Privacy Policy

Football Path X GmbH

Version 2.2. LAST UPDATED ON OCTOBER 29, 2026. Effective on the date it is published in the app and on the website.

This version replaces the Privacy Policy of 27 September 2025, and every later edit of it, in full.

1. Who we are, and how to reach us

Football Path X GmbH is the controller of the personal data described in this policy.

• Company. Football Path X GmbH.
• Address. Othmargasse 34/16, 1200 Vienna, Austria.
• Commercial register. FN 641126 h, Commercial Court of Vienna.
• VAT identification number. ATU81470515.
• Email. info@footballpathx.com.
• Data protection contact. privacy@footballpathx.com.

We have not appointed a Data Protection Officer. If we appoint one, this section will name them.

You can complain about how we handle your data to the Austrian Data Protection Authority at any time:

Österreichische Datenschutzbehörde, Barichgasse 40 to 42, 1030 Vienna, Austria. dsb@dsb.gv.at. www.dsb.gv.at

You can also complain to the supervisory authority where you live or work.

2. What this policy covers

This policy covers the Football Path X mobile apps for iOS and Android (FPX Pro), the Football Path X web app, the public competition pages, and the websites we operate. We call all of these together the Platform.

It covers everyone whose data we handle: people who hold an account, people who appear in a competition or a club without holding an account, and people who only visit a public competition page or our website.

Where a competition organizer decides for themselves what to do with data about their participants, the organizer is a controller in their own right and this policy does not govern those decisions. Section 12 explains where the line sits.

3. Age, and accounts for children

You can hold your own account from the age of digital consent in your country. That is 16 in the European Union and the European Economic Area, and 16 where we cannot tell which country you are in. Elsewhere it is 13, or the higher age your country's law sets. We follow Article 8 GDPR here: below that age a child cannot validly consent to an online service on their own.

Below that age, an adult holds the account. A parent or legal guardian can create an account for a child, and a club can create one for a member it is entitled to register. The adult or the club decides what is visible, and is the person we deal with. A parent or guardian can see everything on the account they created and can delete it at any time. When a club creates an account, the person or their parent or guardian can later take it over with their own email address and password.

If you are old enough to hold your own account but under 18, we ask you to confirm that a parent or guardian agrees, and we record that you confirmed it and when. When a parent or guardian creates a child's account, we record who gave the consent and when.

Protections for anyone under 18:

• the profile starts private, so it does not appear in search or in the player, coach, scout and club lists until a parent or guardian, or the young person once old enough, makes it public;
• a direct conversation with someone under 18 is only possible within their club, between the child and their parent or guardian, or with Football Path X support;
• profiles are only visible to signed-in users, never to search engines or to visitors without an account.

If we learn that someone below the age that applies to them has opened an account without a parent, guardian or club behind it, we will close it and delete the data, unless a parent or guardian confirms they are taking it over.

A parent or guardian can, at any time, ask us to keep a child's name, photograph and content off the visible parts of the Platform. Write to privacy@footballpathx.com and we will apply it.

4. What we collect

4.1 What you give us when you open an account

Always: first name, last name, email address, the role you choose (for example player, coach, club member, parent, scout or fan), and the confirmation that you accepted the Terms and when.

Depending on your role and what you fill in: date of birth or the answer to whether you are over 18, country, nationality, gender, height, weight, preferred foot, playing position, current club and team, profile and cover photographs, and for coaches and scouts the licence held.

Optional: phone number, the year you started playing, favourite formation, transfer history, your own rating of your football skills, favourite local clubs, achievements, career goals, strengths, weaknesses, languages spoken, social media handles. For scouts and coaches: preferred player type, geographic focus, age group and gender scouted or coached.

You do not have to give us the optional items and nothing on the Platform is withheld from you if you leave them blank. Your email address and phone number are kept in a separate private record that other users cannot read.

4.2 What you create while you use the Platform

• Videos and photographs you upload, and their title, description, listed skills, location and tags.
• Posts, comments, ratings, reactions and reports.
• Chat messages, and who they were sent to and when.
• Match and training data: line-ups, appearances, goals, assists, cards, minutes, ratings and the statistics built from them.
• Competitions you create or enter, clubs and teams you manage or join, squads you register, and the schedules that come out of them.
• People you follow and people you block.
• Messages you send to our support, including through our support assistant described in section 8.

4.3 What we collect automatically

• Device and app data: device model, operating system, app version, language, time zone.
• Log data: IP address, timestamps, pages and screens opened, actions taken.
• Crash reports: when the app stops working, a diagnostic report with the device model, operating system, app version and the state of the app at the time. You can turn this off in Settings, under Crash reports.
• Push notification tokens, if you allow notifications.
• Analytics and performance data, only if you turn on Usage data, described in section 9.
• Your presence, meaning whether and when you were last active, so other users can see that you are online.

The app does not ask for your device location. On the website, the tournaments map can show competitions near you if you allow your browser to share your location. That location stays in your browser and is not sent to our servers.

We do not use your IP address to track you as an individual. We keep it for security, fraud prevention and coarse country-level statistics.

4.4 What we get when you sign in with Google or Apple

If you sign in with a Google or Apple account, we receive the identifier that provider gives us, your name, your email address, or the relayed address if you use Apple's private relay, and whether that address is verified. We do not receive your password. We do not post anything to those accounts.

4.5 Payment data

We do not see or store your card number.

In the mobile app, purchases are made through the Apple App Store or Google Play. Apple or Google takes the payment under their own terms and privacy policy, and we use RevenueCat to confirm the purchase and keep track of what you are entitled to. RevenueCat receives your account identifier and the purchase receipt, never your card details.

On the website, you are handed to Stripe or PayPal, who take the card or account details and process the payment on their own systems.

What we do store is the record of the transaction: what was bought, the amount, the currency, the country the price was resolved for, the status, the provider's transaction identifier, the buyer's account, any refund and who made it, any Credit balance, and the billing name and address the provider returns to us for the invoice.

4.6 Data about people who do not hold an account

A competition organizer or a club can register a team and enter players who do not have their own account. For those players we hold the name, date of birth or age, squad number, position, and the match data generated when they play. This data usually reaches us from the organizer or the club rather than from the player.

If you are in this position and want to know what we hold, write to privacy@footballpathx.com.

5. Why we use your data, on what basis, and for how long

The legal bases below are the ones in Article 6(1) GDPR.

• Create and run your account, sign you in, verify your email address. You cannot use the Platform without it. Basis: contract, Art 6(1)(b). Kept while the account is open, then as set out in section 10.
• Show your profile and Football CV to other users. It is the core of the service. Basis: contract, Art 6(1)(b). Kept while the account is open.
• Run competitions, clubs, fixtures, results and statistics. It is the service the organizer or the club bought and the service you joined. Basis: contract, Art 6(1)(b). Competition records are kept while the competition remains published, then 3 years.
• Chat between users. Basis: contract, Art 6(1)(b). Kept while the conversation exists. What happens when you delete your account is in section 10.
• Host and stream video you upload. Basis: contract, Art 6(1)(b). Kept while you keep the video published, then up to 30 days.
• Take payment, issue and keep invoices. Basis: contract, Art 6(1)(b), and legal obligation, Art 6(1)(c), under Austrian bookkeeping law. Kept 7 years from the end of the year of the transaction, per §132 BAO.
• Handle refunds, chargebacks and disputes. Basis: contract, Art 6(1)(b), and legitimate interest in defending claims, Art 6(1)(f). Kept 7 years alongside the transaction record.
• Send service messages about your account, purchases, clubs and competitions, by email, in the app and in chat. You need to receive them. Basis: contract, Art 6(1)(b). Sent, then logged for 12 months.
• Push notifications about activity that concerns you. Basis: consent given in the operating system or the browser, which you can withdraw there at any time, Art 6(1)(a). The token is kept until you turn notifications off or the account closes.
• Marketing email and newsletters. Only if you asked for them. Basis: consent, Art 6(1)(a). Kept until you unsubscribe, then a suppression record is kept so we do not mail you again.
• Analytics and app performance measurement. Understanding how the Platform is used and how fast it is. Basis: consent, Art 6(1)(a). In the app it is off until you turn on Usage data in Settings. Kept up to 14 months.
• Measuring our advertising on our website. Only on our marketing pages, and only if you accept in the cookie banner. Basis: consent, Art 6(1)(a). Details in section 9.
• Crash reports. Finding and fixing faults that stop the app working. Basis: legitimate interest, Art 6(1)(f). On by default in the app, and you can turn it off at any time in Settings, under Crash reports. Kept 90 days.
• Keep the Platform secure, prevent fraud and abuse, protect minors, and investigate breaches of the Terms, including handling reports and blocks. Basis: legitimate interest, Art 6(1)(f). Security logs are kept 12 months, records of an enforcement decision 3 years.
• Support and complaints. Answering you. Basis: contract, Art 6(1)(b), and legitimate interest, Art 6(1)(f). Kept 3 years from the last message.
• Comply with law, court orders and regulatory requests. Basis: legal obligation, Art 6(1)(c). Kept as the obligation requires.
• Establish, exercise or defend legal claims. Basis: legitimate interest, Art 6(1)(f). Kept until the claim is time-barred, generally 3 years, and up to 30 years in the cases §1478 ABGB covers.

Where we rely on legitimate interest, we have weighed our interest against your rights. You can object to any of it under section 11, and we will stop unless we can show compelling grounds that override your objection.

6. Your profile, and what other people can see

Your profile is visible to other signed-in users of the Platform, unless it is private. Profiles are not visible to visitors without an account or to search engines. Competition pages are different: anyone with the link can see a published competition's crest, cover, dates, categories, clubs, organizer, fixtures and results.

Visible on a public profile: your age, not your date of birth. First and last name. City and country. Nationality, gender, height, weight, preferred foot, playing position, current club and team. Profile and cover photographs. Transfer history, your own skill ratings, favourite clubs, the year you started playing, achievements, career goals, strengths, weaknesses, languages spoken, social media handles you add. Videos and posts you publish and the statistics from competitions you played in. For scouts and coaches: licence type, preferred player type, geographic focus, age group and gender scouted.

Never visible to other users: your date of birth, email address, phone number, payment details, the messages in other people's conversations, and anything you left blank.

You can make your profile private, or public again, in your settings. A private profile does not appear in search or in the player, coach, scout and club lists. Under-18 profiles start private, as section 3 explains.

One thing to understand: results from a competition you played in stay attached to that competition's page even if you later make your profile private, because the competition record is a record of what happened. Your name can be removed from it on request under section 11.

7. Ratings, scores and automated processing

The Platform calculates performance scores and ratings from match and training data, and uses them to order search results and to decide what appears in discovery surfaces such as Spotted. This affects how visible you are to coaches, scouts and clubs.

This is profiling within the meaning of Article 4(4) GDPR. It is not an automated decision that produces a legal effect on you or something similarly significant under Article 22, because it does not decide anything about you by itself. A human being decides whether to contact you.

A post that several different users report is hidden automatically. That is a safety measure, not a judgment about you: if your content was hidden and you think that was wrong, write to legal@footballpathx.com and a person will review it.

You can ask us how a score for you was arrived at. Write to privacy@footballpathx.com.

8. Who we share your data with

We do not sell your personal data, and we never have.

We share it with the processors below, each under a written data processing agreement that meets Article 28 GDPR.

• Google Ireland Ltd and Google LLC: Firebase and Google Cloud. Sign-in, database, server functions, file storage, push notifications, Remote Config, In-App Messaging, App Check, Crashlytics crash reports, and, only with your consent, Google Analytics for Firebase and Performance Monitoring. Primary processing region europe-west3, Frankfurt, with support and some sub-processing in the United States. Transfers: EU Standard Contractual Clauses, and the EU to US Data Privacy Framework where it applies.
• Google Ireland Ltd and Google LLC: Google Workspace. Carries our service email and support mailboxes. EU, with support access from the United States. Transfers: EU Standard Contractual Clauses, and the Data Privacy Framework.
• Google Ireland Ltd and Google LLC: Google Maps Platform. Looks up places and addresses when you search for a club or a venue, and draws venue maps on the website. The text you type and your IP address reach Google. Transfers: EU Standard Contractual Clauses, and the Data Privacy Framework.
• Mux, Inc. Video upload, encoding, storage and streaming. United States. Transfers: EU Standard Contractual Clauses.
• Stripe Payments Europe Ltd. Card and wallet payments on the website, invoices, refunds. Ireland, with group transfers to the United States. Transfers: intra-group Standard Contractual Clauses.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. PayPal payments on the website, invoices, refunds. Luxembourg, within the EEA.
• RevenueCat, Inc. Confirms in-app purchases made through the App Store or Google Play and keeps the record of what you are entitled to. United States. Transfers: EU Standard Contractual Clauses.
• Microsoft Ireland Operations Ltd: Microsoft Azure. Hosts our website and web app, the servers running our search index and cache, and our internal administration tools. We manage the software; Microsoft provides the infrastructure. Azure Germany West Central (Frankfurt) and West Europe (Netherlands), inside the EU. Transfers: none outside the EEA, and EU Standard Contractual Clauses cover any support access from outside.
• Anthropic. Our support assistant uses Anthropic's Claude models to read a message you send to Football Path X support and draft or send an answer from our help documentation. Only the support conversation and the account details needed to answer it are sent. Anthropic does not use it to train its models. United States. Transfers: EU Standard Contractual Clauses. You can always ask for a person.
• Algolia SAS. Search inside our internal administration tools, over club records. Transfers: EU Standard Contractual Clauses where data leaves the EEA.
• Cloudflare, Inc. Stores files for our internal match video analysis. Transfers: EU Standard Contractual Clauses, and the Data Privacy Framework.

Map backgrounds are loaded from OpenStreetMap (in the app) and Esri (on the website). Your device asks their servers for the map tiles of the area you are looking at, and they see your IP address when it does, as with any website you load.

We also share data in these situations:

• With Apple or Google when you buy in the app. The App Store and Google Play take in-app payments as independent controllers under their own privacy policies. We receive the purchase record, not your payment details.
• With Meta, if you accept advertising cookies on our website. See section 9.
• With competition organizers. If you enter a competition, the organizer sees the squad you registered, the players in it, and the match data from their competition. Section 12 explains their role.
• With your club. If you belong to a club on the Platform, the club's administrators see your membership, your squad placement and your match data for that club. A ClubHQ club also sees the records it manages for its members.
• With a parent or guardian. The parent or guardian who created a child's account sees that account.
• With professional advisers. Our accountant, tax adviser and lawyers, under professional confidentiality.
• When the law requires it. A court order, a regulatory demand, or a legal obligation. Where we are allowed to tell you, we will.
• If the business is sold. If Football Path X GmbH is acquired or merges, data moves with the business. We will tell you before it does, and this policy continues to apply until we publish a replacement.

9. Cookies, analytics and similar technologies

Strictly necessary. Session and authentication cookies and local storage that keep you signed in, keep the Platform secure, remember your language and remember your cookie choice. These do not need your consent and cannot be turned off without breaking the Platform.

Crash reports in the app. The app sends a diagnostic report through Firebase Crashlytics when it stops working, so we can fix the fault. It contains no profile content. We do this on our legitimate interest in a working app, and you can object at any time by turning off Crash reports in Settings.

Analytics and performance in the app need your consent. Google Analytics for Firebase and Firebase Performance Monitoring are off until you turn on Usage data in Settings. If you do not, they do not run. The app contains no advertising or attribution SDK.

Advertising measurement on our website needs your consent. Our public marketing pages, such as the home page, About, Solutions and Journal, can use the Meta Pixel, from Meta Platforms Ireland Ltd, to measure whether our advertising on Facebook and Instagram works and to show our ads to people who visited. It loads only after you accept in the cookie banner, never inside the web app itself. When it runs, Meta receives your IP address, browser details and the pages you visited, and Meta is a joint controller with us for that collection, under Meta's own terms and privacy policy. If you reject, it does not load.

The website does not use Google Analytics.

You can change your choice at any time: in the app in Settings, and on the website through Cookie settings in your account settings.

10. How long we keep things, and what happens when you leave

Section 5 gives the retention period for each purpose. On top of that:

When you delete your account, we delete at once your sign-in, your profile and its photographs, your private contact record, your posts, videos and photographs together with their likes and comments, your comments, likes and reports on other people's posts, your follows and blocks, your notifications and push tokens, and your presence. You are removed from your teams, clubs and group conversations, and your entry is removed from search.

What survives, and why:

• Messages you sent to other people. They stay in the other person's conversation, because they are part of that person's conversation too, but they are no longer linked to a profile. If a message contains something you want removed, write to privacy@footballpathx.com.
• Accounts of children you created. Deleting your own account does not delete a child's account you created. Delete those first, from the child's card, if you want them gone.
• Payment and invoice records, for 7 years, because §132 BAO requires it. These hold your name, billing address and what you bought.
• Competition results, fixtures and match records, because they are the record of a competition other people took part in. We remove your name from public display on request and keep the record under an anonymous identifier.
• Content quoted in a moderation decision, for as long as that decision is open to challenge.
• Backups, which are kept only to recover from a fault and are overwritten in the ordinary course.
• A minimal suppression record, so a deletion request is not undone by a later import and so we do not email you again.

11. Your rights

You have all of the following. They are free, and we answer within one month. If a request is complex we can extend that by two months and we will tell you why.

• Access, Article 15. A copy of your personal data and an explanation of what we do with it, who receives it, how long we keep it and where it goes outside the EEA.
• Rectification, Article 16. Correction of anything wrong, and completion of anything incomplete. Most of it you can fix yourself in your account.
• Erasure, Article 17. Deletion of your data, subject only to the retention listed in section 10. We do not require you to give a reason, and we do not impose a waiting period.
• Restriction, Article 18. Freezing the processing while a dispute about accuracy or lawfulness is resolved.
• Portability, Article 20. Your data in a structured, commonly used, machine-readable format, and sent directly to another provider where that is technically possible.
• Objection, Article 21. To any processing based on legitimate interest, and, absolutely and at any time, to direct marketing.
• Withdraw consent, Article 7(3). At any time, for anything based on consent. Withdrawing does not undo what was lawful before you withdrew.
• Complain, Article 77. To the Austrian Data Protection Authority, or the one where you live. Details in section 1.

To exercise any of these, write to privacy@footballpathx.com or use the tools in your account settings. We may ask you to confirm who you are before we act, and we will ask for no more than we need to be sure.

Deleting your account

You can delete your account yourself, in the app or on the website, in Settings under Delete account. It takes effect at once. A parent or guardian can delete the account of a child they created in the same way.

You can also ask us at privacy@footballpathx.com and we will delete it for you. We do not ask you for a reason, we do not make you wait for anything to finish or be cancelled first, and we complete the deletion within 30 days.

Subscriptions. A ClubHQ subscription belongs to the club. If you paid for it, or you are the club's last administrator, deleting your account stops it renewing, and the club keeps ClubHQ to the end of the period already paid for. A subscription bought in the app is managed by Apple or Google, so cancel it in your App Store or Google Play account settings as well, or it will keep renewing. Deleting an account does not by itself refund anything. Section 16 of the Terms and Conditions covers refunds, and unused Credit you bought is refunded on request.

12. Competitions, organizers and who is responsible for what

This section matters because a competition brings two organizations into contact with the same data.

Football Path X is the controller for your account, your profile, your content, your messages, the Platform itself and the payments made to us. Everything in sections 4 through 11 is ours.

The organizer is a separate controller for the decisions they take about their own competition: who they invite, which teams they accept, what they do with a participant list outside the Platform, and any communication they send outside the Platform. We give them the tools. We do not decide how they use them.

Where an organizer uses the Platform's own tools to run their competition, we act as their processor for that use, under Annex A to our Terms and Conditions, the Data Processing Agreement for Competition Organizers.

What this means for you in practice: if you want to know why an organizer contacted you, or want them to stop, ask the organizer. If it concerns your account, your profile or the Platform, ask us. If you are not sure which, ask us and we will tell you.

13. Where your data goes

Our primary processing region is Frankfurt, inside the EU. Google Cloud runs in europe-west3, Frankfurt. Our website, web app, search index and cache run in Microsoft Azure in Frankfurt and the Netherlands, both inside the EU.

Some of our processors transfer data to the United States, as set out in section 8. Those transfers rely on the European Commission's Standard Contractual Clauses, on the EU to US Data Privacy Framework where the recipient is certified under it, and on supplementary technical measures including encryption in transit and at rest.

You can ask us for a copy of the transfer safeguards for any processor. Write to privacy@footballpathx.com.

14. How we protect your data

We encrypt data in transit and at rest. Access to production data is limited to the people who need it and is logged. Authentication runs through Firebase Authentication. Database and file access is controlled by security rules that are reviewed before each release. Everyone with access, including contractors, is under a written confidentiality obligation.

No system on the internet is completely secure, and we do not claim otherwise. What we do claim is that we apply measures appropriate to the risk, as Article 32 GDPR requires, and that we review them.

If a breach occurs that is likely to result in a risk to your rights, we notify the Austrian Data Protection Authority within 72 hours of becoming aware of it, and we notify you directly where the risk is high.

15. If you are outside the EEA

We apply this policy to everyone. Some countries give you additional rights, and you have those too.

United Kingdom. The UK GDPR gives you the same rights as sections 11 and 13. You can complain to the Information Commissioner's Office.

Switzerland. The revised FADP applies and you can complain to the Federal Data Protection and Information Commissioner.

California. Under the CCPA as amended by the CPRA you can ask what categories of personal information we collect, use and disclose, ask for a copy, ask for deletion and correction, and limit the use of sensitive personal information. We do not sell personal information. If you accept advertising cookies on our website, section 9 describes what Meta receives, and you can refuse or withdraw that at any time in Cookie settings. We will not treat you differently for exercising a right.

Everywhere else. If your country's data protection law gives you a right that this policy does not describe, write to privacy@footballpathx.com and we will honour it.

16. Changes to this policy

We update this policy when the Platform changes or the law does. The current version is always published in the app and on the website, with its version number and date at the top.

If a change materially affects how we use your data, we will tell you before it takes effect, by email or in the app, and give you at least 30 days notice. Where the change needs your consent, we will ask for it rather than assume it.

Previous versions are kept and we can send you one on request.

17. Questions

privacy@footballpathx.com for anything about data.

info@footballpathx.com for everything else.

Football Path X GmbH, Othmargasse 34/16, 1200 Vienna, Austria.