PRIVACY POLICY

Talent Pro-Max League (“TPL”, “we”, “us” or “our”) respects the privacy of players, parents and guardians, team representatives, coaches, match officials, scouts, supporters, volunteers, apprentices, work-experience participants, sponsors, suppliers, website visitors and other people who interact with us. This Privacy Policy explains what personal data we collect, why we use it, the lawful bases we rely on, who we share it with, how long we keep it, how we protect it, and the rights available to individuals.

This Policy applies to www.talentproleague.co.uk, TPL registration and competition administration, player profiles, digital scouting, statistics and rankings, match recording and highlights, interviews and media, events, marketing, enquiries, sponsorship, community and education activities, and any TPL-controlled digital service that links to this Policy. Separate privacy notices may be provided for employees, job applicants, specific events, safeguarding matters or high-risk processing.

TPL is based in the United Kingdom. Our principal privacy framework is the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Privacy and Electronic Communications Regulations (“PECR”), and applicable guidance and statutory codes issued by the Information Commissioner’s Office (“ICO”).

TPL’s approach is designed to reflect the core principles used by FA for football-related personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; security and confidentiality; and respect for individual rights. FA’s public data-protection framework also recognises player performance, event, photo, video, and technology-generated data as personal data and identifies consent, contract, legal obligation, public interest, and legitimate interests as possible lawful bases, depending on the circumstances.

TPL also recognises the FA direction on personal player performance data: football organisations should protect player privacy, apply safeguards to performance- and health-related information, be transparent about the collection and use of such information, and enable players to exercise their data protection rights. TPL will not describe itself as FA-approved or FA-affiliated unless that status has formally been granted.

The data controller for processing covered by this Policy is the legal entity that operates Talent Pro-Max League. Before publication, TPL must insert the exact legal entity name, registered office/principal address, company number (if applicable), and privacy contact details below.

We may collect personal data directly from you, from a parent or guardian, team manager or authorised representative, through our website and registration systems, during matches and events, from cameras and production teams, from match officials and TPL staff, from technology used to record or analyse matches, and from service providers acting for us.

Where appropriate and lawful, we may also receive football-related information from clubs, schools, colleges, governing bodies, competition partners or other football organisations. FA’s player-data notices similarly recognise that football data can originate from players, member associations, team managers, partners, physicians and technology such as video or tracking systems.

Young people are central to TPL’s mission. TPL therefore intends to apply enhanced privacy safeguards to children’s data. The ICO Children’s Code applies to online services likely to be accessed by children and expects the best interests of the child to be a primary consideration, high privacy by default, data minimisation, age-appropriate transparency, appropriate age assurance, controls around profiling and geolocation, and accessible tools for exercising privacy rights.

• TPL will carry out and maintain a Data Protection Impact Assessment (“DPIA”) for digital services and processing likely to create a high risk to children, including public player profiles, scouting functionality, extensive match analytics or new tracking technologies.
• Child-facing privacy information should be concise and written in language appropriate to the relevant age group.
• Privacy settings for children should be high by default unless TPL documents a compelling reason otherwise.
• TPL should not make a child’s direct contact details, precise home/school location or unnecessary personal information publicly visible.
• Geolocation should be off by default unless necessary and justified.
• TPL should not use manipulative design or nudges to encourage children to disclose more data or reduce privacy protections.
• Children should have simple ways to ask questions, report concerns and exercise their data rights.

Parent or guardian involvement does not remove a child’s own data-protection rights. TPL will consider the child’s age, competence, best interests and the legal basis for each activity.

TPL treats identifiable player-performance data as personal data. Consistent with FA’s public player-data framework, this can include event data, performance data, photos, videos and information generated by football technology. If TPL later introduces GPS, optical tracking, limb tracking, wearable devices or similar systems, TPL will complete a privacy and safeguarding assessment before deployment.

• Players will be told what is being collected, by whom, for what purpose, who can see it and how long it will be retained.
• TPL will collect only performance data proportionate to its competition, scouting or player-development purpose.
• Access to detailed or sensitive performance data may be restricted to the player, authorised TPL personnel and approved football professionals rather than made public.
• TPL will provide a process for players to challenge inaccurate performance information and exercise applicable rights.
• Health, biometric or other special category data will receive additional protection and will not be collected merely because technology makes collection possible.
• TPL will assess vendors and put appropriate data-processing agreements and security obligations in place.

TPL may enable professional or grassroots clubs, scouts, coaches, or other approved football personnel to view information intended for scouting purposes. The exact access model should be documented before launch. TPL may use registration, verification, role-based access, audit logs and terms of use to reduce misuse.

TPL will not sell private player medical data or children’s private contact information to scouts. Where a club or scout receives data as an independent controller, that organisation is responsible for its own lawful processing and privacy obligations.

• TPL staff, authorised volunteers, competition administrators and safeguarding personnel on a need-to-know basis;
• teams, coaches and match officials where necessary to administer the competition;
• medical, first-aid, safeguarding and security providers where necessary;
• video, photography, broadcast, production and technology providers acting under appropriate arrangements;
• website hosting, cloud, CRM, analytics, communications and IT-security providers;
• payment processors, accountants, insurers, professional advisers and auditors;
• verified clubs, scouts or football organisations where the relevant data is lawfully made available for scouting or football administration;
• The Football Association, relevant County FA, or other governing/football bodies where TPL is required or appropriately authorised to share information under applicable rules, affiliation arrangements or law;
• police, courts, regulators, safeguarding authorities or other public bodies where disclosure is legally required or necessary and lawful.

TPL will require processors to handle personal data only in accordance with documented instructions, protect it appropriately, keep it confidential, and assist TPL with relevant legal obligations.

TPL’s use of FA-aligned privacy principles does not mean that all TPL participant data is automatically sent to FA. Personal data will only be shared with the FA, a County FA or another football body where there is a specific lawful, regulatory, competition or operational reason to do so.

Where a governing body receives data as a separate controller, its own privacy policy will govern its subsequent use. Where TPL processes information on another organisation’s instructions, the parties will document their respective responsibilities.

Some technology, cloud, media or service providers may process personal data outside the United Kingdom. Where UK data-protection law restricts an international transfer, TPL will use an available lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and will assess supplementary measures where required.

Football organisations can operate internationally. If data is shared internationally for a legitimate football purpose, TPL will still apply data minimisation, transparency and appropriate safeguards.

TPL will keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, safeguarding, insurance, accounting, dispute resolution, and football record requirements. Retention periods will be documented in a retention schedule.

• Account and registration data: normally for the active relationship, plus a proportionate period for legal and administrative needs.
• Financial and transaction records: for the period required by applicable tax, accounting and legal rules.
• Routine enquiries: only as long as needed to resolve the enquiry and any reasonable follow-up.
• Health and emergency information: no longer than necessary for safety, incident management and applicable legal/safeguarding requirements.
• Safeguarding records: retained according to applicable safeguarding, legal, insurance and governing-body requirements, which may require longer periods.
• Match results and sporting records: selected non-sensitive records may be retained longer for legitimate historical, statistical and competition-archive purposes.
• Raw footage and detailed performance data: retained according to a documented purpose-specific schedule; sensitive data should generally have shorter retention unless a clear justification exists.

FA’s public notices use purpose-specific retention periods for different football datasets. TPL will adopt the same principle of documented, proportionate retention rather than a single indefinite period for all data.

TPL will use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, strong authentication, encryption where appropriate, secure backups, vendor due diligence, staff confidentiality, role-based permissions, audit logging, patching, incident response and staff training.

No internet or storage system can be guaranteed completely secure. Where a personal data breach occurs, TPL will investigate, mitigate risk, and notify the ICO and affected individuals where required by law.

TPL may use statistics or defined criteria to generate rankings, leaderboards, recommendations or performance indicators. TPL will explain material automated features and will not rely solely on automated processing to make a decision that has legal or similarly significant effects on a person unless the processing is lawful and the required safeguards are in place.

A TPL ranking is a football information feature, not a guarantee of a player’s ability, future career or suitability for a professional club. Where children are involved, profiling will be subject to enhanced scrutiny under the Children’s Code.

TPL may use strictly necessary cookies to operate and secure the Website. Analytics, advertising, or other non-essential cookies and similar technologies will be used only in accordance with PECR and applicable consent requirements. TPL should publish a separate Cookie Policy and provide a consent-management tool that allows users to make and later change their choices.

For child users, tracking and profiling technologies should be designed and configured with the Children’s Code in mind.

TPL may promote competitions, events, opportunities, merchandise, content or partner activities. We will not provide personal contact details to a sponsor for that sponsor’s own direct marketing unless there is an appropriate lawful basis and the individual has been clearly informed; where consent is required, it will be obtained.

Users can unsubscribe from marketing at any time. Withdrawal from marketing does not stop necessary operational messages about an active registration, fixture, safety issue, payment or service.

Depending on the circumstances, you may have the right to:

• be informed about how your personal data is used;
• request access to personal data TPL holds about you;
• ask us to correct inaccurate or incomplete data;
• ask for erasure of personal data in applicable circumstances;
• ask us to restrict processing;
• object to processing based on legitimate interests and to direct marketing;
• receive certain data in a portable format where the right applies;
• withdraw consent at any time where processing is based on consent;
• raise concerns about solely automated decisions and profiling where the relevant legal protections apply;
• complain to the ICO.

These rights belong to children as well as adults. A parent or guardian may sometimes exercise rights on a child’s behalf, but TPL will consider the child’s competence, wishes, best interests and the circumstances of the request.

TPL may need to verify identity before acting on a request. We will normally respond within the period required by applicable law and will explain if a lawful exemption applies.

Please raise privacy questions or complaints with TPL first, using the privacy contact published in section 3. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection. Current ICO contact information is available at ico.org.uk.

TPL websites and communications may link to third-party platforms such as social networks, video services, payment services, ticketing providers, clubs or sponsors. Those organisations may act as separate controllers and their own privacy policies apply. TPL is not responsible for the privacy practices of independent third parties.

TPL may update this Policy to reflect changes in law, regulation, FA or football data standards, TPL services, technology or our processing activities. The current version and effective date will be published on the Website. Material changes may be brought to the attention of registered users where appropriate.