Privacy Policy

Last Updated: 5 October 2026

1. Introduction

PrimePlay Sports Technologies ("we", "us", or "our") respects your privacy and is committed to protecting your personal data in compliance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Portuguese Law 58/2019.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at primeplay.football and our mobile web application (the "Service").

By accessing or using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this policy, you must not use the Service.

Data controller. PrimePlay Sports Technologies is the data controller responsible for your personal data. Contact us at privacy@primeplay.football for any privacy matter.

2. Personal Data We Collect

We collect the following categories of personal data:

2.1 Identity and contact data

• First name, last name, nickname
• Mobile phone number (used as your login identifier)
• Email address (optional — for invoices and account notifications)
• Country of residence

2.2 Profile data

All profile fields below are optional. You can edit them at any time in your profile settings, and most can be hidden from public view with per-field privacy toggles.

• Date of birth (year, month, day — collected as separate fields for GDPR minimisation)
• Biography (up to 200 characters)
• Languages spoken, neighbourhood, occupation, employer
• Football attributes: dominant foot, height, playing positions
• Favourite team, admired players, cities
• Avatar image (uploaded via our media storage provider)

2.3 Financial and billing data

• Portuguese Tax ID (NIF) — collected only if you request invoices
• Wallet balance and transaction ledger (top-ups, game payments, refunds, rewards)
• Payment processor customer identifier and saved-card token (full card numbers are never stored by us — see §5)

2.4 Activity data

• Games played, ratings given and received (chill and skill scores per opponent), Man of the Match awards, achievements
• Social graph: users you follow and users who follow you
• Friends invited, referral codes used, sponsorship relationships
• In-app chat messages (up to 1,000 characters per message), reactions, polls
• Testimonials you submit (rating + comment up to 500 characters)

2.5 Device and authentication data

• Phone verification code (used once, then immediately deleted from your record)
• JSON Web Token (JWT) issued to your browser for session authentication
• Push notification subscription keys (endpoint URL, encryption keys, user agent)
• Per-event notification preferences (in-app, push, SMS, WhatsApp)

2.6 Consent and audit data

• Records of consents you have given or withdrawn (type, legal basis, date, IP address, user agent)
• Cookie/storage consent acknowledgement

2.7 Technical data (logs)

• IP address (logged on every request for security, fraud detection, and abuse prevention)
• Browser user agent
• Request timestamps and URLs
• Phone numbers may appear in error logs in case of SMS delivery failures

2.8 Third-party personal data

When you register a team for a tournament, you may provide the names and phone numbers of teammates who are not PrimePlay users. You confirm that you have obtained their consent to share this data with us for the purpose of tournament registration. We will only use this data to process the registration and notify them of game details.

3. How We Use Your Data

We process your personal data for the following purposes, on the following legal bases (GDPR Article 6):

3.1 Member search: finding other players

To help you find people to play with, other signed-in PrimePlay members can find you by searching for your first name or nickname. When someone finds you, we show only your first name, the initial of your last name, your nickname (if you set one) and your profile photo (if you added one). We never show your phone number, email address or full last name in search, and members cannot search by phone number or email.

Search is available only to signed-in members, returns at most ten results per search, and is rate-limited to prevent bulk collection of profiles. If you turn search off, other members can still see you where you have already interacted with them, for example in the same game or squad, as described elsewhere in this policy.

Default and how to turn it off. Search is on by default. It is off by default for accounts whose date of birth shows that the member is under 18; they can turn it on themselves. You can turn it off or on at any time in your privacy settings, using the "Let other members find me by name" option. The change takes effect immediately.

Legal basis and your right to object. We rely on our legitimate interest in running a social football community (GDPR Article 6(1)(f)). You have the right to object at any time (see Section 8): the privacy option above is the quickest way to do so, and you can also email privacy@primeplay.football. We keep this information for as long as your account is open. A summary of our legitimate interest assessment is available on request.

If you tap "Near me" on the venues page, your device's location is used only on your device to work out how far each venue is; it is never sent to our servers and never stored.

4. Cookies and Storage

We do not set any first-party cookies. PrimePlay uses your browser's local storage instead of cookies for the following essential purposes:

• Authentication token (keeps you logged in)
• Selected language (English or Portuguese)
• Shopping cart and checkout state during payment
• User-experience preferences (onboarding progress, dismissed prompts)
• Acknowledgement of our cookie/storage notice

We do not use any advertising cookies or third-party tracking cookies, and no advertising trackers are loaded on our site. We measure audience with Umami, a self-hosted, cookieless tool that we run ourselves in the European Union. It sets no cookies, does not use local storage, does not store your IP address, and stores no personal data: it records page views and key actions (such as starting a booking) without identifying you, cannot follow you across sessions or other websites, and respects your browser's Do Not Track setting. We use it only to improve the service. Because it sets no cookies and stores no personal data, no consent banner is required.

Third-party storage. When you interact with payment forms, our payment processor may set cookies for fraud prevention. When you view maps, the map provider receives your IP address as part of standard tile requests. Both are necessary for the respective features to function.

5. Third-Party Processors

We share personal data with the following categories of third-party processors, each engaged under written contract (GDPR Article 28):

• Payment processors — to handle card payments, refunds, and saved cards. Card data is handled entirely by the processor and never touches our servers.
• Communications providers — to deliver SMS, messaging-app (e.g., WhatsApp), and push notifications for verification codes, game reminders, and cancellations.
• Cloud infrastructure providers — for database hosting, application hosting, and source-code deployment.
• Media storage providers — to host avatar and image uploads.
• Map, weather, and font providers — for venue maps, weather forecasts, and web-font delivery.
• Browser push services — to deliver web push notifications to your device.

Some of these processors operate outside the European Union; see §7 for cross-border transfer information.

What we do not use. No third-party analytics trackers (our audience measurement is self-hosted, cookieless and stores no personal data; see §4). No advertising pixels. No social-login providers. No email marketing platforms. If this changes, we will update this Policy and notify you per §12.

6. Data Retention

We retain your personal data only as long as necessary for the purposes set out in this Policy:

• Account data (profile, settings, social graph): retained for the lifetime of your account. When you delete your account it is erased immediately (see §8.1); residual copies in our database backups are deleted as those backups expire, within 30 days.
• Verification codes (SMS/WhatsApp OTP): deleted immediately after successful verification; expired codes purged within 24 hours.
• Transaction and ledger data: retained for 10 years to comply with Portuguese tax-accounting law (CIRS Art. 129, CIVA Art. 70).
• NIF: retained for the same period as transaction data (10 years).
• Server logs (IP, user agent, error logs): retained for 90 days for security and debugging, then automatically purged.
• Chat messages and testimonials: retained for as long as the conversation or game they belong to exists. When you delete your account they stay visible to the other players, shown as from a "Deleted player" (see §8.1).
• Push subscription keys: deleted when you unsubscribe or close your account.
• Consent audit records: retained for the lifetime of your account plus 3 years, as evidence of compliance.

7. International Data Transfers

Your primary account data is stored in the European Union.

Some of the processor categories listed in §5 operate outside the EU/EEA — typically payment processors, media storage providers, map and font providers, and cloud infrastructure providers with global footprints. Where this occurs, the transfer is protected by Standard Contractual Clauses approved by the European Commission (Decision 2021/914), or another valid transfer mechanism under GDPR Chapter V.

To request a list of the specific processors currently used and their processing locations, contact privacy@primeplay.football.

8. Your Data Protection Rights

Under GDPR Articles 15–21, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention obligations (e.g., tax records).
• Restriction — request that we limit processing of your data in certain circumstances.
• Object — object to processing based on legitimate interests or for direct marketing.
• Data portability — receive your data in a structured, machine-readable format and transmit it to another service.
• Withdraw consent — at any time, for processing based on consent (this does not affect processing already carried out).

To exercise any of these rights, email privacy@primeplay.football with the subject line "Data Subject Request." We will respond within one month (extendable by two further months for complex requests, per GDPR Article 12(3)).

Right to complain. If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Portuguese supervisory authority — Comissão Nacional de Proteção de Dados (CNPD), Av. Brasília 12, 1300-506 Lisboa, Portugal. Website: cnpd.pt.

8.1 Deleting your account

You can delete your account yourself at any time from Account → Delete account. Before anything happens, the app shows exactly what will be cancelled, refunded and forfeited, and asks you to confirm with a code sent to your phone. Deletion is permanent and cannot be undone.

What we delete. Your name, phone number, email, photo, date of birth and other profile details, your follows, saved games and venues, game invites, notifications, push subscriptions and login sessions. Your customer record at our payment processor (Stripe) is deleted too, together with any saved cards.

What we keep, anonymised, and why. Payment, wallet ledger, refund and invoice records are kept for the period set out in §6, without your name, because Portuguese tax and accounting law requires it (legal obligation, GDPR Articles 6(1)(c) and 17(3)(b)). Messages you sent stay in their chats and your past games stay in other players' history, shown as from a "Deleted player". Bug, idea and feedback reports keep their content but lose your contact email and device details.

Your balance. Upcoming bookings are cancelled under the normal cancellation policy. The withdrawable part of your balance is refunded to the original card or payment method, minus the fee our payment processor (Stripe) charged on that payment. Balance that cannot be withdrawn is forfeited: rewards and promotional credit, balance not linked to a card payment (such as credit from before we recorded each payment separately), payments made with MB WAY or Revolut Pay that are older than those methods' refund windows (365 and 180 days), and amounts below the refund minimum.

Card refunds usually arrive within 5 to 10 business days.

9. Security

We use industry-standard technical and organisational measures to protect your personal data:

• Encryption in transit: all traffic uses HTTPS/TLS.
• Payment data: card data never touches our servers — payment processing is fully delegated to our payment processor, which is PCI-DSS Level 1 certified.
• Authentication: JWT tokens signed with a server-side secret; OTP codes expire after a short window; brute-force attempts trigger cooldowns.
• Access controls: administrative access is restricted and logged; admin actions require admin-role authentication.
• Security headers: we use Helmet middleware and rate-limiting on sensitive endpoints.
• Vulnerability disclosure: if you discover a security issue, contact privacy@primeplay.football.

No method of transmission over the Internet is fully secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

To register you must be at least 16 years old, and by accepting these Terms at signup you confirm that you are. This is a PrimePlay platform rule, not a requirement of Portuguese Law 58/2019, which sets 13 as the age from which a child can give valid consent to online information-society services (Article 16).

If we learn that an account belongs to a child under 16, we will close the account and delete the data, refunding any wallet balance to the original payment method. Parents or guardians who believe their child has registered should contact privacy@primeplay.football.

Accounts whose date of birth shows that the member is under 18 are not searchable by other members by default (see Section 3.1).

11. Links to Other Websites

Our service may contain links to third-party websites (e.g., video or social-media links, the payment processor's checkout, venue websites) that we do not control. We are not responsible for the privacy practices or content of these external sites. We recommend you review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top indicates when the policy was last revised. We will notify users of material changes via SMS, WhatsApp, or in-app notification at least 14 days before changes take effect.

Continued use of the Service after the effective date of revised policy constitutes acceptance of the changes.

13. Contact and Supervisory Authority

If you have any questions, requests, or complaints about this Privacy Policy or your personal data, contact us:

• PrimePlay Sports Technologies
• Tax ID (NIF): 517651220
• Rua do Conde de Redondo, 80, 7º Esquerda
• 1150-109 Lisboa, Portugal
• Email: privacy@primeplay.football

Supervisory authority. Comissão Nacional de Proteção de Dados (CNPD), Av. Brasília 12, 1300-506 Lisboa, Portugal. Website: cnpd.pt.