Privacy Policy

LeanPlay Football is the controller of the personal data described in this notice, except where it acts as a processor on behalf of a club or agency under the Data Processing Addendum.

A Data Protection Officer has been appointed pursuant to Article 37 GDPR and may be contacted at dpo@leanplayfootball.com for all matters relating to the processing of your personal data and the exercise of your rights.

Depending on your role, we process:

• identity and contact data: name, date of birth, nationality, photograph, email address, telephone number, postal address;
• verification data: identity documents, passport or national identity card data, birth certificates, proof of guardianship, agent licence numbers, club registration evidence;
• sporting and performance data: position, club history, appearances, minutes, goals, assists, contract status and expiry, match footage and scouting assessments;
• guardian data: identity and contact details of parents or legal guardians and evidence of consent;
• transaction data: subscription plan, invoices, VAT identification, payment status (payment card details are processed exclusively by our payment service provider and are never stored by LeanPlay);
• technical data: IP address, device and browser identifiers, authentication logs, audit trails of document access; and
• communications: correspondence with our support, compliance and safeguarding teams.

Where identity documents reveal information capable of being treated as a special category of data, or where safeguarding concerns require the processing of health or welfare information, that processing takes place only on the basis of Article 9(2)(a) explicit consent, Article 9(2)(f) legal claims, or a substantial public interest basis recognised under applicable national law, and is subject to enhanced access controls.

We process personal data on the following bases:

• performance of a contract (Article 6(1)(b)): account creation, provision of the platform, document custody, subscription administration and support;
• compliance with a legal obligation (Article 6(1)(c)): tax and accounting retention, statutory safeguarding reporting, responses to lawful requests from authorities;
• legitimate interests (Article 6(1)(f)): identity and document fraud prevention, platform security, service improvement, aggregated and anonymised analytics, and defence of legal claims — in each case balanced against your rights and interests, with the balancing assessment available on request; and
• consent (Article 6(1)(a)): non-essential cookies, marketing communications, publication of highlight footage and any optional visibility of a profile to specific clubs. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Where a player is under 18, verified guardian consent is obtained in addition to any consent given by the player, and the guardian may withdraw it on the player's behalf.

Market value indications, marketability scores and search ranking involve algorithmic processing. These outputs are decision-support tools only: they do not produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR, and no offer, rejection or verification outcome is decided solely by automated means. Verification decisions are subject to human review, and you may request an explanation of the principal factors used.

Personal data may be disclosed to: clubs and licensed agents you have expressly authorised; verification and identity assurance providers; hosting, database and email infrastructure providers; payment service providers; professional advisers; and competent authorities, national associations, FIFA or law enforcement where disclosure is required by law or necessary to protect a child.

Documents held in the secure vault are disclosed only on the basis of a granular, revocable, time-limited access grant, and every access event is logged and visible to the data subject or their guardian. LeanPlay does not sell personal data and does not disclose player documentation to unverified parties.

Where personal data is transferred outside the European Economic Area, the transfer is made on the basis of an adequacy decision under Article 45 GDPR or, failing that, the European Commission's Standard Contractual Clauses under Article 46(2)(c), supplemented by a transfer impact assessment and appropriate technical measures including encryption in transit and at rest. A copy of the relevant safeguards is available on request.

Personal data is retained only for as long as necessary for the purposes described:

• account and profile data: for the duration of the account and twenty-four (24) months thereafter;
• verification documents: twelve (12) months after verification lapses or the account closes, unless a longer period is required to defend legal claims;
• contractual and financial records: ten (10) years from the end of the relevant financial year, in accordance with statutory bookkeeping obligations;
• safeguarding records: for the period required by the applicable child protection framework, and in any event no longer than necessary; and
• server and access logs: twelve (12) months.

At the end of the applicable period, data is securely deleted or irreversibly anonymised.

Subject to the conditions in the GDPR, you have the right of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection to processing based on legitimate interests or direct marketing (Article 21), as well as the right to withdraw consent at any time.

Requests may be submitted to dpo@leanplayfootball.com and will be answered without undue delay and in any event within one (1) month, extendable by two (2) further months where necessary. Identity verification may be required. No fee is charged unless a request is manifestly unfounded or excessive.

You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement, without prejudice to any other remedy.

LeanPlay applies technical and organisational measures appropriate to the risk under Article 32 GDPR, including encryption in transit and at rest, role-based access control, least-privilege administration, multi-factor authentication for privileged accounts, immutable audit logging, segregated environments and periodic penetration testing.

Personal data breaches likely to result in a risk to rights and freedoms are notified to the competent supervisory authority within seventy-two (72) hours of awareness, and affected data subjects are informed without undue delay where the risk is high.

The processing of children's personal data is subject to heightened protection, including data minimisation by default, restricted visibility of profiles belonging to minors, guardian-controlled access grants and a prohibition on behavioural advertising. Further detail is set out in the Safeguarding & Minors Policy.

This notice may be updated to reflect legal or operational developments. Material changes will be notified in advance by email or in-platform notice. The version and date shown at the head of this document identify the current text.