1. Data We Collect

We collect the following categories of personal data:

Identity Data: Name, date of birth, email address, phone number
Registration Data: Country selection, position, jersey preferences, soccer experience
Medical Data: Allergies, medical conditions, medications (encrypted at rest)
Emergency Contact: Name, relationship, phone number
Payment Data: Processed securely via Stripe; we do not store card numbers
Usage Data: Pages visited, interactions, device information

2. How We Use Your Data

Process and manage your tournament registration
Communicate tournament updates, schedules, and logistics
Provide medical staff with necessary health information during the tournament
Process payments and manage refunds
Improve our website and services
Comply with legal obligations

3. Legal Basis (GDPR)

We process your data based on: (a) your explicit consent, (b) performance of a contract (registration), (c) legitimate interests (improving services), and (d) legal obligations.

4. Data Security

Medical information is encrypted using AES-256-CBC encryption. All data is transmitted via HTTPS/TLS. Access to personal data is restricted to authorized personnel only. We conduct regular security audits.

5. Data Retention

We retain your data for the duration of your account plus 2 years for legal and compliance purposes. Cancelled registrations are anonymized after 30 days upon request.

6. Your Rights (GDPR Articles 15-22)

Right of Access: Request a copy of all data we hold about you
Right to Rectification: Correct inaccurate personal data
Right to Erasure: Request deletion of your data (30-day grace period)
Right to Data Portability: Receive your data in machine-readable format (JSON)
Right to Withdraw Consent: Withdraw consent at any time via your account settings

Exercise these rights at My Account → My Data or by contacting us.

7. Cookies

We use essential cookies for site functionality and optional analytics cookies. You can manage your preferences via our cookie banner. Essential cookies cannot be disabled as they are required for the site to function.

8. Third-Party Services

Stripe: Payment processing (PCI DSS compliant)
Resend: Email delivery
Vercel: Hosting and analytics
Neon: Database hosting

9. International Transfers

Your data may be processed in the United States. We ensure appropriate safeguards are in place for international data transfers in compliance with GDPR.

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect data from minors.

11. Contact

Data Protection inquiries: privacy@fansworldcup.com

General inquiries: info@fansworldcup.com

PRIVACY POLICY