Privacy Policy

1. Introduction

DataSports ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://datasports.co (the "Site").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

This policy is designed to comply with the General Data Protection Regulation (GDPR), the ePrivacy Directive, and other applicable data protection laws. The data controller responsible for your personal data is DataSports, reachable at privacy@datasports.co.

2. Information We Collect

2.1 Account Information

When you create an account on our Site, we collect information that you voluntarily provide, including:

• Name and email address
• Authentication credentials (password or OAuth tokens via Google)
• League and team preferences you select during onboarding
• Subscription and billing details (processed by Stripe; we store only a reference identifier, never full payment card numbers)

2.2 Usage Data

When you visit our Site, we automatically collect certain technical and behavioural information, including:

• IP address and approximate geolocation
• Browser type, version, and language
• Operating system and device type
• Pages visited, time spent on each page, and navigation paths
• Referring and exit URLs
• Timestamps and frequency of visits

2.3 Cookies

We use cookies and similar technologies (pixels, local storage) to collect and store information when you interact with our Site. For full details on the categories of cookies we use and how to manage your preferences, see Section 5 below.

3. Why We Collect Data

We process your personal data for the following purposes:

3.1 Service Delivery

• Providing, operating, and maintaining the Site and your account
• Authenticating your identity and managing sessions
• Processing subscription payments and managing billing
• Delivering personalised content based on your league and team preferences
• Responding to your enquiries and providing customer support

3.2 Analytics

• Understanding how visitors use our Site so we can improve the user experience
• Monitoring aggregate traffic patterns, page popularity, and feature adoption
• Diagnosing technical issues and improving Site performance

3.3 Advertising

• Displaying relevant advertisements through Google AdSense
• Measuring advertising performance and attribution
• Limiting the number of times you see a particular ad

4. Legal Basis for Processing

Under the GDPR, we rely on the following legal bases when processing your personal data:

4.1 Consent (Article 6(1)(a) GDPR)

We rely on your freely given, specific, informed, and unambiguous consent for:

• Analytics cookies: Placing and reading non-essential analytics cookies (e.g., Google Analytics) to understand Site usage
• Advertising cookies: Placing and reading advertising cookies (e.g., Google AdSense) to deliver personalised advertisements

You may withdraw your consent at any time via the Cookie Settings panel accessible from the cookie consent banner or from the footer of our Site. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.2 Legitimate Interest (Article 6(1)(f) GDPR)

We rely on our legitimate interests for:

• Service delivery: Ensuring the Site functions correctly, loading content efficiently, and maintaining uptime
• Security: Detecting and preventing fraud, abuse, and unauthorised access to our systems
• Internal analytics: Aggregated, non-identifying analysis of usage patterns to improve the Site

We have conducted balancing tests to ensure that our legitimate interests do not override your fundamental rights and freedoms.

4.3 Performance of a Contract (Article 6(1)(b) GDPR)

We process data as necessary to perform our contract with you for:

• Subscription billing: Processing payments, issuing invoices, and managing your subscription status
• Account management: Creating, maintaining, and deleting your account at your request

5. Cookies and Tracking Technologies

Cookies are small text files placed on your device by our Site. We categorise the cookies we use as follows:

5.1 Essential Cookies

These cookies are strictly necessary for the Site to function and cannot be switched off. They include session identifiers, authentication tokens, cookie consent preferences, and CSRF protection tokens. Because they are essential, no consent is required under the ePrivacy Directive.

5.2 Analytics Cookies (Google Analytics 4)

We use Google Analytics 4 (GA4) to collect anonymised usage statistics. GA4 cookies (e.g., _ga, _ga_*) measure page views, session duration, bounce rates, and user journeys. IP anonymisation is enabled by default in GA4. These cookies are only set after you provide consent via our cookie consent banner.

5.3 Advertising Cookies (Google AdSense)

Google AdSense places cookies to serve advertisements relevant to your interests and to limit the number of times you see an ad. These cookies may track your browsing activity across other websites that also use Google's advertising network. Advertising cookies are only set after you provide consent via our cookie consent banner.

You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in our cookie consent banner or in the Site footer. You can also configure your browser to block or delete cookies, although this may affect Site functionality.

6. Third-Party Data Processors

We share personal data with the following third-party processors, each of whom processes data on our behalf under a Data Processing Agreement (DPA):

7. International Data Transfers

Some of our third-party processors are based in the United States, including Neon (database hosting) and Vercel (website hosting). When personal data is transferred from the European Economic Area (EEA) or the United Kingdom to the United States, we ensure appropriate safeguards are in place.

These transfers are protected by EU Standard Contractual Clauses (SCCs) as approved by the European Commission, or by the EU-U.S. Data Privacy Framework where the recipient is certified. We review these safeguards regularly to ensure continued compliance.

8. Data Retention Periods

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy. Specific retention periods are as follows:

After the applicable retention period expires, data is securely deleted or anonymised so that it can no longer be associated with you.

9. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure: You have the right to request that we delete your personal data, subject to certain legal exceptions.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis.

To exercise any of these rights, please email us at privacy@datasports.co. We will respond to your request within 30 days.

You also have the right to withdraw consent at any time for any processing based on consent (such as analytics and advertising cookies). You can withdraw cookie consent by clicking "Cookie Settings" in the cookie consent banner or in the Site footer. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

10. Data Security

We use administrative, technical, and physical security measures to protect your personal information. These include encryption of data in transit (TLS/SSL), encryption of data at rest, access controls, and regular security reviews. While we have taken reasonable steps to secure the information you provide, please be aware that no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against interception or misuse.

11. Children's Privacy

Our Site is not intended for children under 16 years of age, in accordance with the GDPR's requirements for children's consent. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information as promptly as possible. If you believe a child under 16 has provided us with personal data, please contact us at privacy@datasports.co.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top. For significant changes, we may also notify you by email or through a prominent notice on the Site. We encourage you to review this page periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Email: privacy@datasports.co