The Premier League and our associated companies Premier League Charitable Fund, Football DataCo Limited, the Professional Game Academy Audit Company Limited and the Professional Game Match Officials Limited (together the ‘’Group Companies’’) hold and process data on all current and former job applicants, speculative applicants and interview candidates, whose information you provide to us in connection with the recruitment process (e.g. name, address, date of birth, whether or not you have a disability).
We take your data protection rights and our legal obligations seriously. Your Personal Data (as defined below) will be treated in a secure and confidential manner and only as set out below.
This Fair Processing Notice describes the categories of Personal Data we may process, how your Personal Data may be processed and how your privacy is safeguarded in the course of our recruitment process. It is intended to comply with our obligations to provide you with information about the Premier League's processing of your Personal Data under the General Data Protection Regulation and other applicable data protection legislation.
If you have any questions regarding the processing of your Personal Data or if you believe your privacy rights have been violated, please contact firstname.lastname@example.org
. If you are aware of an unauthorised disclosure of data, please also refer this to email@example.com
for guidance as to the applicable reporting requirements.
Processing of Personal Information
The Premier League collects and processes your Personal Data for the purposes described in this Fair Processing Notice. As set out in our internal Data Protection Policy, Personal Data is any information related to a person that can be used to directly or indirectly identify the person (“Personal Data”). Personal Data can be factual (for example, a name, gender, contact details, location or date of birth or even online identifiers such as IP addresses and cookies) or an opinion about that person's actions or behaviour.
The Premier League, or the relevant Group Company to which you are applying for a job, will be the data controller of your Personal Data. In addition, where processing of Personal Data is undertaken by other Group Companies for their own independent purposes, these associated companies may be joint controllers of your Personal Data.
We use Pinpoint, an online software product provided by The Infuse Group Ltd (t/a Pinpoint Software), to assist with our recruitment process. We use Pinpoint to process Personal Data as a data processor on our behalf. Pinpoint is only entitled to process your Personal Data in accordance with our written instructions under a data processing agreement as required under applicable data protection legislation.
What data do we process?
We may collect various types of Personal Data about you for the purposes described in this Fair Processing Notice including:
- Personal data (usually detailed on your CV) – Your title, forename, middle name(s) and surname, birth name, preferred name, any additional names, gender, nationality, second nationality, civil/marital status, date of birth, age, home contact details (e.g. address, telephone number, e-mail), languages spoken, your photograph;
- Data related to your employment and education history e.g. information included on your CV, including references, education history and employment history;
- Recruitment data - Interview and assessment data, Disclosure and Barring Service checks, vetting and verification information, documentation relating to your right to work in the UK, driving licence;
- Regulatory data - records of your registration with any applicable regulatory authority, your regulated status and any regulatory references;
- Remuneration and benefits data - your remuneration information in your current and past roles (including salary/hourly plan/contract pay information as applicable, allowance, bonus and merit plans).
Special categories of Personal Data
To the extent permitted by applicable laws we may also collect and process a limited amount of Personal Data falling into special categories, sometimes called “sensitive personal data”. This term includes information relating to such matters as racial or ethnic origin, religious beliefs, physical or mental health (including details of accommodations or adjustments), sexual orientation, information regarding sexual life, biometric data, criminal records and information regarding criminal offences or proceedings.
How does the Premier League collect data?
We collect and record your Personal Data from a variety of sources, but mainly directly from you. You will usually provide this information to our HR team via your application on our Pinpoint careers page or via an email directly to the HR team and the information we collect will be comprised in your application submission, CV or in your application cover letter. The information may also be gathered in notes made by our recruiting manager during an interview. Further information will be collected directly from you when you complete forms at the start of your employment, for example, your bank and next of kin details. Other details may be collected directly from you in the form of official documentation such as your driving licence, passport or other right to work evidence. We may also collect details of your visits to our careers website including, but not limited to, traffic data, location data and other communication data, the site that referred you to our careers website and the resources that you access.
We may also obtain some information from third parties, for example, employment agencies, references from a previous employer, medical reports from external professionals, tax authorities, benefit providers or where we employ a third party to carry out a background check (where permitted by applicable law). Our Pinpoint careers website also provides us with the facility to link the data you provide to us with other publicly available information about you that you have published on the internet - this may include sources such as LinkedIn and other social media profiles.
Pinpoint's technology enables us to search various databases to find possible candidates to fill our job openings. These databases may comprise your Personal Data where you have permitted prospective employers to access your Personal Data. We may obtain your Personal Data from these databases to potentially fill our job openings.
One of the reasons for processing your data is to allow us to carry out an effective recruitment process. Whilst you are under no obligation to provide us with your data, we may not be able to process, or continue with (as appropriate), your application.
What is the purpose and lawful basis for which data are processed?
We may collect and process your Personal Data for various purposes, as set out in this Fair Processing Notice.
Where applicable data protection laws require us to process your Personal Data on the basis of a specific lawful justification, we generally process your Personal Data under one of the following bases:
- the processing is necessary for the legitimate interests pursued by the Premier League (being those purposes described in the section above), except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of Personal Data;
- the processing is necessary for compliance with a legal obligation to which the Premier League is subject; or
- the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract.
We may on occasion process your Personal Data for the purpose of the legitimate interests pursued by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of Personal Data.
We have identified the following purposes for processing Personal Data. These purposes each relate to a lawful basis for processing, as required under applicable data protection law. These purposes include:
Purpose for processing
Recruitment and selection - This processing is necessary to take steps at the applicant's request to enter a contract of employment. The Premier League considers that it has a legitimate interest in fully assessing applications for employment to ensure that only suitable and appropriate candidates are both assessed and selected.
Appropriate vetting for recruitment and team allocation including, where relevant and appropriate, right to work verification, criminal record checks (if and to the extent permitted by applicable laws), relevant employment history, relevant regulatory status and professional qualifications - This processing is necessary for the compliance with legal obligations to which the Premier League is subject. This processing is also necessary for the purpose of the legitimate interests pursued by the Premier League in terms of the Safeguarding of vulnerable groups for which it has responsibility. The Premier League considers that it has a legitimate interest in managing its business operations in the most effective way and wishes to maintain its world class reputation and continue to attract high calibre employees.
To enforce our legal rights and obligations, and for any purposes in connection with any legal claims made by, against or otherwise involving you - This processing is necessary to perform the contract between you and the Premier League and for the compliance with legal obligations to which the Premier League is subject. The Premier League considers that it has a legitimate interest in protecting its organisation from breaches of legal obligations owed to it and to defend itself from litigation.
Other purposes permitted by applicable laws, including legitimate interests pursued by the Premier League where these are not overridden by the interests or fundamental rights and freedoms of staff.
Additional information regarding specific processing of Personal Data may be notified to you directly or as set out in applicable policies.
Processing special categories of Personal Data or sensitive data
The sensitive or special categories of Personal Data that may be processed by the Premier League are set out in this Fair Processing Notice. Where applicable data protection laws require us to process such special categories of Personal Data on the basis of a specific lawful justification, we process the same under one of the following bases:
- the processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Premier League in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
- the processing is necessary for the assessment of your working capacity, medical diagnosis, or the provision of health care or treatment, to the extent permitted by applicable laws;
- the processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional situations such as a medical emergency); or
- the processing is necessary for the establishment, exercise or defence of legal claims.
This may include the following, although this is not an exhaustive list:
Purpose for processing
Assess and review eligibility to work for the Premier League in the jurisdiction in which you work - This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Premier League in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.
The collection of statistical data to keep the Premier League’s commitment to equal opportunity under review - This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Premier League in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. This processing is also necessary for the purpose of the legitimate interests pursued by the Premier League. The Premier League considers that it has legitimate interests in ensuring that it takes action to prevent discrimination and promote an inclusive and diverse workplace.
Compliance with employment, health and safety or social security laws. For example to make reasonable accommodations or adjustments and avoid unlawful discrimination or dealing with complaints arising in this regard - This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Premier League in the field of employment law, social security and social protection law, to the extent permissible under applicable laws. This processing is also necessary for the purpose of the legitimate interests pursued by the Premier League. The Premier League considers that it has a legitimate interest in ensuring that each employee undertakes appropriate duties, are properly trained and undertake their roles correctly
We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement to agree to any request for consent from the Premier League.
Processing data relating to criminal convictions and offences
Personal Data relating to criminal convictions and offences will only be processed where authorised by applicable laws and where it is appropriate for the role and to safeguard vulnerable groups. In these cases, we would carry out a Disclosure and Barring Service check (DBS) at the recruitment stage, however further information may be collected during your employment should you be successful in obtaining the role.
Automated decision making / profiling
We may leverage Pinpoint’s technology to help us select appropriate candidates for us to consider based on criteria we have identified. The process of finding suitable candidates is automatic; however, any decision as to who we will engage to fill the job opening will be made by our team and is not automated in any way.
Retention of Personal Data
The Premier League endeavours to ensure that Personal Data is kept as current as possible and that irrelevant or excessive data is deleted or made anonymous as soon as reasonably practicable. The retention of your data will depend on whether you are successful in obtaining a role at the Premier League.
If your application is not successful and we have not sought consent or you have not provided consent upon our request to keep your data for the purpose of future suitable job vacancies, we will keep your data for up to twelve months once the recruitment process ends.
If we have sought your consent to keep your data on file for future job vacancies, and you have provided consent, we will keep your data for two years once the recruitment process ends. At the end of this period, we will delete or destroy your data, unless you have already withdrawn your consent to our processing of your data in which case it will be deleted or destroyed upon your withdrawal of consent.
If your application is successful, your data will be kept and transferred to the systems we administer for our employees. We have a separate privacy notice for employees, which we will provide to you. However, some Personal Data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.
Security of data
The Premier League uses a variety of technical and organisational methods to secure your Personal Data in accordance with applicable laws.
The Premier League is committed to protecting the security of the Personal Data you share with us. In support of this commitment, we have implemented appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk.
Transfer of data
The data that we collect from you and process using Pinpoint's services will be transferred to and stored at one of several datacentre locations in Amsterdam (Netherlands) and may be synchronised to one of several datacentre locations in London (United Kingdom) for backup and redundancy purposes. This transfer, storage and processing of your Personal Data shall be in accordance with applicable data protection legislation.
Some countries outside of the European Union (EU) do not have laws that protect privacy rights and Personal Data as extensively as the UK and other countries within the EU. Pinpoint, in providing their services to us, may transfer your Personal Data to sub-processors that may be situated outside of the EU. In such circumstances, we will ensure that your Personal Data is protected to a similar degree, in accordance with applicable data protection legislation by ensuring one of the specific safeguards approved by the European Commission is in place.
The law on data protection gives you certain rights in relation to the data we hold on you. These are:
- The right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
- The right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request
- The right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
- The right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
- The right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
- The right to portability. You may transfer the data that we hold on you for your own purposes
- The right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests
- The right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision making in way that adversely affects your legal rights.
Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.
Additional Fair Processing Notices
We may undertake certain processing of Personal Data which are subject to additional Fair Processing Notices and we shall bring these to your attention where they engage.
Notice of changes
The Premier League may change or update this Fair Processing Notice at any time.
Should we change our approach to data protection, you will be informed of these changes or made aware that we have updated the Fair Processing Notice so that you know which information we process and how we use this information. This Fair Processing Notice was last updated and reviewed on 18 August 2020.