TRANSFERSPLACE LTD - PRIVACY POLICY Effective Date: 30.11.2025 TransfersPlace Ltd (“TransfersPlace”, “we”, “us”, “our”) provides a secure online platform enabling verified professional football clubs (“Clubs”) to manage player information, exchange transfer-related enquiries, and analyse market opportunities. This Privacy Policy explains how we process personal data under: - UK GDPR - EU GDPR (where applicable) - The Data Protection Act 2018 1. WHO WE ARE & OUR DATA PROTECTION ROLES TransfersPlace processes personal data in three different roles depending on the activity: (1) Independent Controller (TransfersPlace) For: - analytics, scoring, and profiling - platform-wide visibility rules - logs, security, audits - platform usage data - product development - platform optimisation (2) Independent Controller (Club) Each Club is an Independent Controller for: - all player personal data it uploads - ensuring accuracy and lawful basis for the data - decisions it makes based on the data (3) Joint Controllers (Club + TransfersPlace) We jointly determine purposes and means for: - platform-wide visibility of all players across all Clubs on the platform - club-to-club transfer/loan enquiries - messaging between Clubs - audit logs relating to shared interactions - retention of enquiry and messaging metadata (4) Processor (TransfersPlace, limited) We act as Processor only when we: - store raw data uploaded by Clubs - implement Clubs’ specific instructions (edit/delete raw player data) 2. CATEGORIES OF PERSONAL DATA WE PROCESS We process the following types of data: A. Club-Uploaded Player Data (Raw Input) TransfersPlace does NOT collect injury data, medical data and player images. Clubs may upload non-sensitive data such as: - player name - date of birth - nationality - position - contract start/end dates - release clause status - performance statistics - internal transfer status B. TransfersPlace Analytics & Profiling (Generated Data) We generate: - skills ratings - potential ratings - comparative statistics - algorithmic performance insights C. Joint Data (Shared Club + Platform Activities) - transfer/loan enquiries - enquiry metadata - secure messages - timestamps - audit logs D. Technical & Log Data - IP address - login history - device type - usage patterns - security logs E. Club Staff Account Data - name - email - role at Club - authentication details 3. PLATFORM-WIDE VISIBILITY (IMPORTANT) TransfersPlace is designed as a closed, professional network. All player profiles on the platform are visible to all verified Clubs using the platform. No player data is visible publicly or outside authorised Clubs. This visibility model is a Joint Controller function between TransfersPlace and Clubs. 4. PURPOSES OF PROCESSING We process data to: - enable club-to-club transfer and loan communications - create fair, platform-wide player visibility - generate ratings, analytics, and insights - support sporting decision-making - secure and maintain platform integrity - prevent abuse and ensure compliance - operate and improve the TransfersPlace platform 5. LAWFUL BASES FOR PROCESSING A. Club-Uploaded Data → Club’s lawful basis TransfersPlace acts as Processor. B. Platform Analytics & Profiling → Legitimate Interest (TransfersPlace) Necessary for core platform function and professional sporting evaluation. C. Platform-wide Visibility, Enquiries, Messaging → Legitimate Interest (Joint Controllers) Necessary to enable the professional transfer market. D. Contractual Necessity For providing accounts and access to Clubs. E. Legal Obligation Where required under football regulations or law enforcement. 6. DATA SHARING We share data only with: 1. Verified Professional Clubs - All player profiles are visible to all Clubs - No visibility outside the platform 2. Sub-Processors Under GDPR safeguards: - hosting providers - infrastructure vendors - email services 3. Football Regulators (where legally required) Examples: FA, FIFA, national associations. 4. TransfersPlace Staff Restricted, role-based access only. We never sell personal data. 7. DATA RETENTION - Club-uploaded data → retained according to Club instructions - Analytics data → retained for platform optimisation - Enquiry/message logs → retained for audit and regulatory purposes - Technical logs → 12–24 months - Deleted data → securely destroyed or anonymised 8. SECURITY MEASURES We implement: - encryption in transit and at rest - access controls - strict role-based permissions - continuous monitoring - audit logging - secure hosting and backup 9. DATA SUBJECT RIGHTS Players and staff can request: - access - rectification - erasure - restriction - portability - objection to profiling Who handles the request? Type of Data Handler Club-uploaded data Club Analytics, logs, profiling TransfersPlace Enquiries & messaging TransfersPlace (coordination) We collaborate as required. 10. INTERNATIONAL TRANSFERS We only transfer data internationally where: - adequacy decisions apply - Standard Contractual Clauses (SCCs) or UK Addendum are in place - equivalent safeguards exist 11. CONTACT DETAILS TransfersPlace Ltd Email: contact@transfersplace.com Address: TransfersPlace Ltd, 124 City Road, London, EC1V 2NX, United Kingdom 12. COMPLAINTS Players may contact: - the UK Information Commissioner’s Office (ICO), or - their local EU supervisory authority