Privacy Policy

Activity and the personal data we collect

Why we collect that personal data

The lawful basis for processing your personal data

When you create an account with us, use our services or sign up to receive communications from the Club, we will collect the identity and contact details that you provide us. This may include your name, title, date of birth, postal address, email address and telephone number(s). We will also collect your login information such as username and password. We may assign a unique identification number (known as a FanID) to your account.

To provide you with a personalised account when making use of the Club’s services.

To provide you with information, products and services you have requested, to tell you about the status of requests or to resolve any issues that have arisen).

To personalise communications with you (including marketing communications, where you are opted in to receive them).

Performance of a contract / potential contract with you.

Where you purchase a Matchday or season ticket (including half season tickets), ticketing memberships services or buy other products and services from us from us, we collect details of your identity (which may include your image / photograph), contact details, account information, purchase history and marketing preferences.

To provide you with tickets, products and services you have purchased and to maintain a record of your purchase history.

To conduct analysis of how supporters use our products / services so that we may to develop and improve our products and services, and develop our business (we may use third party suppliers to help us to this, and may share your personal data with those third party suppliers for that purpose).

We may share your data with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League) and other football clubs in the event that we ban you from attending our matches or other events (for further information, see Section 5 below).

In addition, we may share your data with Fourth Wall FEP1 Limited in order to assist the Club to fulfil any ticketing membership products or services that you have purchased from the Club.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (for sale of a ticket or other products and services, to provide a dedicated seat and to control the number of individuals in the stadium; to ensure tickets for high demand fixtures are limited to active / loyal supporters and to support authorities (the police and other law enforcement agencies, the Health and Safety Executive and other government agencies) football Governing Bodies and other football clubs in delivering a safe and secure event; to study how supporters use our products/services; to develop them and to develop our business).

Where you purchase tickets for away matches from us, we collect details of your identity (which may include an image of you), contact details, account information, ticket purchase history and marketing preferences.

To provide you with tickets you have purchased and to maintain a record of your purchase history.

To provide other clubs with details of any away tickets you have purchased to attend their stadium.

We may share your data with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League) and other football clubs in the event that we ban you from attending our matches or other events (for further information, see Section 5 below).

Necessary for both our and the other club’s legitimate interests (ensuring supporters who have purchased valid tickets are permitted entry to the other club’s stadium, ensuring safety and security for all staff and visitors to the other club’s premises; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims).

When purchasing a product or service from us we will also collect your payment card details and, if that purchase is not made in person (for example you purchase online or over the phone), we will also collect your billing address. We will also collect details of your historic payment method and purchase history. We do not retain payment card details once the payment has been processed.

To collect payment from you for products and services you have purchased.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (to recover debts due to us).

When purchasing a non-football related product or service via the website www.villaparkstadium.com, we will collect your name, email address, phone number and the event type that you are interested in.

To respond to your enquiry, to contact you to assist you with your enquiry, and to send you marketing information (if you have opted in to receive it). In addition, if relevant, to share your personal data with Compass Contract Services (UK) Limited (trading as “Levy Restaurants”) to allow them to contact you to assist you with your enquiry, and to send you marketing information (if you have opted in to receive it). To understand how Levy Restaurants will use your personal data please refer to their privacy policy at https://www.compass-group.co.uk/privacy-notice 

Performance of a contract / potential contract with you.

Consent.

Where you sign up for auto renewal of your season ticket or automatic purchase of cup tickets and provide your payment card details and billing address, those details will be stored (by our third party payment gateway provider) for as long as you are a member of the relevant scheme (or until you update those payment details with new details). Once the details have been entered and provided to our third party payment gateway provider, the Club cannot access these details (they are masked).

To collect payment from you for products and services you have purchased.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (to recover debts due to us).

If you enter a competition, prize draw or other promotion that we may run, we will collect information that you may give us when you enter (or in any follow up communications we have with you), such as your name, Fan ID, contact details or social media handle(s), date of birth and proof of age (if relevant to entry), proof of address (if relevant to entry) and details of the prize won.

To administer the competition, prize draw or promotion and (if you are successful) to provide you with your prize.

Performance of a contract / potential contract with you.

As you interact with our websites and mobile applications, or use our WIFI services, we automatically collect data about your equipment, network connection details, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. We may also receive such information about you if you visit other websites employing our cookies. Please click HERE to see our cookie policy for further details.

To use data analytics to improve our websites, products/services, marketing, information services, supporter relationships and experience.

To study how supporters use our products/services, to develop them and to develop our business.

To monitor the use of our WIFI network by guests visiting our premises.

Necessary for our legitimate interests (to define types of supporters for our products and services; to study how supporters use our products/services; to keep our websites and products / services updated and relevant; to develop our business and inform our marketing strategy and information services strategy; for security).

Where we communicate with you by email, we collect details of whether you opened that email and / or interacted with any of the content within that email.

To analyse, personalise and improve our communications, marketing, information services and supporter relationships.

Necessary for our legitimate interests (to understand relevance of our email communications; to develop our supporter experience; to develop our business; and inform our marketing strategy and information services strategy).

We may collect your age, contact details and marketing preferences to tell us how you prefer to be contacted when we communicate with you, or when you unsubscribe from receiving marketing communications. If you do not consent to any marketing, we also keep a record of this.

To send age appropriate marketing communications to supporters and to provide supporters with information services about the Club and products / services they have purchased.

Consent

Necessary for our legitimate interests (to provide age appropriate information, information services and marketing to supporters, to grow our supporter database; to develop our business; and inform our marketing strategy and information services).

If you have consented to receive Digital Advertisements, we will pass your personal data, in encrypted form, to social media platforms and other third party organisations in order for them to show advertisements regarding Club news, products and services to you on our behalf. If you do not consent to Digital Advertisements we will also keep a record of this. This consent does not cover campaigns where a social media platform or other third party organisation may use the personal data that they may hold about you to show you advertisements regarding Club news, products and services. Whilst your personal data will not be passed onto any such organisations by the Club for those purposes, you may still receive digital advertisements, including about the Club, if you have consented to receive the same from such organisation.

To send age appropriate marketing communications to supporters and to provide supporters with information services about the Club and products / services.

Consent

Necessary for our legitimate interests (to provide age appropriate information, information services and marketing to supporters, to grow our supporter database; to develop our business; and inform our marketing strategy and information services).

We may collect your child’s name and age, photographs of them, film or video recordings of them, their medication details and your name, relationship to child and contact details in connection with your child’s mascot experience and for use in marketing communications. If you do not consent to any marketing, we will also keep a record of this.

To administer the mascot experience, in particular if we need to contact you in the case of an emergency. For the child’s first name and image to be used in connection with publicity and marketing purposes for the Club to provide supporters with information services about the Club and its products and services.

Performance of a contract / potential contract with you

Consent

Necessary for our legitimate interests (to provide age appropriate information, information services and marketing to supporters, to grow our supporter database; to develop our business, ensuring safety and security for all staff and visitors to our premises; to respond to any claims and to claim from our insurers).

To comply with our legal obligations.

If you contact us, for example with an enquiry, comment or complaint, we collect any personal information you may give in such correspondence with us.

To investigate, review and respond to your enquiry, comment or complaint.

Necessary for our legitimate interests (supporter relations; to improve our information services, products, services and supporter experience; and to develop our business).

If you call us, for example to buy a match ticket, season ticket, membership, hospitality, or event, or in relation to a ticketing, hospitality or event enquiry, we may record the phone call

For training or monitoring purposes and to respond to any enquiry, comment, or complaint.

Necessary for our legitimate interests (supporter relations; to improve our information services, products, services and supporter experience; and to respond to enquiries and complaints).

For security and safety of the Club and those visiting Club premises, the Club uses CCTV in and around Villa Park and the Club’s other premises (this includes the Club’s training ground and car parks) and certain streets surrounding the Club’s premises and so if you attend either of those premises your image may be captured on CCTV recordings. The Club’s security staff and matchday stewards may also use body worn cameras which may also capture your image when attending our premises.

To monitor and review any accidents or incidents and for the safety and security of visitors to our premises.

We may share CCTV with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League), insurance companies and / or the Club’s service providers (including the Club’s Catering and Events Partner and Retail Partner) where such sharing necessary and in accordance with data protection (for example, where sharing CCTV is necessary for the purposes of the prevention or detection or crime, the apprehension or prosecution of offenders or in relation to prospective or ongoing legal proceedings).

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to improve our safety / security operations; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims).

To comply with our legal obligations.

If you have an accident whilst at our premises, we may record details of your identity and contact details, as well as details of the accident, any injury sustained, treatment received and any other relevant factors or medical conditions.

To maintain a record of any accidents or incidents in line with legislation and good industry practice, for our insurance purposes and to protect the Club in the event of any future claims or legal action.

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to respond to any claims and to claim from our insurers).

To comply with our legal obligations.

If you are involved in any security related incident during a Matchday (whether at the Club’s stadium or at any other stadium or event which the Club participates in), we will keep details related to that incident, for example the identity and contact information of people involved or potential witnesses, details of the incident and copies of any relevant video footage.

To maintain a record of any accidents or incidents in line with legislation and good industry practice, for our insurance purposes and to protect the Club in the event of any future claims or legal action.

We may share your data with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League) and other football clubs in the event that we ban you from attending our matches or other events (for further information, see Section 5 below).

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to improve our safety / security operations; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims and to claim from our insurers).

To comply with our legal obligations.

We may collect details of your identity (including image from CCTV or other camera footage) together with any relevant details of any convictions, orders, arrests or suspected involvement in incidents which may impact on the safety or security of any Matchdays or other events the Club takes part in.

To ensure safety and security for all staff and visitors to our premises.

We may share your data with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League) and other football clubs in the event that we ban you from attending our matches or other events (for further information, see Section 5 below).

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims).

To comply with our legal obligations.

If you attend an event hosted or arranged by the Club, we may take photographs and / or film or video recordings of the event, which may include your image.

For use in marketing materials and / or media coverage of the event.

Depending on the event, we may share these details with a third party (for example, Aston Villa Foundation may share copies of images with its grant funders, when the event was related to a grant funded project). We will tell you if we plan to do this and you will have the ability to opt out.

Where consent is sought prior to or at the relevant event: consent.

Where the Club deems it inappropriate to seek consent prior to or at the relevant event: necessary for our legitimate interests (to develop our business).

Regardless of the basis upon which this personal data is processed, the Club will respect a request not to use your image in any future marketing materials.

If you attend the Club’s premises (for example the  Villa Park stadium or Bodymoor Heath training ground) for a match or other event (or attend as part of any preparation for such match or event), the Club may need to collect your identity and contact information (such as name, company you are from, purpose of your visit and contact details). We may also need to collect any other information relevant to ensuring the safety and security of our premises and the people who use it.

We collect this information to comply with our obligation to provide a safe working environment and to fulfil our duty of care to those visiting and working at the Club’s premises. We may need to share your data with our football Governing Bodies (for example The FA, the Premier League and The English Football League) and Regulatory Bodies (for example the Health and Safety Executive), where necessary for the purposes of competition integrity.

We may also share your data with the police or other law enforcement or governmental agencies, football Governing Bodies (for example The FA, the Premier League and The English Football League) and other football clubs in the event that we ban you from attending our matches or other events (for further information, see Section 5 below).

Necessary for our legitimate interests (operating the stadium in a safe and lawful manner and ensuring safety for all staff and visitors to our premises).

To comply with our legal obligations.

As a result of the Covid-19 pandemic and the Club’s related obligations and protocols when permitting people to access the Club’s premises, if you attend the stadium for a match or other event (or attend as part of any preparation for such match or event) or attend the Club’s training ground, the Club may need to collect information about your health.

We collect this information to with our obligation to provide a safe working environment and to fulfil our duty of care to those visiting and working at the Club’s stadium and to make an assessment of whether you are fit and well enough to be permitted access to the stadium. We may need to share your data with our football Governing Bodies (for example The FA, the Premier League and the English Football League), but only where necessary for the purposes of competition integrity. 

Necessary for our legitimate interests (operating the stadium in a safe and lawful manner and ensuring safety for all staff and visitors to our premises).

To comply with our legal obligations.

Activity and the personal data we collect

Why we collect that personal data

The lawful basis for processing your personal data

The Club’s official retail channels (which includes over the phone, and online at shop.avfc.co.uk) are operated by Fanatics (International) Limited (“Fanatics”). When you buy products or services via those channels, we may receive information from Fanatics about your identity, contact details, purchase history and marketing preferences (only where you have given Fanatics consent to do so). You can view Fanatics’ privacy policy in relation to the operation of the Club’s official retail channels at:

https://shop.avfc.co.uk/en/astonvilla-privacy-policy/ch-1422

To market to you in line with your marketing preferences.

To study how supporters use our products/services, to develop them and to develop our business.

Consent

Necessary for our legitimate interests (to study how supporters use our products and services; to develop our products and services; and to develop our business).

We may receive details of your identity, contact details, account information, ticket purchase history and marketing preferences from the provider of our Online Ticket Office and back office ticketing software. They will tell us if you have purchased a ticket to any match or event at the Club’s stadium or for an away match in which one of the Club’s teams takes part.

To provide you with tickets you have purchased and to maintain a record of your ticket purchase history.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (to study how supporters use our products/services; to develop them and to develop our business).

If you access the Club’s WIFI service, we collect details of your identity (name, email address, post code, confirmation of being over 18) and marketing preferences as part of your registration for our WIFI service from the provider of our WIFI registration services.

Our third party provider also collects details of your browsing session, including the device and browser you are using and sites you visit whilst using our WIFI services.

To provide you with WIFI access at the Club’s premises.

To market to you in line with your marketing preferences.

To analyse and understand who uses the Club’s WIFI services.

For security and monitoring to ensure compliance with the law and terms and conditions of use of the services provided.

Performance of a contract / potential contract with you.

Consent

Necessary for our legitimate interests (supporter relations; to improve products / services / supporter experience and to develop our business; and to identify, protect against and report actual, potential or suspected fraud or breaches of our terms and conditions of service or criminal activity).

In periods where we expect high demand for tickets (e.g. key matches or periods where season tickets go on sale), we may use the services of a call centre to assist us with ticket purchases over the telephone. Where this occurs, you may be directed to a call centre when you call the Club’s Ticket Office. They will collect your identity, contact and payment details and provide them to us / our Ticket Office software provider to process the purchase.

To ensure your call is answered as quickly as possible; and to provide you with tickets you have purchased.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (to study how supporters use our products/services; to develop them and to develop our business).

We may receive details of your identity, contact details and account information received from the provider of our Pride Rewards scheme and e-cash scheme to tell us about your membership and use of the scheme (including products / services you have purchased from third party affiliates using your Pride Rewards e-cash card).

To administer the Pride Rewards and E-cash scheme.

To analyse and understand how supporters use the Pride Rewards and E-cash scheme.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (supporter relations; and to improve products / services / supporter experience and to develop our business).

We may receive details of your identity, contact details and transaction information from our secondary ticketing partner to tell us about any tickets you have purchased or sold on our official secondary ticketing platform.

To process any ticket sale / purchase made through our secondary ticketing partner.

Performance of a contract / potential contract with you.

When you use your Matchday ticket, season card or membership card to gain access to the Club’s facilities services at Villa Park (the Club’s stadium), we receive details of usage of your tickets from the providers of our stadium access control system.

To provide you with access to the Club’s stadium (Villa Park) and the Club’s facilities / services.

To analyse and understand how and when our supporters use our facilities / services.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (supporter relations; and to improve products / services / supporter experience and to develop our business).

When you purchase a product or service, we receive your contact details, payment details and details of the transaction from our payment gateway provider.

To collect payment from you for products and services you have purchased.

Performance of a contract / potential contract with you.

Necessary for our legitimate interests (to recover debts due to us).

If you have an accident whilst at our premises and are treated by a third party (for example, St John’s Ambulance), we may receive details of your identity and contact details, as well as details of the accident, any injury sustained, treatment administered and any other relevant factors or medical conditions.

To maintain a record of any accidents or incidents in line with legislation and good industry practice, for our insurance purposes and to protect the Club in the event of any future claims or legal action.

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to respond to any claims; and to claim from our insurers).

To comply with our legal obligations.

We may receive details of your identity (which may include your image) from government and law enforcement authorities, football Governing Bodies (such as The FA, the Premier League and the English Football League) and / or other football clubs together with any relevant details of any convictions, orders, arrests, bans from other football or sporting events or suspected involvement in incidents which may impact on the safety or security of any Matchdays or other events the Club takes part in. 

To ensure safety and security for all staff and visitors to our premises.

Necessary for our legitimate interests (ensuring safety and security for all staff and visitors to our premises; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims).

To comply with our legal obligations.

We may receive details relating to any conduct, act or statement that is abusive, insulting, intimidating, offensive or discriminatory which has been directed to the Club or any member if its staff, player, match official or other individuals attending a Club football match, whether such conduct, act or statement takes place within the Club’s stadium, otherwise in person or online. Such information may be received from government and law enforcement authorities, football Governing Bodies (such as The FA, the Premier League and the English Football League) and / or other football clubs)

To meet the commitment made by the Premier League and its member football clubs (including Aston Villa Football Club) to ensure that any individual found to have engaged in discriminatory or abusive conduct is not only prevented from attending football matches at the stadium of the club that they support, but all Premier League football matches.

Necessary for our legitimate interests and the legitimate interests of the Premier League, its member football clubs and the wider public (preventing abusive and discriminatory behaviour).

If you are an away fan attending the Club’s stadium (Villa Park) and have purchased your tickets via the away club, we may receive details of your name and ticket details from that away club.

To ensure safety and security for all staff and visitors to our premises.

Necessary for both our and the away club’s legitimate interests (ensuring supporters who have purchased valid tickets are permitted entry to the Club’s stadium, ensuring safety and security for all staff and visitors to our premises; to identify, protect against and report actual, potential or suspected fraud or criminal activity; to respond to claims.

When you agree to receive notifications from our websites and / or mobile applications, our third party notification services providers will collect information about your device, the pages on our websites and / or mobile applications that you visited, the start and end time of your session(s) and the location of your device when visiting our websites and / or using our mobile applications. This information is collected on an anonymised basis (whilst this information is linked to the device you used, we do not link that information to an individual or an IP address).

To provide tailored notifications to you based on your websites and mobile applications usage, device type and location (subject to you providing your consent to receive notifications). 

Consent

If you agree to take part in an online Club survey or other data capture exercise hosted by a third party (for example, Survey Monkey), the Club will receive the information that you provide as part of that survey

To review and analyse the results of the survey or other data capture exercise. To administer any prize draws or competitions that are related to the survey or other data capture exercise. There may also be other purposes for collecting the personal data, which will be specified within the form used to collect the personal data.

Generally, the lawful basis for processing personal data captured via a survey or other data capture exercise will be consent.

There may a separate lawful basis – if so, details will be set out in the form used to collect the personal data.

Specialist data providers provide us with profile information about our supporters. We use this to segment and understand our supporters and the way we communicate with them (including any marketing we may send).

Currently, we use two companies to do this: Experian Limited and X Channel Marketing Limited– you can visit their websites and view their privacy policies at www.experian.co.uk and https://www.xcm-uk.com/).

To understand supporter preferences. To provide supporters with relevant information and improve our products and services.

Necessary for our legitimate interests (supporter relations; and to improve products / services / supporter experience and to develop our business).

Data analytics providers provide us with: (a) data on supporters’ behaviour on our websites and mobile applications (e.g. how much time supporters spend on which pages / sections, which links they choose to click, what supporters do and don’t like, etc.); and (b) devices used to access our websites and mobile applications (in particular device's IP address (in an anonymised form), screen size, type (unique device identifiers), browser data, geographic location (country only), preferred language).

Currently we use Hotjar Limited to do this for website data and Shift6 Limited (trading as “AppSee”) for mobile application data.

Hotjar, AppSee and the Club will never use this information to identify individual supporters or to match it with further data on an individual supporter.

For further details, please see Hotjar’s website and privacy policy at www.hotjar.com and AppSee’s website and privacy policy at www.appsee.com

To understand the needs of supporters and to optimise service and experience.

Necessary for our legitimate interests (supporter relations; and to improve products / services / supporter experience and to develop our business).

The Club’s Catering and Hospitality Services partner (currently Compass Contract Services (UK) Limited, trading as Levy Restaurants) operates “frictionless retail units at the Club’s Villa Park Stadium. Where you use one of these frictionless retail units, your personal data will be collected and processed by Levy Restaurants.

Data collected by Levy Restaurants and processed pursuant to Levy’s privacy notice (www.compass-group.co.uk/about/privacy-notice/).

Data collected by Levy Restaurants and processed pursuant to Levy’s privacy notice (www.compass-group.co.uk/about/privacy-notice/).