PRIVACY POLICY

1. Data We Collect

We collect the following categories of personal data:

• Identity Data: Name, date of birth, email address, phone number
• Registration Data: Country selection, position, jersey preferences, soccer experience
• Medical Data: Allergies, medical conditions, medications (encrypted at rest)
• Emergency Contact: Name, relationship, phone number
• Payment Data: Processed securely via Stripe; we do not store card numbers
• Usage Data: Pages visited, interactions, device information

2. How We Use Your Data

• Process and manage your tournament registration
• Communicate tournament updates, schedules, and logistics
• Provide medical staff with necessary health information during the tournament
• Process payments and manage refunds
• Improve our website and services
• Comply with legal obligations

3. Legal Basis (GDPR)

We process your data based on: (a) your explicit consent, (b) performance of a contract (registration), (c) legitimate interests (improving services), and (d) legal obligations.

4. Data Security

Medical information is encrypted using AES-256-CBC encryption. All data is transmitted via HTTPS/TLS. Access to personal data is restricted to authorized personnel only. We conduct regular security audits.

5. Data Retention

We retain your data for the duration of your account plus 2 years for legal and compliance purposes. Cancelled registrations are anonymized after 30 days upon request.

6. Your Rights (GDPR Articles 15-22)

• Right of Access: Request a copy of all data we hold about you
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your data (30-day grace period)
• Right to Data Portability: Receive your data in machine-readable format (JSON)
• Right to Withdraw Consent: Withdraw consent at any time via your account settings

Exercise these rights at My Account → My Data or by contacting us.

7. Cookies

We use essential cookies for site functionality and optional analytics cookies. You can manage your preferences via our cookie banner. Essential cookies cannot be disabled as they are required for the site to function.

8. Third-Party Services

• Stripe: Payment processing (PCI DSS compliant)
• Resend: Email delivery
• Vercel: Hosting and analytics
• Neon: Database hosting

9. International Transfers

Your data may be processed in the United States. We ensure appropriate safeguards are in place for international data transfers in compliance with GDPR.

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect data from minors.

11. Contact

Data Protection inquiries: privacy@fansworldcup.com

General inquiries: info@fansworldcup.com