Privacy policy

Identification

To contact Weyland Tech, S.L. or exercise your data rights, use the linked public form or write to the registered address shown. No account is required.

Data and purposes

We process data about footballers, coaches and referees who are not site users: names and aliases, birth dates and places, nationality, authorised photographs, appearances, minutes, events, career records and editorial ratings labelled as opinion. Sources include sporting records, match archives, Wikidata, Wikimedia Commons and reviewed contributions. Not every person has every field. We disclose coverage and do not infer absent information.

For users and editors we process email, account identifier, role, session and authorised activity. For correction reporters we process contact information if supplied, the report, proposed value, links or documents, status and decisions. Contact details and documents are not public. IP addresses, technical logs and abuse signals support security, service delivery and rate limits, not advertising.

Legal bases

For the sporting archive and editorial publication we rely on the legitimate interest in informing the public and preserving sporting memory (GDPR article 6(1)(f)). The balance considers the public interest in the record, each item’s relevance to sporting activity and its privacy impact; being public does not make every item suitable for publication. GDPR article 85 and Spanish LOPDGDD articles 85 and 86 reconcile expression, information and rights, without providing a separate lawful basis or blanket exemption. For minors, their best interests, data minimisation and exclusion of information unrelated to sport take priority. The rectification route allows requests for correction, objection or restriction and a reasoned response. Photographs also require copyright permission and an image-rights assessment.

Accounts, requested sessions and services rely on contract (6(1)(b)); optional consent-based features, where applicable, rely on 6(1)(a), with withdrawal possible. Security and abuse prevention rely on legitimate interest (6(1)(f)). Handling statutory rights and duties relies on legal obligation (6(1)(c)); other voluntary contributions rely on the legitimate interest in accuracy (6(1)(f)). Ratings are human judgements, not facts or identity evidence. The identity reviewer processes names, birth dates and nationalities to propose reviews; the model makes no final decisions and cannot amend facts on its authority.

Rights and complaints

You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent, through the linked public form or by post to the registered address shown. No account is required. You may complain to the AEPD (aepd.es). Identity checks are proportionate. The ordinary response period is one month; justified extensions are notified under the GDPR. Information collected from third parties is explained under Article 14; no exemption from individual notification is presumed.

Retention and erasure

Sporting facts (matches, events, lineups, minutes and career records), identity decisions and their evidence including superseded decisions, published editorial opinions with author and date, and community rating aggregates are retained indefinitely for archival and journalistic purposes. Original records and later decisions remain traceable. The proposed basis is legitimate interest in informing and preserving the archive (GDPR Article 6(1)(f)), reconciled with expression and information under Article 85 and Spain’s LOPDGDD. An objection or erasure request about a sporting fact is handled through rectification with a reasoned response, rather than automatic removal of the archive. This does not exclude mandatory rights: correction, restriction, blocking and Article 17(3) exceptions are assessed case by case.

Photographs remain while the licence holds and are withdrawn if it changes or the subject objects. Publication stops when the decision is recorded; stored objects are removed by the daily job. Pages fall back to a shirt number or neutral placeholder. Withdrawal provenance remains, not a public image copy.

Accounts remain while active and are purged 30 days after a closure request, which immediately suspends access. Community aggregates survive, but the account link and account identifiers in provenance are removed. Published editorial opinions retain author and date separately from login accounts. Correction reports and decisions remain as provenance; reporter contact is stored separately and deleted 12 months after resolution.

Reviewer invocation logs remain complete for 24 months, then become monthly counts and costs without person-level detail, inputs, responses or invocation quotations. Separately retained decision evidence follows the archive schedule. Magic links last one hour. Application sessions last at most 30 days; editorial access retains the stricter eight-hour limit and two hours without refresh. Supabase Free has no native session timeboxing; application checks and policies enforce these limits.

Our technical logs and rate-limit signals have a 90-day maximum. We do not claim providers retain 90 days: Vercel Pro runtime logs and Supabase Free API/database logs are available for one day. Availability limits do not prove deletion of all provider-internal copies. No log drain extends these periods. A daily job records time, result and removal/reduction counts without copying deleted detail. Expiry is processed on the next daily run; failures are recorded for retry.

Processors and transfers

Supabase hosts database, authentication, photographs and documents: the current project is in Paris (eu-west-3), without guaranteeing EEA-only support, logs or subprocessors. Vercel hosts and distributes the site globally; its current function region is iad1, United States. Anthropic supplies the identity-review API: default storage is in the United States and processing may occur in other regions under its terms. Ratings are not sent to the reviewer. Production configuration and recipients must be confirmed.

Agreements: the Dr futbol organisation’s Supabase dashboard says its DPA is incorporated into its terms. Vercel’s DPA covers Pro/Enterprise agreements and Anthropic’s is incorporated into commercial terms. We have not verified that Weyland Tech, S.L. is the contractual customer for all three; this draft does NOT claim all three DPAs were accepted under that company. Transfers outside the EEA require the standard contractual clauses provided by the DPAs or another documented valid mechanism, with assessment and supplementary safeguards where needed. Their actual applicability and any adequacy reliance must be verified before launch.