Player Privacy Notice

Union des Associations Européennes de Football (UEFA) and its subsidiaries (“we/us”, “UEFA”) are data controllers and recognise the importance of protecting the fundamental rights of the players and persons associated with them (for example, a club’s or national team’s coaching, technical and medical staff) (also referred to as “you/your”), including with regard to their personal data.

The purpose of this Privacy Notice is to provide information and ensure transparency about the way your personal data is processed at UEFA.

UEFA is committed to complying with data protection laws, ensuring the confidentiality, integrity and availability of your personal data, while respecting your privacy. The commitments described here uphold UEFA’s values and principles of action, and comply with applicable Swiss and European legislation.

This Privacy Notice has been drafted in English and translated into other languages. In the event of any discrepancy between the English and the translations, the English text prevails and shall be used to resolve doubts about interpretation.

The latest version of this Privacy Notice was issued in: November 2020

1 WHAT THIS PRIVACY NOTICE COVERS

This Privacy Notice applies to the way UEFA handles personal data collected for your participation in UEFA’s competitions or when you otherwise interact with UEFA, and tells you the types of personal data UEFA may collect, how it will be processed, the third parties to whom it may be forwarded and how long UEFA will keep it. It also explains your rights with respect to that personal data.

2 HOW DO WE COLLECT YOUR PERSONAL DATA?

Certain personal data collected and processed by UEFA comes from direct interactions with you and includes the details provided by you and your club, league or football member association, or by other third parties, such as FIFA or the World Anti-Doping Agency (WADA).

3 WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT

The types of personal data we collect and the purpose of processing it vary according to your relationship with us. ‘Personal data’ means any information that may be linked directly or indirectly to you as an individual.

Please note that some of the personal data you provide may be considered sensitive or attract special category status under Art. 3 letter c of the Swiss Federal Data Protection Act (FADP) or Art. 9 of the EU General Data Protection Regulation. This may, for example, be information about political opinions, religious beliefs, physical or mental health or a photo showing your ethnic origin.

UEFA competitions and events
When you take part in a UEFA competition or event, we may collect and process the following types of information for administrative purposes:

• Personal information, such as your full name, date of birth, gender, nationality, and legal representative in the case of minors

• Professional information, such as your club(s), position, professional experience and skills

• Contact information, such as your phone number, address and email address

• Travel information, such as your accommodation and travel details

This enables us to run UEFA competitions and events, facilitate your registration and carry out pre-registration measures (contract performance).

UEFA Club Licensing and Financial Fair Play Regulations
When you take part in a UEFA competition or event we may process the following types of information:

a) To check that clubs taking part in UEFA club competitions are compliant with the UEFA Club Licensing and Financial Fair Play Regulations:

• Personal information, such as your full name, date of birth, nationality and legal representative in the case minors

• Professional information, such as your club(s) and your contracts with them (including details of any remuneration and compensation), together with a record of all previous transfers and contracts

b) To provide some statistical insights and benchmarking information about the players and clubs:

• Personal information, such as your full name, date of birth and nationality

• Professional information, such as your club(s)

This processing is justified by our legitimate interests to regulate and govern UEFA competitions and associated activities in an effective and lawful manner, take measures designed to protect the integrity of football and investigate breaches to integrity rules and UEFA regulations.

Anti-doping regulations
When you take part in a UEFA competition or event, we may collect and process the following types of information:

a) To plan doping controls at any moment and ensure that players to be tested are designated in a way that maximises efficiency and fairness:

• Personal information, such as your full name, gender, date of birth and nationality

• Professional information, such as your club(s) and position

• Medical information such as your biological profiles (past anti-doping results, general health data) and your whereabouts information

b) To collect your biological (blood and urine) samples to ensure that you do not use banned substances to enhance your performance:

• Personal information, such as your full name, gender and date of birth

• Professional information, such as your club(s) and position

• Sports data, such as records of matches you have played

• Medical information, such as sample legal information (date and place, name and signature of player representative), sample technical information (label number of each sample, precise time when the sample was taken), declaration of medication (diagnosis, substances used, dose, start and end of treatment) and result of the anti-doping test

c) To collect your therapeutic use exemptions (TUEs) to ensure that you have a valid medical justification for using potentially banned substances:

• Personal information, such as your full name, gender and date of birth

• Professional information, such as your club(s) and position

• Sports data, such as records of matches you have played

• Medical information, such as your treatment information: diagnosis, medical justification, substances used, start and end of the treatment

d) To establish whether a player/club/other person is guilty of violating anti-doping regulations and impose any necessary disciplinary sanctions:

• Personal information, such as your full name, gender and date of birth

• Professional information, such as about your club(s) and position

• Sports data, such of records of matches you have played

• Medical information, such as sample legal information (date and place, name and signature of player representative), sample technical information (label number of each sample, precise time when the sample was taken), declaration of medication (diagnosis, substances used, dose, start and end of treatment) and result of the anti-doping test

This processing is justified by our legitimate interests to regulate and govern UEFA competitions and associated activities in an effective and lawful manner, take measures to eliminate doping in football by carrying out anti-doping testing, and comply with health and safety obligations. When sensitive or special categories of personal data need to be collected or processed, we will always ask for your specific consent.

Disciplinary and integrity cases
When you take part in a UEFA competition or event, we may collect and process the following types of information:

a) To establish whether a player/club/other person is guilty of violating UEFA rules and regulations or any other sports regulations and impose disciplinary sanctions:

• Personal information, such as your full name, date of birth, gender and nationality

• Professional information, such as your club(s)

• Contact information, such as your address, telephone number and email address

• Sports data, such as records of matches you have played and disciplinary actions against you

b) To investigate specific match situations or disputes, hear stakeholders’ testimony and determine appropriate sanctions:

• Personal information, such as your full name

• Professional information, such as your club(s)

• Sports data, such as records of matches you have played, disciplinary actions against you and information about your performance

c) To detect matches that might have been fixed, maintain integrity and prevent crime and corruption in football:

• Personal information, such as your full name

• Professional information, such as your club(s)

• Sports data, such as records of matches you have played, including disciplinary actions against you and information about your performance

d) To apply measures designed to protect the integrity of a UEFA competition or event:

• Personal information, such as your full name

• Professional information, such as your club(s)

• Sports data, such as records of matches you have played, disciplinary actions against you and information about your performance

This processing is justified by our legitimate interests to regulate and govern UEFA competitions and associated activities in an effective and lawful manner, deal with legal disputes involving you or other players and investigate integrity breaches.

Performance analysis and match data
When you take part in a UEFA competition or event, we may collect and process the following types of information:

a) To provide live data for the public reporting of certain UEFA competitions and for the participating teams for the purposes of their own tactical analysis:

• Personal information, such as your full name, date of birth and nationality

• Professional information, such as your club(s)

• Tracking data, such as live on-field tracking and performance data for certain matches, such as positioning, distance run and passes made

• Tactical feed, such as specific tailored coaching/tactical feed

b) To use analysis, statistics, data and other information in view of the public reporting about UEFA competitions and events and their promotion, as well as for archiving and statistical purposes:

• Personal information, such as your full name, date of birth and nationality

• Professional information, such as your club(s)

• Sports data, such as records of matches you have played and information about your performance

• Media data, such as photographs, images, videos, media and audio recordings of you

c) To provide clubs with statistical insights of the number and type of injuries and allow them to use this data to improve recovery and sports performance:

• Personal information, such as your full name, date of birth and nationality

• Professional information, such as your club(s)

• Medical information, such as the nature and date of the injury, the diagnosis, and the medical treatment

d) To monitor the evolution of the game and identify educational needs, including the preparation and delivery of UEFA’s technical reports:

• Tracking data, such as live on-field tracking and performance data for some matches, such as positioning, distance run and passes made

• Tactical feed, such as specific tailored coaching/tactical feed

This processing is justified by our legitimate interests to record information about participants in UEFA competitions and events, promote and commercialise UEFA competitions and events, and enhance the fan experience in-stadium, online and during game telecasts.

When sensitive or special categories of personal data need to be collected or processed, we will always ask for your specific consent.

Communication
If we need to interact with you, we may collect and process the following types of information:

• Personal information, such as your full name, gender, date of birth, nationality, and legal representative in the case of minors

• Contact information, such as your address, telephone number and email address

This processing is justified by our legitimate interests to contact you.

Legal obligation and emergencies
We may also use your personal data for other purposes, which includes sharing it with third parties, when we need to comply with a legal obligation (for example, because a court has ordered us to do so) or to protect yours or someone else’s vital interests in emergency situations. In such cases, we may not have time or even be legally required to inform you.

Additional purposes
We may also use your personal data for other purposes, for which we will provide you with specific advanced notice.

4 PERSONAL DATA SHARING AND DISCLOSURE

We may share your personal data:

• between ourselves (UEFA and its subsidiaries) for internal reasons, primarily for business (promoting UEFA competitions), administrative and operational purposes (such as managing UEFA competitions and events, statistics tabs, research projects, technical reports or individual investigations), in line with this Privacy Notice;

• with external third parties acting on our behalf and providing us with services, such as technology providers and hosting companies, analytics companies and medical professionals, and which comply with similar and equally stringent undertakings of privacy and confidentiality;

• with clubs or national teams taking part in UEFA competitions, for their own administrative use and internal tactical or statistical analysis, or to inform them about any disciplinary decisions, anti-doping test results or injury study reports;

• with various UEFA committees and bodies responsible for monitoring the compliance with UEFA rules and regulations as well as with other sports bodies, such as FIFA or WADA, that are responsible for ensuring compliance with sports regulations;

• with broadcasters covering UEFA competitions and for use on websites and social media, including for the purposes of incorporating a limited subset of tracking data into the multilateral feed and support commentary;

• with media, to incorporate certain information and statistics in the match press kits or any media support;

• with selected sponsors, for the delivery of additional services on uefa.com;

• with certain third parties pursuant to court orders or warrants;

• with police and state authorities in particular to carry out security or administrative checks at UEFA competitions or events you will attend;

• with third parties, for which you give us express permission to do so from time to time over the course of your relationship with us.

5 FORWARDING PERSONAL DATA

Your personal data is generally stored within Switzerland and the EEA but in limited circumstances it may be forwarded to suppliers located outside Switzerland or the EEA, including in the US. In such cases, we ensure adequate security measures are taken to offer equivalent protection as within Switzerland and the EEA and in compliance with applicable data protection laws. We have instituted EU model contractual clauses as an adequate safeguard for forwarding data outside Switzerland and the EEA. For further details on how we safeguard your personal data forwarded outside Switzerland and the EEA (including how to obtain a copy of such safeguards), you can contact us using the details set out in Section 10 below.

6 DATA RETENTION AND ARCHIVING

Personal data processed by UEFA will be retained only for as long as is necessary to fulfil the purposes outlined above. This will generally, though not in all cases, be for the duration of your contract with us, to comply with our legal obligations, or to protect UEFA’s rights. When determining the relevant retention periods for your personal data, we will consider factors such as:

• Our contractual obligations and rights in relation to the personal data concerned

• Legal obligation(s) to retain data for a certain period of time under applicable law or sports regulations

• Statutes of limitations under applicable law(s), i.e. the period during which contractual claims may be brought, which is ten years in Switzerland

• Our legitimate interests, for which we have carried out balancing tests (see Section 3 on above)

• (Potential) disputes

• Guidelines issued by relevant data protection authorities.

7 YOUR RIGHTS

By law, subject to certain conditions, you have various rights when it comes to your personal data. Further information and advice about your rights can be obtained from the data protection regulator in your country.

RightsWhat does this mean?
Your right to object to processingYou have the right to object to certain types of processing, in particular when grounds depending on your situation override our legitimate interests.
Your right to be informedYou have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights, which is the purpose of this Privacy Notice.
Your right to access your personal dataYou have the right to obtain access to your personal data, and certain other information, such as that provided in this Privacy Notice.

This is to ensure you are aware and can check that we are using your personal data in accordance with data protection law.
Your right to update and rectificationYou are entitled to have your personal data corrected if it is inaccurate or incomplete.
The right to erasureThis is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there is no compelling reason for UEFA to keep using it. This is not a general right to erasure, as there are exceptions.
Your right to restrict processingYou have a right to block or suppress further use of your personal data. When processing is restricted, UEFA can still store your personal data, but will not make any further use of it. We maintain lists of people who have asked for further use of their personal data to be blocked to make sure the restriction is adhered to in future.
Your right to data portabilityYou have a right to obtain and reuse your personal data for your own purposes on different services, though only when the processing is based on your consent or on a contract.
Your right to lodge a complaintYou have the right to lodge a complaint about the way UEFA handles or processes your personal data by contacting your national data protection regulator directly.
Your right to withdraw consentIf you have given UEFA your consent to process your personal data, you have the right to withdraw that consent at any time, although that would not mean that anything we have done with your personal data with your consent up to that point can be deemed unlawful.

You can exercise any of these rights by contacting us in writing, by email or by post, to the addresses below. Please note that we may require proof of your identity before we can respond to your request.

Email
privacy@uefa.ch

Post
Union des Associations Européennes de Football (UEFA)
Corporate Legal Services
Data Protection - Data Subject Request
Route de Genève 46
Case postale
CH-1260 Nyon 2
Switzerland

We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs when providing information for:

• Baseless or excessive/repeated requests

• Further copies of the same information

UEFA may refuse, restrict or defer the provision of information when it has the right to do so under current data protection legislation.

Please consider your request responsibly before submitting it. We will respond as soon as we can. Generally, this will be within one month from receipt of your request but, if the request is going to take longer to deal with, we will let you know.

8 DATA SECURITY

UEFA defines and implements reasonable technical and organisational measures to maintain the security of your personal data, determined by the nature of the personal data processed and the circumstances of the processing, with the objective of avoiding non-authorised processing or access, alteration or loss, and to ensure confidentiality, integrity and availability.

9 CHANGES TO THIS PRIVACY NOTICE

The Privacy Notice is available at any time on www.uefa.com/playerprivacynotice/ and may be amended from time to time. We will place any updated version on www.uefa.com/playerprivacynotice/.

You are responsible for ensuring you are familiar with the terms of this Privacy Notice. UEFA reserves the right to amend it at any time without prior notice to you; however, we will notify you if we make significant changes.

10 CONTACT US

If you have any questions about this Privacy Notice, please contact us at privacy@uefa.ch. If you are not satisfied with our response to a complaint you have made, or think we are not complying with data protection law, you may file a complaint with the data protection regulator in your country.

For more information about how UEFA handles personal data when people access UEFA’s websites or apps, interact with our social media profiles, and/or when they communicate with UEFA, please check the UEFA Privacy Policy.