What is this policy for?
This privacy policy sets out the way in which your personal information is handled by City Football Group Limited, including Manchester City Football Club, and other members of the City Football Group. It also sets out which additional entities receive your information from us, including stichd group B.V. (“stichd”) who operate the Manchester City Official Online Store.
A version which is designed for children and our younger fans can be viewed in the “info for kids” section below.
For the purpose of the Data Protection Act 2018 and the General Data Protection Regulation (“GDPR”), the data controller is City Football Group Limited (company number: 08355862) whose registered office is at Regent’s Place, 14th Floor, 10 Brock Street, London, NW1 3FG (referred to as “we”, “us”, “our” and “Man City”).
We are registered with the Information Commissioner’s Office (ICO) as a data controller, with reference number ZA234714. You can see our registration here.
Sometimes, specific products and services, such as apps, may be offered by different entities in the City Football Group, in which case the entity providing the product or service will be the data controller, so you should check the individual privacy information published with each service.
This Privacy Policy should be read alongside our website terms of use, which govern the use of our online services. You can read the website terms of use here.
What information do we collect about you?
We collect information that you provide to us, including your contact details, preferences and associated information when you visit and/or register for any of our online products and services, make a purchase through our websites or via our telephone or other sales outlets, or when you participate in club events, competitions and promotions.
When you visit our stadium, offices or other premises (including other stadia), or otherwise publicly interact with us, we may collect: (1) CCTV images including for the purposes of public order and the prevention of crime; and (2) photographic images, and/or video recordings and/or feeds (and/or stills taken from video recordings) which may be used for commercial and other purposes (including without limitation the production, licence, distribution and related marketing and promotion of documentaries, series, films, or other content pieces, which may be transmitted worldwide on our own, our affiliates, or third party platforms, streaming services and/or social media) and as further detailed in our match ticket terms and conditions and Ground Regulations.
We may also collect information about your use of our websites and apps as well as information about you from third parties (including other entities in the City Football Group).
What information do we collect about you?
When you purchase products and services, we may collect personal information from you, such as your name, address, delivery address, email, telephone number and payment card details. We will use this information to supply you with products and services, to recover debt, to help us to prevent fraud, and keep records about your purchases.
You may need to register an account to use certain parts of our websites or apps. When you register an account you will need to provide basic information about yourself. This will vary depending on which part of our websites or apps you are registering for, but will usually include your email address and may also include other relevant information such as your name, date of birth and/or location. If you do not want us to record this information about you, please do not register.
stichd’ privacy policy sets out the ways in which stichd process your personal data, including any customer profiling or market research that stichd do. Your rights in relation to that processing, including your right to object to processing by stichd are set out in more detail in that policy. You can at any time object to processing by stichd by accessing your profile or by sending an email to [email protected].
You may also be given the opportunity to provide additional personal information, such as your postal address to send you a prize if you win a competition that you enter or the ability to upload an avatar (which could for example be a photograph of you). It is entirely your decision as to whether you provide more information to us and you should only provide this information if you are comfortable with us storing it and using it to provide services, content and information to you as described in this privacy policy.
When you sign up to be kept informed about exciting promotions, news, features and activities we may collect your personal information, such as your name, email address, date of birth and country of residence. Please see our separate tab below on marketing and the preference centre.
If you log in using social media depending on how you log in we may collect your profile name/user name, profile picture, email address and date of birth. The social media information you consent to share with us will be combined with the other information you provide to us or that we collect about you. We will also collect information about your comments, posts and ‘likes’ to allow us to administer our Cityzens membership scheme.
As you move around our sites or use our apps we will collect information about your visit, such as which pages you visit, how often you visit and which competitions you enter.
We will also automatically collect the following information:
- technical information, including the Internet protocol (IP) address used to connect your device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
- information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
You can exercise control over some of this information, for example by adjusting your preferences for an app in your smartphone, or adjusting your settings via your website browser. Please also see our cookies policy.
From our commercial partners and other third parties, we may collect information including your name, date of birth and contact information, when you enter into jointly conducted competitions and promotions or purchase our products or services via a third party site.
We use specialist data enrichment providers to assist us with enriching the data we hold on you. This includes helping us to review, segment and correct the data we hold, to make sure it remains accurate and up-to-date and help us to identify and delete data we no longer need. This also helps us to understand your interests and preferences, so we can provide you with information which is likely to be most relevant to you and improve your experience of our products and services. You can visit their websites and view their Privacy Policies using the links below.
Provider name | Website |
Experian | www.experian.co.uk |
Bureau Van Dyck | www.bvdinfo.com/en-gb |
What special category information do you collect about me?
We may record details of any disability or health needs you may have at the time of booking an event or service to help us make reasonable adjustments for you and to ensure your safety. We will usually ask your consent to do this, unless there are other legal grounds on which we need to use the information.
In some limited circumstances, we may process information about criminal convictions, where this is necessary for public order and the prevention of crime, and there are adequate protections in place.
Why do we collect and use this information and what are the legal grounds for us doing so?
We collect this information to (i) provide you with products and services you request; (ii) make our website available and improve its performance and presentation; (iii) to improve and enhance our services and make them more personal to you; (iv) to provide consistency when using the services offered to you by companies in our group; (v) to administer competitions and prize draws you enter; (vi) for the purposes of undertaking our business; and (vii) safety and public order and the prevention of crime; and (viii) to produce, licence, distribute, market and promote relevant documentaries, series, films or other content pieces, for commercial and other purposes.
The legal grounds for this processing are:
- our legitimate interests (in carrying on our business, making our website available, and providing our customers with content which is appropriate for them) (including photography, filming and production content, whether on our own or third-party platforms, streaming services or social media));
- for the performance of our contract with you (where you purchase goods or services from us or via a third party partner or one of the members of our group);
- to comply with our legal obligations (for example, where we are required to record information in relation to health and safety, or safety and public order at match days as well as age-sensitive content).
In respect of limited categories of data we may record and use this with your consent (for example, in relation to sending you direct marketing). You can withdraw your consent at any time but this will not affect any processing undertaken before that point.
Where we develop a new feature or product (such as an updated ticketing website), if a separate account is required to access this we may for your convenience automatically create a new account for you using the details associated with your existing account. In this case we will email you to let you know.
Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
To register you as a new customer |
|
Performance of a contract with you |
To register you as a new customer
|
|
|
To manage our relationship with you which will include:
|
|
|
To enable you to partake in a prize draw, competition or complete a survey |
|
|
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
|
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you |
|
Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy) |
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences |
|
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) |
To communicate suggestions and recommendations to you about goods or services that may be of interest to you |
|
Necessary for our legitimate interests (to develop our products/services and grow our business) |
When can we send you marketing and how can you change your mind?
We can send you updates and newsletters if you sign up to any of our products and services. We can also send you marketing communications in relation to our products, services and partnerships with sponsors, promotions and other initiatives.
You can change your mind at any time, either by logging in to your preference centre http://profile.mancity.com/ (which allows you to control what communications you receive and how you receive them). You can also opt out by selecting the link or following the instructions sent with each communication.
When can we send you marketing and how can you change your mind?
There are many exciting promotions, news, features and activities we and our commercial partners want to keep in touch with you about. When you register with us, or provide us with your personal information, there will be a consent box that allows you to indicate your preference in this respect.
If you opt-in it means that we will let you know about exciting promotions, news, features and activities of Man City, the City Football Group and/or our commercial partners.
Providing this consent means you get the following fantastic promotions, news, features and more:
- BluePrint Newsletter, Matchday, Post Match Videos, Ticket Alert, Hospitality & Events and Retail, as well as exclusive offers, products and services on behalf of our commercial partners.
stichd, who run the Manchester City Official Online Store, may also send you marketing communications from time to time in relation to the Online Store, which may include product news, offers or promotions.
Just to make sure you are happy with your preferences we will get in touch once a year by email to check you are happy with what you are (or are not) receiving from us and that the information we hold about you is up to date.
You can also change your mind at any time via your preference centre http://profile.mancity.com/. You can update your personal information if it changes by logging into your account or taking the specific steps to opt-out set out at the end of each digital marketing communication.
Our sites and apps may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies or their use of your data. Please check these policies before you submit any personal data to these websites.
Who may we share your information with or disclose it to?
We may share your information with other members of the City Football Group, with our service providers who help us to provide goods and services, help us to operate our website, provide us with support in communicating with you or administering and delivering our prize draws and promotions, or help us to ensure our data remains accurate and relevant.
In the context of your photographic images, and/or video recordings and/or feeds (and/or stills taken from video recordings) taken for commercial purposes, we may additionally share this with other stakeholders in any productions, e.g. affiliates, group companies, co-producers, the commissioner of the production, the broadcaster, distributors, professional advisors and/or financiers.
We will share your personal data with our payment providers, merchants and 3D-Secure Services for fraud prevention purposes, when you make purchases (including in respect of food and beverages) across our campus (including within the stadium, the academy stadium and/or surrounding areas)
We may also share your information with regulatory bodies and other similar bodies and associations (such as the Premier League and the Football Association).
We may share your information with our professional advisors and with any potential purchaser of part or all of our business or assets. We may also share it with law enforcement organisations.
When we share your data we will always take reasonable steps to ensure that there are adequate safeguards in place.
How will your information be used if you are a member of an Official Supporters Club or wish to join an Official Supporters Club branch?
We have a large number of Official Supporters Clubs around the world. If you are already a member of a branch, we will store your membership information on behalf of the branch you are a member of.
If you are interested in becoming a member of your local Official Supporters Club, we will share your information with that club, such as your name and contact details. By selecting to ‘join a branch’ you are consenting to this and your willingness to share your information.
To join your local branch, please register and fill in the online form.
Where necessary, we may also share your personal data with, or request your personal data from, your local Official Supporters Club in the context of: (i) safety and security; (ii) any alleged or actual breach of Club terms and conditions and/or Ground Regulations; (iii) Club investigations, sanction, and appeal panels; and/or (iii) the application and enforcement of bans/sanctions issued by the Club (including without limitation in respect of ticketing and match attendance).
Our commercial partners and the City Football Group
For a current list of our sponsors, licensees and partners please visit Club Partners page. These may change from time to time, so please come and check the list regularly.
By opting in it means that we will let you know about exciting promotions, news, features and activities of Man City, the City Football Group and/or our commercial partners.
When we refer to the City Football Group, we are referring to the other companies that form part of our corporate group. Some of these companies may be involved in helping to provide the services and communications referred to in this privacy policy, or as requested by you from time to time.
We may also use the personal information we collect about you to create statistics and anonymised information to then share with third parties including ad networks, search engines and analytics providers.
Certain parts of our websites and apps may allow you to share information with other users. For example, we may offer you the opportunity to create a “fan profile” containing basic personal information about you such as your first name, avatar, general location and social media handles, or, where there is a competition element, we may show scoreboards or basic details relating to the winner(s) of the competition. We will always make it clear where your personal information may be shared with other users in this way and you should only provide personal information to those parts of our sites and apps where you are comfortable with it being shared in this way.
We may share your information with business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
We may disclose your personal information to third parties in the following circumstances:
- In the event that we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets.
- If Man City or any other members of the City Football Group or substantially all of their assets are acquired by a third party, in which case personal information held by them about their customers will be one of the transferred assets.
- If we are under a duty to disclose or share your personal information in order: to comply with any legal obligation, court or police request, or in order to enforce or apply our Term of use or terms and conditions of sale Terms and Conditions and other agreements; or to protect the rights, property, or safety of Man City and the City Football Group, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
We may share your information with selected third parties including:
- Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
- Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others.
- Analytics and search engine providers that assist us in the improvement and optimisation of our sites and apps.
Will we transfer your data outside of the EEA?
We may sometimes have to transfer your data outside of the European Economic Area (EEA). However, we will only do so where there are adequate safeguards in place or it is otherwise lawful.
In some circumstances, we may need to transfer your personal information to countries outside the EEA, some of which do not protect privacy rights as extensively as in the United Kingdom. In order for the transfer to be lawful, we must ensure adequate safeguards are in place.
Where we transfer your data to a third party outside of the EEA (such as another company in our group) we will either:
- do so where there has been a finding of adequacy in respect of that territory, including under a recognised scheme (such as the US Privacy Shield); or
- implement model contract clauses governing the transfer, as approved by the European Commission.
The only circumstances in which we may transfer data outside of the EEA outside of the above circumstances are:
- where you have given your explicit consent (having had the risks explained to you);
- where the transfer is necessary for the performance of a contract with you, or with a third party in your interest;
- the transfer is necessary for the establishment, exercise or defense of legal claims;
For more information please contact us.
Will your information be used for profiling and automated decision-making?
We may sometimes have to transfer your data outside of the European Economic Area (EEA). However, we will only do so where there are adequate safeguards in place or it is otherwise lawful.
We may use your data for profiling and limited automated decision taking, for example matching unique identifiers in our database (e.g. email address) with the same unique identifiers on social media platforms. In practice, the personal data is anonymised. Additionally, there are a variety of web analytics tools that we use (e.g. Google Analytics and Facebook Analytics). These platforms use a level of processing unique identifiers (e.g. IP address, Mac address, user ID, social handle, cookies) to track digital behaviours.
Will your information be secure?
We take the security of your personal information seriously and take steps (including the implementation of appropriate technical and organisational measures) to ensure your personal information is treated securely and in accordance with this privacy policy.
Your information is kept on secure servers and we implement a range of measures to try to ensure the security and integrity of our digital products, services and databases. We take steps to ensure that only authorised persons have access to your data.
When you submit your payment card details, we use industry-standard secure sockets layer (ssl) encryption technology to guard your information. However, we cannot guarantee that any data transmission over the internet is completely secure.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites or apps, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Our websites and apps may contain links to other websites. We are only responsible for the privacy practices on our websites and in our apps. We recommend that you check the privacy and security policies and procedures of each and every other website that you visit.
How long will you keep my information?
We will keep your information for as long as reasonably necessary to fulfil the purposes that we collected it for. However, we take steps to regularly review our information ensures that we are not holding excessive personal information for longer than is necessary or required.
The factors which influence how long we hold onto specific information for include (i) legal requirements; (ii) managing our legal risks; (iii) management of our business; and (iv) the nature of our relationship with you (and the services we provide you with).
Where you enter into a contract with us (such as for the purchase of goods or services) we will generally keep your information for six years after the end of our contract with you.
Details of retention periods for different aspects of your personal data are available in our retention policy. You can find out more by contacting us.
What rights do you have in relation to your personal information?
Under data protection legislation you have a range of rights. You have a right to ask us for a copy of the information we hold about you. You can also ask us to correct or update your personal data, or to erase it or transfer it to a third party. You can object to processing of your personal information by us, including to object to any direct marketing. Where we are using your information based on your consent you can withdraw your consent.
The way some of your rights apply may depend on the circumstances. To exercise your rights please contact us. Further information about your rights is set out below.
Making a request
To make a request, please contact us at [email protected].
You have the right to request us to delete your personal data, to do so please fill out this form https://www.mancity.com/right-to-delete-request. Please be aware that as a consequence of us deleting your data, you will no longer be able to access key Manchester City Digital platforms, for example, tickets.mancity.com, shop.mancity.com and cityzens.mancity.com as we will no longer have the information necessary to allow you access.
More about your rights
Right of access | You have a right to access the personal information we hold about you and be told why we use it. |
Right of rectification | You can ask us to correct or update your information to ensure it is accurate and complete. |
Right to erasure and right to restrict processing | You can ask us to stop processing and to delete your data in certain circumstances (for example where it is processed with your consent, or it is no longer necessary for us to process it). |
Right to object | You have a right to object to our processing of your information. |
Rights: profiling and automated decisions | You have a right not to be subject to automated decisions which have a legal effect and to be protected by safeguards in respect of any profiling. |
Right to object to direct marketing | Where you have consented to receive direct marketing you can change your mind at any time as described in the marketing section above. Please allow a few days for us to action your request. |
You can find out more or exercise the above rights by contacting us. Further information is also available from the ICO’s website ( https://www.ico.org.uk).
Fees, information requirements and time limits
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Contacting us and Complaints
Our Data Protection Officer can be contacted via [email protected] if you have any questions, would like to exercise any of your legal rights or you would like to make a complaint.
You also have a right to complain to the Information Commissioner’s Office by writing to them at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or by telephone 0303 123 1113. More information is available on the ICO’s website https://www.ico.org.uk
Info for kids
This is a child-friendly explanation of how we use information. You should read it with a parent, guardian or other adult so that they can help you understand.
When you:
- look at our website (including the videos and games);
- download one of our apps;
- contact us; or
- create an account with us
We collect some information about you (like your name, or information about the tablet or computer you are using).
We do this because we need to so we can carry on making our apps, website and our other services better. We make sure we use as little personal information as possible and only for as long as we need to. We will only keep your information as long as you need it. You can ask us for a copy of your information, or to correct, erase or stop using it. We will do our best to keep your information safe.
For some uses of your personal information, we may ask your permission. If you are aged 13 or over, you can give your permission yourself. If you are aged under 13 we require the consent of your parent or guardian.
For each child-friendly app we operate, we include specific details of how we will use your information and why in a “Privacy Policy”. For example, if you sign up to use The City Kids App and Website, the Privacy Policy
You can use certain parts of our websites and apps without providing us with any of your personal information. If you do provide us with your personal information we will use it as set out on the relevant website or in the relevant app. For example, if you sign up to get the newsletter, we will use your email address to send you the newsletter and news, updates and promotions we think you might like.
If you are under 13 and register on https://www.mancity.com we will not send you any emails or SMS until after your 13th birthday. However, you should still decide when you register what type of emails and SMS you want to receive from us when you reach your 13th birthday and tick or untick the box or boxes on the registration form to tell us your preferences. If you decide to receive updates from us then after your 13th birthday we will email to let you know how we are going to get in contact with you about Man City and our exciting news, features and activities. We encourage you to talk with your parent/guardian about the information we send to you, and check that they are happy for you to continue to receive this information. If you do not tell us you do not want to receive this information any more, we will assume you have your parent and/or guardian’s consent to continue to receive this information.
You can ask us to stop sending you any emails, SMS or other communications at any time. In each message we send you, there will be an ‘unsubscribe’ option, if you follow these instructions we will stop sending the messages. You can also send us a message to [email protected] if you have any questions, want us to stop sending you messages or want to change any of the information you have given to us.
If you are a parent or guardian of a child who is using www.mancity.com or otherwise in contact with us, we recommend that you supervise your child while they are online and check what personal information your child is providing to us.
Things work slightly differently on our Man City Kids website https://kids.mancity.com/, the same rules apply to the personal information we collect about you – we will use for the purposes we have told you about when we collect your information. But if you are under 12, when you sign up we ask you for your parent/guardian’s email address so we can let them know you are registering on Junior Cityzens. If you are aged 12 to 13, we ask that you check with your parent/guardian before signing up and then let us know that they are happy for you to do so.
We make sure that any information or marketing that we send to under 18s is always age-appropriate. If you have any concerns about the information your child is receiving, please contact us at [email protected].
Contacting us and Complaints
Changes to how we use your information will be published on this page, so you should check back periodically. If we are making a significant change to how we will be using your information we will normally contact you to let you know.
We will change our practices from time to time as we continue to develop our products and services. We may also change our privacy policy at any time, so we recommend that you visit this page occasionally to check what has changed.