Last updated: 2026-04-26
1. Data controller
Calciometrica is operated by a Belgian société (full details in the Imprint). Registered office: Belgium. Lead supervisory authority per Regulation EU 2016/679 art. 56: Autorité de protection des données (APD/GBA), https://www.autoriteprotectiondonnees.be.
Italian users retain the right to lodge a complaint with the Garante per la protezione dei dati personali per GDPR art. 77 (https://www.garanteprivacy.it).
2. Data categories and lawful basis
- Email (waitlist /asta and /support) — basis: consent (art. 6.1.a) via double opt-in.
- Anonymous pageviews (Plausible) — basis: legitimate interest (art. 6.1.f). No cookies, no PII.
- Application errors (Sentry) — basis: legitimate interest (service quality). Emails scrubbed before transmission.
3. Processors
The following providers process personal data on our behalf, under a Data Processing Agreement (GDPR art. 28) signed or being signed:
- Brevo (France) — newsletter and waitlist
- Plausible Analytics (Germany) — anonymous, cookie-less analytics
- Hetzner (Germany) — infrastructure hosting
- Sentry (EU plan) — application error tracking
API-Football (France) is an upstream data source (public sports statistics, fixtures, line-ups): data flows into Calciometrica, no personal data of users or subscribers is transmitted to API-Football. It is therefore not a processor under GDPR art. 28.
3.1 Technical suppliers for editorial content generation
The following AI providers generate editorial content (articles, translations, claim verification, cover images) from public data (fixtures, match statistics, professional player names, content destined for publication). No personal data of registered users or mailing-list subscribers crosses the boundary to these providers: the backend combines user preferences with generic AI output server-side. They are therefore NOT processors under GDPR art. 28 (similar to a CDN or image hosting service), but technical suppliers for editorial production:
- Anthropic Claude (US) — article generation and fact-check
- xAI Grok (eu-west-1 region) — translations, fact-check web search, image generation
- Google Gemini (US/EU) — translations (transitional during Grok migration)
- OpenAI (US) — cover image generation (fallback during Grok migration)
4. Extra-EU transfers
All processors of personal data listed in section 3 are established in the European Economic Area (Brevo in France, Plausible and Hetzner in Germany, Sentry on the EU instance): no personal-data flow currently requires Chapter V GDPR transfer mechanisms (Standard Contractual Clauses, adequacy decisions, or Binding Corporate Rules). AI suppliers (section 3.1) fall outside this analysis because they do not process personal data.
5. Your rights
Access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), consent withdrawal (7.3). Response within 30 days per art. 12.3.
6. Contact
privacy@calciometrica.com (phone: +32 2 894 36 56)
7. Retention
Waitlist email: until unsubscribe. Application logs: 90 days rolling. Backups: 30 days rolling.
8. Data Protection Officer (DPO)
Calciometrica has not designated a Data Protection Officer under Art. 37 of EU Regulation 2016/679. The determination follows the criteria of Art. 37(1) GDPR: the activity does not constitute systematic monitoring of data subjects on a large scale (point b), does not involve large-scale processing of special categories of personal data (point c), and is not part of the activities of a public authority or body (point a). Documented on 2026-05-04, subject to periodic review as volumes and processing categories evolve.
For any data-processing inquiry or to exercise data-subject rights, the single channel is privacy@calciometrica.com.