Ticket Sales, Football Card, Marketing
Privacy Policy
relating to ticket sales, football card and our marketing activities
1. Where can you find information relating to data processing?
MLSZ (Hungarian Football Federation) prepared this policy in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter: GDPR or Regulation) with the specific purpose of making data processing operations transparent in an easily understandable way.
This policy contains the main information about the specific processing (legal ground, purpose of processing, scope, duration of the data processed and your rights) which supplements the document “General information on data processing” which explains your rights, how you can exercise them, the obligations concerning the security of personal data and the rules for the modification of the policy. The document “General information on data processing” is available here.
2. Introduction of processing cases and the categories of data processed
For ticket sales, a distinction must be made between the international matches organised by MLSZ, other matches (e.g. Hungarian Cup final), matches organised by sports organisations, Football Cards and Club Cards.
Regarding matches organized by MLSZ, MLSZ is the controller of personal data on shown on personal tickets and of Football Card data.
In the case of Club card and matches organized by club teams, clubs are the controller. However, in these cases MLSZ also functions as controller but only to the extent that the IT systems required for ticket sales were produced at the request of MLSZ, and the operation is also provided by a processor chosen by MLSZ; furthermore, MLSZ determines the software to be used and their configurations. However, MLSZ does not have access to the personal data and Club card data stored in relation to the events of club teams. In respect of these data, the club team is the controller in accordance with their own data policy regulations. Therefore, the information below applies to ticket sales, marketing activities and the issuance of Football cards concerning matches organized by MLSZ in Hungary.
Information on ticket purchases for Hungarian national team matches outside Hungary and the related privacy policy is available at https://adatvedelem.mlsz.hu/dokumentumtar/adatkezelesi-tajekoztatok/szurkolokra-vonatkozo-adatkezelesek/jegyvasarlasarlas-kulfoldi-merkozesre.
2.1. Purchasing tickets
Customers can buy tickets for the matches organised by MLSZ at the cashier or online.
2.1.1. Purchasing tickets at cashiers
If customers would like to buy tickets at the cashier and if personal tickets are sold, they have to provide three different pieces of data (name, date and place of birth) on a mandatory basis which must be recorded in the ticket sales system. Optionally, the mother’s maiden name may also be recorded.
Tickets may be purchased for third persons as well. Data processing for these purchases is the same as in the case of tickets purchased for the customer’s own use.
As a general rule, ticket purchases are not subject to verification of personal identity. At the same time, with a view to security considerations, MLSZ may decide to require ticket buyers to present their Club card, Football card (hereinafter jointly referred to as club cards) or personal identity card upon ticket purchases. Club cards issued by club teams are also accepted for ticket purchases for matches organized by MLSZ.
If personal identification is required:
customers must present their club card or personal identity card for the purchase (when purchasing tickets for a third person, the customer must present the club card or personal identity card of the personal ticket holder),
when a ticket is purchased using a club card number (or barcode), the personal data required for the purchase can be loaded using the club card register, or
if the club card number is not available, the cashier shall record the data required for the ticket purchase in the system based on the presented personal identity card or club card.
However, when personal tickets are sold, it must be borne in mind that identity check is carried out upon entry into the stadium and if the customer made an error when providing the name of the ticket holder, the ticket holder will not be allowed in the stadium. If access to the event is denied, owing to the provisions of point e) in paragraph (1) of Article 71 of Act 1 of 2004 on Sport (hereinafter the Sports Act), data processing shall be subject to the rules set out at https://adatvedelem.mlsz.hu/dokumentumtar/adatkezelesi-tajekoztatok/szurkolokra-vonatkozo-adatkezelesek/beleptetes-merkozesre.
Based on the customer or ticket holder data provided, the ticket sales system examines whether the person concerned is banned, disqualified or excluded from matches (namely, the system queries the Sports Safety and Security Database - Sportrendészeti Nyilvántartás, Hungarian acronym: SRNY).
If there is a match on the basis of personal data provided in advance, the customer may provide his mother’s name even if he did not provide it first. Then the system performs an additional check.
Persons included in the SRNY database are not allowed to purchase tickets for the matches and no match tickets can be purchased for such persons.
If the system reply is affirmative (in case of banned/disqualified or excluded status) the personal data of the purchaser or the would-be ticket holder will not be stored in the ticket system, but the data of the person concerned will be available in SRNY log, as even the purchase attempt qualifies as a minor offence.
If the ticket buyer or would-be ticket holder is not found in the SRNY database, the personal data of the buyer necessary for ticket purchase (name, place and date of birth) will be stored in the central ticketing system’s database.
Personal tickets will bear the name and date of birth of the beneficiary.
If a customer buys tickets for multiple persons, he is required to sign a so-called transaction certificate showing his name, date and place of birth and signature. Based on this document, we can link the tickets purchased in a single transaction and MLSZ will keep track of who purchased tickets for whom.
2.1.2. Online ticket purchases
If the customer shops in the web shop available on meccsjegy.mlsz.hu, the use of the web shop requires registration.
Upon registration, the customer is required to provide his email address, name and a password, while business customers must also provide billing information (business name, address and optionally the tax number). This information will be processed owing to registration itself, even if no ticket is purchased in the end. However, registration on meccsjegy.mlsz.hu and the purchase of a personal ticket are two distinct data processing flows.
Upon registration, users can opt-in to receive notifications prior to the event. If the user chooses to opt in, MLSZ will process his name, email address and the time data of the purchased ticket for the purpose of notification.
Data required for purchasing tickets:
for personal tickets: name, place and date of birth and, optionally, mother’s maiden name;
for purchases linked to club cards: card number.
Online purchases are executed in a web-based system operated by Jegymester Kft. The scope of personal data processed and the ticket purchasing process are the same as with purchases at the cashier except that the customer may also provide a phone number during on-line registration to facilitate contact keeping for the resolution of potential registration or ticket purchase issues.
If non-personal tickets are sold online for a specific match, we only process those data of the customer that he provided upon registration.
In case customer data are provided using a club card, the card number must be entered into the system (along with the PIN code upon web shop purchases) and the IT system will retrieve the customer’s personal data required for ticket purchases based on the entered number.
If payment is by card, the customer will enter the data requested by the bank on their proprietary platform. In this respect, MLSZ does not have access to card data and does not carry out any data processing transactions.
2.2. Processing for marketing purposes
The customer may authorize MLSZ to process his personal data for marketing purposes.
This authorization may be provided to MLSZ upon redeeming a Football card or purchasing a ticket.
If authorization is provided when redeeming a Football card, the following cardholder data will be recorded for marketing purposes:
card number;
club membership category;
date and time when the card application was submitted;
validity period of card;
place where card will be received;
whether pre-registration took place;
photo of card owner,
PIN code (a four-digit number to enhance card security);
signature of member or his legitimate representative;
in the case of minors aged below 16, name and address of legitimate representative (typically a parent).
Email address in case of online application or contact keeping.
The photo provided to MLSZ for printing the Football card will be deleted automatically upon printing.
The card owner is required to sign a statement of receipt when receiving the football card. The statement will show the Football card owner’s name, place and date of birth, signature, card number, statement date, and, in the case of minors, the name, address and signature of his legitimate representative. If the maiden name of the card owner’s mother appears on the card, it will be shown in the receipt statement as well.
MLSZ will keep contact with the customer in order to check the technical details of how he can redeem his Football card (e.g. notification on availability for receipt, etc.). In this context, we will process the following customer data:
- name;
- Football card number;
- email address;
- phone number;
- address.
3. Duration of processing
In accordance with applicable laws, personal data shall be deleted after three working days following the match – unless a competent authority requires MLSZ to retain the data for up to an additional 30 days. The data of the transaction certificate generated upon group ticket purchases at a cashier are processed in the same manner.
Football cards will be issued for 10 years for adult card holders, and for 5 years for minors. Data processed in connection with the football card shall be deleted on the 3rd day after the expiry of the card, failing that, after the withdrawal of the consent to processing.
Statements completed by the customer upon redeeming the Football card will be processed until 3rd working day following the expiry of the Football card or the day when the consent to issue the Football card is revoked (card cancellation).
If the consent to data processing is revoked, the data on the Football card form and the card receipt confirmation form will be deleted. MLSZ processes the statement and the card together.
Data provided for marketing purposes based on consent and data entered on online platforms to enable advance notification shall be processed until the withdrawal of the consent.
4. Purpose of processing
The purpose of the sale of name-specific tickets and seasonal tickets and that of the processing of personal data concerning Football card is to carry out the ticket sales in compliance with the stadium security requirements according to Article 75/B of Sports Act. (The purpose of the football card itself is to make the purchase of the tickets easier)
Under the act referred to earlier, data can be used for criminal or infringement proceedings crimes for minor offence committed at the venue of the sporting event or while approaching or leaving the venue of the sporting event, and for exclusion from the participation in sporting events.
Under paragraphs (3) and (4) of Article 72 of the Sports Act, processing of personal data concerning ticket sales is obligatory when the entrance system is used; however, the use of a club card is only mandatory if so required by the sport organisation or MLSZ for the given match.
The purpose of the processing of personal data for processing is to deliver offers and newsletters to data subjects.
The purpose of the transaction certificate generated upon group ticket purchases at a cashier is to verify and record the customer’s personal data and to enable the investigation of potential subsequent customer complaints. For a ticket buyer may purchase a ticket for the wrong name which would prevent the personal ticket owner to buy tickets later on (a specific person can only have one ticket for a match). Therefore, it must be recorded who purchased the ticket and for whom.
The purpose of processing the data in the receipt confirmation statements completed upon redeeming a football card or club card (in case the club card is issued by TEX Hungary Kft. on behalf of the club) is to evidence the receipt of the card and the consent to data processing.
The purpose of processing contact data is to communicate with the customer regarding the issuance and management of the Football card.
5. Data recipients, categories of recipients
In the absence of the request by the authority or any report made to the police, MLSZ shall not transfer the personal data processed to anyone, only its processors shall have direct access to them.
Those participating in the activity as a processor:
Nádor Rendszerház Kft.
registered seat: 1152 Budapest, Telek utca 7-9.
company registration number: 01-09-074755
mailing address: 1152 Budapest, Telek utca 7-9.
email address: info@nador.hu
website: www.nador.hu
Nádor Rendszerház Kft. is the operator of the Stadium Security System, supports the central ticket system, it carries out the storage and maintenance of data according to the instructions from the controller.
e-Corvina Kft.
registered seat: 1134 Budapest, Róbert Károly krt. 64-66.
company registration number: 01-09-718803
email address: info@e-corvina.hu
website: www.e-corvina.hu
During the development of club card system, the e-Corvina Kft. may become aware of personal data.
TEX Hungary Kft.
registered seat: 1065 Budapest, Bajcsy-Zsilinszky út 31. 1. em. 1. company registration number: 01-09-877903
mailing address: 1065 Budapest, Bajcsy-Zsilinszky út 31. 1. em. 1.
email address: info@tex.hu
in matters relating to club card: futballkartya@tex.hu
in matters relating to ticket sales: mlsz@tex.hu
Website: www.tex.hu
The issuer of Football card is MLSZ.
TEX Hungary Kft. is the ticket seller of MLSZ, issuer of Football cards, responsible for customer service duties.
Sub-processors of TEX as well as further ticket agents of TEX Hungary Kft. and its contracted partners who hand over the issued cards to the card holders, whose current data can be accessed on www.tex.hu/mlsz and can be examined at the ticket offices of the stadiums used by MLSZ during ticket sales period.
Jegymester Kft.
registered seat: 1065 Budapest, Bajcsy-Zsilinszky út 31.
company registration number: 01-09-369537
email address: info@jegymester.hu
Jegymester Kft. is the developer of the central ticket sales system, on behalf of Nádor Rendszerház Kft, it provides the support of the system and participates in the ticket sales as subcontractor of TEX Hungary Kft. (and as its processor at the same time), and on behalf of Nádor Rendszerház Kft, it assists in the operation of the web shop available on meccsjegy.mlsz.hu.
6. Source of personal data
Data are provided by the customer (or the person purchasing the ticket on his behalf or the fan’s legitimate representative). The result of SRNY query derives from the SRNY database maintained by the police. Customers are informed on the processing of their personal data by way of written announcements placed in the box offices and, upon online purchases, via the information material published on the adatkezeles.mlsz.hu website. In instances when the customer purchases tickets for a third person, users are notified of the availability of data processing information on the tickets.
7. Legal ground of processing
The legal ground of processing is the legal obligation under point c) of paragraph (1) of Article 6 of the Regulation; since the organiser may apply a security entry and control system (hereinafter: entry system) at its discretion or if so required by the National Police Command, for the individual identification of the participants under paragraph (1) of Article 72 of Sports Act, an entrance system is applied for sporting events with particular security risk and sporting events with high security risk in respect of football.
Under paragraph (2) of the same section, if an entry system is applied, the organiser can only sell personal tickets or season tickets.
Under paragraph (4) of the same section, when selling ticket and seasonal tickets and during the entry, the organiser or the ticket sellers acting on behalf of the organiser is entitled to establish the spectator’s identity on the basis of an identity document.
Under paragraph (5) of the same section, if an entry system is applied, the organiser or the ticket sellers acting on behalf of the organiser may compare the identity of the spectator with the data of the SRNY database when selling tickets or season tickets.
If an entry system is applied, the organiser may compare the identity of the spectator with the data of the Sports Safety and Security Database during the entry—at the request of the police. Tickets or seasonal tickets cannot be sold to persons recorded in the Sports Safety and Security Database, and their entry into the venue of the sporting event specified in the banning, disqualification or exclusion order, the sport facilities and this venue has to be refused.
Under Article 72/A of Sports Act, if an entry system is used, the organiser may require the purchase of a card suitable for identification, bearing a photograph, providing discounts (hereinafter: club card).
Currently, the purchase of the football card for matches organised by MLSZ is not obligatory; we will process the data of the football cards as well as the data relating to marketing activity with the consent of the data subjects, pursuant to point a) in paragraph (1) of Article 6 of the Directive. Based on authorization provided by applicable laws, MLSZ may change its decision on making Football cards mandatory in respect of specific matches organised by MLSZ.
The processing of data provided on the Football card receipt confirmation form is also based on customer consent.
8. Rights of the data subject
Under the Regulation, the data subjects shall have several rights (e.g.: right to request information, right to access to the personal data, right to erasure and right to be forgotten, right to restriction, right to withdraw consent, right to go to supervisory authority and court), however, the information on how and under what legal ground a specific right can be exercised is included in the document General information on data processing.
On behalf of underage data subjects under the age of 16, their rights can be exercised by their legal representative; on behalf of underage data subjects over the age of 16, their rights can be exercised by their legal representative.
Forms required for the exercise of your rights are available here.
This Policy shall enter into force on 28 July 2021, its archived version can be found under the policy, among downloadable documents.
