Fanometrix Privacy Notice

1. About this notice

Fanometrix runs football research in several different ways.

You might take one of our short surveys on a media website or app. You might join Fanometrix as a member and take part in Community research. You might visit our website, contact us or use one of our professional services.

Different information is used in different situations.

This notice explains what we collect, why we use it, who can see it, how long we keep it and the choices and rights you have.

2. Who we are

Fanometrix is a product of The Football Collective Ltd, registered in England and Wales under company number 16678941.

The Football Collective Ltd is the controller of the personal information described in this notice where we decide why and how that information is used.

Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

Privacy enquiries: privacy@fanometrix.com

3. If you are a Fanometrix member

Fanometrix is a football research membership.

When you become a member, we may hold your email address and account information; verification and membership status; when you joined, left or rejoined; versions of Membership Terms and privacy information presented to you and your acceptance records; communication permissions and suppression records; membership and participation status; profile information you choose to provide, such as the name you would like us to call you, your year of birth, gender, broad UK location, club supported and other football interests; activities offered to you and operational participation/completion records; points earned, reversed or redeemed and your current balance; reward and fulfilment information where applicable; referral information where you use the referral programme; security, fraud and research-integrity information where necessary; support requests and important account-administration records; and appropriate technical and service records needed to operate and secure Fanometrix.

Your profile. We ask five short profile questions: what you would like us to call you, your year of birth, your gender, broadly where in the UK you live, and the club you support. Each is optional. You can answer "Prefer not to say" (or, for club, "I don't support a club"), answer later, or change an answer whenever you like. We ask for your year of birth only, never your full date of birth. Each question you answer earns one point, once, and a "Prefer not to say" answer earns the same point.

4. Why we use membership information

We use membership information to create and operate your Fanometrix account; verify and administer membership; provide relevant research opportunities; determine which activities you may be eligible for; operate your profile and personalise the member experience, for example by greeting you by the name you have chosen; record participation and completion; award and administer points and rewards; maintain research quality and prevent abuse; provide support; communicate with you about your account and genuine research opportunities; understand and improve Fanometrix; and comply with legal obligations and respond to data-rights requests.

Where processing is objectively necessary to provide the Fanometrix membership you have chosen, we rely on performance of our contract with you.

For research analysis, research quality, service improvement, security, fraud prevention and other appropriate operational purposes, we may rely on our legitimate interests, after considering necessity and your interests and rights. Particular care is required where members are 16 or 17.

Where the law requires consent, for example for optional marketing or particular non-essential technologies, we rely on consent.

Where we must process information to comply with the law, we may rely on a legal obligation.

5. Research invitations and marketing are different

Being offered genuine opportunities to participate in research is part of active Fanometrix membership.

We may therefore email active members about research opportunities they may be eligible for. Taking part in any individual activity is always optional.

Marketing/content is separate. Where you choose to receive Fanometrix marketing or content, we record that permission separately and you can withdraw it.

Leaving Fanometrix ends active membership and stops research invitations. It does not silently change a separate marketing preference; the leaving experience should make the consequences and choices clear.

6. If you take a Fanometrix survey on a media website or app

This section is about Fanometrix surveys shown inside third-party media websites and apps. It is not about research you take part in while signed into your Fanometrix membership.

When you take one of these media surveys, we may collect your answers; a randomly generated survey-session identifier; the campaign and survey; the publisher/media environment; placement and creative/configuration information; configured market/country and survey language; broad device/browser information; and timing and survey-performance events.

The existing system deliberately does not put your name, email address or Fanometrix member account into those media-survey responses. We describe this data as pseudonymous rather than claiming it is legally anonymous.

We use this information to conduct and analyse research, understand survey performance and create aggregated research about what fans think.

Our principal lawful basis for this processing is our legitimate interest in carrying out and improving research, subject to the safeguards required by data-protection law.

7. Media surveys and Fanometrix membership remain separated

Joining Fanometrix does not retrospectively identify you as the person behind answers you previously gave through a Fanometrix survey on a media website or app.

We do not turn those historical media-survey answers into your member research history simply because you later join Fanometrix.

This is different from research you deliberately undertake as a Fanometrix member, which is explained below.

8. If you take part in research as a Fanometrix member

When you deliberately take part in research while signed in as a Fanometrix member, Fanometrix needs to know operationally that you participated. This allows us to determine eligibility, prevent duplicate participation, record completion and award points.

We deliberately avoid making your ordinary account identity part of routine research analysis.

Your research answers are held as pseudonymous research data. Pseudonymous means that the research dataset used for ordinary analysis does not itself need to contain your everyday account identity, but Fanometrix may hold separate information that could reconnect the data in authorised circumstances.

Pseudonymous information is still personal information under UK data-protection law.

Information about your household

Some Community surveys ask about your household, including household income ranges and the broad age groups of people living with you, such as children. This helps us understand different types of football fans and households. We do not ask you to identify individual household members, and you can choose “Prefer not to say” rather than provide this information. We use these responses for research and statistical analysis, subject to the privacy protections and retention arrangements described in this Notice.

9. Who at Fanometrix can see research answers

Fanometrix separates three types of access.

Research Admin allows authorised members of the small Fanometrix research team to work with research data, including respondent-level pseudonymous answers where necessary for genuine research analysis. Ordinary Research Admin access does not give the researcher your name, the name you have asked us to call you, your email address or normal account identity alongside those answers.

Member Operations allows authorised staff to support and administer members, including account status, participation/completion, points and other appropriate operational information. It does not provide an identifiable dossier of the answers a member gave.

Research Identity Resolution is a separately controlled capability used only where there is an authorised reason to connect research evidence to member identity. It is not part of ordinary research analysis or ordinary member support.

Access is limited to authorised staff with a legitimate need, subject to confidentiality, access controls and audit.

Separately, a very small number of authorised engineers administer the databases that store this information. Queries they run with administrator access, for example through our database console, are recorded in audit logs, which our hosting provider keeps for a limited period. Those logs do not record read-only access through our hosting provider's management tools, routine activity by the hosting provider's own platform, or the automated access the Fanometrix service needs to run. Engineers do not use any of this access to look at individual research answers, except through the controlled identity-resolution process described above.

10. Using profile information with research

Research is more useful when Fanometrix can understand differences between relevant groups of football fans.

Where appropriate for a research purpose, approved profile characteristics may therefore be used alongside pseudonymous research responses. These may include gender, where provided; an age band worked out from your year of birth, where provided; broad UK location, where provided; club supported; football interests or competitions followed; and other profile characteristics deliberately provided or legitimately collected for the relevant research purpose.

We do not need to show a research analyst your name or email address in order to analyse, for example, how supporters of different clubs answered a question.

We limit profile characteristics to what is appropriate for the research and do not collect profile information simply because it might someday be commercially useful.

The name you have asked us to call you is used only to personalise your membership. It is not a research characteristic and is never shown alongside research answers or in research results.

11. When identity may exceptionally be connected to research

Fanometrix does not promise that Community research can never be connected to identity.

A controlled connection may be permitted where there is a specific lawful and authorised need, for example responding to a valid data-rights request where resolution is necessary; investigating serious fraud, security or research-integrity concerns where proportionate; correcting a serious data or points integrity issue; an activity explicitly designed as longitudinal or identified research and explained appropriately to participants; or another legal obligation or exceptional governed purpose that has been properly authorised.

The ability to resolve identity is restricted. It is not available merely because somebody is curious about how a named member answered.

Where a future activity materially differs from the normal Fanometrix model, we will provide additional information before participation where required.

12. Sponsored and commissioned research

Some research is commissioned or sponsored by clubs, competitions, brands, agencies or other organisations.

Where sponsorship is important to understanding the activity, we will identify it.

Our normal V1 model is that clients receive research findings and aggregated or appropriately anonymised insight rather than Community member identity or unrestricted access to the member database.

If a particular research project requires respondent-level personal data to be provided to another organisation, or creates a materially different controller/data-sharing arrangement, that must be specifically assessed and explained rather than hidden inside this general notice.

13. Aggregated research and disclosure

Fanometrix may combine and analyse research to produce aggregated findings and intelligence.

These may be shown to members; provided to research clients; used in Fanometrix reports and products; published publicly; used to understand differences between groups of football fans; or used commercially as Fanometrix research and intelligence.

Before respondent-derived analytical results are released, Fanometrix applies governed disclosure controls intended to prevent protected individual or small-group information being derived from released results.

Governed Disclosure: Advanced remains PARKED / PRESERVED and is not represented here as a live member capability.

Where information has been genuinely anonymised so that individuals are no longer identifiable, it is no longer personal information for UK GDPR purposes. Pseudonymised respondent-level information remains personal information.

14. Points, rewards and membership administration

We keep information necessary to record points earned; pending and confirmed awards; legitimate reversals or corrections; redemptions; current balance; qualifying participation; the one-time points for answering your profile questions; referral qualification where applicable; and relevant reward fulfilment.

This information is connected to your member account because we cannot operate an individual points/reward system without knowing whose points they are.

It is separate from ordinary research-answer analysis.

15. Security, fraud and research integrity

We may use proportionate information to protect members, Fanometrix, research integrity and the reward programme.

This can include account and participation patterns, completion speed, unusual activity, referral relationships, earning patterns, appropriate technical/network information and manual investigation.

Our lawful basis will normally be our legitimate interests in security, preventing fraud and protecting research integrity, subject to necessity and balancing.

We do not use an opaque automated score alone to make a significant permanent decision about a member where human review or another safeguard is required.

16. AI and automated processing

Fanometrix may use automated tools to help operate and analyse research where they have been approved for that purpose.

Where AI is used within an approved research activity, we will make that clear where required. Participant statements remain research evidence; AI-generated themes, codes or summaries are treated as derived interpretations rather than as things the participant literally said.

We do not use the Community AI research capability as a general-purpose chatbot profile of members, and we do not use it to make significant solely automated decisions about members without a separate legal and product assessment.

16A. If you contact us or work with us

If you email us, ask for access to our platform, or send us a research enquiry, we keep what you send. That is usually your name, work email address, job title, the organisation you work for, and whatever you wrote to us.

We use it to reply, to consider the request, and to keep an ordinary record of business correspondence. Our basis is our legitimate interest in running our business and responding to people who get in touch.

16B. If you have a Fanometrix business account

People at publishers, brands, agencies and other partner organisations are given accounts on the Fanometrix platform. If you have one, we hold the information listed below.

We do not track which pages you visit or what you click while you use the platform.

Our basis is our legitimate interest in providing and administering access for the partner organisations we work with, and in keeping the platform secure and its administration accountable.

If your account is closed, we remove your name and replace the email address on it. Some records of what the account did, and the address it used, remain in our security and record-keeping so that historical activity stays accurate and is not wrongly attributed to somebody else.

• Your name, work email address and job title
• Your password, stored only as a cryptographic hash, so nobody at Fanometrix can read it
• Which organisations you are associated with, and what you are permitted to do
• When you last signed in, and when you were last active
• A security record of significant administrative actions, so changes to access and permissions can be accounted for

17. Who helps us operate Fanometrix

We use service providers to operate Fanometrix. Depending on the service, they process information on our instructions.

The currently documented providers include Supabase for database and related infrastructure; Vercel for hosting and application delivery; Resend for member/service email delivery; and Google and Microsoft for website analytics where those services are enabled with the required permission.

Fanometrix's primary Supabase project is hosted in AWS eu-west-2 (London). Vercel is used for application hosting and delivery and current account evidence records London edge delivery with some serverless function processing in the United States. Resend is used for email delivery and stores customer data in the United States. Where personal data is transferred internationally, Fanometrix requires an applicable lawful transfer mechanism and contractual safeguards. The provider register and transfer assessment are reviewed when providers, regions or subprocessors change.

We do not sell Community members' personal information.

18. How long we keep information

We do not use one retention period for every type of information.

We keep personal information only for as long as it is needed for the relevant purpose, taking account of research integrity, membership administration, points/rewards, legal obligations, fraud/security, complaints and legal claims.

Our retention schedule distinguishes between incomplete/unverified registration records; active and departed member/account information; profile information; Terms and permission evidence; participation/completion records; research evidence; points and reward records; communications; security/fraud records; support and audit records; and anonymised research outputs.

Where information is no longer needed, we delete it, de-identify it or anonymise it as appropriate.

Research information may sometimes be retained for longer where UK data-protection law permits research/statistical retention and the required safeguards are in place. This is not a licence to keep identifiable information indefinitely just in case.

Fanometrix applies the retention schedule set out in its internal governance records. Our Founder and Chief Executive is accountable for it.

For the Fanometrix Community, we keep your account and profile information while you are a member. If there has been no qualifying activity on your account for 24 months, for example signing in, verifying your email address or taking part in an activity, we will contact you in advance and give you the opportunity to remain a member. If you do not, we erase your account identity and profile information as described in section 20. This also applies if you have left Fanometrix, counting from your last activity.

We keep the research answers you give, linked to your membership, while you remain a member. What happens to them when your account identity is erased is described in section 20.

Contract, points, reward and acceptance evidence may be retained for up to six years where needed for legal claims, accounting or programme integrity. If your account identity is erased before then, these records are kept only in de-identified form.

19. Leaving Fanometrix

If you leave Fanometrix, your active membership ends; research invitations stop; you cannot continue participating as an active member or earning new participation points; your account becomes inactive rather than being silently treated as active membership; relevant account, points and membership history may be retained in accordance with our retention schedule; and you may later choose to rejoin through an affirmative rejoining process.

Leaving membership is not the same as asking us to erase your personal information.

A separate marketing permission is also not automatically rewritten by leaving membership. The leaving experience will explain the communication choices available to you.

20. Deletion requests and research data

You can ask us to erase personal information about you. The right to erasure is important but is not absolute.

Where the law requires erasure, we will erase or de-identify the relevant personal information.

When we act on an erasure request for a Community member, we remove your account identity and profile information, such as your email address, password, name, year of birth and other profile answers. Points and reward records are kept in de-identified form where they are needed for accounting or programme integrity.

When your account identity is erased, we remove the direct information that identifies you and retain existing research answers under a separate, pseudonymous identifier for research and statistical purposes. Those answers are no longer connected to an active member account, but they may still constitute personal information under data-protection law. We protect them through restricted access, purpose limitations and research safeguards, and continue to assess applicable data-protection rights and retention requirements.

Information removed from our live systems may remain temporarily in restricted backup copies until those backups expire under our hosting provider's retention arrangements. These backups are not used for ordinary research or account administration, and any restored data remains subject to applicable deletion requirements.

Some information may legitimately need to remain, for example minimum records needed to establish or defend legal rights; appropriate points/reward/accounting records; security or fraud evidence where continued retention is justified; evidence needed to demonstrate permissions or withdrawal; minimum suppression information needed to respect a marketing objection; or research information lawfully retained under applicable research safeguards.

Information that has already been genuinely anonymised cannot be linked back to you and is no longer personal information.

Pseudonymised information is different: it remains personal information where Fanometrix retains the means to reconnect it.

21. Your data-protection rights

Depending on the circumstances, you may have rights to receive information about how we use your personal information; obtain a copy of personal information we hold about you; correct inaccurate information; ask us to erase information; restrict particular processing; object to processing based on legitimate interests; receive certain information in a portable format where applicable; and withdraw consent where consent is the basis we rely on.

To exercise a right, contact privacy@fanometrix.com.

We may need to confirm your identity before disclosing or changing personal information.

For Community research, an authorised identity-resolution process may be needed to locate pseudonymous research evidence. That capability must be tightly controlled and does not make identity available to ordinary researchers.

For older media surveys, the position may be different, because those surveys were deliberately collected without member or account identity, so we may not be able to locate a particular media-survey response.

22. Members aged 16 or 17

UK Fanometrix membership is currently for people aged 16 or over.

We design the Community on the basis that 16- and 17-year-old members require clear, understandable information and appropriate safeguards.

We do not use rewards to pressure members into optional research participation or optional marketing.

Where legitimate interests are relied upon, children's interests and rights receive particular weight in the balancing assessment.

If you tell us your year of birth, we use it to understand your age group for your profile and for research analysis, for example comparing how different age groups of fans answered. We do not ask for your full date of birth, and we do not use your age to decide which research activities you are offered.

In our "How You Follow Football" survey, one question asks how you watch football video content, including whether you use unofficial or unauthorised streaming services. If you may have been under 18 when you answered, or you have not told us your year of birth, your answer to that question is only ever used as part of overall totals and is never examined on its own.

Fanometrix Community is for people aged 16 or over. Your confirmation that you are 16 or over when you join is what governs whether you can sign up. The year-of-birth question is a profile question, not a second age check. If you enter a year that would mean you are under 16, we do not save it and we ask you to check it; the rest of your answers are still saved. If we later have reason to believe that a member may be under 16, we review it and may restrict the account while we do. If we find that a member does not meet the 16+ requirement, their membership is paused rather than deleted, and it can be reactivated once they are eligible.

23. Cookies, analytics and similar technologies

Fanometrix may use technologies necessary to provide and secure its services.

Where non-essential analytics or similar technologies require permission under applicable UK privacy rules, we will obtain that permission before using them.

Our cookie/technology register records the technologies used, their purposes and the applicable consent or exemption assessment.

23A. If you visit our website

On our marketing website we use two analytics services to understand how visitors find and use the site, so we can improve it. They are off by default and load only if you accept analytics cookies in our banner. You can change or withdraw your choice at any time using the "Cookie Settings" link in the website footer.

These do not run on our surveys, and they do not run on the Fanometrix Community pages. Those pages set no analytics cookies at all.

We do not use these services for advertising and we do not sell your personal data.

• Legal basis: your consent, which you can withdraw at any time.
• To change or withdraw consent: use "Cookie Settings" in the website footer, or clear the fx-analytics-consent cookie in your browser.
• Strictly necessary cookies (for example sign-in/session) are always required for the site to function, are not analytics cookies, and are not covered by this consent.

24. Changes to this notice

We update this notice when Fanometrix or the way we use personal information materially changes.

The current version and effective date will be displayed.

Where a material change affects existing Community members, we will bring it to their attention. Where the accompanying membership proposition also changes materially, we may require affirmative acceptance of revised Membership Terms.

25. Complaints

If you are unhappy with how we have used your information, contact privacy@fanometrix.com.

We will operate the applicable UK data-protection complaints procedure.

You also have the right to complain to the Information Commissioner's Office (ICO).

26. Contact

The Football Collective Ltd

Company number: 16678941

Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

Privacy: privacy@fanometrix.com