Privacy policy

Article 1. Controller

Foot Legendary determines the purposes and means of the processing described below and is accordingly the controller within the meaning of Article 4(7) of the Regulation.

All requests concerning personal data shall be addressed to contact@footlegendary.com.

Article 2. Categories of data and legal bases

Processing concerns three categories of data subjects, whose data differ both in origin and in legal regime.

• Client account holders. Name, electronic address, position, club or body of affiliation, language and currency preferences, and sign in and action logs are processed. Legal basis: performance of the contract concluded with the client club, within the meaning of Article 6(1)(b) of the Regulation, and the legitimate interest of the controller in securing access, within the meaning of Article 6(1)(f).
• Authors of an access request. Name, position, electronic address, club and the message transmitted are processed. Legal basis: steps taken at the request of the data subject prior to entering into a contract, within the meaning of Article 6(1)(b) of the Regulation.
• Professional players. Identity, date of birth, club, position, match statistics, transfer history and contract expiry are processed, obtained from the public sources listed in Article 5 of the legal notice. Legal basis: the legitimate interest of the controller in carrying on an intermediation business in a market where such information is public and professional in character, within the meaning of Article 6(1)(f) of the Regulation. No data concerning minors, health or private life is collected or published.

Article 3. Information of the players concerned

As data relating to players is not collected from them, this policy constitutes the information required by Article 14 of the Regulation. It is permanently accessible from every page of the site.

Any data subject may, at the address set out in Article 1, obtain communication of the data concerning them, request its rectification or object to its processing under the conditions laid down in Article 21 of the Regulation.

Article 4. Remuneration declared by clubs

The client club may itself record the remuneration, release clauses and contract expiry dates of its players. Such data is accessible only to that club and to the Publisher's administrators.

It is communicated to a supervisory body, whether a league or a public authority, only in aggregate form and subject to the express and prior consent of the club, obtained in accordance with Article 7 of the Regulation. Consent may be withdrawn at any time, with immediate effect and without affecting the lawfulness of processing carried out beforehand.

Article 5. Off pitch signals

The service monitors public information liable to affect a player's value. None of that information is published on a profile before validation by an authorised operator, and its retention is limited to what is strictly necessary for the purpose pursued, in accordance with the principle of minimisation laid down in Article 5(1)(c) of the Regulation.

Any data subject may obtain its rectification or erasure, which is carried out without delay.

Article 6. Recipients and processors

The Publisher carries out no transfer of data for advertising or commercial purposes. Only those providers necessary to the operation of the service are involved, bound by the terms required by Article 28 of the Regulation.

• Hostinger International Limited, hosting of the site and database, infrastructure located in Paris.
• Resend, delivery of transactional electronic mail, Ireland region infrastructure.
• API-Football, Transfermarkt and Wikimedia, sources of sporting data. These services are queried for reading; no user data is transmitted to them.

Article 7. Transfers outside the European Union

Hosting and delivery of electronic mail are carried out within the territory of the European Union. No account data leaves it in the ordinary operation of the service.

The product includes a conversational assistant based on a language model, which is not activated as at the date of this version. Its activation would entail the transmission to the model provider of the questions entered by the user and of their recent exchanges only, to the exclusion of any content of the database. This policy will be updated beforehand so as to identify that provider, its country of establishment and the appropriate safeguards governing the transfer within the meaning of Chapter V of the Regulation.

Article 8. Retention periods

• Account data: for the duration of the contractual relationship, then twelve months in intermediate archiving.
• Access requests that did not result in an account being opened: twelve months from receipt.
• Audit and sign in logs: twelve months. They record, among other things, administrators' access to client areas.
• Public sporting data: for as long as it remains relevant to the market, reassessed at each collection campaign.

Article 9. Administrators' access to client areas

For the purpose of diagnosing a malfunction, an administrator of the Publisher may display a club's area as that club sees it. Such access gives knowledge of no data that the account concerned does not already display and confers no power to act in the name of the holder.

Every access of that nature is timestamped and recorded in the Publisher's audit log together with the administrator's identity. The club may obtain that record on request.

Article 10. Rights of data subjects

Every data subject enjoys the rights of access, rectification, erasure, restriction of processing, objection and portability laid down in Articles 15 to 22 of the Regulation.

Those rights are exercised at contact@footlegendary.com. A reply is given within one month of receipt of the request, extendable by two months where the request is complex, in accordance with Article 12(3) of the Regulation.

Data subjects have the right to lodge a complaint with a supervisory authority, and in particular with the Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris.

Article 11. Trackers and local storage

The site employs no advertising tracker and no audience measurement device. Consequently no consent is required and no banner is displayed.

Only devices strictly necessary to the provision of the service expressly requested by the user are employed: the session cookie maintaining the connection, and local storage of language, currency and theme preferences, written on the user's own terminal following the user's own choice and never transmitted to a third party.

Article 12. Security

In accordance with Article 32 of the Regulation, the Publisher implements technical and organisational measures appropriate to the risks. Traffic with the site is encrypted in transit. Partitioning of access is enforced within the database engine itself, by row level security policies, and not at application level alone: an account is technically unable to read another account's records, whatever query is formed.

No password is transmitted by electronic mail. An account is opened by means of a single use link of limited duration, the holder determining their own password, which is at no time known to the Publisher.