide us with services, including IT providers such as Microsoft Azure for hosting the Website and Typeform for the online form on the Website and Google Analytics in order to track visits to the Website (although this service only uses anonymous data).
8.2 If you choose to apply to become a participant of the Fan Movement on the Website, we may need to disclose your personal data to FIFA (based in Zurich, Switzerland) for reviewing potential applicant profiles in order to decide which applicants to recruit for the Fan Movement.
- WHERE MIGHT DATA ABOUT YOU BE SENT
9.1 As with any multinational organisation, and as a result of the global nature of the Fan Movement, we are often required to transfer personal data internationally. Accordingly, personal data about you may be transferred globally (i.e. outside of the country in which it was initially collected).
9.2 When using personal data as described in this Policy, personal data may be transferred either within or outside the country or territory where it was collected, including to a country, territory or international organisation that may not have UK and/or EU equivalent data protection standards.
9.3 Many of the third parties with whom we work are based outside both the United Kingdom (UK) and the European Union (EU), so their processing of your personal data may involve a transfer of this data outside both the UK and the EU. When we use cloud-based platforms to store personal data, this may involve the use of geographically-distributed data centres including data centres outside both the UK and the EU. You have the right to request copies of the transfer mechanisms that apply to your personal data by contacting us using the details above.
We will not transfer your personal data outside the UK and EU, except:
● to a country which has been found by the European Commission to provide an adequate level of protection, which can be found here https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en;
● to an entity in the United States which is part of the EU-US Privacy Shield Framework. For further information see: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_en;
● to a company which has agreed to follow the same rules when processing your personal data; ● where your personal data benefits from the same contractual protections as it would in the EU;
● where the transfer is necessary to perform a contract between us; or
● with your explicit consent.
9.4 Such transfer of your data will always be subject to our physical, technical and organisational measures for the protection of personal data in those countries, territories or international organisations in accordance with applicable data protection laws.
- THIRD PARTY WEBSITES
- DATA SECURITY
11.1 We have appropriate physical, technical and organisational security measures in place to safeguard your personal data, and protect it from being accidentally or unlawfully destroyed, lost or altered, or disclosed or accessed in any unlawful way.
11.2 We limit access to your personal data to those of our employees, agents, contractors and other third parties who have a genuine business need to know it, and those processing your information will do so only in an authorised manner.
11.3 We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
- DATA RETENTION
12.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of complying with any legal, accounting and/or reporting obligations. If you would like to find out more about how long we store your data for, please get in touch using the contact details above.
12.2 In some circumstances you can ask us to delete your personal data: see paragraph 13 below. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
- YOUR RIGHTS
13.1 As a result of us collecting and processing your personal data, you may have the following legal rights:
● to access personal data held about you;
● to request us to make any changes to your personal data if it is inaccurate or incomplete;
● to request your personal data is deleted where we do not have a compelling reason to continue to process such data in certain circumstances;
● to receive your personal data provided to us as a controller in a structured, commonly used and machine-readable format where our processing of your personal data is based on: (i) your consent; (ii) our necessity for performance of a contract to which you are a party; or (iii) steps taken at your request prior to entering into a contract with us and the processing is carried out by automated means;
● to object to, or restrict, our processing of your personal data in certain circumstances;
● if we use your personal data for direct marketing, you can ask us to stop and we will comply with your request;
● if we use your personal data on the basis of having a legitimate interest, you can object to our use of it for those purposes, giving an explanation of your particular situation, and we will consider your objection;
● to object to, and not be subject to a decision which is based solely on, automated processing (including profiling), which produces legal effects or could significantly affect you; and
● to lodge a complaint with a data protection supervisory body or seek a judicial remedy from your national court. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/make-a-complaint/, although we would like the prior opportunity to respond to any complaint.
13.2 To exercise any of your rights set out above, including to withdraw your consent where we have stated we are processing your personal data based on your consent, please contact us using the contact details above.
- CONTACTING US AND CHANGES TO YOUR PERSONAL DATA
If you have any questions, comments and requests about this Policy or your personal data, please contact us using the contact details above. Please notify us with any changes to your personal data at any time.
Any changes we may make to this Policy in the future will be posted here. Please check back regularly to keep informed of updates or changes to this Policy.
This Policy was last updated on 26 March 2019.