8. Individuals located outside of the United States
The MLS’s headquarters is in the United States, and, regardless of where you use our Services or otherwise provide information to us, your information may be transferred to, maintained, and processed by the MLS, its affiliates, and our operational partners and service providers in the United States or other locations outside of your jurisdiction of residence. Such other locations may include, from time to time, Canada, Belgium, Finland, Germany, Ireland, the Philippines, Sweden, the United Kingdom, and potentially other countries. Please note that the United States and certain other locations to which your information may be transferred, maintained, or processed may not provide an equivalent level of data protection as your home country, and, although unlikely, in certain cases such information may be subject to lawful access by United States or such other location’s courts, law enforcement, and governmental authorities.
A.1. EU, EEA, Switzerland, and the UK
This supplemental section applies only if you use our website or Services otherwise covered by this Privacy Policy from a country that is not the United States, and where the MLS is subject to jurisdiction-specific laws. MLS is the controller of Personal Data collected through the Services. MLS has implemented appropriate safeguards to help ensure that the personal data we transfer is protected in accordance with applicable data protection requirements. Such safeguards may include the European Commission's standard contractual clauses when transferring personal data from the European Economic Area (EEA), and the UK and Swiss Addenda to the standard contractual clauses when transferring personal data from the UK and Switzerland respectively. If your personal data is transferred relying upon these safeguards, you may request a copy by contacting us at the address listed in the Contact Us section below.
If you are in the UK, you may lodge a complaint with the Information Commissioner’s Officer ()). If you are in the EEA, you may lodge a complaint with a supervisory authority that has authority in your country or region. Please click here for contact information for such authorities.
A.2. Legal Basis for Processing for EU, EEA, Swiss, and UK Residents
To the extent required by applicable law, the legal bases and justifications for our processing activities depend on how you interact with us. Under data protection laws in the UK and EEA, we can only use your Personal Data if we have a valid reason. The most common so-called lawful bases we rely upon are as follows:
- where you have given consent (“Consent”);
- to comply with our legal obligations (“Legal Obligations”);
- for the performance of a contract with you or to take steps at your request before entering into a contract (“Contract”); or
- for our legitimate interests or those of a third party (“Legitimate Interests”).
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.
Where we process information about a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition or sexual life, or genetic or biometric data (known as Special Category Personal Data), we will only do so where a further condition is also met. Usually this will mean that the processing is [e.g., with your explicit consent, where it is legally required under employment or health & safety law or where there is a substantial public interest].
As noted at Section 3, the nature of your interaction with us will determine how we will process your Personal Data. The relevant specific purposes as noted at Section 3 and lawful bases for which we will process your Personal Data are set out below in the relevant tables below:
With respect to Individuals:
Purpose |
Categories of Personal Data |
Lawful Basis |
To fulfill any agreement we have with you and/or to provide the services that you have requested from us |
Personal Identifiers Contact Information Commercial Information Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in order to provide you with the expected services |
To send communications regarding services you have requested from us |
Personal Identifiers Contact Information Commercial Information Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in sending communications relevant to the services you have requested. |
To send marketing communications |
Personal Identifiers Contact Information Commercial Information Inferences drawn from other Personal Data Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
Where you have provided Consent Or In all other cases, where it is in our Legitimate Interests as we can otherwise rely on soft opt-in given your prior interactions with us. |
To administer contests and sweepstakes that you have entered |
Personal Identifiers Contact Information Commercial Information Internet or Other Electronic Network Activity Information Geolocation Information |
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in order to provide you with the expected services |
To detect and prevent fraud and illegal activities |
Personal Identifiers Contact Information Commercial Information Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information
|
To comply with Legal Obligations, e.g. [with respect to AML or KYC information] Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests to ensure we are providing a secure service being mindful of the expectations of us as a business and to otherwise prevent and detect crime, fraud and other abuses |
To complete transactions with business partners |
Personal Identifiers Contact Information Commercial Information Inferences drawn from other Personal Data Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in order to provide you with the expected services and to otherwise operate our business in a reasonable manner |
To perform analytics to better understand our customer base and present you with a better product |
Personal Identifiers Contact Information Commercial Information Inferences drawn from other Personal Data Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
Where it is in our or a Service Provider’s Legitimate Interests in order to (i) provide you with the expected services; (ii) tailor our services to you |
To comply with our legal obligations and for enforcement purposes |
Personal Identifiers Contact Information Commercial Information Inferences drawn from other Personal Data Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information
|
To comply with Legal Obligations, e.g. [INSERT] Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests including (i) to comply with applicable regulations and guidance as well as internal policies and procedures; (ii) for audit purposes and quality checks, and (iii) to respond to requests from legal, regulatory, judicial, administrative, governmental and other official bodies; (iv) to enforce our legal rights; (v) initiate claims; (vi) defend claims; and (vii) investigate and attend to enquiries |
To help administer the Services |
Device Identifiable Information |
Where it is in our Legitimate Interests to process such data in order for us to operate the Services, such as (i) for IT operations; (ii) IT security and maintenance, and systems controls; (iii) to be efficient so we can deliver the best service to you. |
To disclose information to Service Providers (as set out in this Privacy Policy) in order to enable the other purposes outlined in this Privacy Policy |
Personal Identifiers Contact Information Commercial Information Inferences drawn from other Personal Data Internet or Other Electronic Network Activity Information Device Identifiable Information Geolocation Information |
Where it is in our Legitimate Interests to process such data in order for us to operate the Services, and provide the expected service to you |
With respect to Participants:
Purpose |
Categories of Personal Data |
Lawful Basis |
To allow for the operation of our clubs, matches, league and events
|
Personal Identifiers Contact Information Participant Education Provider Information Inferences drawn from other Personal Data Demographic data Performance tracking data Physiological data |
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in order to provide you with the expected services
|
To comply with our legal obligations
|
Personal Identifiers Contact Information Participant Education Provider Information Demographic data |
To comply with Legal Obligations, e.g. [INSERT] |
To contact you with communications related to events and matches related to you |
Contact Information
|
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in sending communications relevant to the Services you have requested. |
In case of emergencies/for emergency contacts |
Contact Information
|
Where it is in our Legitimate Interests for your safety and security |
To ensure that you can participate in our events/for Participant eligibility |
Participant Education Provider Information National or government identifiers Demographic data
|
To comply with Legal Obligations, e.g. [INSERT] Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests including to comply with applicable regulations and guidance as well as internal policies and procedures; |
To help ensure that our services and leagues are inclusive, equitable and fair to all participants, fans and customers |
Demographic data |
[TBC] |
With respect to Parents:
Purpose |
Categories of Personal Data |
Lawful Basis |
To allow for the operation of our clubs, matches, league and events
|
Personal Identifiers Contact Information Interaction Data
|
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in order to provide you with the expected services |
In case of emergencies/for emergency contacts |
Personal Identifiers Contact Information National or government identifiers |
Where it is in our Legitimate Interests for your/the Participant’s safety and security |
To contact you with communications related to events and matches related to you and/or your child or dependent |
Personal Identifiers Contact Information Interaction Data
|
In order to perform our obligations under Contract Or In all other cases, where it is in our or a Service Provider’s Legitimate Interests in sending communications relevant to the Services you have requested. |
To comply with our legal obligations
|
Personal Identifiers Contact Information Participant Education Provider Information Demographic data |
To comply with Legal Obligations, e.g. [when you sign or provide information for a minor child]
|
To better understand and improve our services |
Interaction Data |
Where it is in our or a Service Provider’s Legitimate Interests in order to (i) provide you with the expected services; (ii) tailor our services to you |
Failure to provide us with the relevant Personal Data, in cases where you are legally or contractually required to provide it, may result in our being unable to establish or continue our relationship with you or to provide products and services to you.
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
A.3. International Data Transfers
Please note Personal Data we collect about you may be transferred, processed and/or accessed by us in the United States, or another country where we, or our Service Providers operate. This means that Personal Data may be transferred to, and maintained on, computers located outside of your jurisdiction or country where privacy laws may differ from and may not be as protective as those where you live.
In order to provide adequate protection for the transfer of your Personal Data, we have in place contractual arrangements (as appropriate) with our subsidiaries, affiliates and Service Providers in respect of such transfers. Where applicable and/or where required, we utilize the Standard Contractual Clauses published by the European Commission on 4 June 2021 (“SCCs”) and the applicable addendum to such SCCs as approved by relevant authorities in the UK . If you require further details of such data transfers mechanisms and data transfer documentation, please use the contact details specified in Section 16.
A.4. Data Controller for EEA, Swiss and UK Residents
If you are located in the EEA, Switzerland, or the UK, Major League Soccer, LLC is the controller responsible for the processing of your personal data. You may lodge a complaint with your local supervisory authority if you consider that our processing of your personal data infringes applicable law.
\\
B. Canadian Individuals\\
We have designated a Privacy Officer who is responsible for overseeing the company's compliance with privacy legislation. We have established policies and practices that govern our treatment of personal data and set out the responsibilities of our employees. These policies and practices include, among other things, the following:
- Policies and practices to collect, use and disclose personal data with consent, where required by applicable Canadian privacy laws.
- Policies and procedures to protect personal data in our custody and control from unauthorized access, use or disclosure.
- Policies and processes to respond to data subject requests and complaints in a timely and effective manner.
- A framework for the retention and destruction of personal data to ensure compliance with legal obligations.
C. Other Country Individuals
Information for Australia Residents
If you have any queries or complaints with regards to our collection, use, and disclosure of your personal data, please contact us as set out in the Contact Us section below.
If you make a complaint, we will endeavor to respond to it as soon as possible. If you are dissatisfied with our response, you have the right to make a complaint to the Office of the Australian Information Commissioner by phoning 1300 363 992, by email at enquiries@oaic.gov.au, or by visiting their website here.
