Privacy Policy (GDPR & KVKK) — MatchdayLeague
This notice explains how MatchdayLeague (matchdayleague.com, the "Service") processes your personal data under the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Which regime applies is determined by your country at the time of registration.
1. Controller
The operator of MatchdayLeague is the data controller. Contact: [email protected].
2. Data we process
| Data | Source | Purpose |
|---|---|---|
| Username, password (stored as an irreversible hash), e-mail address | Registration form | Account creation, sign-in, password reset, security notices |
| Club name, colours, in-game preferences, game progress, chat and private messages | Using the game | Providing the Service; multiplayer features |
| IP address, browser/device data, access time, country | Server and Cloudflare logs | Security, abuse and attack prevention, debugging |
| Pseudonymous user ID (numeric account number), in-game events, page views, device and approximate location | Google Analytics 4 (only with your consent) | Product analytics, improving the game |
| Push subscription (browser endpoint) | If you enable notifications | Match, transfer and message notifications |
| Two-factor secret and backup codes (encrypted) | If you enable 2FA | Account security |
| Invite code and inviting account | Registering via an invite link | Granting invite rewards |
We do not request or process government IDs, payment details or special categories of data. The game is free; no payments are taken.
3. Legal bases
- Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c): account, game progress, messaging.
- Legitimate interests (Art. 6(1)(f); KVKK Art. 5/2-f): security logs, cheating and abuse prevention, error logs.
- Consent (Art. 6(1)(a); KVKK Art. 5/1): Google Analytics measurement, push notifications, marketing e-mails (if any). You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities.
4. Recipients and international transfers
Data is shared only as needed to run the Service with these processors: Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (CDN, DDoS protection, DNS; EU and US data centres under EU Standard Contractual Clauses), Google LLC (Google Analytics 4 – only with your consent; IP anonymisation enabled; EU SCCs / EU-US Data Privacy Framework) and an e-mail delivery provider (password reset and security e-mails). Transfers outside the EEA/UK/Türkiye rely on the safeguards in GDPR Chapter V and KVKK Art. 9. We never sell your data or share it with third parties for advertising.
5. Cookies and local storage
The Service stores a session key, language and theme preference in your browser's local storage (strictly necessary). Google Analytics cookies (_ga, _ga_*) are set only if you choose "Accept" in the cookie banner; if you decline, Analytics runs without cookies and without identifiers, or not at all. You can change your choice under Club → Settings → Privacy.
6. Retention
- Account data: until you delete your account; deleted or anonymised within 30 days of a deletion request.
- Server and security logs: 90 days.
- Google Analytics data: 14 months (Google setting).
- Backups: rotated within 30 days.
7. Your rights
Under GDPR Art. 15–22 and KVKK Art. 11 you have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. In the game you can change your e-mail and password and request account deletion under Club → Account & Security. We respond within 30 days. You may lodge a complaint with your local supervisory authority (in Türkiye: the Personal Data Protection Authority).
8. Children
The Service is not directed at children under 13. For users in the EU, analytics consent is not collected from anyone under 16. If we learn that we hold data of a child, we delete it promptly.
9. Security
Passwords are hashed with irreversible algorithms, all traffic is encrypted with HTTPS, servers are protected by firewall and intrusion prevention, and daily backups are taken. Optional two-factor authentication is available.
10. Changes
When this notice changes, the version date is updated and material changes are announced in-game.