We value your privacy and are committed to safeguarding your personal information (meaning any information about you from which you can be identified). This Privacy Policy explains what personal data we collect when you: access the FanaFootball game (regardless of where you visit it from), use the official FanaFootball app, or play the Fantasy game through FanaFootball site. It also describes how we may use this information and what rights you have in relation to it.

We review our privacy practices on a regular basis and may change this Privacy Policy at any time by posting changes on the Services or otherwise notifying you. The Policy is current as of July 1, 2023.

1. Background

We are responsible for deciding how we will use the personal data that we collect about you, and in accordance with the Data Protection Law, we will always ensure that the personal data we hold about you is:
1. used fairly, legally, and transparently;
2. collected for limited, specific purposes only;
3. adequate, relevant to, and limited to what is necessary for those purposes;
4. kept accurate and up to date;
5. not kept for longer than necessary; and
6. held securely.

We must be accountable for and demonstrate compliance with our obligations under the Data Protection Law, and this Privacy Policy is one way we will do so.

2. Personal Data We Collect About You

Personal data means any information about an individual from which that person can be identified. We may collect, store, transfer and use various types of your personal data:

1. Registration Data To access and use certain elements of the Services, you must first create a FanaFootball account by providing us with the information requested on the relevant registration page, which includes your name, email address, gender, date of birth, and location (country/region of residence). In addition, we will request a username and password. Please keep in mind that if you do not provide the required information, some aspects of the Services will be unavailable. We may also request or allow you to provide additional information, such as your mobile phone number.

2. Identity Data When we provide other elements of the Services, we also require you to provide identification information such as your name, age, gender, and social media handles/usernames.

3. Contact Data We use your email address, phone numbers, social media handles/ usernames, and location (country/place of residence) to communicate with you or with you to communicate with us.

4. Media Data We use crowd and fan images from photographs and video footage, as well as other media content created by us (or on our behalf) at matches and events or provided by you for our use. As further described below, we may also use some of your user-generated content in social media.

5. User Data Language, game-play statistics, scores, rankings, time spent playing game profile, preferences (including favorite Clubs), survey responses, feedback, and other data that you provide to us as part of your account are all collected by us.

6. Technical Data When you use the Services, we automatically generate and collect certain data, such as your IP address, MAC address, and other device identifiers; your clickstream to, though, and from the Services (including date and time); pages you viewed or searched for; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); and methods used to navigate away from the page.

Not all of the items on the list above will necessarily apply to you; it all depends on how you use the Services and how you interact and communicate with us.

3. How We Collect Your Personal Data

You give us your personal information when you:
(1) access, use, or play the Services;
(2) create a fanfootball account for the Services;
(3) request information, marketing, and other communications be sent to you;
(4) enter a competition, promotion, or survey;
(5) complete surveys or provide feedback to us;
(6) and otherwise interact or correspond with us (including via email, social media or telephone).

By using cookies and other similar web technologies, we automatically collect Technical Data as you interact with our Services.

We use Google Analytics, a third-party service, to collect standard internet log information as well as visitor behavior patterns. We do this to learn things like the number of visitors to specific parts of the Services. We only use this information in ways that do not allow us to identify you. We make no attempt, and do not permit Google to make any attempt, to learn the identities of those who visit our website.

4. How and Why We Use Your Personal Data.

We will only use your personal information where permitted by Data Protection Law. According to Data Protection Law, we can collect and use personal data on the following grounds:
(a) It is required for us to be able to carry out an agreement with you.
(b) It is required for our legitimate interests (which do not outweigh your interests or fundamental rights);
(c) if we have your permission (which you can revoke at any time); or
(d) to follow a legal obligation, such as rules established by courts, statutes, or regulations

According to Data Protection Law, we can only collect and use your Sensitive Personal Data for the following reasons: for reasons of substantial public interest, such as preventing or detecting illegal acts or in connection with our regulatory and oversight functions in sport; in connection with legal claims; cases where you have made the data public yourself; or where you have given explicit consent.

Accordingly, we lawfully use your personal data in the following ways:
Delivering the Services : We use the Registration Data, User Data, and Contact Data to provide you with the Services in an effective, efficient, and accurate manner. We would be unable to provide you with a tailored service, respond to issues with these Services identified by us or you, or ensure you get the most out of your experience if we did not have it. As a result, we use this data because it is required for us to perform our agreement with you (i.e. the terms and conditions of the relevant Services) and for our legitimate interests in providing the Services in this manner.
Operating the Services : We use Technical Data to operate and administer the Services, including testing, analysis, maintenance, support, reporting, and data hosting. As a result, we use this data on the grounds that it is required for our legitimate interests in operating the Services in this manner. We also use Technical Data in conjunction with certain Identity Data and Contact Data to help with security and fraud prevention, system integrity, and/or to respond to a legal process. As a result, we use this data on the grounds that it is required both for our legitimate interests in protecting the Services in this manner and to comply with a legal obligation.
Competitions and promotions : We use Identity Data and Contact Data, as well as any other personal data related to the entry (for example, a photograph), to administer and operate contests, prize draws, competitions, or other promotions, such as selecting winners, delivering prizes, and publishing the results. As a result, we use this data because it is required for us to perform our agreement with you (i.e. the terms and conditions of the relevant promotion) and to comply with a legal obligation. If we intend to use your personal information for any other purpose, we will notify you and, if necessary, obtain your consent at that time.
Marketing communications : We use the Identity Data and Contact Data to notify you of news, offers, events, competitions, and promotions that may be of interest to you via specified media (including, if requested, calendar notifications) and/or we provide such data to our Clubs and/or official commercial partners so that they can do so. We give you the option of providing opt-in consent to receive various types of direct marketing communications from us or these third parties, or not.
Media coverage : For the Primus National League-related publishing and media coverage, we combine Media Data with Identity and Contact Data. Except in cases where you are not the subject of the Media Data, such as general crowd shots, we will seek your consent and inform you of our intended use of such information.
Other puporses : We may need to use your personal information to protect your or someone else's vital interests, such as making contact in rare emergency situations. We may also be required to use your personal data in connection with legal and regulatory matters such as the maintenance of business records, compliance with external reporting requirements and internal policies and procedures, and responses to requests from government, law enforcement, regulators, courts, rights holders, or other third parties, including in relation to the use or misuse of intellectual property, such as our brand or media rights or those of our licensees/commercial partners. As a result, we use this data because it is necessary for both our legitimate interests in protecting, defending, and enforcing rights and interests in this manner, as well as to comply with legal obligations. We may also use your personal information when processing Media Data as part of our dedicated reporting and take-down program, which aids in the fight against serious abuse directed at players, coaching staff, and their families on social media. We use this data to fight abuse and, where Sensitive Personal Data is involved, to prevent or detect illegal acts, in connection with legal claims, and where you have made the data public yourself.

Before we use your personal data for our legitimate interests, we ensure that we consider any potential impact on you to ensure that your interests and fundamental rights and freedoms do not outweigh those interests. In other words, we've determined that we have a legitimate need to process your personal data, and we're not aware of any reasons why we shouldn't. If you have any questions or concerns about our processing, please contact us using the information provided in this privacy and policy.

We will only use your personal data for the purposes described above, unless we reasonably believe that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for a non-related purpose, we will notify you and explain the legal basis for doing so.

What if you do not want to share your personal data?

Unless otherwise specified above, generally we collect your personal data on a voluntary basis. However, please note that if you decline to provide certain mandatory personal data, you may not be able to access certain Services and we may be unable to fully respond to any inquiries you make.

5. Disclosure of Your Personal Data.

We may disclose or share your personal information in the following situations:

Third Party Service Providers We hire third-party companies to perform services for us or on our behalf, such as support for the internal operations of our Services (and related services), communications, data storage, and communication delivery. On our behalf, our service providers may access, receive, store, or otherwise use personal data. Our service providers only use your personal data to provide the relevant services in accordance with our strict instructions and are not permitted to use your personal data for their own purposes unless authorized by us to do so. In this case, we will notify you and provide you with their privacy policies so that you can understand how they will treat data.
Commercial Partners We may also disclose your personal information to our commercial partners if you have given us your permission or requested that we do so. For example, when you enter a joint promotion's competition or sweepstakes, or when you request to receive certain marketing communications. Before we disclose or share your personal data, we will provide you with specific information in each case.
Publicity and media we may make public your personal information through the media, social media, or the Services. For example, if you contact the Fanclub and share a comment or opinion, or if you win a competition or promotion, we may publish your name online. In such cases, we will clearly notify you of the sharing, and you will have the option not to participate or to object to such sharing in any other way, subject to our other legal obligations.
Favorite Clubs; We will share your personal data with your favorite Clubs where you have given us permission to do so in order to help our Clubs interact with their fans or where it is required for the completion of a competition (e.g. you have won tickets to a Club match). This Privacy Policy only applies to our use of your personal data; you should consult the relevant privacy policies of each Club to understand how they use your personal data.
Legally Required We may also disclose your personal data if we believe we are required to do so by law, or if doing so is reasonably necessary to comply with legal processes or the enforcement of our rights, or if we receive evidence sufficient to justify such disclosure.

6. Security of Your Personal Data.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized manner, altered, or disclosed (a Data Security Breach). Furthermore, we restrict access to your personal data to employees, contractors, and other third parties who have a business need to know. They will only use your personal data in accordance with our instructions, and they are bound by a duty of confidentiality. We take steps to ensure that third-party service providers we appoint to process your personal data on our behalf are contractually bound to protect your personal data. The Services may contain links to websites, applications, and environments that we do not own or control (the Other Sites). The owners and operators of those Other Sites are responsible for the collection and/or use of your personal data, and you should review their privacy policies. Unless otherwise specified, this Privacy Policy only applies to the Services and not the Other Sites.

We have procedures in place to deal with any suspected Data Security Breach and will notify you and any applicable regulator where required by law.

If we have given you or you have chosen a password that allows you to access certain Services, you are responsible for keeping this password confidential with reasonable care.

7. Links to Other Sites

The Services may contain links to websites, applications, and environments that we do not own or control (the Other Sites). The owners and operators of those Other Sites are responsible for the collection and/or use of your personal data, and you should review their privacy policies. Unless otherwise specified, this Privacy Policy only applies to the Services and not the Other Sites.

8. Data Retention

In general, we will only keep your personal data for as long as is necessary to fulfill the purposes for which it was collected, in accordance with our internal Data Retention Policy. However, in some cases, we may be required to retain personal data for longer periods of time, such as when required by legal, tax, or accounting requirements, or when required by a legal process, legal authority, or other governmental entity with the authority to make the request.

To determine the appropriate retention period, we consider other relevant factors such as the nature and scope of the personal data, the potential risks to data subjects from a Data Security Breach, and the applicable legal requirements, such as the limitation period for which legal claims can be made in court. For example, all non-activated FanaFootball accounts are deleted after 21 days, and all non-authorized accounts for users aged 12 and under are deleted immediately if a parent refuses consent and after 21 days if an account relating to a user aged 12 and under is not verified.

After the applicable retention period has ended, your personal data will be securely deleted, destroyed, or anonymized (for example, where the data will be used in aggregated/generic form for statistical purposes) in accordance with our internal Data Retention Policy and the Data Protection Law.

Specific retention periods for various aspects of your personal data are available upon request using the contact information provided below.

9. Your rights

Under Data Protection Law, you have certain rights (depending on the circumstances) in connection with your personal data, which include:

(1) Access your personal data (also known as a "data subject access request"). Access your personal data (also known as a "data subject access request"). This allows you to obtain a copy of the personal information we have on file for you and to ensure that we are using it lawfully, provided that it does not infringe on the rights and freedoms of others.

(2) Request that we correct the personal information we have on file for you. If any of the information we have on file for you is incorrect or incomplete, we will act quickly to correct it, even if you have requested that we do so.

(3) Request that your personal data be erased. This allows you to request that we delete or remove personal data from our systems if there is no compelling reason for us to keep it. You may also request that we delete or remove your personal data if you have exercised your right to object to our use (see below);

(4) Object to our use of your personal data where we are relying on our legitimate interests (see above) and something about your specific situation makes you want to object to our use on this basis;

(5) Withdraw your consent to our use of your personal data where we are relying on it. We will no longer use your personal data for the purpose or purposes you originally agreed to once we have received notification that you have withdrawn your consent, unless we have another legal basis for doing so.

(6) Request that your personal data be restricted from being used. This allows you to request that we suspend the use of personal data about you, for example, if you want us to investigate its accuracy or the reason for its use; and

(7) Request that the personal data you have provided be transferred to you or a third party, where technically feasible, on the basis of consent or a contract with us.

We are dedicated to upholding your rights. You may exercise your rights (as applicable) by contacting us using the information provided. We will make every reasonable effort to respond to your requests within a reasonable timeframe and, in any case, within the timeframes specified by the Data Protection Law, unless we have a legal reason not to. To ensure that personal data is handled carefully and confidentially, we will require the requestor to provide verification of their identity, and all applications must be accompanied by copies of at least two official documents that show your name, date of birth, and current address.

10. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the following contact details: