Privacy notice.

1. Controller

2. Website visits and server logs

When a website is accessed, the technical hosting server generally processes connection and log data, including IP address, time, requested file or URL, HTTP status, referrer, and information about browser and operating system. This processing is necessary for delivery, stability, and security of the website.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure, stable, and reliable operation of the site. Server logs are deleted according to the hosting provider’s configured retention periods unless a longer period is required to investigate a specific security incident.

3. Technically necessary session cookies and local storage

This website uses a PHP session cookie. It supports language selection and CSRF protection for forms and is deleted after the session ends. In addition, the cookie notice only stores locally in the browser that the notice has been acknowledged. This package does not set analytics, advertising, profiling, or social-media cookies.

Further details appear in the cookie policy. If non-essential technologies are added later, they must be assessed and, where required, loaded only after valid consent.

4. Contact form

When a contact request is sent, the website processes name, email address, selected topic, message text, time, language version, and the version of this privacy notice. This data is used to review and answer the request and, where required, conduct follow-up communication.

The legal basis is Article 6(1)(b) GDPR where the request concerns pre-contractual or contractual communication, otherwise Article 6(1)(f) GDPR. Data is stored locally in a server-side protected file and is automatically cleaned up after no more than 180 days.

5. Update list / newsletter interest

When joining the update list, the website processes the email address, time, language version, proof of consent, and the version of the privacy notice. Processing is based on Article 6(1)(a) GDPR. This website package does not implement automatic email delivery or tracking pixels.

Data is automatically cleaned up after no more than 730 days or earlier when the email address is removed through the unsubscribe page. Before promotional or newsletter emails are actually sent from the list, a legally and technically reviewed double-opt-in and unsubscribe process must be implemented.

Remove an email address from the update list

6. Recipients and third parties

The current code does not send form or analytics data to external analytics, advertising, social-media, or marketing services. The technical hosting provider receives data where required to operate the website. If external services are integrated later, they must be added to this privacy notice and, where applicable, to the consent system beforehand.

7. Security and automated decisions

The website uses technical safeguards including HTTPS-ready session cookies, CSRF protection, input validation, access restrictions, and security headers. Completely risk-free transmission or storage cannot be guaranteed.

No automated decision-making, including profiling, takes place. The current code does not provide for transfers of form data collected through this website to third countries.

8. Your rights

Subject to the GDPR, you have in particular the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Consent can be withdrawn at any time with future effect. You also have the right to lodge a complaint with a data-protection supervisory authority.

Privacy requests can be sent to world-soccer@heaven-shield.nl or through the contact form using the “Privacy & data request” topic. Suitable proof of identity may be required to prevent unauthorised disclosure.

You may also lodge a complaint with a data-protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. LDI NRW complaint portal.