Privacy policy
Version 2026-11-05 · Last updated: 5 November 2026
This is a translation for your convenience. The data controller is based in Spain and Spanish law applies: if there is any discrepancy, the Spanish version prevails.
This policy explains how we process your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD). The service is aimed at users across Europe; the GDPR applies to all of them equally.
1. Data controller
- Controller: Rubén Cantero
- Tax ID (NIF): available on request at [email protected] (to authorities or with a justified request)
- Address: available on request at [email protected] (to authorities or with a justified request)
- Privacy contact: [email protected] or the contact form (option “Privacy rights”).
The service is currently free of charge. If the controller introduces paid features, subscriptions or donations, it will give at least 30 days' notice in the terms of use and by email, without affecting data already processed, and will update this policy. No data protection officer has been appointed because none of the mandatory cases in article 37 GDPR and article 34 LOPDGDD applies.
2. What data we process, why and for how long
The table below summarises each processing activity. The periods are maximums: if you stop being a user or exercise your rights, data is deleted sooner where the law allows.
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| User account | Email, display name, password (hashed with Argon2id), role, account status and the date you turn 18 (not your date of birth) | Performance of a contract (art. 6.1.b GDPR) | While the account exists. Accounts inactive for 2 years: prior notice and deletion |
| Age check at sign-up | Date of birth: requested once to check that you are at least 14 and to work out the date you turn 18 | Legal obligation (6.1.c; art. 7 LOPDGDD) | Not retained: discarded when sign-up is completed. We only keep the date you turn 18 |
| Player or club profile | Positions, platforms, region, country, languages, description, availability, vacancies, club members | Performance of a contract (6.1.b) | While the account exists. When you delete your account the profile is deleted immediately |
| Country and languages | Country (optional) and the languages you speak (up to five), so that clubs and players can find and understand each other | Performance of a contract (6.1.b) | While the account exists. Deleted immediately when you delete your account |
| Interface language | Chosen language (Spanish or English), stored in your account and in the technical cookie mcp_lang | Performance of a contract (6.1.b); the cookie is strictly necessary | Account: while it exists. Cookie: 1 year |
| Profile visible on the internet (signed out) and social network links | The profile details you mark as public and your social network handles | Consent (6.1.a), optional and revocable at any time | Until you change the visibility or remove the links |
| Internal chat | Messages, threads, participants, date and time | Performance of a contract (6.1.b) | Until either side closes the conversation or 30 days pass without activity: in both cases the messages are deleted for both sides. After account deletion, messages are anonymised and their content is deleted after 30 days |
| Moderation, reports and chat safety | Messages flagged by automated filters, reports (with a copy of the reported message), decisions and their reasons, log of team access | Legitimate interest (6.1.f) and legal obligation (6.1.c; arts. 16 to 18 DSA) | Resolved or dismissed reports: 12 months. Moderation decisions: while the account exists and up to 3 years to defend against claims |
| Statistics imported from leagues (VPG, VPN) and EA SPORTS FC | Your player ID in the league, your EA name and the EA clubs linked to your profile (up to three: those you add or your current club on the site); matches, goals, assists and ratings published by the competition itself or by EA about you. We never import a club's squad or data about other people | Legitimate interest (6.1.f); source shown on each profile and right to object | Until you object or remove the statistics from your profile |
| Technical logs and audit | Truncated IP address (stored without its last part, so it does not identify your specific connection), browser, sensitive actions (sign-in, security changes) | Legitimate interest in security (6.1.f) | IP and browser of sessions: 30 days. IP in the audit log: 90 days. The rest of the audit log (action, date and account): 12 months |
| Consent record | Version of the texts accepted, date, type of consent; the truncated IP and browser used when you accepted are deleted after 30 days | Legal obligation and defence of claims (6.1.c and 6.1.f) | While the account exists and up to 3 years afterwards |
| Contact form and notices without an account | Name (optional), email, message, reported URL, truncated IP address (deleted when the request is handled or, at most, after 30 days) | Legitimate interest and legal obligation (arts. 11, 12 and 16 DSA) | As long as needed to handle the request and up to 3 years for possible claims |
| Payments or donations (only if activated; the payment provider will be named at that time) | Amount, date, description and transaction ID. Card or payment details are processed directly by the payment provider | Performance of a contract (6.1.b) and tax and accounting legal obligation (6.1.c) | The period required by tax and commercial law |
Account, profile and chat data are necessary to provide the service; without them we cannot register you. What you publish in your profile is voluntary, but a profile without useful information does not serve its purpose.
3. Chat: how it works and what is reviewed
The internal chat is not end-to-end encrypted. Messages are stored on our servers and club managers (owner, manager and captains) can read the conversations held on behalf of the club. Participants in a conversation always know who can read it.
To protect users we apply targeted automated filters: they detect payment details, suspicious links, scam patterns, insults and risk signals for minors. These filters flag messages for review and only automatically block IBAN and card numbers. The filters do not suspend accounts: any decision about an account is always taken by a person, with written reasons.
The moderation team only reads the content of a conversation after a report or an alert, limited to the thread concerned, and every access is recorded in the audit log. We do not carry out general reading or user profiling.
The chat is ephemeral. Either side (the player or the club) can close a conversation at any time: doing so deletes all its messages for both sides and the other side receives a notice. Conversations with no activity for 30 days are deleted automatically. If a closed conversation is used again, it starts empty. Reports keep a copy of the reported message while they are being handled, so the author cannot delete the evidence.
4. Statistics imported from leagues and EA
If you provide your ID in a supported league (VPG or VPN), or your EA SPORTS FC name and the EA clubs linked to your profile (up to three: those you add or your current club on the site), we import the statistics that the competition or EA publishes about you and show them on your profile with the source indicated. The basis is our legitimate interest in giving clubs useful information to assess signings, after weighing it against your rights. You have the right to object: from your player profile you can remove your imported statistics and external identities with one click (including the EA clubs linked to your profile), and we delete them from our systems.
We only import your own statistics, and only from the details you provide. We never store your club's squad, nor data from EA, leagues or any other source about people who do not have an account on the site. This way we avoid processing data of people who have not consented and reduce what could be exposed in the event of an incident.
5. Minors
The minimum age to use the site is 14 (art. 7 LOPDGDD, which applies to the controller as it is established in Spain). If the age to consent to data processing for online services in your country of residence is higher (up to 16, depending on the Member State), you need the authorisation of your parent or legal guardian to use the site. To check your age we ask for your date of birth at sign-up, but we do not store it: we only keep the date you turn 18, which we use to apply protections for minors until then. If you are under 18, your profile is created with visibility limited to registered users by default and your social networks are not shown unless you expressly enable them. Data you provided as a minor is deleted immediately if you ask (art. 94.3 LOPDGDD). If we detect that an account belongs to someone under 14, we close it and delete its data.
6. Recipients, processors and transfers
- netcup GmbH (Karlsruhe, Germany): hosting of the server and the database, in European Union data centres (Germany/Austria), as processor under a contract pursuant to art. 28 GDPR. This involves no international transfers.
- Cloudflare, Inc. (USA): access tunnel, delivery network and anti-bot verification (Turnstile). International transfer covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Transactional email provider: sending of verification emails, password recovery and service notices.
- Payment provider (only if payments or donations are activated): it will be named in this policy before activation.
- Authorities: when required by law or to report serious crimes under article 18 DSA.
We do not sell data or pass it to third parties for advertising. Club managers and other users only see what you decide to publish on your profile.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability. You can export your data in JSON format at /cuenta/datos and delete your account from your account page. For anything else, use the contact form or write to [email protected]. We will reply within one month at most. You can withdraw any consent you have given at any time, without affecting processing carried out before.
If you think we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, the controller's competent authority; www.aepd.es) or with the data protection authority of your country of residence.
8. Security
We apply proportionate technical and organisational measures: passwords hashed with Argon2id, opaque sessions, encryption in transit, attempt limiting, logging of staff access and least privilege in the back office. We also minimise what we store: truncated IP addresses deleted after 30 days (90 in the audit log), an ephemeral chat deleted when closed or after 30 days of inactivity, no date of birth and no data of people without an account, so that in the event of an incident there is as little as possible to expose. If a security breach occurred that poses a risk to you, we will tell you and notify the AEPD within the legal deadlines.
9. Changes to this policy
If we change this policy significantly, we will update the version and date shown above and tell you before the changes apply when they affect your rights.