Privacy Policy

MLSZ Pilot Programme - Hungary

Last updated: March 10, 2026

Privacy Summary

Controller: Asociación Futbolea Innovation (CIF G-26595975), C/ Manuel Marañón 15, 4ª, 28043 Madrid, Spain.
Adult data: name, email, phone, role, club, team category, survey responses and basic technical data.
Under 16 data: nickname (no surname), guardian email and survey responses, with enhanced minimization.
Purposes: account management, aggregated scores, operational communications and, only with consent, commercial communications.
Legal bases: contract performance, legitimate interest, consent and legal obligation.
Rights: access, rectification, erasure, restriction, portability, objection and related safeguards.

1. Identity of the Data Controller

Controller: Asociación Futbolea Innovation (CIF: G-26595975), C/ Manuel Marañón 15, 4ª, 28043 Madrid, Spain.

Pilot context: collaboration with Magyar Labdarúgó Szövetség (MLSZ) and Nagykáta SE.

Futbolea is the sole controller. MLSZ and Nagykáta SE do not process personal data collected through the Platform.

2. What Data We Collect

2.1 Adults (16+)

Identity and contact: full name, email, phone.
Community context: role, club, team and team category.
Service usage: survey responses (1-5 scale indicators).
Technical data: IP, device type, operating system, language and timezone.

2.2 Minors under 16

Futbolea applies strict minimization for minors. We collect less data than for adults.

Nickname (no surname).
Guardian email (for consent verification and activation).
Password (encrypted), role, club/team and team category.
Survey responses and technical data (IP, device, language).
System technical alias for internal uniqueness only (not user-visible).

We do not collect surname, personal email or phone number from minors. We do not collect GPS location from any user.

3. Purposes, Legal Bases and Retention

Account management and service delivery: Art. 6(1)(b) GDPR.
Survey processing: Art. 6(1)(b) GDPR.
Aggregated score generation/publication: Art. 6(1)(f) GDPR (legitimate interest).
Commercial communications: Art. 6(1)(a) GDPR (consent).
Minor registration: Art. 8 GDPR (verified guardian consent).
Pre-activation temporary retention: Art. 6(1)(f) GDPR (max 48h).
Security and fraud prevention: Art. 6(1)(f) GDPR.
Legal/fiscal obligations: Art. 6(1)(c) GDPR.

4. Processing Data of Minors under 16

Futbolea uses a uniform 16-year threshold for autonomous consent, aligned with Hungarian law and a conservative cross-jurisdiction standard.

4.1 How minors are identified

Futbolea does not request date of birth. Minor flow is triggered by selected youth team categories (for example U10, U12, U14, U16 or equivalent).

4.2 Minor registration flow

Minor submits nickname, guardian email and password.
System stores provisional data in pre-activation state (maximum 48h).
Guardian receives verification email and confirms via link.
Upon verification, account is activated and a technical alias is created.
Minor logs in via dedicated minor access using nickname + guardian email.

If verification is not completed within 48 hours, provisional data is automatically and permanently deleted.

4.3 Guardian rights

Guardians may access, rectify, erase, or revoke consent at any time. Revocation implies immediate deactivation and deletion of the minor account.

4.4 Rights at age 16

Once the user turns 16, they may directly exercise rights and request migration to a full adult account.

4.5 Minors and commercial communications

No commercial communications are sent to users under 16 under any circumstances.

5. Futbolea Score (Aggregated Scoring)

5.1 How it works

Individual survey responses are aggregated into 1-5 star scores by match, team, club and venue, across three dimensions. Individual responses are never published or attributable.

5.2 Legal basis: legitimate interest

Publication of aggregated scores is based on legitimate interest with balancing safeguards: anonymous aggregation, no individual metrics, right of reply and dispute mechanism.

5.3 Right to object

Users may object to future processing for score generation. Previously aggregated data cannot be technically dissociated.

6. WhatsApp Channel

Futbolea uses one-way WhatsApp Communities communication, segmented by country and role, for service-related updates.

Joining requires explicit consent and users may leave at any time. Under-16 users cannot join without verified guardian consent.

7. Commercial Communications

Commercial communication consent is separate from core service consent and can be revoked at any time from settings or unsubscribe links.

No commercial communications are sent to users under 16.

8. Recipients and International Transfers

Data may be processed by service providers (hosting, email delivery, analytics) under contractual safeguards.

Transfers outside the EEA occur only under adequacy decisions or Standard Contractual Clauses (SCCs). MLSZ and Nagykáta SE do not receive personal platform data.

9. Security Measures

Encryption in transit and at rest.
Role-based access controls and secure internal authentication.
Encrypted backups and access monitoring.
Incident response aligned with GDPR Art. 33 (72-hour notice).
Irreversible anonymization of aggregated survey responses.
Automatic deletion of pre-activation minor data after 48 hours.

10. Retention Periods

Account data: active account plus 30 days after cancellation.
Minor account data: active period or guardian revocation plus 30 days.
Pre-activation data: maximum 48 hours.
Identifiable survey responses: while account is active.
Aggregated anonymous score data: indefinitely.
Technical logs: up to 12 months.
Commercial consent records: 3 years after revocation.

11. Data Subject Rights

Access, rectification, erasure, restriction and portability.
Objection to processing based on legitimate interest.
Protection against solely automated decisions producing legal or similarly significant effects (not used by Futbolea).

Rights may be exercised through futbolea.com contact channels. Futbolea responds within one month (extendable by two months for complex requests).

Complaints can be filed with NAIH (Hungary) or AEPD (Spain), and judicial remedies may be pursued under applicable law.

Under Hungarian law, a designated person may exercise post-mortem rights for up to 5 years after the data subject's death.

12. Policy Modifications

Futbolea may update this Policy. Substantial changes are communicated with at least 15 calendar days' notice via email or in-app notification.

13. Coherence Clause

In case of discrepancy between Hungarian and English versions of this Policy, the version that is more protective of the data subject prevails.

Keep playing.