Introduction
This Privacy Notice explains how Tottenham Hotspur Ltd and Tottenham Hotspur Football & Athletic Co. Limited handles personal data.
We are the data controller for the personal data described in this Notice and responsible for complying with data protection law.
This Notice may be updated from time to time. The current version will be made available through our website.
Personal Data We Hold
The table below summarises the main personal data we collect, where it comes from, why we use it and the lawful basis relied upon under the UK GDPR:
| The data we collect | Where from? | Purpose | Lawful basis |
| Website and digital platform data, including IP and MAC address, device and browser information, page interactions, searches, content viewed, account status and approximate location. | Automatically from your device, browser, cookies and similar technologies; and directly from you through online forms. | To operate, secure and improve our websites and digital platforms; understand use; personalise content; and measure advertising effectiveness. | Legitimate interests. Consent. |
| Account and contact data, including name, title, date of birth, gender, address, email address, telephone number, password and contact preferences. | Directly from you when you register or update an account. | To create and manage a secure account, provide age-appropriate content, communicate with you and administer services and purchases. | Legal obligation. Legitimate interests. Consent. |
| Purchase, ticketing and payment data, including order details, payment card data, membership and ticket information, vehicle details and delivery information. | Directly from you. From payment, ticketing and fulfilment providers |
To process payment, supply products and services, manage ticketing, parking and delivery, and communicate about purchases. | Legal obligation. Legitimate interests. |
| Accessibility, disability and health information, including access requirements and relevant medical conditions for events or coaching courses. | Directly from you or a person acting on your behalf. | To make reasonable adjustments, support safe attendance and provide appropriate first aid or assistance. | Legal obligation. Substantial public interest. Explicit consent. Vital interests in an emergency. |
| Fraud, identity and security data, including copies of identity documents, name-change evidence and records of suspected fraud or ticket touting. | Directly from you. From transaction, security and fraud-prevention systems. From law enforcement where applicable. |
To verify identity or name changes, prevent and investigate fraud and ticket touting, protect customers and enforce our terms. | Legitimate interests. Legal obligation. |
| App data, including device identifiers, app usage, location, Bluetooth proximity, push-notification settings, photographs and quiz participation. | Automatically from your device and directly from you through the app. | To provide app features, remember preferences, personalise content, provide location-based services or notifications and administer interactive features. | Legitimate interests. Consent. |
| Stadium and visitor Wi-Fi data, including device and IP addresses, connection records, sites visited and traffic information. | Automatically from devices connected to our networks and network-security systems. | To provide internet access, protect the network, block malicious content and investigate misuse or security incidents. | Legitimate interests. |
| Marketing and market-research data, including contact preferences, campaign engagement, survey responses and interests. | Directly from you; your account and interactions with our communications. | To send marketing and partner communications where requested, manage preferences and conduct market research. | Consent. Legitimate interests. |
| Competition, voting and quiz data, including name, email address, entry, vote, score and prize information. | Directly from you when you participate. | To administer the activity, contact winners, award prizes and prevent misuse. | Legitimate interests. Contract. Consent. |
| Enquiry and complaint data, including contact details, correspondence, call recordings and case notes. | Directly from you; telephone and customer-service systems. | To respond to enquiries and complaints, monitor service quality, keep case records and address subsequent issues. | Legitimate interests. |
| CCTV, body-worn camera and audio data. | CCTV systems and body-worn cameras at our premises and venues. | For public and staff safety, building security, crime prevention and detection, incident management and evidence capture. | Legitimate interests. Legal obligation. Substantial public interest. |
| Supplier, partner and visitor data, including names, job titles, business contact details, company, visitor records and delivery-driver photographs. | Directly from you. From your employer or the organisation you represent. From visitor and access-control systems. |
To manage business relationships, deliveries, site access, safety and security. | Legitimate interests. Contract. |
| Recruitment data, including application details, qualifications, skills, employment history, remuneration, right-to-work information, references, background checks, reasonable-adjustment information and equality-monitoring data. | Directly from you; referees, former employers, recruitment agencies, background-check providers and the Disclosure and Barring Service where applicable. | To assess applications, arrange interviews and adjustments, verify eligibility, obtain references and checks, meet safeguarding duties and monitor equality of opportunity. | Legal obligation. Legitimate interests. Substantial public interest. Consent. |
| Data-subject-rights request information, including identity-verification information, customer reference number and request records. | Directly from you and from our existing records. | To verify identity, respond to rights requests and demonstrate compliance. | Legal obligation. Legitimate interests |
| Children’s data, including name, date of birth, country and parent or guardian contact and consent information. | Directly from the child, parent or guardian and through account registration. | To provide age-appropriate services, manage access to restricted areas and obtain parental authorisation where required. | Legal obligation. Contract. Consent. |
| Sharing, partner and publicity data, including contact information, comments, opinions, competition results and media content. | Directly from you and from your interactions with us. | To share information with service providers, commercial partners, Supporters’ Clubs, other football clubs, regulators, law enforcement or the public where necessary and lawful. | Contract. Legal obligation. Legitimate interests. Consent. |
| Talk Spurs discussion-forum data, including Spurs account identifier, display name or username, account contact details, age or age-band information where collected, IP address, device and browser identifiers, authentication and security logs, comments and replies, reactions, reports, moderation history, timestamps, restrictions or sanctions and technical usage data. | Directly from you through your Spurs account and activity in Talk Spurs; from Club account and identity systems; from automated and human moderation; and from other users who report content. | To provide and manage Talk Spurs; enable supporter comments and interaction; authenticate users; curate discussions; moderate, review and remove content; investigate reports; protect users, including children; enforce Community Guidelines and account restrictions; and maintain platform security. | Contract. Legitimate interests. Legal obligation. Substantial public interest. |
Do You Have To Provide Data?
You may need to provide certain personal data so that we can create an account, supply products or services, process a purchase, administer a booking, consider a job application, comply with the law or respond to a request. If required information is not provided, we may be unable to provide the relevant service or progress the request.
Where we rely on consent, you may refuse or withdraw consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn, although it may mean that an optional feature or communication can no longer be provided.
Who Is Your Personal Data Shared With?
We may share personal data where necessary with companies within the Tottenham Hotspur group and with carefully selected third parties, including:
- payment, ticketing, fulfilment, IT, hosting, analytics, communications and security providers;
- professional advisers, insurers, auditors and fraud-prevention providers;
- commercial partners and Supporters’ Clubs where you have requested or consented to the sharing;
- other football clubs and football bodies where this is necessary to provide tickets or comply with competition requirements;
- law enforcement, regulators, courts and other authorities where disclosure is required or permitted by law;
- recruitment agencies, referees, former employers, background-check providers and the Disclosure and Barring Service; and
- media or the public where you have been clearly informed and the disclosure is lawful.
Where a third party processes personal data on our behalf, it must act only on our instructions, protect the information and retain it only for the period we specify.
Data Outside Of The Uk
Some suppliers and partners may process personal data outside the UK. Where personal data is transferred internationally, we will use an appropriate lawful transfer mechanism and safeguards so that the information remains protected in accordance with data protection law.
Security
We use technical, physical and organisational measures designed to protect personal data. These include access controls, secure user accounts, encryption where appropriate, anti-virus protection, backups, system testing, physical access restrictions, confidentiality obligations and staff awareness training. Where suppliers provide systems or services, their security responsibilities are addressed contractually.
How Long Do We Keep Your Data For?
We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, regulatory, contractual and operational requirements, resolve disputes, investigate incidents and establish, exercise or defend legal claims. Retention periods differ by activity and system. At the end of the relevant period, data is deleted, destroyed or anonymised.
Automated Decision-Making And Profiling
Where we use automated decision-making or profiling in a way that produces legal or similarly significant effects, we will provide the information required by data protection law, including meaningful information about the logic involved, the significance and the likely consequences, and any applicable right to request human intervention or challenge the decision.
Your Rights
You have rights in relation to your personal data. The rights that apply will depend on the circumstances and the lawful basis used. To exercise a right, contact the Data Protection Officer using the details at the end of this Notice.
Right of access. You may request confirmation of whether we process your personal data and a copy of that data.
Right to rectification. You may ask us to correct inaccurate information and complete information that is incomplete.
Right to erasure. In some circumstances, you may ask us to delete your personal data. This is not an absolute right and we may need to retain information for legal or other lawful reasons.
Right to object. You may object where processing is based on legitimate interests or carried out for direct marketing. We will stop direct marketing when you object.
Right to restrict processing. In some circumstances, you may ask us to limit how personal data is used while an issue is considered.
Right to data portability. Where applicable, you may ask for certain personal data provided by you to be supplied in a structured, commonly used and machine-readable format or transferred to another controller.
Right to withdraw consent. Where processing relies on consent, you may withdraw it at any time.
Rights relating to automated decisions. Where applicable, you may ask for human intervention, express your point of view and challenge a decision made solely by automated means.
Complaints
You may complain to the Data Protection Officer about how we use your personal data. We will consider and respond to your complaint in accordance with applicable data protection law.
You may also complain to the Information Commissioner’s Office, the UK regulator for data protection. You can call 0303 123 1113 or visit https://ico.org.uk/make-a-complaint/.
Getting In Touch
If you have questions about this Privacy Notice, wish to exercise a right or want further information about retention periods, contact the Data Protection Officer at personaldata@tottenhamhotspur.com.
You can also write to: Data Protection Officer, Tottenham Hotspur Football Club, Lilywhite House, 782 High Road, London, N17 0BX.