Privacy Notice


This Notice tells you what to expect in relation to personal information about you which is collected, handled and processed by Middlesbrough Football Club Foundation (“the Foundation” or “MFCF” or “We”) as Data Controller.

We are committed to protecting your data and respecting your privacy.

We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect with your data.  We handle and process data in accordance with the General Data Protection Regulation 2018 (“GDPR”) and the Privacy and Electronic Communications Regulations 2003.


You give us information when you contact us with an enquiry; use or register on the Website; forward an item to a friend; make a purchase, booking or donation; fill out a survey or other form; request us to provide you with information; enter a competition or prize draw or engage in a promotion or survey; post information to public areas of the Website; book an event or fundraising activity or engage in one of our programmes, holiday clubs or sessions, by phone or email or online via our Website; sign up for a newsletter or update preferences on our Website; contact us via email, mobile messaging or when posting on or communicating via our social medial platforms; become a sponsor, advertiser or funder; become a mascot or provide content for our materials or by communicating with us via any other channel.

The information we may collect, hold and process about you, provided by you, may include:



Email address

Telephone number(s)

Bank details and/or payment details


Dietary requirements

Health and genetic information

Billing information

Vehicle registration number, make and model

Details of other people within your group booking including name and age

Purchase/transaction and ticketing history

Your preference for how we communicate with you about our activities


IP address

Information gathered by use of cookies in your web browser

Information that is available publicly, including social media username if you interact with us through social media channels

Record of accidents and treatment received

We maintain a record of your transaction history, but we never store your payment card number (although we may keep a secure record of the last four digits only to help us identify transactions).

We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you relevant information.  We may track subsequent online actions such as ticket or retail purchases and enquiries.

With regard to each of your visits to our Website we collect the following information:


technical information, including the Internet protocol (IP) address used to connect your computer/device to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;

information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call our customer service number. Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve our site.

For further information on the cookies we use and the purposes for which we use them see our Cookie Policy.

We may monitor or record calls for security and training purposes and to improve the quality of our services.

Your image and vehicle number plate may be recorded by CCTV when you visit any of our sites for safety and security purposes and to improve the service we can provide to you.  This footage may also be used to exercise and defend our legal rights or to comply with legal obligations in the interest of the public.  Where necessary this footage will also be shared with the authorities for law enforcement purposes.


The above information is used to:


provide our services to you and enable us to process, administer and manage your orders, contracts, accounts and;

create an account so that we understand and respect your preferences;

establish dietary requirements and provide suitable catering options for you and your guests (where applicable);

inform you about changes to our products and services or new products and services;

inform you about fundraising activities, programmes and holiday clubs and sessions offered by MFC Foundation;

inform you about MFC matches and events with which MFC Foundation are associated or involved;

communicate information about any agreement you may have with us or have enquired about;

inform you about offers, events and promotions that may be of interest to you;

improve the services We offer you (which may sometimes include undertaking customer research);

keep a record of your relationship with us and how you prefer to be contacted;

analyse your personal information to create a profile of your interests and preferences so we can contact you with information most relevant to you;

to ensure that content from our Website is presented in the most effective manner for you and for your computer;

to administer our Website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

to administer prize draws and competitions you have entered;

to allow you to participate in interactive features of our service, when you choose to do so;

as part of our efforts to keep our site safe and secure;

to resolve an enquiry or progress a complaint;

comply with legal and regulatory obligations placed on MFC Foundation.

We use profiling and segmentation to ensure communications are relevant to you.  For this purpose we may analyse geographic, demographic and other information relating to you to enable us to understand your preferences.


MFC Foundation and/or its media partners may from time to time create images and/or audio-visual footages of you and you at sessions and fundraising events. MFC Foundation is the owner of all rights in such footages and shall be entitled to use such footage on any media platform for the following purposes:


Safety and security purposes;

Promotional, marketing and commercial purposes;

Training for MFC Foundation employees and third parties who work with MFC Foundation;

Broadcasting and editorial purposes.



All personal information we hold is stored on our secured servers in the UK and EU.

Access to our information is strictly controlled.  We may disclose your details to police, regulatory bodies, local authorities, football governing bodies and the Independent Football Ombudsman or legal advisors if so required.  If any of the organisations to which we disclose your personal information is situated outside the European Economic Area (EEA) we would take reasonable steps to ensure that your information is properly protected including safeguards such as using contractual provisions to ensure your information is properly protected.



We do not share your information with any third party without your agreement unless we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or terms and conditions of purchase and other agreements; or to protect the rights, property, or safety of MFC Foundation, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Any third party providers used by us to fulfil our contractual obligations to you will only collect, use, store and disclose your information in the manner and to the extent necessary for them to provide their services to us.  We have written agreements in place with each third party to ensure that your information is kept securely, is not used for any other purpose and is deleted when no longer required.

Such third party providers may include:

Middlesbrough Football Club in respect of the administrative support services provided by Middlesbrough Football Club to MFC Foundation;

Funders for compliance purposes, research, reporting and improvement of strategic planning and business decisions or funding;

Email distribution service;

Mailing house;

SMS distribution service;

IT companies who support our Website and other business services;

Analytical or search engine provider to assist us with the improvement or optimisation of our Website;

Credit reference agency for the purpose of assessing your credit score where this is a condition of us entering into a contract with you.

We may share personal information with other organisations such as the Premier League and Premier League Charitable Fund, the English Football League and English Football League Trust, the FA, the Office for National Statistics and other governing bodies and funders for compliance purposes, research, reporting and improvement of strategic planning and business decisions or funding.

We never sell personal information to third parties.

Our Website may, from time to time, contain links to and from the websites of our commercial partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites



The legal basis for collecting and processing your data may be:

Consent – you may have given us your consent to use your data for example when you tick a box to receive marketing emails, offers and newsletters. You can withdraw your consent at any time.

Contractual obligation – to enter into a contract with us we need your personal information (including financial information) to process and fulfil the contract for example to purchase a ticket to an event or make a donation.

Legal obligation – if required by law to process personal information for example to comply with health and safety and equality obligations or to provide information to the police to prevent fraud or criminal activity.

Legitimate interest – for a genuine business reason that does not override your rights, freedom or interests for example administrative purposes, or using your purchase history to send you personalised offers.



We understand that children and young people under the age of 14 years (“Children”) may visit our Website.  Children may need their parent or guardian’s permission to use or access certain areas of our Website or receive certain information through the Website.  Children may also be asked to confirm they have that permission and we reserve the right to verify parental or guardian consent where required.

We do not actively market to Children.  We do not share Children’s personal information for any commercial purpose.



You have the right at any time to ask for a copy of the information we hold about you and confirmation of how it is being processed.  You will be required to verify your identity when making a request.  If you would like to make a request for information please:

Email – or

Send a request in writing to – Data Protection Officer, MFC Foundation, Willie Maddren Centre, The Riverside Stadium, Middlesbrough, TS3 6RS

You also have the right to:

request that we correct inaccuracies to your information. You must notify us of any updates, amendments or corrections to previously collected personal information in writing to the Club or by email or by updating your single sign on account online at our Website.   We encourage you to keep the personal information we hold on you up to date and accurate;

request that we delete some or all of your personal information for example if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it

request that we stop or limit the processing of your information where you think the information we hold is inaccurate (until the accuracy is proved or updated); if you have objected to the processing (when it was necessary for legitimate interests); if you have consented to the use of it; or if it is no longer necessary for us to hold it for the purpose it was provided and we have no legal basis to retain it;

(in certain circumstances) move, copy or transfer your personal information to another organisation or to yourself.  This applies only to personal information you have provided us with and is being processed by us with your consent or for performance of a contract and is processed automatically;

(in certain circumstances) you have the right to object to certain types of processing of your personal information when it is based on legitimate interests, when it is processed for direct marketing including profiling, or when it is processed for the purpose of statistics.



Your personal information will be retained for no longer than is necessary to fulfil the purpose for which we collected it or as required to satisfy any legal or reporting obligation or to resolve a dispute or enforce an agreement.

When We no longer require your personal information, We will dispose of it in line with approved company processes.  If personal data is retained for legal or reporting obligations it will be archived and reduced to the minimum.



If you have provided us with your consent to process your personal information you have the right to withdraw this at any time.  In order to do so you should contact us by emailing



If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us by contacting:

Data Protection Officer, MFC Foundation, Willie Maddren Centre, The Riverside Stadium, Middlesbrough, TS3 6RS

You also have the right to contact the Information Commissioners Office at https:\\\concerns\.



Our policies are constantly under review and this Privacy Notice may be changed by us at any time.  Any changes shall be posted on the Website ( and we recommend that you check regularly to review the latest version.