Privacy Notice

Controller and scope

The sole proprietor identified on the Business Information page is the data controller for FootForAll. This Notice covers the website, installed PWA, accounts, match features, support and moderation. Use the published support and privacy email for data-protection requests.

Adults only

The service is intended only for people aged 18 or over. We collect birth date to apply that rule and for match eligibility. If we learn that a minor created an account, we may restrict it and erase or retain limited records as legally required.

Data we process

• Identity and account data: name, email, hashed password, birth date, gender, language, account status and verification records.
• Profile and role data: city, optional contact or football details, media, player, referee and venue information.
• Match data: interests, invitations, registrations, attendance, teams, events, protocols, statistics, ratings, reviews and safety acknowledgements.
• Venue and location data: submitted addresses, coordinates, availability, photos and role-related documents.
• Technical and security data: IP address, session and device information, timestamps, audit logs, identifiers and diagnostic records.
• Communications and governance data: support tickets, complaints, moderation evidence, privacy choices, legal-document versions and deletion requests.

Purposes and legal bases

We process data to create and secure accounts, provide requested match and role features, communicate service information, prevent abuse, maintain reliable records, respond to users, establish or defend legal claims and comply with law. The legal basis, depending on the operation, is performance of the service agreement or pre-contract steps, legitimate interests in a secure and trustworthy platform, a legal obligation, protection of vital interests in a genuine emergency, or consent for an optional purpose. Consent can be withdrawn without affecting earlier lawful processing.

Visibility and recipients

Information is shared with other users only as required by the selected feature, role and privacy setting—for example, a participant list, referee profile or venue page. Organisers, referees and venue managers receive only the information needed for their independent roles. Service providers for hosting, database, file storage, email, maps/address tools and security process data under appropriate terms. We may disclose information to advisers, authorities or emergency responders where lawful and necessary. We do not sell personal data.

International transfers

Some providers may process data outside Greece or the European Economic Area. Where required, we rely on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism, and assess supplementary safeguards as appropriate. Contact us for information about the mechanism relevant to a provider.

Retention

We keep account and operational data while needed to provide the service. Retention then depends on the type of record, match integrity, security, dispute limitation periods, legal obligations and the ability to anonymise it. Active authentication records expire or are revoked under their security lifecycle. Support, audit, policy-acceptance and complaint records may be retained for a limited period after account closure to demonstrate compliance or address claims. Backups expire through their normal protected rotation.

Your rights

Subject to the GDPR and applicable exceptions, you may request access, correction, erasure, restriction, portability or objection; withdraw consent; and ask for information about safeguards. You can export data or request deletion from the account page, or contact us. We may verify identity and normally respond within one month. You may complain to the Hellenic Data Protection Authority at dpa.gr or to the competent authority where you live or work.

Algorithms and decisions

The service may calculate teams, ratings, reputation, eligibility indicators and recommendations from match records and configured rules. These support the service but are not intended to produce legal or similarly significant effects through a solely automated decision. Contact support if a result appears incorrect or materially affects access.

Security, cookies and changes

We use access controls, encrypted transport, password hashing, restricted production credentials, logging and other proportionate safeguards. No online system is completely secure; report suspected compromise promptly. The Cookie and Local Storage Policy lists information stored on a device. Material changes to this Notice will carry a new date and, where required, a new acknowledgement or notice.