Last updated: 2026-04-26
1. Data controller
Calciometrica is operated by a Belgian société (full details in the Imprint). Registered office: Belgium. Lead supervisory authority per Regulation EU 2016/679 art. 56: Autorité de protection des données (APD/GBA), https://www.autoriteprotectiondonnees.be.
Italian users retain the right to lodge a complaint with the Garante per la protezione dei dati personali per GDPR art. 77 (https://www.garanteprivacy.it).
2. Data categories and lawful basis
- Email (waitlist /asta and /support) — basis: consent (art. 6.1.a) via double opt-in.
- Anonymous pageviews (Plausible) — basis: legitimate interest (art. 6.1.f). No cookies, no PII.
- Application errors (Sentry) — basis: legitimate interest (service quality). Emails scrubbed before transmission.
3. Processors
The following providers process personal data on our behalf, under a Data Processing Agreement (GDPR art. 28) signed or being signed:
- Brevo (France) — newsletter and waitlist
- Plausible Analytics (Germany) — anonymous, cookie-less analytics
- Hetzner (Germany) — infrastructure hosting
- Sentry (EU plan) — application error tracking
- API-Football (France) — sports data
3.1 Technical suppliers for editorial content generation
The following AI providers generate editorial content (articles, translations, claim verification, cover images) from public data (fixtures, match statistics, professional player names, content destined for publication). No personal data of registered users or mailing-list subscribers crosses the boundary to these providers: the backend combines user preferences with generic AI output server-side. They are therefore NOT processors under GDPR art. 28 (similar to a CDN or image hosting service), but technical suppliers for editorial production:
- Anthropic Claude (US) — article generation and fact-check
- xAI Grok (eu-west-1 region) — translations, fact-check web search, image generation
- Google Gemini (US/EU) — translations (transitional during Grok migration)
- OpenAI (US) — cover image generation (fallback during Grok migration)
4. Extra-EU transfers
US providers handling personal data (Sentry US tier where applicable) rely on Standard Contractual Clauses (SCC, decision 2021/914) plus EU-US Data Privacy Framework adequacy decision where available. A Schrems II Transfer Impact Assessment is on file for each personal-data transfer; documentation available on request at privacy@calciometrica.com. AI suppliers (section 3.1) fall outside this analysis because they do not process personal data.
5. Your rights
Access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), consent withdrawal (7.3). Response within 30 days per art. 12.3.
6. Contact
privacy@calciometrica.com
7. Retention
Waitlist email: until unsubscribe. Application logs: 90 days rolling. Backups: 30 days rolling.