Privacy Policy (GDPR & KVKK) — MatchdayLeague
This notice explains how MatchdayLeague (matchdayleague.com, the "Service") processes your personal data under the EU General Data Protection Regulation ("GDPR"), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 ("KVKK"). Which regime applies is determined by your country at the time of registration.
1. Controller
The operator of MatchdayLeague is the data controller. Contact: [email protected].
2. Data we process
| Data | Source | Purpose |
|---|---|---|
| Username, password (stored as an irreversible hash), e-mail address | Registration form | Account creation, sign-in, password reset, security notices |
| Club name, colours, in-game preferences, game progress, chat and private messages | Using the game | Providing the Service; multiplayer features |
| IP address, browser/device data, access time, country | Server and Cloudflare logs | Security, abuse and attack prevention, debugging |
| Pseudonymous user ID (numeric account number), in-game events, page views, device and approximate location | Google Analytics 4 and Google Tag Manager tags (only with your consent; the tag manager runs no measurement tags before consent) | Product analytics, improving the game |
| Page views, in-game events, acquisition source (campaign/UTM), device information | Attrely (web attribution measurement; only with your consent) | Measuring the effectiveness of marketing campaigns |
| The text of a chat message you ask to have translated (without sender identity) | DeepL SE (machine translation; only when you tap "Translate" or enable auto-translate) | Translating chat messages into your language |
| Push subscription (browser endpoint) | If you enable notifications | Match, transfer and message notifications |
| Two-factor secret and backup codes (encrypted) | If you enable 2FA | Account security |
| Invite code and inviting account | Registering via an invite link | Granting invite rewards |
We do not request or process government IDs, payment details or special categories of data. The game is free; no payments are taken.
3. Legal bases
- Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c): account, game progress, messaging.
- Legitimate interests (Art. 6(1)(f); KVKK Art. 5/2-f): security logs, cheating and abuse prevention, error logs.
- Consent (Art. 6(1)(a); KVKK Art. 5/1): Google Analytics measurement, push notifications, marketing e-mails (if any). You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities.
4. Recipients and international transfers
Data is shared only as needed to run the Service with these processors: Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (CDN, DDoS protection, DNS; EU and US data centres under EU Standard Contractual Clauses), Google LLC (Google Analytics 4, Google Tag Manager and Google Ads conversion measurement – only with your consent; IP anonymisation enabled; EU SCCs / EU-US Data Privacy Framework), Attrely (web attribution measurement – only with your consent), DeepL SE (machine translation of chat messages – only when you request a translation, Germany; the text is sent without sender identity and the result is cached in the game) and an e-mail delivery provider (password reset and security e-mails). Transfers outside the EEA/UK/Türkiye rely on the safeguards in GDPR Chapter V and KVKK Art. 9. We never sell your data or share it with third parties for advertising.
5. Cookies and local storage
The Service stores a session key, language and theme preference in your browser's local storage (strictly necessary). Google Analytics cookies (_ga, _ga_*) and Attrely attribution measurement are enabled only if you choose "Accept" in the cookie banner; if you decline, Analytics runs without cookies and without identifiers, or not at all. You can change your choice under Club → Settings → Privacy.
6. Retention
- Account data: until you delete your account; deleted or anonymised within 30 days of a deletion request.
- Server and security logs: 90 days.
- Google Analytics data: 14 months (Google setting).
- Backups: rotated within 30 days.
7. Your rights
Under GDPR Art. 15–22 and KVKK Art. 11 you have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent. In the game you can change your e-mail and password and request account deletion under Club → Account & Security. We respond within 30 days. You may lodge a complaint with your local supervisory authority (in Türkiye: the Personal Data Protection Authority).
8. Children
The Service is not directed at children under 13. For users in the EU, analytics consent is not collected from anyone under 16. If we learn that we hold data of a child, we delete it promptly.
9. Message moderation
In-game chat channels and private messages between managers are retained and may be reviewed by authorised administrators to keep the service safe and enforce community rules; content that appears to involve threats, harassment, fraud, sexual material, or risk to minors may be flagged automatically. This review is carried out solely for safety and moderation purposes.
9a. Multi-account and cheating prevention
To protect the game economy, the IP address and a random browser-generated device identifier (containing no personal data) are stored for 90 days at registration and login. Transfers, loans, duels, alliances and referral rewards between accounts created from the same device or network may be restricted, and accounts that break the rules may be suspended. Guest accounts play in a separate trial league and are deleted after 36 hours.
10. Security
Passwords are hashed with irreversible algorithms, all traffic is encrypted with HTTPS, servers are protected by firewall and intrusion prevention, and daily backups are taken. Optional two-factor authentication is available.
11. Changes
When this notice changes, the version date is updated and material changes are announced in-game.