Privacy Policy

Arsenal FC Privacy Policy

Summary

The Arsenal Football Club Limited (‘Arsenal’, ‘we’, ‘us’) is the controller and responsible for protecting your personal data and handling it responsibly.

This policy covers the personal data that Arsenal processes whenever you interact with us, including when you engage with us online (such as on social media or by using our websites and apps), when you attend events at Emirates Stadium, and when you correspond with us (such as by email or over the phone). It also covers personal data that we may receive from third parties about you, either in connection with a relationship we have with you, or as part of our football activities, such as talent identification or analysis of the professional game.

The sections below explain in more detail:

the types of personal data we collect from you
the types of personal data we receive from third parties
why we process your personal data
who we share your personal data with
personal data transfers outside of the UK
how long we retain your personal data
your rights to withdraw your consent and to object (including to direct marketing)
your other personal data rights
how to contact us and exercise your rights

If you would like to know how we collect information about your use of our websites, apps and social media sites, you can read our Cookies Policy.

Whilst interacting with us, you may decide to follow links to websites which are operated by third parties who control the collection and use of your personal data. In these situations, Arsenal does not control how your personal data is processed and therefore you should read the privacy policy and cookie policy (as applicable) located on such third-party websites.

------

Personal data Arsenal collects from you
We collect personal data from your interactions with us, such as when you engage with us online (such as on social media or by using our websites and apps), attend an event at Emirates Stadium, or when you email or phone us.

The personal data we collect includes:

Category	Details
Identification and Membership Information	Your name, username and password, gender, age/date of birth, membership number, details of any qualifying rewards, information you may include in your user profile, choice of avatar
Contact Information	Your home or business address, email address and phone number, as appropriate to our relationship with you
Payment and Delivery Details	Your payment and delivery details, including billing and delivery addresses and payment details, where you make purchases from us
Purchase Details	Details of purchases you make from us, including tickets, shop items or other products or services we offer
Marketing Information	Your marketing preferences, including any consents you have given us
Device and Interaction Information	Information related to the browser or device you use to access our website and apps and tools made available on our website and apps, and your use of our website and apps. This may include the device type, manufacturer, and model, operating system, IP address, browser type, Internet service provider, and unique identifiers associated with you, your device, or your network (including, for example, a persistent device identifier or advertising ID), and information about the site from which you came, the site to which you are going when you leave our site, how frequently you access the our site, whether you open emails or click the links contained in emails, whether you access our site or apps from multiple devices, and other browsing behaviour and actions you take on our website and apps
Correspondence and Survey Information	Conversation history related to communications between you and us where you have interacted with us, including as shared by email, and market research survey responses, or your communications with others on our services
Disability and Health Details	Details of your disability, where you supply this to enable us to provide you with reasonable adjustments, or assistance at a venue, or to get access to disability ticketing. Details of your health condition, if necessary to ensure your safety at an event, for example dietary requirements, or medication requirements
Employment and Business Information	Your position and employer, your work contact details and your interaction with us in your role, including information provided during the contractual or client relationship between you or your organisation and Arsenal, or otherwise voluntarily provided by you or your organisation
Broadcast and Media Information	Details of your attendance at Arsenal events as may be contained in images and footage collected at those events, which may be used to publicise, promote or distribute footage of such events, and other images or recordings collected for media or promotional purposes in any other setting, such as visiting Arsenal's offices, sites or other premises including but not limited to Emirates Stadium, The Hub, our training centres or museum, such as of competition winners or as submitted by fans
Visit and Access Details	Personal data collected when you visit us at a match or office, or approach our buildings, including as applicable CCTV, access details you provide in connection with a visit including ticket details and other information you provide at site entry, and information supplied to us by police or others in connection with expected visitors. It may also include details of any incidents with which you are involved, whether this relates to misconduct, breaches of our terms or health and safety matter, including your health data where required by law. Where we ask for biometric data for the purposes of granting access, we will also collect and process this information
Application Information	Personal data related to your application for a role with Arsenal, or to be included in our productions, films or series or to act as a host family for a youth player, including relevant information for your application, which may include you curriculum vitae (CV), cover letter, employment history, education history, qualifications and skills, references, background screening information if relevant, and information about your entitlement to work. This may include information related to your health, where this is necessary to offer you reasonable adjustments and criminal records data where necessary for the relevant role.
Safeguarding Related Information	Information we collect or receive in relation to safeguarding matters, such as reports of incidents involving children or vulnerable people. This might include details of alleged victims or perpetrators, including names and alleged conduct, which involve collection of information about criminal activity, health status, racial or ethnic identity, religion, sex life and/or sexual orientation to the extent that it is relevant to the report.

Sensitive Data

In limited circumstances, we may need to process your sensitive personal data, such as race or ethnicity data, health data, biometric data, or data about criminal offences. This will only ever be where we meet a lawful condition for such processing, such as where we have your explicit consent, where the data has been made public by the data subject, or where processing is necessary for: the prevention or detection or unlawful acts, the substantial public interest (such as safeguarding vulnerable individuals, or complying with UEFA, Premier League or FA rules on behaviour in football), or legal claims.

------

Personal data Arsenal receives from third parties
Sometimes we receive personal data from third parties, in particular:

our commercial partners provide us with your name and contact details if you’ve asked to receive information from Arsenal. - see a list of our current partners
ticketing providers and overseas ticketing agents let us know if you’ve purchased tickets to an event at Emirates Stadium
access control providers let us know if your tickets have been used at Emirates Stadium
online personalisation providers tell us how you engage with our websites and apps
data specialists provide us with insights about our supporters, based on their own aggregated data sets
if you register for Digital Membership using your social media account, the social media platform provides us with information that you have consented to share with us
government and law enforcement authorities provide us with personal identification and background information when they are involved in official inquiries
finance providers may inform us about a credit arrangement you have with them for Arsenal season tickets
third‑party suppliers who support us in verifying your identity and age
agencies who partner with Arsenal in the Community may share information with us about participants that we refer to them
other football clubs and football authorities (such as the Premier League, The Football Association or The Union of European Football Associations (‘UEFA’)) may provide us with personal data to, amongst other things: (i) assist in preventing violent and antisocial behaviour at matches, (ii) enforce sanctions under the Premier League’s Commitment Regarding Abusive and Discriminatory Conduct, (iii) to validate tickets and combat ticket touting, and/or (iv) support with handling fan inquiries
if you are a My Arsenal Rewards Member, Rewards Affiliates and/or Fortress (GB) Limited may share information about you with us so that we can administer your Membership

------

Why Arsenal processes your personal data
Whenever we use your personal information, we do so based on a specific lawful bases under data protection law. This section explains the reasons why we process your personal data and our legal bases for doing so.

Consent
For example, if you’ve opted in to receive information and offers relating to the Club and our commercial partners (by ticking a box on one of our websites or apps), then we’ll provide this information to you by email, text, or phone - see a list of our current partners.

We may also rely on your consent to process information about your use of our websites, apps and social media sites, so that we can improve your browsing experience and deliver online advertising that is relevant to you (for more information, see our Cookies Policy).

We sometimes rely on your Explicit Consent for certain processing of sensitive data. These circumstances are set out above under Sensitive Data.

Wherever we rely on your consent to process personal data, we will explain our proposed uses of that information at the time this is obtained, and you have a right to withdraw that consent at any time. You can find information on how to exercise your rights below.

Legitimate interests

Where we process personal data on the basis of a legitimate interest, unless this is a ‘recognised legitimate interest’ under the UK GDPR, we carry out a ‘balancing test’ to document our interest(s), consider what the impact of the processing will be on individuals and determine whether individuals’ interests outweigh our interest(s) in the processing taking place. You can contact us if you have questions about this. You can find information on how to contact us below.

Contract

We may process your personal data where this is necessary to fulfil a contract with you, or to take steps at your request before entering into a contract. For example, where you communicate with us about a ticket you have purchased, or where you are using our services under our terms and conditions, we will process this personal data in order to perform our contract with you.

Legal Obligation

Where it is required by law, for example to comply with any duties to prevent illegal content or content harmful to children, we may process personal data to prevent, detect, or investigate a crime or to safeguard children.

------

Who Arsenal shares personal data with

We may share your personal data with the following recipients:

Arsenal Broadband Limited, a company within the Arsenal Holdings Plc Group, for the purpose of administering our websites and apps
commercial partners, so they can advise us how best to communicate with you on their behalf. We do not give your data to partners for them to communicate with you directly - see a list of our current partners
Facebook, so that we can display relevant advertising to you on their platform (your data is converted into a unique ID before it is shared with Facebook)
third party suppliers, including those involved in; data insights, website and app hosting, online personalisation, advertising, tracking online abuse, systems maintenance, ticketing, database management, identity checking, payment processing, delivery logistics, facilities management, content moderation and credit and debt management
third party advisors to the club, such as accountancy firms, consultants and our legal advisors.
organisations undertaking official data scout spotting activities within Emirates Stadium
public authorities or law enforcement officials, to assist with their official requests and comply with our legal obligations.
recruitment and vetting agents and scouts, to assist with our talent ID and recruitment processes
other football clubs and football authorities (such as the Premier League, The Football Association, or UEFA), where this is necessary to, amongst other things: (i) ensure the safety and security of supporters, (ii) assist in preventing violent or antisocial behaviour at matches, (iii) enforce sanctions under the Premier League’s Commitment Regarding Abusive and Discriminatory Conduct, (iv) combat ticket touting, (v) support with handling supporter inquiries, (vi) if we think it’s appropriate to inform them of incidents at Emirates Stadium involving supporters, (vii) ensure the safeguarding of vulnerable people, or (viii) ensure we comply with relevant rules applicable to us related to ensure standards of behaviour in sport
third parties operating events at our venues, or who have allocated matches to be held at our venues
if you are a My Arsenal Rewards Member, we may share information about you with Rewards Affiliates and/or Fortress (GB) Limited or suppliers of services connected to My Arsenal Rewards in order to administer your Membership
our advisers, any prospective purchaser’s advisers, and any new owners of the business (in the event our business is sold or integrated with another business)
agencies who partner with Arsenal in the Community (if you have been referred to those agencies through us) for the operation of relevant programmes
third-party stakeholders involved in our video productions including any co-producers, commissioners, broadcasters or distributors (if you have been filmed for any productions)
third-party providers who assist us in managing and supporting provisions for supporters with a disability

------

Personal data transfers outside of the UK
Where your personal data is transferred to a country outside of the UK, and that country is not subject to a UK Adequacy Regulation, we will ensure your data is protected by appropriate safeguards (for example, approved standard contractual clauses or a supplier’s Binding Corporate Rules). A copy of the relevant safeguard can be provided for your review on request. You can find information on how to contact us below.

------

How long Arsenal retains personal data
We retain personal data about your membership for as long as your account remains active, and for a limited period of time afterwards (in case you decide to reactivate your membership or have queries about it).

We retain personal data relating to your purchases for several years from the date of the relevant transaction. This is to understand your purchasing preferences and to meet our legal and contractual obligations. If your purchase has enduring relevance (such as a Celebration Corner plaque) then we’ll keep relevant information for as long as we remain responsible to you for that purchase.

Where you have asked us not to send you direct marketing, we keep a record of that fact to ensure we respect your request in future.

We keep a record of call centre recordings for 27 months and CCTV security footage for 30 days, unless we need to hold this data for longer to resolve an issue or to meet a legal requirement.

We also retain information with the potential to give rise to legal disputes for 7 years. If we are involved in a legal dispute, we will hold relevant information for at least as long as is necessary for that dispute to be finally resolved, and to keep relevant details of that dispute and its outcome on file once it has concluded.

We may hold other information for as long as is required by applicable laws, such as duties to maintain health and safety records or accountancy records, or as long as is necessary for the relevant purpose. For example, information we hold in relation to safeguarding cases may be held as long as is necessary to ensure the safety of children or other vulnerable people at the Club.

------

Your rights to withdraw consent and to object (including to direct marketing)

Wherever we rely on your consent to process personal data, you always have a right to withdraw that consent. See the Consent section above for details of processing based on your consent.

You also have the right to object to any use of your personal data for direct marketing purposes, as well as to processing that we undertake based on our legitimate interests. See the Legitimate Interest section above for details of processing based on your Legitimate Interest.

You can find information on how to contact us and exercise your rights below.

------

Your other personal data rights

In addition to your rights to withdraw your consent and to object, you have the right to ask us:

for access to information about your personal data or for a copy of your personal data
to correct or delete your personal data
to restrict (i.e. stop any active) processing of your personal data
to provide you with certain personal data in a structured, machine-readable format and to transmit that data to another organisation

You also have a right to complain, either to us, or to the Information Commissioner or other relevant supervisory authority, for example in the country where you live or work.

These rights may not always apply, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have a compelling legitimate interest in keeping. If this is the case, then we’ll let you know when we respond to your request.

You can find information on how to contact us and exercise your rights below

------

How to contact us and exercise your rights
The easiest way to stop receiving information from us is by opting out of communications through your online preference centre (this is linked to in our communications with you and is accessible at times via your account settings). You can also correct your registration details through your online account.

We will do our best to assist with any queries you have about your personal data within one month of receipt. You can contact our Data Protection Officer at any time using the contact details below. When you do so, please provide your full name, your preferred contact information, and a summary of your query. If you are sending a complaint, please indicate this in the subject line of your query.

dpo@arsenal.co.uk

Data Protection Officer
Arsenal Football Club
Highbury House
75 Drayton Park
London, N5 1BU

To comply with the EU General Data Protection Regulation (2016/679) we have also appointed a European representative. If you wish to contact them, their details are as follows:

Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium

EUrepresentative.ArsenalFC@twobirds.com

Last updated 06/02/2026

We suggest that you check back here for updates, as we will update this policy from time to time.