Privacy Policy

Version 3.1 — 23 October 2026 (friends, preferred position and in-app notifications added)

Project First League — trade name of Sebastiano Bartoli, KBO 1017.790.019 Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium Contact: info@projectfirstleague.com

1. Data Controller

Project First League, the trade name of Sebastiano Bartoli, registered with the Belgian Crossroads Bank for Enterprises (KBO) under number 1017.790.019, with registered office at Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium ("we", "us", "our"), is the data controller. We operate the Project First League mobile application (the "App"), available on the Apple App Store and Google Play Store, and the website projectfirstleague.com (the "Website").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what your rights are under the General Data Protection Regulation (GDPR) and applicable Belgian data protection legislation.

Contact: info@projectfirstleague.com

2. What personal data we collect

2.1 Data you provide to us

• Full name
• Email address
• Date of birth
• Profile photo
• Region setting (geographical area)
• Preferred playing position (optional; goalkeeper, defence, midfield, attack or none)
• Friend relations: who you sent a friend request to, who sent one to you, and who your Friends are
• In-app notifications addressed to you (friend requests, places booked for you, Sessions joined by Friends), with the name of the User concerned
• Language preference (English, Dutch or French). You choose this during onboarding, when we ask you once after an update, or at any time in Settings. We store it so that our servers know which language to use when they send you a notification — the App itself would otherwise follow your device language, which our servers cannot see.

When you sign in with a Google or Apple account, we receive your name and email address from that provider. Apple allows you to hide your real email address ("Hide My Email"); in that case we only receive the relay address Apple provides.

2.2 Data generated through your use of the App

• Game statistics (MVP votes, Total Played, XP, level)
• Session participation and booking history
• Session type participation, where applicable. Sessions created since August 2026 are all of one type; the type recorded for Sessions you joined before then is retained in your history.
• Team selections (Team Black / Team Colour)
• Attendance records (present/absent per Session)
• Coin balance and Strikes
• The number of Sessions you did not check in for (kept separately from your Strikes, so that a reset of your Strikes does not erase whether a missed check-in was a first occurrence)
• Notification preferences (whether push notifications are enabled, and separately whether promotional notifications are enabled)
• Push notification tokens (for sending notifications to your device)
• Post-session feedback you submit (e.g. whether the ball was present), linked to your account and used for quality control of Sessions and venues
• Host ratings you give, and host ratings you receive — see section 2.6
• Which Venues you have marked as a favourite, so that we can notify you when a new Session is posted there
• The Venue, pitch, date and time you enter when you post a Host Session, together with the booking confirmation if you choose to attach one

2.3 Payment data

When you make a payment through the App, the transaction is processed by Stripe, Inc. (our third-party payment provider). We store a reference to the payment and the associated User ID in our database, as well as a log of bookings, cancellations and refunds. We do not store your full credit card number, CVV, or other sensitive payment details. Stripe handles this in accordance with PCI-DSS standards. See Stripe's privacy policy at https://stripe.com/privacy.

2.3ter Subscription data (Venue Pass)

If you buy a Venue Pass, we store the data needed to run that subscription: your customer and subscription identifier at Stripe, the plan you chose, the Venue it applies to, the status of the subscription (active, payment failed, paused, cancelled), the current Billing Period, and how many Credits you have used and have left. We also store a record of each paid invoice — amount, date and invoice number — so that we can account for the revenue and answer questions about it later.

Your customer identifier at Stripe is stored in a private part of your profile that other Users cannot read. Card details themselves never reach us; Stripe handles those.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) for running the subscription, and legal obligation (Art. 6(1)(c) GDPR) for keeping the invoice records.

2.3bis Location data (session check-in)

When you check in for a Session, the App determines your location once, on your device, solely to verify that you are at the venue (within approximately 200 metres). Your coordinates are used for this distance check at that moment and are not stored — only the calculated distance to the venue and the check-in time are recorded, for support purposes (e.g. disputes about attendance). Location access is only requested when you check in (or during onboarding, to prepare for your first check-in) and is never used in the background or for any other purpose. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). If you refuse location access you cannot check in, which the Terms & Conditions treat as a no-show.

2.4 Technical data

• Device type and operating system
• Firebase Authentication identifiers (user ID, authentication tokens)
• The version (build number) of the App you last used, and the date you last opened it. We use this only to know which App versions are still in use, so we can support them correctly and tell you when an update is required. It is not linked to advertising, not shared with anyone, and is deleted together with your account.

2.5 Venue partner data

If you apply to list your venue on PFL or operate a venue account, we process the contact details you provide: contact name, business e-mail address, phone number and venue address. These details are used exclusively by PFL to contact you about the partnership and are never shared with Players or other venues. They are stored in a restricted part of our database that is only accessible to you and PFL administrators, and are deleted when the partnership ends and no legal retention obligation applies.

2.6 Host ratings

If you take part in a Session posted by a Host, you can give that Host a score of one to five stars with an optional written comment. If you post a Session as a Host yourself, other Players can rate you.

What we store, and who sees what:

• The rating you give is stored with your account attached to it. The Host cannot see that it came from you — he sees the score and the comment, not who gave it. PFL administrators can, so that we can deal with abusive or coordinated ratings.
• The rating you receive is stored under your own account, together with your average and the number of ratings. Your average and that number are shown to other Users only on the Sessions you posted as a Host. They are not shown on your profile, in the ranking or anywhere else, and not at all if you have never hosted.
• The comment is free text you write yourself. Do not put personal data of other people in it.

The average is calculated on our servers; neither you nor any other User can set or change it.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) — the rating is what lets other Players see with whom they are booking — and our legitimate interest in a safe platform (Art. 6(1)(f) GDPR) for keeping the identity of the rater available to administrators.

Retention: ratings you gave and received are deleted together with your account. A rating you gave to someone else remains part of that Host's average as an anonymous score, because removing it would retroactively change a figure other Players relied on; nothing in it then still points to you.

2.7 Proof of booking for a Host Session

When you post a Host Session you may — but do not have to — attach the confirmation you received from the Venue. That file may contain your name, your email address and your booking reference. We use it for one purpose only: settling any dispute about whether that Session corresponded to a real booking. We do not check it up front; posting a Session needs no approval. It is stored in a part of our storage that other Users cannot read and is seen only by PFL administrators. We keep it for as long as we may need it to verify the Session or to settle a dispute about it, and we delete it on request via info@projectfirstleague.com. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fake Sessions (Art. 6(1)(f) GDPR).

3. Why we collect your data and on what legal basis

3.1 Performance of the contract (Art. 6(1)(b) GDPR)

We process your personal data to provide the services you signed up for:

• Creating and managing your account
• Organising and facilitating Sessions (bookings, attendance, waitlists)
• Processing payments and refunds via Stripe
• Running a Venue Pass subscription: charging it monthly, keeping track of your Credits, and pausing or ending it when required
• Maintaining your game statistics, ranking and level progression
• Letting you find other players by name (unless you switch this off in the settings), become Friends, book places for Friends and be notified of what your Friends do in the App (performance of the contract, Art. 6(1)(b) GDPR, and our legitimate interest in a social booking experience, Art. 6(1)(f) GDPR)
• Showing your preferred position to the other participants of a Session (performance of the contract, Art. 6(1)(b) GDPR)
• Enabling MVP voting and leaderboard functionality

3.2 Legitimate interest (Art. 6(1)(f) GDPR)

• Sending transactional push notifications about Sessions (e.g. session updates and cancellations, waitlist spots, Ball Captain changes, MVP voting)
• Sending occasional promotional push notifications about our own Sessions (e.g. that a Session still needs players, or an invitation to book again). You can opt out of these separately at any time (see Section 11), and doing so does not affect transactional notifications
• Improving the App and fixing bugs based on technical/error data, and knowing which App versions are still in use so we can keep them working and plan updates
• Preventing fraud and ensuring security of the platform (including the Strike system)

3.3 Legal obligation (Art. 6(1)(c) GDPR)

• Retaining financial transaction records as required by Belgian tax and accounting legislation

4. Who we share your data with

We do not sell your personal data to third parties. We share data only with the following service providers, solely to the extent necessary to operate the App:

Google LLC / Firebase — Firebase provides our backend infrastructure: database (Cloud Firestore), user authentication (Firebase Authentication, including Google and Apple sign-in), file storage (profile photos), server-side functions, and push notifications (Firebase Cloud Messaging). Data may be processed in the United States and other countries where Google operates data centres. The transfer is governed by Standard Contractual Clauses (SCCs) as approved by the European Commission. Google LLC is additionally certified under the EU-US Data Privacy Framework.

Stripe, Inc. — Stripe processes all in-app card payments and refunds, and also runs the recurring billing behind the Venue Pass (Stripe Billing). For a Venue Pass we store your Stripe customer and subscription identifier so that we can charge, pause, resume or cancel the subscription. When you pay for a Session, your payment data is transmitted directly to Stripe. Data may be processed in the United States. The transfer is governed by Standard Contractual Clauses (SCCs). Stripe, Inc. is additionally certified under the EU-US Data Privacy Framework. See: https://stripe.com/privacy.

Apple Inc. / Google LLC (App Stores) — The App is distributed via the Apple App Store and Google Play Store. These platforms may collect their own data when you download or update the App, subject to their own privacy policies.

Brevo (Sendinblue SAS) — Brevo sends our service and information e-mails (for example when we announce changes to these documents). We store your e-mail address and your name with Brevo for that purpose. Brevo is established in France; your data stays within the European Economic Area. See: https://www.brevo.com/legal/privacypolicy/.

5. International data transfers

Some of our service providers (Google/Firebase, Stripe) process data outside the European Economic Area (EEA), primarily in the United States. These transfers are safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914) and, where applicable, certification of the data importer under the EU-US Data Privacy Framework (Adequacy Decision of 10 July 2023), ensuring an adequate level of protection for your personal data.

6. Profiling and automated processing

The App automatically calculates certain statistics and metrics based on your participation and performance, including your XP (Experience Points), level, ranking position, MVP count and Strikes. These calculations are fully automated and are used to maintain the leaderboard, gamification and fair-play features of the App.

The first time you do not check in for a Session, you receive a warning and no Strike. From the second time onwards, each missed check-in adds one Strike, as does every cancellation within 12 hours of kick-off. An account is automatically blocked at the third Strike. You can always contact us through the App or at info@projectfirstleague.com to have a block reviewed by a person.

Blocking your account is the only decision we take about you that is made purely by the system. Rather than rely on our own assessment of whether Article 22 GDPR applies to it, we give you the safeguards of that Article in any case:

• You are told. The App shows a banner explaining that your account is blocked from booking, and you receive a notification at the moment each Strike is recorded.
• We state the logic in full. A Strike is recorded for a cancellation within 12 hours of kick-off, and for the second and every further Session you do not check in for. At three Strikes, booking is blocked. A Strike expires 12 months after it was recorded, after which the block is lifted automatically.
• A person reviews it. Write to info@projectfirstleague.com and a human being — not the system — reconsiders the block. You may explain your side and contest the outcome. We respond within 30 days (Article 8.4 of our Terms & Conditions).
• Nothing else is decided automatically. Your XP, level, ranking position, MVP count and your Host Rating are calculated automatically, but they never restrict your access to anything. A low Host Rating does not block you and does not stop you posting Sessions; it is an opinion of the Players who were there, shown to others so that they can decide for themselves.

7. Photos and video at Sessions

Sessions may be photographed and filmed by or on behalf of Project First League for promotional purposes. This material may show you as a participant and may be published on our Website and social media channels (Instagram, TikTok). The legal basis for this processing is our legitimate interest in promoting the platform (Art. 6(1)(f) GDPR), combined with the consent provisions in Article 13 of our Terms & Conditions.

You can object at any time: tell the person filming at the Session that you do not want to appear, or request the removal of specific published material by emailing info@projectfirstleague.com. We will remove the material from our own channels within a reasonable time, where technically feasible. Note that we are not responsible for recordings made by other participants in a private capacity.

Promotional material is retained for as long as it is in use on our channels, or until you successfully object to its publication.

8. How long we keep your data

Active account: we retain your personal data for as long as your account is active and you use the App.

After account deletion:

• Your authentication account and profile (name, email, date of birth, profile photo, statistics, preferred position) are deleted immediately when you delete your account in the App, and in any event within 30 days. Your friend relations and in-app notifications are deleted at the same time; the in-app notification list is in any event limited to the most recent entries.
• Anonymised game statistics (without personal identifiers) may be retained indefinitely for statistical and historical ranking purposes, as described in Article 17.3 of our Terms & Conditions.
• Payment transaction records are retained for 7 years after the transaction date, as required by Belgian accounting and tax legislation (Art. III.86 Belgian Code of Economic Law).
• Post-session feedback you submitted is deleted upon account deletion.
• Push notification tokens are deleted upon account deletion.
• Venue Pass data: your subscription is cancelled when you delete your account and the Credit balance is deleted with your profile. The invoices of Billing Periods already paid are retained for 7 years, on the same legal basis as other payment records.

Strikes and missed check-ins: a Strike expires 12 months after it was recorded, and the count of missed check-ins is reduced accordingly. We keep them no longer than that, because they only serve to identify a repeated pattern.

Apart from the retention periods above, personal data of an active account is kept for as long as the account exists.

9. Your rights under the GDPR

As a data subject, you have the following rights:

• Right of access — you can request a copy of all personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data. You can edit your name, photo and region directly in the App.
• Right to erasure — you can delete your account directly in the App (Settings → Delete account), or request deletion by contacting us. We will comply within 30 days, subject to legal retention obligations.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can request your data in a structured, commonly used, machine-readable format.
• Right to object — you can object to processing based on legitimate interest. If you object to the use of your data for direct communications (e.g. push notifications), we will cease such processing immediately.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@projectfirstleague.com. We will respond within 30 days.

If you believe your rights have been violated, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / GBA): Drukpersstraat 35, 1000 Brussel https://www.gegevensbeschermingsautoriteit.be contact@apd-gba.be

10. Children

The App is not intended for children under the age of 16. By creating an account, the User confirms that they are at least 16 years old. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete the account and associated data promptly.

11. Push notifications

We use Firebase Cloud Messaging (FCM) to send push notifications to your device. We distinguish two types:

Transactional notifications — directly related to your participation in Sessions:

• Session reminders and updates (e.g. jersey colour reminders, session cancellations)
• Check-in reminders
• Waitlist alerts when a spot becomes available
• Ball Captain changes and availability alerts
• MVP voting and voting results
• Game results and ranking updates

Promotional notifications — occasional messages that encourage participation in our own Sessions:

• Reminders that a Session near you still needs players
• Invitations to book a Session again after a period of inactivity
• Invitations to book a Session — including a first invitation to Users who have created an account but not yet played

Promotional notifications are sent on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in filling Sessions, and you can opt out of them at any time.

Language. Notifications are sent in the language stored on your account (see 2.1). If you have not chosen one, we send them in English. Changing your language in Settings changes the language of your notifications as well.

Your controls. In the App (Settings → Notifications) you can:

• turn off promotional notifications separately, while continuing to receive transactional ones; and
• turn off all push notifications entirely.

When disabled, the corresponding notifications are no longer sent to you. You can additionally disable notifications via your device settings (iOS: Settings → Notifications → Project First League; Android: Settings → Apps → Project First League → Notifications). Disabling notifications does not affect your ability to use the App, but you will not receive waitlist or session alerts.

12. How we protect your data

We implement appropriate technical and organisational measures to protect your personal data, including:

• Firebase Security Rules restricting database access to authorised users only
• Server-side processing of sensitive operations (attendance, MVP voting, refunds) via secured cloud functions
• Encryption of data in transit (TLS/SSL) and at rest (provided by Firebase/Google Cloud)
• Payment processing exclusively via PCI-DSS compliant Stripe infrastructure
• Regular review and update of access controls and security rules

While we take all reasonable steps to protect your data, no system is 100% secure. If you suspect a data breach, please contact us immediately at info@projectfirstleague.com.

13. Cookies and tracking

The App does not use cookies. The Website (projectfirstleague.com) does not use cookies. We do not use analytics cookies, advertising cookies, or third-party tracking technologies on our Website or in our App. The fonts on our Website are self-hosted; visiting the Website does not send your data to third-party font or analytics services.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version is published on our Website with a new version number and date. We announce material changes in the App, by e-mail, or both — whichever reaches you reliably.

15. Contact

For any questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us at:

Project First League — trade name of Sebastiano Bartoli, KBO 1017.790.019 Vrijheidstraat 9, 2070 Burcht (Zwijndrecht), Belgium Email: info@projectfirstleague.com Website: https://www.projectfirstleague.com