Privacy Policy

Version 2.1 — 11 June 2026

Project First League — trade name of Sebastiano Bartoli, KBO 1017.790.019 Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium Contact: info@projectfirstleague.com

1. Data Controller

Project First League, the trade name of Sebastiano Bartoli, registered with the Belgian Crossroads Bank for Enterprises (KBO) under number 1017.790.019, with registered office at Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium ("we", "us", "our"), is the data controller. We operate the Project First League mobile application (the "App"), available on the Apple App Store and Google Play Store, and the website projectfirstleague.com (the "Website").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what your rights are under the General Data Protection Regulation (GDPR) and applicable Belgian data protection legislation.

Contact: info@projectfirstleague.com

2. What personal data we collect

2.1 Data you provide to us

• Full name
• Email address
• Date of birth
• Profile photo
• Region setting (geographical area)

When you sign in with a Google or Apple account, we receive your name and email address from that provider. Apple allows you to hide your real email address ("Hide My Email"); in that case we only receive the relay address Apple provides.

2.2 Data generated through your use of the App

• Game statistics (MVP votes, Total Played, XP, level)
• Session participation and booking history
• Session type participation (e.g. Casual Sessions, Women's Sessions, Elite Sessions)
• Team selections (Team Black / Team Colour)
• Attendance records (present/absent per Session)
• Coin balance and Strikes
• Notification preference (whether push notifications are enabled)
• Push notification tokens (for sending notifications to your device)

2.3 Payment data

When you make a payment through the App, the transaction is processed by Stripe, Inc. (our third-party payment provider). We store a reference to the payment and the associated User ID in our database, as well as a log of bookings, cancellations and refunds. We do not store your full credit card number, CVV, or other sensitive payment details. Stripe handles this in accordance with PCI-DSS standards. See Stripe's privacy policy at https://stripe.com/privacy.

2.4 Technical data

• Device type and operating system
• Firebase Authentication identifiers (user ID, authentication tokens)

3. Why we collect your data and on what legal basis

3.1 Performance of the contract (Art. 6(1)(b) GDPR)

We process your personal data to provide the services you signed up for:

• Creating and managing your account
• Organising and facilitating Sessions (bookings, attendance, waitlists)
• Processing payments and refunds via Stripe
• Maintaining your game statistics, ranking and level progression
• Enabling MVP voting and leaderboard functionality

3.2 Legitimate interest (Art. 6(1)(f) GDPR)

• Sending transactional push notifications about Sessions (e.g. session updates and cancellations, waitlist spots, Ball Captain changes, MVP voting)
• Improving the App and fixing bugs based on technical/error data
• Preventing fraud and ensuring security of the platform (including the Strike system)

3.3 Legal obligation (Art. 6(1)(c) GDPR)

• Retaining financial transaction records as required by Belgian tax and accounting legislation

4. Who we share your data with

We do not sell your personal data to third parties. We share data only with the following service providers, solely to the extent necessary to operate the App:

Google LLC / Firebase — Firebase provides our backend infrastructure: database (Cloud Firestore), user authentication (Firebase Authentication, including Google and Apple sign-in), file storage (profile photos), server-side functions, and push notifications (Firebase Cloud Messaging). Data may be processed in the United States and other countries where Google operates data centres. The transfer is governed by Standard Contractual Clauses (SCCs) as approved by the European Commission. Google LLC is additionally certified under the EU-US Data Privacy Framework.

Stripe, Inc. — Stripe processes all in-app card payments and refunds. When you pay for a Session, your payment data is transmitted directly to Stripe. Data may be processed in the United States. The transfer is governed by Standard Contractual Clauses (SCCs). Stripe, Inc. is additionally certified under the EU-US Data Privacy Framework. See: https://stripe.com/privacy.

Apple Inc. / Google LLC (App Stores) — The App is distributed via the Apple App Store and Google Play Store. These platforms may collect their own data when you download or update the App, subject to their own privacy policies.

5. International data transfers

Some of our service providers (Google/Firebase, Stripe) process data outside the European Economic Area (EEA), primarily in the United States. These transfers are safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914) and, where applicable, certification of the data importer under the EU-US Data Privacy Framework (Adequacy Decision of 10 July 2023), ensuring an adequate level of protection for your personal data.

6. Profiling and automated processing

The App automatically calculates certain statistics and metrics based on your participation and performance, including your XP (Experience Points), level, ranking position, MVP count and Strikes. These calculations are fully automated and are used to maintain the leaderboard, gamification and fair-play features of the App.

An account is automatically blocked after a third Strike (recorded for late cancellations and no-shows). You can always contact us through the App or at info@projectfirstleague.com to have a block reviewed by a person.

This automated processing does not produce legal effects or similarly significant effects on you beyond access to the App's booking functionality, and human review is available on request. You have the right to request an explanation of the logic involved by contacting us at info@projectfirstleague.com.

7. Photos and video at Sessions

Sessions may be photographed and filmed by or on behalf of Project First League for promotional purposes. This material may show you as a participant and may be published on our Website and social media channels (Instagram, TikTok). The legal basis for this processing is our legitimate interest in promoting the platform (Art. 6(1)(f) GDPR), combined with the consent provisions in Article 13 of our Terms & Conditions.

You can object at any time: tell the person filming at the Session that you do not want to appear, or request the removal of specific published material by emailing info@projectfirstleague.com. We will remove the material from our own channels within a reasonable time, where technically feasible. Note that we are not responsible for recordings made by other participants in a private capacity.

Promotional material is retained for as long as it is in use on our channels, or until you successfully object to its publication.

8. How long we keep your data

Active account: we retain your personal data for as long as your account is active and you use the App.

After account deletion:

• Your authentication account and profile (name, email, date of birth, profile photo, statistics) are deleted immediately when you delete your account in the App, and in any event within 30 days.
• Anonymised game statistics (without personal identifiers) may be retained indefinitely for statistical and historical ranking purposes, as described in Article 17.3 of our Terms & Conditions.
• Payment transaction records are retained for 7 years after the transaction date, as required by Belgian accounting and tax legislation (Art. III.86 Belgian Code of Economic Law).
• Push notification tokens are deleted upon account deletion.

Personal data is only deleted upon account deletion. We do not delete personal data of active accounts.

9. Your rights under the GDPR

As a data subject, you have the following rights:

• Right of access — you can request a copy of all personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data. You can edit your name, photo and region directly in the App.
• Right to erasure — you can delete your account directly in the App (Settings → Delete account), or request deletion by contacting us. We will comply within 30 days, subject to legal retention obligations.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can request your data in a structured, commonly used, machine-readable format.
• Right to object — you can object to processing based on legitimate interest. If you object to the use of your data for direct communications (e.g. push notifications), we will cease such processing immediately.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@projectfirstleague.com. We will respond within 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / GBA): Drukpersstraat 35, 1000 Brussel https://www.gegevensbeschermingsautoriteit.be contact@apd-gba.be

10. Children

The App is not intended for children under the age of 16. By creating an account, the User confirms that they are at least 16 years old. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete the account and associated data promptly.

11. Push notifications

We use Firebase Cloud Messaging (FCM) to send transactional push notifications to your device. These may include:

• Session reminders and updates (e.g. jersey colour reminders, session cancellations)
• Waitlist alerts when a spot becomes available
• Ball Captain changes and availability alerts
• MVP voting and voting results
• Game results and ranking updates

All push notifications are transactional in nature and directly related to your participation in Sessions. We do not send promotional or marketing notifications.

You can disable all push notifications at any time inside the App (Settings → Account → Notifications); when disabled, no notifications are sent to you. You can additionally disable notifications via your device settings (iOS: Settings → Notifications → Project First League; Android: Settings → Apps → Project First League → Notifications). Disabling notifications does not affect your ability to use the App, but you will not receive waitlist or session alerts.

12. How we protect your data

We implement appropriate technical and organisational measures to protect your personal data, including:

• Firebase Security Rules restricting database access to authorised users only
• Server-side processing of sensitive operations (attendance, MVP voting, refunds) via secured cloud functions
• Encryption of data in transit (TLS/SSL) and at rest (provided by Firebase/Google Cloud)
• Payment processing exclusively via PCI-DSS compliant Stripe infrastructure
• Regular review and update of access controls and security rules

While we take all reasonable steps to protect your data, no system is 100% secure. If you suspect a data breach, please contact us immediately at info@projectfirstleague.com.

13. Cookies and tracking

The App does not use cookies. The Website (projectfirstleague.com) does not use cookies. We do not use analytics cookies, advertising cookies, or third-party tracking technologies on our Website or in our App. The fonts on our Website are self-hosted; visiting the Website does not send your data to third-party font or analytics services.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Changes will be announced in the App and the updated version will be published on our Website with a new version number and date.

15. Contact

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us at:

Project First League — trade name of Sebastiano Bartoli, KBO 1017.790.019 Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium Email: info@projectfirstleague.com Website: https://www.projectfirstleague.com