Summary
This policy explains what information ‘CPFC Limited’, (‘CPFC’, ‘we’, ‘us’, and ‘our’) gather about you whenever you interact with us, what we use that information for, and who we give that information to. It also sets out your rights in relation to your information and who you can contact for more information or queries.
Scope
This policy describes how we handle personal information collected by any means, including through these websites and the official CPFC app:
cpfc.co.uk
eticketing.co.uk/cpfc
shop.cpfc.co.uk
https://www.eticketing.co.uk/po5/
It’s our policy to collect only the information required from you so we can provide you with the products and services you need from us, and tailor your experience . If you believe we’ve collected excessive information about you, please contact us.
In this policy your personal information is sometimes called “personal data”. We sometimes collectively refer to handling, collecting, protecting or storing your personal information as ‘processing’.
Although you don’t have to provide any of your personal information to us, if we ask you to do so and you refuse, we may be unable to provide you with the information, goods or services you want from us (like buying tickets, for example.)
Personal Information: This is anything that enables you to be identified or identifiable, e.g. your name, address, email or phone number.
Where do we collect personal information?
Below are some examples of how you may provide personal information to us:
-
when you register for a Palace account, sign up to marketing communications, enter competitions
-
when you buy tickets or merchandise from the online shop or box office, or in our physical stores
-
when you browse our websites;
-
when you communicate with us;
-
when, by attendance at matches or club events, photos and video footage are taken of you
How do we use personal information?
We use personal information for a range of reasons, and may use it for any of the purposes described in this policy or as stated at the point of collection (or as obvious from the context of collection), including:
-
To provide you with the goods, services, content or publications you’ve requested;
-
To enable you to be at events you want to attend;
-
To consider whether or not to make you an offer of employment;
-
To administer and manage our websites, including
-
To confirm and authenticate your identity and prevent unauthorised access to any restricted areas of the sites;
-
To personalise your browsing experience by displaying content that is more likely to be relevant and of interest to you;
-
To sort and analyse user data; and
-
To understand how people, use the features and functions of our websites in order to improve the user experience.
-
-
To develop our businesses and services;
-
To market to you, using your consent when you opt-in using preferences in your profile, or using legitimate interest if you haven’t selected your communication preferences
-
To send you ‘basket abandonment’ emails
-
To market to you via online adverts on social media and other websites
-
To monitor and enforce compliance with our Terms & Conditions, Terms of Use and policies; and/or
-
Any other purposes for which you provided the information to us, including any of the purposes given in the ‘Collection of personal information’ section, above.
We do not collect personally identifying information for sale to third parties.
Rights in relation to your information
You have certain rights in relation to the personal information we hold about you. In particular, you have the right to:
-
Request a copy of personal information we hold about you;
-
Ask that we update the personal information we hold about you, or correct personal information that you think is incorrect or incomplete;
-
Ask that we delete personal information that we hold about you, or restrict the way in which we use such personal information;
-
Object to our processing of your personal information; and/or
-
Withdraw your consent to our processing of your personal information (to the extent such processing is based on consent and consent is the only permissible basis for processing).
If you would like to exercise these rights or understand if these rights apply to you, please contact us.
Legal grounds for processing personal information
We rely on one or more of the following processing conditions:
-
To perform our contractual obligations to you; and/or
-
To satisfy any legal and regulatory obligations to which we are subject; and/or
-
To satisfy our legitimate interests in the effective delivery of information and services to you and in the effective and lawful operation of our businesses (where this does not interfere with your rights); and/or
-
When you have agreed (consented) to us processing your personal information.
Security of personal information
We have implemented generally accepted standards of technology and operational security in order to protect personally identifiable information from loss, misuse, alteration or destruction.
Only authorised persons are provided access to personally identifiable information we have collected, and such individuals have agreed to maintain the confidentiality of this information.
Although we use appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure.
We endeavour to protect personal data, but we cannot guarantee the security of data transmitted to or by us.
Sharing personal information
We may transfer, share or disclose the personal data we collect from you to third-parties (and their respective sub-contractors, and/or their subsidiaries and affiliates) for:
-
The purposes for which the information has been submitted
-
The purposes listed above under use of personal information
-
The administration and maintenance of our websites and/or
-
Other internal or administrative purposes
-
We also may transfer share or disclose personal data to third-party service providers of website hosting and management, data analysis, data backup, security and storage services.
-
The third-party providers may use their own third-party subcontractors that have access to personal data (sub-processors). It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality, to process personal information only as instructed by us, and to flow those same obligations down to their sub-processors.
Examples of some of third parties we may transfer, share or disclose the personal data we collect from you to are:
-
TicketMaster, who provide our online ticketing system
-
Retail & Sports Systems, who provide our online club shop
-
Fortress GB, who manage our stadium entry and loyalty points programme
-
Fourth wall Creative, who manage our Membership fulfilment
-
InCrowd Sports, who manage our app and database
-
DotDigital EMEA LTD, who are our email service provider
-
Bellcom Communications, our telecoms communications provider
-
StreamAMG, who provide our live video and audio services
-
Delete Limited, who are our website partner
International transfers of personal information
Your personal information will not be transferred to or stored outside the European Economic Area (EEA).
Other disclosures
We may also disclose personal information to third parties under the following circumstances:
-
When explicitly requested by you;
-
When required to deliver publications as requested by you;
-
When required to facilitate events hosted by a third party;
-
For regulatory compliance purposes; and/or
-
As otherwise set out in this privacy statement.
We may also disclose your personal information to law enforcement and other government agencies and to professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation.
Retention of personal information
We will retain your personal information only for as long as we need it, given the purposes for which it was collected, or as required to do so by law.
Normally, this means we will retain your personal information for six years. For more information please click here or contact us to request a copy of our retention policy.
Special category (sensitive) information
We don’t intend to collect special category (also known as sensitive) personal information through our websites unless we are legally required to do so, or you volunteer this information to us in order for us to help improve your experience with the club. An example of this is the ability for individuals to inform CPFC of their disability or access requirements when using our website and app, or accessing our stadium.
Examples of special category information are: race or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; physical or mental health; genetic data; biometric data; sexual life or sexual orientation; and criminal records.
We may from time to time ask you questions regarding special category personal information, as part surveys with the Premier League, or our own internal surveys to help us with our equality and adversity objectives. (Find more info on those here). This is entirely voluntary, and we’ll never record this type of information without your consent.
Marketing
To give you the most relevant news and promotions, we tailor communications based on your preferences, and based on what you do on our websites and app (if relevant).
When you set your preferences, we’ll send you communications relating to the area of the club you want to hear about. We may also tailor communications to you using ‘legitimate interest’ if you’re yet to tell us your preferences, which is based on your purchase history and how you engage with us on our websites and app.
You can update your preferences at any time in your Palace account, which you can do here.
To stop receiving any communications from us, simply tick ‘no’ in the communications preferences area of your profile, or use the unsubscribe option shown in all Palace communications. Alternatively, you can contact customer.service@cpfc.co.uk with your request.
If you choose to unsubscribe from any or all communications, we may retain information sufficient to identify you so that we can honour your request.
Cookies
If you would like to know how we collect information about your use of websites, apps and social media sites, please see our Cookie Policy.
Automated decision making
We will not use your personal information for automated decision making based on profiling. We may use your personal information to automatically ensure that the content or communications you see or receive are age or location relevant. E.g we endeavour to ensure gambling adverts and communications are hidden for users under 18.
Our websites
Our websites may link to third-party sites not controlled by us and which do not operate under our privacy practices. When you link to third-party sites, our privacy practices no longer apply. We encourage you to review each third-party site's privacy policy before disclosing any personally identifiable information.
Children
We understand the importance of protecting children's privacy and we never knowingly collect personal information about individuals under the age of 13, unless it is specifically required to deliver a product or service (like a Season Ticket). We encourage anyone under the age of 18 to obtain the permission of a parent or guardian before providing us with any personal data or information.
If we know the age of the person browsing our website or reading our communications, we may tailor and restrict the services, content or marketing shown.
Contact us
If you have any questions or complaints about this Privacy policy or the way your personal information is processed by us, or would like to exercise one of your rights set out above, please contact us by one of the following means:
Form: www.cpfc.co.uk/contact-us/
Email: customer.service@cpfc.co.uk
DPO email: DPO@cpfc.co.uk
Post: Whitehorse Lane, London SE25 6PU
You also have the right to lodge a complaint with your local data protection regulator, which in the UK is the Information Commissioner Office (ICO). The ICO can be contacted by the following means:
Form: www.ico.org.uk/global/contact-us/email/
Telephone: 0303 123 1113 (local rate – calls to this number cost the same as calls to 01 or 02 numbers).
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We may update this policy at any time by publishing an updated version here. So that you know when we make changes to this policy and we encourage you to review this policy periodically to be informed about how we are protecting your information.
This Privacy Policy was last updated on 31 October 2023.