PRIVACY

Privacy Policy

Updated: November 2024

1. INTRODUCTION

This Privacy Policy (“Privacy Policy”) relates to (i) the Guardians of the Ball software application or any related software application (“Apps”) and (ii) the website https://www.GuardiansoftheBall.com and/or any sub-website and/or associated domains (and/or sub-domains) of https://www.GuardiansoftheBall.com(the “Site”), (iii) the Marketplace, (iv) the owner of the Site and (v) the services provided by it and its subsidiaries, whether direct or indirect, including but not limited to Guardians of the Ball Limited (hereinafter collectively referred to as “We”, “Us”, “Our”, “Ourselves” and/or “Guardians of the Ball Limited.”).

“You”, “Your” and “User” refer to an identified or identifiable natural person being the User of the Site, Apps and/or client (or prospective client) of any of Our services.

This Privacy Policy provides detailed, layered information as to how and why We process Personal Data (via the Site, any of Our Apps, or otherwise) as well as detailed information about Your various rights. We are committed to protecting Your privacy and handling your information in an open and transparent manner.

We strongly encourage You to read this Privacy Policy with care. Please contact Us for any clarification You may need. We would be happy to provide You with any information You may need.

Any questions, comments or complaints that you might have should be emailed to [email protected]

2. CONTENTS OF THIS PRIVACY POLICY

Introduction
Contents of this Privacy Policy
Principles
Applicable Laws
What is personal data?
Personal data we collect about you
How and why, we collect personal data
What we use your personal data for (purpose of processing)
Region Specific Disclosures
Special note on consent
Accuracy of personal data
Direct marketing
Data Transfers
How we disclose personal data.
Security measures
Retention periods
Processing for research and statistical reasons
Links to third-party sources
Cookies
Minors
Your rights under the data protection laws
Guardians of the Ball Limited. – company details
Updates

3. PRINCIPLES

We are committed to protecting your privacy and adhering to the following key data protection principles in compliance with the General Data Protection Regulation (GDPR) and Maltese law:

Lawfulness, Fairness, and Transparency: All Personal Data we collect via the Site, Apps, Marketplace, or Our services will be processed lawfully, fairly, and transparently. Users will be provided with clear and accessible information on the purposes for data collection, the way We use Personal Data, and the specific rights available under GDPR.
Purpose Limitation: Personal Data will be collected only for specified, explicit, and legitimate purposes related to the provision of football-related experiences on the Site, Apps, and Marketplace, including interactive and promotional activities with partnered football clubs. We will not process Personal Data for purposes incompatible with these objectives unless required by law.
Data Minimization: We limit data collection to only what is necessary for the specified purposes. This includes basic identification data, usage information within the Site, Apps, and Marketplace, and preferences related to football content and experiences.
Accuracy: We take reasonable steps to ensure that the Personal Data we hold is accurate and up to date. Users may request rectification of inaccurate data at any time. We also conduct periodic data reviews to maintain data accuracy.
Storage Limitation: Personal Data will be retained only as long as necessary to fulfill the purposes for which it was collected or as required by legal retention obligations. After these purposes are achieved, data will be securely deleted or anonymized.
Integrity and Confidentiality (Data Security): We are dedicated to safeguarding your Personal Data by implementing robust technical and organizational security measures. These measures protect against unauthorized access, misuse, accidental loss, or destruction, ensuring only authorized personnel have access to Personal Data. Data protection protocols include encryption, restricted access, and secure storage practices.
Accountability: As the data controller, Guardians of the Ball Limited is accountable for upholding these principles and can demonstrate compliance through regular audits, staff training, and systematic reviews of privacy practices. We take responsibility for ensuring the protection of your Personal Data in all aspects of Our operations and with any authorized third parties.

Users are encouraged to read this Privacy Policy carefully for a complete understanding of how We process Personal Data. If you have any questions or require further information, please contact us. We are committed to addressing any inquiries and providing the information you need to feel confident about your privacy.

4. APPLICABLE LAWS

As an entity established in Malta, the main privacy laws that are applicable to us in so far as You are concerned, are the following:

Federal Law Privacy Policy Requirements:

General Data Protection Regulation (GDPR) (EU) 2016/679
Maltese Data Protection Act (Chapter 586 of the Laws of Malta)
ePrivacy Regulation
Digital Content Directive
Any subsequent legislation or amendments applicable within the European Union or Malta

All the above is referred to collectively as the “Data Protection Laws”

5. WHAT IS PERSONAL DATA

“PERSONAL DATA” means any information that identifies You as an individual or that relates to an identifiable individual.

Whenever it is not possible or feasible for Us to make use of anonymous and/or anonymized data (in a manner that does not identify any Users of the Site, Apps or customers of Our services), We are nevertheless committed to always protecting Your privacy and the security of Your Personal Data. We collect Personal Data in various ways, digitally via the Site or the Apps (either when you choose to provide Us with certain data or in some cases automatically, or from third parties).

6. PERSONAL DATA WE COLLECT ABOUT YOU

We collect various categories of Personal Data from you, namely:

CATEGORY OF PERSONAL DATA

DESCRIPTION

Contact Details
Full legal name, email address, and mobile/phone number.
Location
IP address of the computer connected to the internet, location data through the mobile phone and Apps used and GPS data.
Payment data, such as credit card information and billing address.
Usage date
Details about how and when you use Our services (our Site and/or Apps)
Details about You that are stored in documents in different formats, or copies of them.
This includes identity cards and other data that confirm Your identity and prove the residential address; as well as any other additional documentation as deemed necessary by Our compliance team

Special types of data

Data Protection Laws treat some types of personal information as special, which We will only collect and use if the law allows Us to do so. Such data consist of:

Political connections
Criminal convictions and offences

7. HOW AND WHY WE COLLECT PERSONAL DATA

As a general rule, We do not collect any Personal Data, that is, information that identifies You as an individual other than that which You choose to provide to Us such as the data (including Contact Details) You provide when registering with our Site or Apps, when contacting Us with enquiries relating to Our services, when subscribing to any service offered by Us or via Our Site or Apps, such as any newsletters as may be issued by Us from time to time or even when subscribing to any offers We (and/or Our affiliates and/or corporate partners) may offer from time to time.

However, we may also collect personal data from other sources, joint marketing partners, social media, partnerships, platforms and other third parties. We may also receive Personal Data about You from third parties when We need to confirm Your contact details. Should this be the case, we will take all measures as required by law to further inform You about the source of such Personal Data as well as the categories of Personal Data We collect and process. There are certain instances at law where We are specifically forbidden from disclosing to You such activity (for example, when carrying out due diligence for anti-money laundering purposes).

For information about the Personal Data that We may collect automatically via the Site or Apps, please see the Cookies section below. Unless otherwise specified and subject to various controls, as a general rule, we only collect Personal Data (from You or elsewhere) that We:

Need to be able to provide You with the services You request from Us;
Are legally required to collect/use and to keep for a predetermined period of time (three years) in accordance with the nature of the data and the purposes of processing.
Believe to be necessary for Our legitimate business interests

A detailed description of the reasons why We process specific categories of personal data as well as the corresponding legal ground(s) for doing so, please see the ‘What We Use Your Personal Data For (Purpose of Processing)’ below.

8. WHAT WE USE YOUR PERSONAL DATA FOR (PURPOSE OF PROCESSING)

Data Protection Laws permit Us to process personal data only if we have a lawful basis for doing so. In accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws, we must rely on one or more of the following lawful bases:

To perform the services, You have contracted with Us
When We are legally obligated to do so
When it is necessary for Our legitimate interest, meaning that We have a justified business or commercial reason to use Your personal data. If We rely on Our legitimate interest, We will clearly inform You of that interest
When You have provided Your explicit consent

Below is a description of the purposes for which We use Your Personal Data and the corresponding legal ground(s) upon which We rely.

Please note that the right to withdraw your consent is a fundamental right under data protection laws. This means that, when the processing of your personal data is based on your consent, you have the right to withdraw it at any time without penalty. Just as you provided your consent, you may withdraw it at will. Once you withdraw your consent, we will cease processing your personal data for the relevant purposes, unless another legal basis exists that allows us to continue such processing.

For the purposes of setting up an account on our system, categories of personal data We collect include contact details, documentary data, national identifiers and special category (particularly political connections) data. The legal basis for processing such data is based on contractual necessity, legitimate interest to ensure We have an accurate account and legal duty for due diligence purposes.
For the purposes of managing our relationship with You, categories of personal data we collect are mainly contact details for purposes of contractual necessity and compliance with legal obligations.
For the purposes of establishing and investigating any suspicious behavior to protect our business from any risk, fraud or other illegal activities (such as money laundering or terrorist financing) categories of personal data we collect are mainly documentary data and contact details. The legal basis to collect this data is based on our compliance with legal obligations and legitimate interest in detection and prevention of fraud or other illegal activities.
For the purposes of subscribing to a newsletter or mailing list We mainly collect contact details based on your consent.
For the purposes of evaluating your queries and/or requests you send Us to use/receive any of Our services (including customer support services) We mainly collect contract details based on contractual necessity and legitimate interest to be able to attend to Your queries.
For the purposes of maintaining and updating the user accounts records on Our system we will be required to collect contact details based on contractual necessity and legitimate interest to ensure We have an accurate user account record.
For the purposes of continuing to manage our relationships with You We will be required to collect contact details based on contractual necessity and compliance with legal obligations.
For the purposes of complying with legal and regulatory obligations including the detection and prevention of any financial crime We will be required to collect documentary data, special types of data, national identifiers and locational data based on our legal obligations.
For the purposes of providing, you with our services, especially those provided via the App including location services We will be required to collect contact details and tracking data based on our contractual necessity.
For the purposes of developing and managing Our brands, products and services We will be required to collect contact details based on legitimate interest to develop Our products and services.
For the purposes of internal data analysis, We will be required to collect contact details and tracking data based on contractual necessity.

Should We need to process Your data for a new purpose in the future, which is entirely unrelated to the above, We will inform You of such processing in advance and You may exercise Your applicable rights (as explained below) in relation to such processing.

Finally, do note that without certain Personal Data relating to You, We may not be in the position to provide some or all of the services You expect from Us or even to guarantee the full functionality of Our Site and/or App.

9. Region Specific Disclosures

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal information about residents of certain countries, regions, or states. Please refer below for disclosures that may be applicable to you:

European Union (EU). If you are located within the European Union, we process personal data in accordance with the General Data Protection Regulation (GDPR). This includes ensuring your rights to access, rectify, delete, restrict, or object to the processing of your personal data, as well as the right to data portability. For further information on how we handle personal data under the GDPR, please contact us as outlined in our privacy policy.
Brazil. If you are a resident of Brazil, we comply with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, LGPD). Under the LGPD, you have specific rights concerning your personal data, including the right to access, rectify, anonymize, and delete your data. Please reach out to us for more details on our compliance with LGPD.
California. If you are a resident of the State of California in the United States, we comply with California Consumer Privacy Act of 2018 (CCPA) specific privacy disclosures, including your right to access, delete, and opt-out of the sale of your personal information.
Nevada. If you are a resident of the State of Nevada, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect. To submit such a request, please contact us at GuardiansoftheBall.com with the subject line “Nevada opt-out.”
Canada. If you are a resident of Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy laws. Under PIPEDA, you have the right to access and correct your personal information and to know how it is used and disclosed.

In those limited cases, We will process Your Personal Data based on Your consent, which We will obtain from You in a clear and manifest manner. In such cases where You provide Us with Your consent, You shall have the right to withdraw Your consent at any time and this, in the same manner as You shall have provided it to Us unless an alternative option is provided by Us.

Should You exercise Your right to withdraw Your consent at any time (by writing to Us at the physical or email address below), We will determine whether at that stage an alternative legal basis exists for processing Your Personal Data (for example, based on a legal obligation to which We are subject) where We would be legally authorized (or even obliged) to process Your Personal Data without needing Your consent and if so, notify You accordingly.

When We ask for such Personal Data, You may always decline, however, should You decline to provide Us with necessary data that We require to provide requested services, We may not necessarily be able to provide You with such service (such as location services), especially if consent is the only legal ground that is available to Us.

Just to clarify, consent is not the only ground that permits Us to process Your Personal Data. In the above Section 7, We pointed out the various grounds that We rely on when processing Your Personal Data for specific purposes.

11. ACCURACY OF PERSONAL DATA

All reasonable efforts are made to keep any Personal Data We may hold about You up-to-date and as accurate as possible. You can check the information that We hold about You at any time by contacting Us in the manner explained below. If You find any inaccuracies, We will correct them and where required, delete them as necessary. Please see below for a detailed list of Your legal rights in terms of any applicable Data Protection Laws.

12. DIRECT MARKETING

We only send mail messages, emails and other communications relating to marketing where We are authorized to do so at law. In most cases, We rely on your consent to do so (especially where we use electronic communications). If, at any time, You no longer wish to receive direct marketing communications from Us please let Us know by contacting Us at the details below or update Your preference on any of Our Site(s) or Apps.

In the case of direct marketing sent by electronic communications (where We are legally authorized to do so) You shall be given an easy way of opting out (or unsubscribing) from any such communications.

Please note that even if You withdraw any consent, You may have given Us or if You object to receiving such direct marketing material from Us (in those cases where We do not need Your consent), from time to time We may still need to send You certain important communications from which You cannot opt out.

13. DATA TRANSFERS

Personal Data collected by Guardians of the Ball may be stored and processed within the European Economic Area (EEA), specifically in Malta where our primary operations are based, and in any other region where we have authorized third-party service providers or significant operational activities. We take necessary steps to ensure that all Personal Data collected under this Privacy Policy is stored and processed in accordance with this Privacy Policy and GDPR requirements, regardless of where it is located. If Personal Data is transferred outside the EEA to countries that do not have an adequacy decision by the European Commission, we implement appropriate safeguards to ensure adequate protection of your Personal Data. These safeguards may include, where applicable, the use of Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognized mechanisms under GDPR.

14. HOW WE DISCLOSURE PERSONAL DATA

We disclose the Personal Data collected for the following purposes:

Within Guardians of the Ball and Affiliates. We disclose Personal Data among entities within Guardians of the Ball to provide and improve our metaverse services and football-related experiences, personalize user interactions, send promotional messages and advertisements about products and services that may be of interest, and for other purposes consistent with this Privacy Policy.

To Provide the Services. We collaborate with other companies and service providers to operate and deliver our products and services or to perform certain functions on our behalf. We disclose Personal Data to vendors and business partners performing services on our behalf, such as technology support, communications, payment processing, advertising and marketing, analytics, automated chat providers, fraud prevention and security, and customer relations. We also work with third parties to operate our service platforms and may provide these companies with access to Personal Data to perform their functions.

With Partners and Third Parties. We may disclose Personal Data to certain business partners for advertising and marketing purposes, so they can offer special promotions, offers, and other materials of interest to users. We disclose Personal Data to partners and third parties as part of our marketing and advertising activities on and off our online platforms. We may also work with third parties to display advertisements on our platforms and on third-party platforms. These third parties may set their own cookies or similar technologies to collect information about users’ online activities over time and across different apps and websites. Please see Your rights under the data protection laws section for further information on the right to opt out of these disclosures of Personal Data.

As Part of a Change in Business Structure. In the event of a sale, merger, acquisition, reorganization, or similar event, or in contemplation of such an event (e.g., due diligence), Personal Data may be transferred or disclosed.

When Necessary, Under Certain Circumstances. We may disclose Personal Data when we believe that disclosure is necessary to:

Comply with applicable law or respond to a valid legal process;
Protect the safety and security of our users or our products and services;
Prevent fraud, abuse, or other unlawful or unauthorized activities;
Protect our rights or property, or those of third parties, including enforcing the terms of our agreements.

15. SECURITY MEASURES

The Personal Data we may hold (and/or disclose to any affiliates, partners, or subcontractors, as applicable) will be securely maintained in accordance with our internal security policy and applicable law, including the General Data Protection Regulation (GDPR) and the Data Protection Act of Malta.

We make reasonable efforts to protect the confidentiality and integrity of all Personal Data we process about you. We regularly review and enhance our technical, physical, and organizational procedures to ensure that your Personal Data is always protected against:

Unauthorized access
Improper use or disclosure
Unauthorized modification
Unlawful destruction or accidental loss

We have implemented security policies, rules, and technical and organizational measures in compliance with GDPR requirements to safeguard the Personal Data under our control. These measures include the use of encryption, access controls, security audits, and incident management protocols. Additionally, our members, staff, and data processors (including specific subcontractors and cloud service providers) are subject to strict contractual confidentiality obligations, along with other obligations imposed by applicable Data Protection Laws.

Furthermore, any disclosure of Personal Data to third parties is conducted only with entities that implement adequate security measures in compliance with GDPR, to prevent unauthorized or accidental disclosure, loss, or destruction, as well as any form of unlawful processing. For external providers or partners located outside the European Economic Area (EEA), we apply the necessary safeguards, such as Standard Contractual Clauses approved by the European Commission, to ensure that your Personal Data receives a level of protection equivalent to that required in the European Union.

Despite the above measures, we cannot guarantee that any data transmission or storage system is 100% secure. Nevertheless, we require that all authorized third parties and external service providers with permitted access to your Personal Data adhere to specific security and confidentiality obligations in accordance with GDPR and the Data Protection Act of Malta, along with any additional obligations imposed by applicable laws.

You may contact us for further information regarding our security policies and measures.

16. RETENTION PERIODS

We will retain Your Personal Data only for as long as is necessary, taking into consideration the purpose for which it was originally obtained. Generally, we apply a standard retention period of three (3) years for Personal Data, unless otherwise required by law or contractual obligation.

The criteria we use to determine what is ‘necessary’ depends on the specific type of Personal Data in question and the nature of our relationship with you, including its duration.

Our standard practice involves assessing whether there are specific U.S. laws (for example, tax or corporate laws) that permit or obligate us to retain certain Personal Data for a particular period (in which case, we will retain the Personal Data for the maximum period specified by such law).

We also determine whether any laws or contractual provisions allow you and/or third parties to bring claims against us, and if so, what the limitation periods for such claims are (which are generally five (5) years). In these cases, we will retain any relevant Personal Data necessary to defend against potential claims, challenges, or other actions by you and/or third parties for the duration required.

In summary, we will retain your Personal Data on our systems for the longest of the following periods:

The duration of your status as a customer or user of our services
Any retention period required by applicable law
The end of the period in which litigation or investigations might arise concerning our products or services
Our standard retention period of three (3) years Where Your Personal Data is no longer required by us, we will either securely delete or anonymize the Personal Data in question.

17. PROCESSING FOR RESEARCH AND STATISTICAL REASONS

Research and statistics using User or client information is only carried out so that We may understand Our Users’ and/or clients’ needs and to develop and improve Our services/activities. In any case, We will always ensure to obtain any consent We may legally require from You beforehand. As in all other cases, we will also ensure to implement all appropriate safeguards as may be necessary.

18. LINKS TO THIRD-PARTY SOURCES

Links that We may provide to third-party websites are clearly marked and We are not in any way whatsoever responsible for (nor can We be deemed to endorse in any way) the content of such websites (including any applicable privacy policies or data processing operations of any kind). We suggest that You should view the privacy policies of any such third-party websites.

19. COOKIES

When You visit Our site, or use our App, We will collect certain categories of Personal Data automatically using cookies and similar technologies. For more detailed information including what cookies are and how and why We process such data in this manner (including the difference between ‘essential’ and ‘non-essential’ cookies) please read Our Detailed Cookies Policy.

Cookie Control and Browser Settings: To limit Cookies from tracking your activity on our Platform or across multiple websites, you may adjust your browser settings to block specific Cookies or receive notifications when a Cookie is set. For detailed guidance on customizing your browser’s Cookie preferences, please refer to the following link for your respective web browser:

Chrome

Safari

Internet Explorer

Mozilla

20. MINORS

Our Site, App and services are not intended to be used by any person under the age of sixteen (16) and therefore We will never intentionally collect any Personal Data from such persons. If You are under the age of consent, please consult and get Your parent’s or legal guardian’s permission to use the site, App and any of Our other services. We shall consider that any Personal Data of any persons under the age of sixteen (16) received by Us, shall be sent with the proper authority from the holder of parental responsibility over the child and that the sender can demonstrate such authority at any time, upon Our request.

21. YOUR RIGHTS UNDER THE DATA PROTECTION LAWS

As a user, the GDPR and Maltese legislation grant you certain rights concerning your Personal Data. Below, we provide a detailed description of these rights and how you may exercise them:

Right to Transparent Information

You have the right to receive clear, transparent, and easily understandable information about how we process your Personal Data and about your rights. This right ensures that you are always fully informed about our data processing practices so you can make informed decisions.

Right of Access

You may request access to the Personal Data we hold about you. This means you can request a copy of the Personal Data we process and verify that we are handling it lawfully. This right allows you to review and confirm our use of your information and obtain a copy of your data in our possession.

Right to Rectification You have the right to request that we correct any incomplete or inaccurate information we hold about you. This right ensures that your Personal Data is accurate and up to date.

Right to Erasure (Right to be Forgotten)

You may request that we delete your Personal Data when there is no valid reason for us to continue processing it. However, this right may be limited if we have a legal obligation to retain your data or if we need it to comply with regulatory or legal requirements. The right to erasure allows you to remove your data when processing is no longer necessary or lawful.

Right to Restrict Processing

You may request that we restrict the processing of your Personal Data in certain circumstances, such as if you are contesting the accuracy of the data or if the processing is unlawful, but you do not want it deleted. During the period of restriction, your data will not be used except in specific and legally permitted cases.

Right to Object

You have the right to object to the processing of your Personal Data in certain cases, such as when the processing is based on our or a third party’s legitimate interest. If we do not have a compelling legitimate reason to continue processing your data, we will cease to use it. You also have an absolute right to object to your data being used for direct marketing purposes, in which case we will stop sending you marketing communications.

Right to Data Portability

In certain situations, you have the right to request the transfer of your Personal Data to another data controller when you have provided it to us, and we are using it based on your consent or to perform a contract with you, and we are processing it by automated means. This right enables you to move, copy, or transfer personal data easily and securely.

Right to Withdraw Consent

In cases where we are processing your Personal Data based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before your withdrawal. Once you withdraw consent, we will stop processing your data for those specific purposes unless we have another lawful basis or regulatory requirement to continue processing it for a defined period.

Right to Lodge a Complaint

If you believe that we have breached your rights or processed your Personal Data in a way that violates Data Protection Laws, you have the right to lodge a complaint with the appropriate data protection authority. In Malta, you may contact the Office of the Information and Data Protection Commissioner (IDPC) via their official website at https://idpc.org.mt/en/Pages/contact/complaints.aspx. We encourage you to attempt to resolve any issues with us first so we can assist you.

HOW TO EXERCISE YOUR RIGHTS

To exercise any of these rights, you may contact us at any time. We may ask for specific information to help us understand the nature of your complaint or request, confirm your identity, and ensure that you are exercising your rights over your own Personal Data. This is a necessary security measure to ensure that your personal information is not disclosed to anyone who is not entitled to receive it.

RESPONSE TIME

We are committed to responding to all your requests within one month of receiving them. In complex cases or when we receive numerous requests, this period may be extended by an additional two months. We will notify you within the first month if an extension is necessary, along with the reasons for the delay.

REQUEST FEES

Generally, we do not charge a fee for the exercise of your rights. However, if your request is manifestly unfounded or excessive (particularly if it is repetitive), we reserve the right to charge a reasonable fee to cover administrative costs. We will inform you in advance of any applicable fee in such cases.

22. Guardians of the Ball Limited. – COMPANY DETAILS

Guardians of the Ball Limited, a company registered in Malta is the data controller responsible for processing Your Personal Data that takes place via the Site, our App or in the manner explained above.

If you have any questions/comments about privacy or should You wish to exercise any of Your individual rights, please contact Us by sending an email to the following address: [email protected] with the subject “PRIVACY REQUEST”.

23. UPDATES

We reserve the right to unilaterally modify this Privacy Policy at any time, particularly if statutory obligations so mandate or the interest of our users’ security so requires. To let You know when we make changes to this Privacy Policy, We will amend the revision date at the top of this page. The modified Privacy Policy will apply from such revision date. We will not officially notify you about such changes, and it is therefore in Your own interest to check this Privacy Policy page from time to time to familiarize yourself with any changes.

Privacy Policy