Privacy Policy

14th November

This Privacy Policy explains how West Bromwich Albion Football Club Limited (the Club) uses and protects your personal data, as well as your rights in respect of it, how to exercise them and how to contact us.

It is important that you understand and are comfortable with all privacy terms before using our websites, apps and/or becoming involved with the Club and we encourage you to take time to read them.

Changes to this Privacy Policy

Privacy laws and practice are constantly developing and we aim to meet high standards.  Our policies and procedures are, therefore, under continual review. We may, from time to time, update our security and privacy policies.  If we want to make any significant changes to the way in which we will use your personal data we will contact you directly and, if required, seek your consent.

We will ensure our websites have our most up to date privacy policy and suggest that you visit our privacy pages periodically to review our latest version.

Information about other people

If you provide information to us about any other people (such as someone you are making a booking for, an emergency contact, a professional representative or a colleague), you must ensure they understand how we will use and protection their information and you should direct them to our website privacy policy page. 

You should only provide information about other people and give consent on their behalf if you are authorised to do so.


Please note, our websites, apps and our other services may contain links to other websites or services (such as those of advertisers or our partners) that are not controlled by us or our service providers.  These links are provided for your convenience.

We are only responsible for our own privacy practices and security of our systems, websites and apps.  We recommend that you check the privacy and security policies of each and every website that you visit.


About us

The Club is an English professional football club and is proud to compete in the EFL Championship.  As part of the West Midlands community, we are keen to encourage enjoyment and participation of football at all levels including through our professional team, our Academy and match attendance.  Examples of some of our initiatives to help get involved in football or with the Club are shown below:

WBA TV Learn More
WBA Shop Learn More
Hospitality Learn More
Memberships Learn More
Ticketing Learn More
The Albion Foundation Learn More


How we know you

The Club operates in many capacities, for example:

  • as an employer
  • as a website operator
  • as a provider of goods and services to fans and customers
  • as a supplier of services to other parts of the West Bromwich Albion Football Club organisation such as the Women’s Team or The Albion Foundation
  • as a provider of Club apps
  • as a provider of support for volunteers
  • as an accreditor for media organisations
  • as a customer of other organisations that provide services to us, such as our survey technology, our online shop and our ticketing provider

We may know you in a number of ways.  For example, we know that some of our employees and accredited media personnel also use our online shop and are, therefore, also customers.  In this Privacy Policy, all of the ways we know you are grouped together and referred to as ‘Our Relationship’.

If you have any questions or concerns about how we are handling your personal data you can direct them to or you can make a complaint to the Information Commissioner’s Office (

Who is responsible for protecting your personal data?

Unless we say otherwise in our Privacy Notice (in most cases, this will be the privacy notice you have been reading and which provided a link to this Privacy Policy) – we call this the ‘Relevant Privacy Notice’ – the Club is the ‘data controller’ in respect of all personal data we obtain about you whether that is on one of our websites or apps or as a result of Our Relationship with you.  This means that we are responsible for ensuring that we obtain and look after your personal data in full compliance with data protection and all other related privacy laws.

Here are links to some of our most frequently used ‘Relevant Privacy Notices’

Player Privacy Notice June 2023 Click to view
Academy Player Privacy Notice June 2023 Click to view
Customer Privacy Notice July 2023 Click to view
Matchday Hospitality Photography and Filming Privacy Notice 2023 Click to view
Mascot Photography and Filming Privacy Notice 2023 Click to view
Staff Privacy Notice 2023 Click to view

Where we receive your personal data but have no relationship with you

In a small number of situations, we may obtain information about you from someone else and we may not have contact information for you to enable us to provide you with the Relevant Privacy Notice. However, we recognise the importance of making privacy notice information available to you and you should be able to access this at the relevant link(s) below

Information received from talent scouts  Scouting Privacy Notice


If you are under 13, you will need to ask your parent, carer or legal guardian to register you for any Club services you want to use and will need their permission before bookings and purchases can be made or you can take part in any competitions, games or events. 

We may require your parent, carer or legal guardian to confirm that they have given permission. We may ask for their contact details so that we can check that they have done so and may carry out checks to confirm that the details you have given us are correct.

If you are under 13, we will normally only send newsletters and offers and opportunities to you if your parent, carer or legal guardian has given their consent to them being sent. They can change their mind at any time (see ‘Invitations, newsletters, offers and opportunities’ below).

There may be age restrictions that apply to some of our products, services and opportunities and we may make checks to help us ensure that what we provide is, in each case, age appropriate.

The personal data we collect

The information we obtain about you and its sources will depend on the nature of Our Relationship.  Specific detail will be in the Relevant Privacy Notice but to give you a general idea we will typically obtain some or all of the following information where we believe it is relevant:

  • identity information such as name, username, social media handles, date of birth, gender, nationality, ethnicity
  • contact details including addresses, email address, mobile phone number, social media details
  • vehicle registration details
  • devices that you have used to interact with us
  • payment details such as bank account or other payment card information, payments and details of returns or refunds
  • purchase history  
  • services and opportunities you have expressed an interest in, such as which of our websites and apps you have used and, maybe, which pages or features you have looked at or used
  • medical information such as injury information, medication, health status and issues and disability information, information needed to satisfy any requirements of epidemics, pandemics, health emergency or other public health matters such as temperature, vaccination status, medical passport details
  • associated people for example, details of any people you make bookings for, next of kin, family members and emergency contacts (in each case, where relevant)
  • eligibility information such as your eligibility to play, work for us, make purchases or take up our services
  • supporting information that is relevant to Our Relationship such as photographs for accreditations, clothing size and any personalisation for kit or other items where we are supplying this, dietary requirements where you or someone else you are providing details for are attending an event or meeting where refreshments are being provided, allergy information or treatment that may need to be given
  • behavior information such as incidents involving you, football banning orders that you are subject to, information relating to your involvement in incidents that may impact the safety / security of yourself or others, breaches of Terms & Conditions of Entry, Ground Regulations, courtsiding or other Club policies, previous evictions from matches or our premises,
  • audio-visual materials such as photographs and video recordings
  • experience and accreditations including qualifications and training
  • statistics including match and playing statistics
  • regulatory information such as anti-doping, disciplinary, safeguarding and anti-corruption information, including DBS information (criminal records checks)
  • feedback and survey responses
  • preferences including your direct marketing preferences and consents
  • communications such as records of your interactions with us such as telephone conversations, emails and other correspondence

Some of this information will be obtained before any decisions about whether to enter into an arrangement with you is made and is needed to enable decisions to be made.

Where we obtain information from

We obtain information from a wide variety of sources depending on the nature of Our Relationship or proposed relationship. 

Specific detail will be in the Relevant Privacy Notice but to give you a general idea, we may obtain information:

  • directly from you or from someone who is requesting goods or services for you or who is providing references or other supporting information to support Our Relationship)
  • from other information we already hold as a result of Our Relationship
  • from any device you use to communicate with us such as when accessing our websites or apps, from telephone conversations, emails and written and verbal communications including blogs and social media interactions
  • from records of the goods and services provided to you. Some of this information may be obtained from the service providers we use, such as ticket agents
  • from other clubs, teams, sporting authorities, leagues or from football authorities
  • from talent scouts and scouting data providers, the media, coaches, referees, and other match officials
  • from emergency services, public bodies, statutory agencies (e.g. Child Services or Adult Services), local authorities and agencies, electoral register, Companies House, credit reference agencies
  • from third party data providers
  • from WBA Affiliates or Club Sponsors & Partners
  • from agents, representatives and family members

We may supplement the information that you provide with other information that we obtain from our dealings with you (such as tickets you have purchased, newsletters you have subscribed to, events you or someone you book for have attended, your roles and achievements in football and details from other Club services you have signed up for, use or have used) or which we receive from other organisations, such as other WBA Affiliates or Club Sponsors & Partners.

Public source data

We obtain some information through searches of various public resources such as identity checking services, social media platforms like Twitter, Instagram and Facebook and also carry out browser-based searches.

We may use third party service providers to do this on our behalf.

Recording / monitoring telephone calls and use of CCTV and body cameras

We may monitor / record telephone calls for security, training to provide an accurate record of any calls we may have with you.

We may use CCTV and body cameras at our stadium, training ground and other Club sites for security (including preventing and detecting crime) and safety purposes and to monitor compliance with law, our Terms & Conditions of Entry  and our Ground Regulations.  Footage may be used as evidence in any investigations.

Images are monitored by authorised personnel 24 hours a day, every day of the year. We normally place signage in and around all sites which operate CCTV.

We only use covert monitoring or surveillance (that is, where individuals are unaware that the monitoring or surveillance is taking place) in highly exceptional circumstances such as if there are reasonable grounds to suspect that criminal activity or extremely serious malpractice is taking place

Body worn cameras may be used to deter and provide evidence of acts of aggression, verbal or physical abuse, violence or health and safety incidents as well as to provide evidence to support internal or law enforcement agencies, Football Authorities or other football club investigations.

Apps, IP addresses, cookies and tracking tools

Apps.  Most Club apps do not involve us obtaining obvious user personal data that enables us to know who you are but, in order to enable the app to function and to help with analytics, the app functionality may mean we get some information that privacy laws designate as personal data.  This includes details of the app that has been downloaded and may include the age range of the user, their country of residence, the brand of the device used, the type and model of the device that the app has been downloaded to, user gender, interests (such as arts and entertainment, sport) and when the user firsts opens the app.  Analytics also automatically generates a unique identifier for each downloaded copy of the app to compute user metrics.  This is known as an ‘app instance identifier’. 

To access certain areas of the Club Apps you may be required to login to your My Albion Account.

Club apps do not normally include an option for in-app purchases; however they may link through to the Club ticketing website and shop where you can purchase tickets and merchandise.

If you download a Club app that involves us processing more clearly identifiable personal data or includes tracking for in-app purchases, the Club will ensure you are provided with a Relevant Privacy Notice to ensure you have appropriate privacy information.

Please note, the app store you use to download the app may also obtain and process personal data about you and your choice / use of apps.  We are only responsible for our own privacy practices and the security of our own systems. 

We recommend that you check the privacy and security policies and procedures of each app store you use to download apps.


IP addresses. In order to understand how users use our websites, apps and our services and the things they are interested in, we may collect your Internet Protocol addresses (also known as IP addresses).  Your IP address is a unique address that computer devices (such as PCs, tablets and smartphones) use to identify themselves and in order to communicate with other devices in the network. 

Cookies. In common with many other website operators, we may use standard technology called 'cookies' on our websites. Cookies are small pieces of information that are stored by your browser on your computer's hard drive and they are used to record how you navigate our Site on each visit.

Our cookies are used to enable us to develop our websites and to enable you to properly navigate it.  We use cookies to collect personal data to enable us to reflect our users’ interests and by noting who has seen which pages, properties and advertisements (including ‘click throughs’ from emails), how frequently particular pages are visited and to enable us to determine the most popular areas of our websites. We may use cookies to enrich your experience of using our websites, apps and other services by allowing us to tailor what you see to what we have learned about your preferences during your visits to our websites.  Sometimes we may use services of third parties and they may use cookies on our behalf in order to provide their services.

The cookies we use can be found in the Cookie Notice on the Club websites or you can click here to see it.  You will automatically see our Cookie Notice as a ‘pop-up’ the first time you use each of our websites and again if you use the website after having deleted our cookies for the website.

Preventing use of cookies. Most browsers automatically accept cookies, but you can usually change your browser to prevent cookies being stored.  With experience, you can usually choose to switch off all cookies or to allow only certain ‘trusted’ sites to place cookies.

For further information on cookies and Flash cookies and how to switch them off see the Information Commissioner’s website at or visit or

Please note, if you do turn cookies off, this will limit the service that we are able to provide to you and may affect your user experience. 

Google Ad Manager. Our websites use Google Ad Manager, a service provided by Google through which it uses advertising cookies to serve adverts.  These cookies enable the Club, WBA Affiliates and Club Sponsors & Partners to serve you with adverts based on your previous visits to our Site or other websites that you have visited.

Preventing use of these advertising cookies. You can choose not to be shown personalised advertising when visiting our Site by visiting Ads Settings or you can choose to stop Google using cookies for personalised advertising by visiting

You can find Google’s explanation of how it will use your information at this link How Google uses data when you use our partners’ sites or apps.

Tracking technology. Occasionally, we may use digital tracking (usually in a cookie) on our websites or in emails or other messages we send to you.  We use these to ensure you receive appropriate information and do not receive multiple communications about the same thing (such as ticketing offers) from different WBA Affiliates. 

Preventing use of tracking technologies. If you stop cookies, this will normally stop any tracking from the website. Where we plan to use tracking technology, we will ask for your consent.

Please note, If you do not allow us to use tracking technology, you may receive communications that are of less interest to you or multiple communications about the same thing from different WBA Affiliates. 

Automated decisions using personal data

We do not normally take any solely automated decisions.

Purposes for which we process personal data and the legal basis for doing so

The legal basis for the collection and processing of your personal data depends on the type of information, the purpose for which we use it and the nature of Our Relationship.  There are a large number of legal bases for our use of personal data such as to enable us to comply with our legal responsibilities (for example a contract we have with you or which the law imposes on us) or that the processing is in our legitimate interests (for example to uphold standards and ensure the reputation of and opportunities at the Club are enhanced) or for establishing and dealing with any legal claims.  Apart from direct marketing, social inclusion or dealing with certain medical needs, we rarely rely on consent. 

A comprehensive explanation is set out in the Relevant Privacy Notice but some examples are below.



Legal basis

Administration.  For registration and general administration (including verification and security checking), processing applications, creating and administering accounts and subscription services, login credentials and access controls for online services and dealing with any payments (including debt recovery and fraud).


Personal data

It is necessary to fulfil the contract that you are going to enter into or have entered into with us and/or

It is necessary for compliance with a legal obligation and/or

It is necessary for our legitimate interests which are to ensure the requirements set by football governing bodies are met and the Club’s policies and objectives and managing its business effectively


and, in addition for ‘special category’ personal data

Explicit consent or

It relates to personal data that are manifestly made public by you and/or

It is necessary for insurance purposes and/or

It is necessary for the establishment, exercise or defence of legal claims











Delivery.  To provide the goods and services you request from us or our service providers (including helping you with any specific needs you or others in your group may have).


Competition / survey administration. To administer competitions, prize draws and surveys.

Communications.  To communicate with you.

Security.  To ensure a safe environment to work in and for the enjoyment of matches, events and activities.  To protect the security of our systems, services and premises.

Records.  For record-keeping purposes.

Market research and service development.  To carry out market research so that we can understand requirements, improve our offerings and develop new services.

Analysis.  To track and analyse activity on our websites and apps and to understand the interests and views of those using them and/or engaging with the Club.

Getting to know you. To create an individual profile for you so that we can enhance your user experience, to understand and respect your preferences and to provide updates and details of relevant opportunities where you have agreed to receive them.

Complaint, accident, incident and query handling.  To deal with accidents or incidents (including safety and security related incidents), complaints and queries raised.

Compliance.  Ensuring compliance with law, Terms & Conditions of Entry, our Ground Regulations and the Club’s policies including the for courtsiding, Anti-Bribery, Modern Slavery, Anti-Corruption.

Publicity and advertising and commercial activities. Administration and carrying out Club commercial activities.

Business development.  Dealing with the expansion or sale of the Club’s business or assets

Job application. Processing any job application you submit to the Club.


Staff and visitor health and welfare. Dealing with any accidents, medical issues, injuries, allergies, special needs and health concerns which may include crowd control emergencies, public health emergencies and situations.





















Personal data

It is necessary to fulfil the contract that you are going to enter into or have entered into with us and/or

It is necessary for compliance with a legal obligation and/or

It is necessary for our legitimate interests which are to ensure health and welfare of those on our premises and to meet insurance requirements


and, in addition for ‘special category’ personal data

Explicit consent or

It relates to personal data that are manifestly made public by you and/or

It is in your vital interests or the vital interests of another person and/or

It is necessary for reasons of public interest in the area of public health and/or

It is necessary for the purposes of preventative or occupational medicine or assessment of your working capacity, medical diagnosis or the provision of health or social care or treatment and/or

It is necessary for the establishment, exercise or defence of legal claims


Social inclusion.  To keep under review equal opportunities within the Club and football generally (such as in respect of ethnicity, gender, race, age and disability) and providing equal opportunities and to enable us to monitor and ensure compliance with anti-discrimination law and policies and/or where applicable to comply with our obligations to various agencies, e.g. Sport England, EFL, Premier League.




personal data

It is necessary for compliance with a legal obligation and/or

It is necessary for our legitimate interests which are to ensure we the requirements set by football governing bodies and the Club’s objectives


and, in addition for ‘special category’ personal data

Explicit consent or

It is necessary for the purposes of quality of opportunity and/or

Is necessary for the establishment, exercise or defence of legal claims


Legal matters.  Including supporting law enforcement bodies in the prevention, detection and prosecution of crime, dealing with legal claims and disputes.


Personal data

It is necessary to fulfil the contract that you are going to enter into or have entered into with us and/or

It is necessary for compliance with a legal obligation; and/or

It is necessary for our legitimate interests which are to ensure manage the Club’s business effectively


and, in addition for ‘special category’ personal data

Explicit consent or

It relates to personal data that are manifestly made public by you and/or

It is necessary for the establishment, exercise or defence of legal claims



Where you have given your consent to any processing of personal data, you have the right to withdraw that consent at any time.  If you do, it will not affect the lawfulness of any processing for which we had consent prior to your withdrawing it.

Where your personal data will be held or used

Unless we say otherwise in the Relevant Privacy Notice you are given, we do not normally transfer personal data outside of the United Kingdom or the European Economic Area other than, potentially, to a few of our service providers in other parts of the world. 

Wherever we transfer your personal data outside of the United Kingdom, we will take proper steps to ensure that it is protected in accordance with this Privacy Policy and applicable privacy laws. In most cases, this will mean we use UK approved Standard Contractual Clauses or only allow the data to be processed in those countries which, the United Kingdom is satisfied, offer an adequate level of protection.

Disclosing your personal data

In order to provide our products and services, and to operate our business, we need to share relevant information with certain other organisations.  The Relevant Privacy Notice has specific details.

We may, occasionally, appoint other organisations to carry out some of the processing activities on our behalf. These may include, for example, technology hosts, printing companies and mailing houses. In these circumstances, we will ensure that personal data is properly protected and that it is only used in accordance with the Relevant Privacy Notice and our Privacy Policy.

We may share relevant information with WBA Affiliates, emergency services/authorities, third parties that acquire parts of our business or assets (and vice versa), advertising networks, social media platforms, search engine and analytics providers, competition and prize draw partners, finance providers, our professional advisers and regulators and, if you purchase a ticket for a match, we may provide some information about you to other club, teams, leagues or relevant football authorities.

Where relevant (for example, if you have attended a match or event), we may share details with law enforcement agencies or NHS Test and Trace.

WBA Affiliates

The Club is part of a wider WBA family that includes the WBA women’s team and the Albion Foundation, our charity arm (each a WBA Affiliate).  Some of the goods and services available on or though our websites, apps and services are provided by those WBA Affiliates.  Each WBA Affiliate has its own privacy practices and you should check that you are satisfied with them before you provide any personal data to them.

You can view an up-to-date list of WBA Affiliates by clicking the link.

Club sponsors and partners

The Club teams up with a variety of sponsors and commercial partners each of which bring value to the game and many of them are happy to make offers and opportunities available to you so that you can also benefit from them being in the WBA family.

You can view an up-to-date list of Club Sponsors & Partners by clicking the link.

Invitations, newsletters, offers and opportunities

The Club, WBA Affiliates and Club Sponsors & Partners would like to contact you and/or any person whose information you provide to us to invite you to enjoy other products and services (where you have agreed to us sending an invitation), to provide newsletters and to tell you and/or them about offers and opportunities that are available and about a range of other initiatives in a number of ways, including by post, text message, email or, for relevant services, push notification, personalised on-screen messages and social media.

Preferences / subscribe / unsubscribe

Details of how to opt-in to or opt-out of receiving newsletters and details of offers are on relevant pages of our websites and apps, in relevant forms you complete and/or in the message you receive.

You (and any other person whose information you have provided to us) can notify us that you/they have changed your/their mind about whether you/they wish to receive details of offers and opportunities at any time by logging into your/their myalbion account or by using any of the methods shown below (see the section ‘How to contact us’ below or refer to the Relevant Privacy Notice) or by following the instructions provided with each offer you/they receive.



We take the security of personal data seriously.  We use security technology, including firewalls, password protection and encryption to safeguard information and have procedures in place to ensure that our paper and computer systems and databases are protected against unauthorised disclosure, use, loss and damage.  We have processes in place to deal with a data breach in the unlikely event one should occur.

We only use third party service providers where we are satisfied that they provide adequate security for your personal data.

Where you use one of our websites, apps or other services that requires use of access controls such as a password, you are responsible for keeping your log in details confidential.


How long we will keep your personal data

The duration for which we keep your personal data depends on the type of information and the purpose for which we use it as well as the nature of Our Relationship, our legal obligations and whether we expect the personal data may be needed for dealing with any issues or complaints. 

Some information is kept for a very short time (such as website and app device data) but other information may be kept indefinitely (such as match statistics for professional players).  A detailed explanation is set out in the Relevant Privacy Notice.

Updating and correcting information

You may update or correct your personal data online in relevant membership areas or by contacting us in writing or by email (see the section ‘How to contact us’ below or refer to the Relevant Privacy Notice). Please include your name, address and/or email address when you contact us as this helps us to ensure that we accept amendments only from the correct person. We encourage you to promptly update your personal data if it changes. 

If you are providing updates or corrections about another person, we may require you to provide us with proof that you are authorised to provide that information to us.

Your legal rights in respect of your personal data

You have a number of legal rights over your personal data, which are:




You have the right to receive a copy of the personal data that we hold about you.  We will need proof of identity and proof of authority if the request comes from someone other than you.  This will ensure we only provide information to the correct person. 

withdraw consent to direct marketing

You can exercise this right at any time.  Just send an email to and we will take care of this for you.

withdraw consent to other processing

Where the only legal basis for our processing your personal data is that we have your consent, you can withdraw that consent at any time, and we will have to stop processing your personal data.  Please note, this does not mean that processing carried out before you withdrew your consent is unlawful.


If you think any of the personal data we hold about you is inaccurate – please contact us at and we will check and, if necessary, amend our records.


In limited circumstances you may be able to require us to restrict our processing of your personal data.  For example, if you think what we hold is inaccurate and we disagree, we may restrict what we do with your personal data until the accuracy has been verified.


In some circumstances, for example, where we have no legal basis for keeping your personal data, you may be entitled to require us to delete it.


Where our processing is based on it being in our legitimate interests, you may be entitled to object to us processing it.


Where you have provided personal data to us electronically, you may be entitled to require us to provide that data to you electronically or to transmit it to someone else.


If you have any concerns or complaints about how we are handling your personal data we would prefer you to get in touch with us directly so that we can try to resolve the You can also contact the Information Commissioner’s Office at

Some of these legal rights are subject to exceptions which means that we may be entitled, or required, to refuse to comply with a request or to charge a fee for dealing with the request


How to contact us

You can contact us as follows:




Legal Department

West Bromwich Albion Football Club

The Hawthorns

West Bromwich

West Midlands

B71 4LF


Phone:                           0121 524 3470

Email address:           

If you have any questions or concerns about how we are handling your personal data you can direct them to or you can make a complaint to the Information Commissioner’s Office (