Privacy Policy

Last updated: May 2026.

1. Introduction

This Privacy Policy describes how VAKS FZCO (hereinafter "we", "us", "the organizer"), the organizer of the World Cup 2026 — Football - Fantasy Game (hereinafter "the Game"), collects, uses, stores, and protects your personal data.

By participating in the Game, you confirm that you have read and accepted this Privacy Policy. The Game is open only to participants aged 18 years or older.

2. Data we collect

2.1 Account data

• Email address (provided at signup)
• Username / pseudonym (displayed on the platform)
• Hashed password (we never store passwords in plain text)
• Allkeyshop account ID (username, provided at signup for prize attribution)

2.2 Game data

• Your predictions on matches
• Jokers used (and when)
• Daily mini-challenge answers
• Bonus picks (global tournament predictions)
• Referral activity (who you referred / who referred you)
• League memberships
• Score and ranking history

2.3 Technical data

• IP address (used for rough geographic location and anti-fraud measures only — not for precise tracking)
• User agent (browser and device type, for compatibility and analytics)
• Outbound click events on Allkeyshop deals and partner links (used only for game analytics and partnership reporting)

2.4 Cookies

The platform uses strictly necessary cookies only (session, authentication) which do not require consent under GDPR. No tracking or third-party analytics cookies are used. The platform does not use Google Analytics, Plausible, Matomo, Hotjar, or any similar analytics tool.

3. How we use your data

We use your data to:

• Run the Game: account management, matching predictions to results, leaderboard calculations, scoring
• Deliver prizes: contact winners by email and identify their Allkeyshop account for voucher attribution
• Improve the platform: bug detection, performance monitoring
• Communicate with you: transactional emails (welcome, password reset, account verification, winner notifications)
• Prevent fraud and abuse: detect multi-accounts, bots, manipulation of the leaderboard
• Comply with legal obligations: if and when applicable

We never sell your data to third parties. We never use your data for unsolicited marketing without your explicit consent.

4. Data sharing & third parties

To operate the Game, we rely on the following service providers, who only process data on our behalf:

• Hosting provider: Netlify Inc. (USA) — the platform front-end and static assets are hosted on Netlify
• Database & authentication provider: Supabase Inc. — user accounts, predictions, and game data are stored on Supabase infrastructure, in the European Union (Ireland region)
• Email service provider: Resend — used for transactional emails (welcome, password reset, verification)
• Analytics provider: none — no third-party analytics tool is used on the platform
• Allkeyshop: at the end of the tournament, the usernames of winners are shared with Allkeyshop to enable voucher distribution

The platform also loads the following technical resources from third-party services (no personal data is transmitted):

• flagcdn.com: for displaying country flags of teams
• Google Fonts: for typography (loaded via Next.js next/font)

We do not share your data with advertising networks, data brokers, or any party not strictly necessary to operate the Game.

Note: Netlify is located in the United States. Supabase is located in the European Union (Ireland). We ensure adequate data protection through contractual arrangements with our providers, in compliance with applicable data protection regulations.

5. How long we keep your data

Data type	Retention period
Account data (email, username, hashed password, AKS ID)	Throughout the duration of the Game + 3 months after the end of the tournament (to handle claims and prize distribution)
Game data (predictions, scores, leaderboard)	Throughout the duration of the Game; pseudonymized records may be retained indefinitely for historical and integrity purposes
Technical data (IP, user agent, click events)	13 months maximum

After the retention period, personal data is either deleted or anonymized.

6. Your rights

Under the General Data Protection Regulation (GDPR) and similar privacy laws, you have the following rights:

• Right of access: you can see your data at any time via your profile page on the platform
• Right to rectification: you can edit your profile information (email, username, password, AKS ID)
• Right to erasure ("right to be forgotten"): you can request the deletion of your account. Personal fields will be anonymized; pseudonymous game records may be retained for tournament integrity purposes
• Right to data portability: upon request, you can receive a copy of your personal data in a structured, commonly used format
• Right to object: you can object to the processing of your data for specific purposes (e.g., analytics)
• Right to withdraw consent: where processing is based on consent, you can withdraw it at any time
• Right to lodge a complaint: you can lodge a complaint with the data protection authority of your country of residence

To exercise any of these rights, contact us at: wc26.fantasygame@gmail.com. We will respond to your request within 30 days.

7. Security

We implement reasonable technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Hashed password storage
• HTTPS encryption for all data in transit
• Access controls on admin functions
• Anti-fraud detection on signups and predictions

However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

8. Children's privacy

The Game is open only to participants aged 18 years or older. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has provided us with personal data, we will delete it as soon as possible.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The most recent version, indicated by the "Last updated" date at the top, prevails. Substantial changes will be communicated to participants via the platform.

By continuing to use the platform after a modification, you accept the new Privacy Policy.

10. Contact

For any question or request related to your personal data, please contact us at: wc26.fantasygame@gmail.com

This Privacy Policy is written in English. In case of translation into another language, the English version prevails.