Last updated: 2026-08-02
1. Data controller
Calciometrica is operated by a Belgian société (full details in the Imprint). Registered office: Belgium. Lead supervisory authority per Regulation EU 2016/679 art. 56: Autorité de protection des données (APD/GBA), https://www.autoriteprotectiondonnees.be.
Italian users retain the right to lodge a complaint with the Garante per la protezione dei dati personali per GDPR art. 77 (https://www.garanteprivacy.it).
2. Data categories and lawful basis
- Email (waitlist /asta and /support) — basis: consent (art. 6.1.a) via double opt-in.
- Anonymous pageviews (Plausible) — basis: legitimate interest (art. 6.1.f). No cookies, no PII.
- Application errors (Sentry) — basis: legitimate interest (service quality). Emails scrubbed before transmission.
- Purchase email (Auction assistant) — basis: performance of a contract (art. 6.1.b). It delivers the access you bought and recognises you when you come back. We keep the email, the access expiry date and the transaction references.
- Your auction data — basis: performance of a contract (art. 6.1.b). Who you bought and for how much, and who left the list: this is what makes the advice yours rather than generic, and without it you would have to re-enter it on every visit. It contains no personal data: footballer identifiers, roles and credits, tied to your purchase and not to your name.
3. Processors
The following providers process personal data on our behalf, under a Data Processing Agreement (GDPR art. 28) signed or being signed:
- Brevo (France) — newsletter and waitlist
- Plausible Analytics (Germany) — anonymous, cookie-less analytics
- Hetzner (Germany) — infrastructure hosting
- Sentry (EU plan) — application error tracking
- Stripe (Ireland, for the EU) — payment collection. It acts as merchant of record: payment data (card, billing address, VAT) is collected and processed by Stripe and never passes through our systems. We receive the buyer email and the transaction reference.
API-Football (France) is an upstream data source (public sports statistics, fixtures, line-ups): data flows into Calciometrica, no personal data of users or subscribers is transmitted to API-Football. It is therefore not a processor under GDPR art. 28.
3.1 Technical suppliers for editorial content generation
The following AI providers generate editorial content (articles, translations, claim verification, cover images) from public data (fixtures, match statistics, professional player names, content destined for publication). No personal data of registered users or mailing-list subscribers crosses the boundary to these providers: the backend combines user preferences with generic AI output server-side. They are therefore NOT processors under GDPR art. 28 (similar to a CDN or image hosting service), but technical suppliers for editorial production:
- Anthropic Claude (US) — article generation and fact-check
- xAI Grok (eu-west-1 region) — translations, fact-check web search, image generation
- Google Gemini (US/EU) — translations (transitional during Grok migration)
- OpenAI (US) — cover image generation (fallback during Grok migration)
4. Extra-EU transfers
All processors of personal data listed in section 3 are established in the European Economic Area (Brevo in France, Plausible and Hetzner in Germany, Sentry on the EU instance): no personal-data flow currently requires Chapter V GDPR transfer mechanisms (Standard Contractual Clauses, adequacy decisions, or Binding Corporate Rules). AI suppliers (section 3.1) fall outside this analysis because they do not process personal data.
5. Your rights
Access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), consent withdrawal (7.3). Response within 30 days per art. 12.3.
6. Contact
privacy@calciometrica.com (phone: +32 2 894 36 56)
7. Retention
Waitlist email: until unsubscribe. Application logs: 90 days rolling. Backups: 30 days rolling.
Purchased access and your auction data: until the access expires (the end of the season you bought it for), or earlier on request. Deleting the access takes the auction data with it, in a single operation. Tax records of the transaction stay with Stripe, which keeps them for its own legal obligations.
8. Data Protection Officer (DPO)
Calciometrica has not designated a Data Protection Officer under Art. 37 of EU Regulation 2016/679. The determination follows the criteria of Art. 37(1) GDPR: the activity does not constitute systematic monitoring of data subjects on a large scale (point b), does not involve large-scale processing of special categories of personal data (point c), and is not part of the activities of a public authority or body (point a). Documented on 2026-05-04, subject to periodic review as volumes and processing categories evolve.
For any data-processing inquiry or to exercise data-subject rights, the single channel is privacy@calciometrica.com.