Privacy Notice

THE SCOTTISH FOOTBALL ASSOCIATION PRIVACY Notice

INTRODUCTION

The Scottish Football Association Limited (Scottish FA / Us / We) is a data controller. This means that we are responsible for deciding how we hold and use personal information about you. We are required under Data Protection Legislation to notify you of the information contained in this Privacy Notice.

This notice applies to individuals whose personal data is processed by us, including:

current and former players of all levels (including those playing in the Scottish Professional Football League);
Club Academy Scotland players;

Performance School players; and

managers and / or coaches of all

It is important that you read this notice, together with any other Privacy Notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such information.

In this Privacy Notice, Data Protection Legislation means all applicable legislation which relates to the protection of individuals with regards processing personal data, including the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679.

2 DATA PROTECTION PRINCIPLES

We will comply with Data Protection Legislation. This says that the personal data we hold about you must be:

Used lawfully, fairly and in a transparent way;
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
Relevant to the purposes we have told you about and limited only to those
Accurate and kept up to date;
Kept only as long as necessary for the purposes we have told you about; and
Kept

3 WHAT KIND OF PERSONAL DATA DO WE HOLD ABOUT YOU?

Personal data means any information about an individual from which that person can be identified. It does not include data where such identifiable information has been removed (i.e. anonymous data).

We will collect, store, and use the following categories of personal data about you including:

Personal contact details such as name, title, addresses, telephone numbers, and email addresses;
Identification documentation (e.g. drivers licence, passport, birth certificate );
Date of birth, place of birth, country of birth, gender, next of kin and emergency contact information;
Documentation evidencing your right to work in the UK (e.g. passport, visa, immigration documentation etc.) and a copy of your International Transfer Certificate (where you have previously been registered with the football association of a separate country);
Information about your club, Performance School, or Club Academy with which you are associated with and the contracts you have in place with them (including details of any remuneration and compensation which you receive), as well as a record of all previous contracts which you have entered into;
Details of any intermediary who you have entered into a contract with, and a copy of any contract which you have in place with said intermediary;
Records of matches you have played, including disciplinary information and information about your performance, accolades and achievements; and
Photographs, videos and audio recordings of you;
Details of your training and qualifications (where necessary);
Information about your performance (where you are enrolled in Club Academy Scotland or a Performance School; and
Documentation evidencing your eligibility for selection to the Scotland National Team
any other personal data which you share with us (e.g. by email, telephone, or in writing).

4 WHAT “SPECIAL CATEGORIES” OF PERSONAL DATA DO WE HOLD ABOUT YOU?

“Special categories” of particularly sensitive personal data require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal data. We have in place an appropriate policy document and safeguards which we are

required by law to maintain when processing such data. We may collect, store and use the following special categories of personal data:

Diversity Information: including information about your race or ethnicity, religious beliefs, age, gender, sexual orientation and political opinions;
Information about your health, including any medical condition, injury, health and sickness records; and
information relation to criminal convictions where it is relevant to our role in upholding sporting integrity and upholding appropriate standards of conduct in accordance with the Articles of Association of the Scottish FA and the Judicial Panel Protocol.

5 HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data about players directly from the players themselves, and from staff of the clubs with which they are associated, and from schools. We may sometimes collect additional information from other parties, such as FIFA, UEFA, or the intermediary acting on behalf of the player.

We will collect additional personal data on an ongoing basis.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.

6 LEGAL BASIS FOR USING YOUR PERSONAL DATA

Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract we have entered into with you;

Where we need to comply with a legal obligation; and

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal data in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else’s interests); and
Where it is needed in the public interest.

Special Category Personal Data

It may also be necessary for us to process your special category personal data. Where this is necessary, we shall comply at all times with our obligations regarding special category personal data, as set out in the Data Protection Legislation.

We shall only use your special category personal data where the Data Protection Legislation allows us to, specifically:

Where it is necessary for reasons of substantial public interest. Further information is set out in paragraph 7 below explaining how we rely on this legal basis.

Where you given us explicit written consent. In certain circumstances, we may ask you for written consent to allow us to process your special category personal data.

Where we have asked for consent, you are under no obligation to grant us consent, and you shall have the right to withdraw your consent at any time by contacting us (see paragraph 17 for further details).

We shall ensure that we provide you with adequate details in relation to our consent to ensure that you are able to decide whether or not you wish to give us your consent.

7 HOW WE USE YOUR PERSONAL DATA

We need all the categories of information in the list above (see paragraph 3) primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal data to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests.

In particular, we shall use your personal data for the following purposes:

Player Registration and Administrative Purposes: We will use your personal data for the purposes of propose of proper administration of our duties as a national governing body for football in Scotland, which shall include:
- Processing your registration with the Scottish FA as a player of your club;

Holding a record of all previous registrations which you have held with clubs;

processing all player transfers;

Liaising with the club, football academy or performance school with which you are associated with;

Eligibility for selection to the Scotland National Team

Administering the contract we have entered into with you;

Administering any competition, including tournaments and / or leagues for which we are responsible for or affiliated with;

To register you as a user and display your photograph, playing history and statistics on the My Scottish Football application;

Checking you are eligible to compete in certain matches and competitions; and

Business management and planning, including accounting and

Disciplinary Purposes: It is the responsibility of the Scottish FA to protect the integrity of the sport, and any sporting event which falls under our governance.

Use of Personal Data: The Scottish FA shall process a player's personal data and special category personal data in connection with: (i) the furtherance and management of disciplinary investigations and/or disciplinary proceedings following any allegation that a player has breached their obligations under the Judicial Panel Protocol (including the Scottish FA Disciplinary Rules contained at Annex A) and/or the Scottish FA's Articles of Association; and/or (ii) where a player has provided a statement or other information as part of a disciplinary investigation or as part of disciplinary proceedings as described at (i) above; and/or (iii) where a player has raised a Claim in terms of the Judicial Panel Protocol, Fast Track Proceedings; and/or

(iv) where a player has provided a statement or other information in connection with a Claim as described at (iii) above.

Personal data is processed by the Compliance Officer of the Scottish FA in accordance with his duties and powers as set out by the Articles of Association and the Judicial Panel Protocol and may include using such data in conducting disciplinary proceedings in accordance with the Judicial Panel Protocol.

Where disciplinary proceedings are raised personal data is processed by the Judicial Panel Secretary and any appointed Tribunal Secretary in accordance with their duties and powers as set out by the Articles of Association and the Judicial Panel Protocol. The player's personal data shall be shared with the Tribunal members appointed to Determine the case. Where disciplinary proceedings are raised the existence of that fact and the outcome of any later disciplinary hearing will be posted upon the Scottish FA's official website.

Where a Claim is raised in terms of the Judicial Panel Protocol, Fast Track Proceedings, personal data is processed by the Judicial Panel Secretary and any appointed Tribunal Secretary in accordance with their duties and powers as set out by the Articles of Association and the Judicial Panel Protocol. The player's personal data shall be shared with the Tribunal members appointed to Determine the Claim. Where a Claim is raised the existence of that fact and the outcome of any later Hearing will be posted upon the Scottish FA's official website.

Data Sharing: In certain cases, personal data and special category personal data shall be shared with the relevant authorities, such as Police Scotland.

In certain cases, personal data and special category personal data shall be shared with the relevant member Leagues and Affiliated National Associations.

Where there is an alleged breach of the Scottish FA's rules on gambling, personal data may be shared with the Gambling Commission.

Legal Basis: The Scottish FA shall process the personal data and special category personal data of players where such processing is necessary for the purposes of taking measures designed to protect the integrity of sport or a sporting event. Such processing is lawful on the grounds of substantial public interest.

Anti-Doping: It is the responsibility of the Scottish FA to take measures designed to eliminate doping in football under the governing authority of the Scottish FA, in accordance with the Scottish FA Anti-Doping Regulations (the Regulations).

Use of Personal Data: The Scottish FA shall process a player's personal data and special category personal data in discharging its duties as a sporting governing body, as more fully set out in the Regulations.

We shall use your personal data for the purposes of:

Communicating with you about anti-doping efforts, including requesting that you attend for a test, and communication the results of any positive tests to you;
Maintaining records of outcomes and other relevant information in relation to tests which have been undertaken, and the results of our investigations;
Managing information relating to Therapeutic Use Exemptions;

Undertaking testing and investigations into the use of banned substances, including the analysis of samples and the management and communication of results;
Undertaking disciplinary proceedings where necessary, and for the enforcement of any relevant sanctions;
Public reporting of the decisions of our anti-doping disciplinary hearings in accordance with the Regulations.

Data sharing: For these purposes, your personal data and sensitive personal data shall be shared with UK Anti-Doping (UKAD). UKAD undertake testing and analysis of samples on our behalf, and are a joint-controller of your personal data. Where necessary, your information may also be shared with FIFA, UEFA, the World Anti- Doping Agency (WADA), and any relevant event organisers and international federations with responsibility for anti-doping functions (where such data sharing is necessary).

Where you test positive for a banned substance, we shall inform your club of the result, and information may also be passed on to relevant authorities, including Police

Scotland. Your personal data shall also be passed to the relevant Panel Members in advance of any hearing with the Scottish FA's Judicial Panel.

In accordance with WADA rules, all anti-doping rule violations must be published online by UKAD. A record of all athletes currently serving a ban, or who have served a ban in the past 6 years is made available online by WADA.

Legal Basis: The Scottish FA shall process the personal data and special category personal data of players where such processing is necessary in connection efforts to eliminate doping in sport. Such processing is lawful on the grounds of substantial public interest.

Player Welfare and Safeguarding: The Scottish FA has an obligation to safeguard participants in organised football in Scotland and to ensure the welfare of all children and adult participants. We do this by undertaking background checks and in the investigation of relevant allegations or incidents.

Use of Personal Data: We are responsible for undertaking background checks to ensure that individuals who have interaction with children and adults at risk as suitable for such a position.

Personal data and special category personal data is also processed for the purposes of investigating allegations of abuse, mistreatment and other incidents threatening the welfare of children or adults at risk.

Personal data shall also be used to provide support to victims of any form of abuse which has been identified, and to provide support to authorities (such as Police Scotland) in the investigation of any criminal investigations.

Data sharing: The Scottish FA shall share personal data with Disclosure Scotland for the purposes of undertaking criminal record and background checks on all individuals who have interactions with children and adults at risk.

Personal data and special category personal data may be shared with other stakeholders who may come into contact with participants who represent a threat to the wellbeing of children or adults at risk in football or other environments (e.g. local authorities, relevant charities, other football clubs and other sporting bodies).

Information may be shared with relevant authorities, including Police Scotland, where it is necessary for the purposes of any investigations.

Legal Basis: The Scottish FA shall process the personal data and special category personal data of players and other individuals who have interactions with children and adults at risk for the purposes of preventing and / or detecting unlawful acts, as well as for the purposes of safeguarding of children and of individuals at risk. Such processing is lawful on the grounds of substantial public interest.

Diversity Monitoring: We are committed to monitoring diversity within Scottish football, and we may ask you to provide information about your ethnicity, gender and sexual orientation, age, religion, and any disability which you may have.

Diversity monitoring is voluntary, and only used to ensure meaningful diversity and equal opportunity monitoring and reporting. Information required for diversity and equality purposes is anonymised, and is only available in un-anonymised form to our Diversity & Inclusion Manager.

Legal Basis: Where you provide us with the information required for diversity monitoring, we shall process your personal data and special category personal data for the purposes of keeping under review the existence or absence of equality of opportunity and / or treatment between groups of people with a view to enabling the promotion and / or maintenance of equality. Such processing is lawful on the grounds of substantial public interest.

Other Purposes: We use your personal data for the following additional purposes:
- Marketing our competitions, events and merchandise;
- Performance monitoring purposes (training academy performance school players only);
- Performance analysis (National Squads)
- To conduct data analytics studies to review and improve player and team
- To make the necessary arrangements to allow you to travel to other countries in a football related capacity;
- Dealing with legal disputes involving you or other players;
- Complying with health and safety obligations;
- To prevent fraud;
- To monitor your use of our information and communication systems to ensure compliance with our IT policies; and
- To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.

8 SHARING YOUR PERSONAL DATA WITH OTHERS

In addition to any sharing of personal data set out in paragraph 7 above, we will share your personal data with third parties where required by law, where it is necessary to administer our relationship with you or where we have another legitimate interest in doing so, and where

such legitimate interests are not inconsistent with any of your rights under the Data Protection Legislation.

Third parties will only process your personal data on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
For the purposes of paragraph 1, “third parties” include:
- Scottish FA affiliate companies (including Hampden Park Limited and The National Stadium Sports Medicine Centre (trading as Hampden Sports Clinic));
- our third-party service providers (including contractors and designated agents) where such sharing of personal data is necessary for the delivery of services to us;
- the Affiliated National Associations (which are: i) Scottish Junior Football Association, ii) Scottish Youth Football Association, iii) Scottish Women’s Football,

iv) Scottish Amateur Football Association, v) Scottish Schools’ Football Association,
vi) The Scottish Welfare Football Association, and vii) Scottish Para-Football);

other sporting bodies such as FIFA, UEFA, and with National Football Associations of other countries;
the club, performance school, and / or football academy which you are a registered with;
third party performance analysists who provide statistical data on National matches for Performance department (Stats Perform)
the clubs, leagues (including the Scottish Professional Football League) and / or associations of the matches which you are playing in;
our commercial partners, sponsors, and any relevant broadcast partners;
third parties who provide accommodation or travel services whilst you are travelling;
authorities, such as Police Scotland, where necessary to comply with a legal obligation or on the grounds of substantial public interest;
the Gambling Commission in connection with any actual or suspected sporting integrity issues;
third party medical recording platform where injuries, treatments and diagnosis is recorded when selected for National Squads (ScribePro); and
third party medical professionals (where necessary).

9 WHAT HAPPENS IF YOU FAIL TO PROVIDE PERSONAL DATA?

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of players).

Ultimately, we may be unable to register you as a player with the Scottish FA, which would result in you being unavailable for selection to play matches.

10 WHAT HAPPENS IF THE PURPOSE FOR WHICH WE COLLECTED YOUR PERSONAL DATA CHANGES?

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

11 AUTOMATED DECISION-MAKING

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.

12 TRANSFERS OUTSIDE THE EEA

There may be occasions where it is necessary for us to transfer your personal data to countries which are not part of the European Economic Area (EEA) and where personal data is not afforded the same level of protection under the domestic laws.

Whenever we transfer your personal data out of the EEA, we shall ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European

Where we use certain service providers, we may enter into the EU’s “Model Contracts for the transfer of personal data to third countries”. These are specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

Where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US.

Where it is not possible to put in place any of the measures set out above, we will only transfer your personal data to a third country where you have given us your express consent to do so.

13 DATA SECURITY

We have put in place measures to protect the security of your information. Details of these measures are available upon request.

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

14 DATA RETENTION

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

15 YOUR RIGHTS

Under Data Protection Legislation, you are entitled to exercise the following rights over your personal data:

Right to object: You can object to our processing of your personal

Access to your personal information: You can request access to a copy of your personal data that we hold, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge.
Right to withdraw consent: If you have given us your consent to use your personal data, you can withdraw your consent at any time.
Rectification: You can ask us to change or complete any inaccurate or incomplete personal data held about you.
Erasure: You can ask us to delete your personal data where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.

Portability: You can ask us to provide you or a third party with some of the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.
Restriction: You can ask us to restrict the personal data we use about you where you have asked for it to be erased or where you have objected to our use of it.
Make a complaint: You can make a complaint about how we have used your personal data to us by contacting us, or to a supervisory authority - for the UK this is the Information Commissioner’s Office, at https://ico.org.uk/.

If you would like to exercise any of your rights above, please contact us by email to dpo@scottishfa.co.uk.

16 CHANGES TO THIS PRIVACY NOTICE

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new fair processing notice when we make any substantial updates.

17 CONTACT US

If you have any questions about this fair processing notice, including any requests to exercise your legal rights or making a complaint to us about how we have used your personal data, please contact us by emailing dpo@scottishfa.co.uk, or by writing to us at “Data Protection Officer, The Scottish Football Association, Hampden Park, Glasgow, G42 9AY”.

ADDITIONAL SCOTTISH FA PRIVACY POLICIES

Other Scottish FA Privacy Policies that may be more relevant to you are as follows:

Football Development Privacy Policy	Click here
Match Officials Privacy Policy	Click here
Official Return Privacy Policy	Click here
Participant Privacy Policy	Click here
Player Privacy Policy	Click here
Recruitment Privacy Policy	Click here
Referee Course SQA Privacy Policy	Click here
School of Football Privacy Policy	Click here
Staff Privacy Policy	Click here
Volunteer Privacy Policy	Click here