Thanks for viewing our Privacy Notice (aka “Privacy Policy”). Your trust is important to us. We are committed to protecting your personal data (aka personal information) and being transparent about how and why we collect, use, and share it. This notice explains how we handle personal data in connection with the Fantasy Champions fantasy golf application and our related website and services.
We are: Draft Champions Ltd, a limited company incorporated in England & Wales with company number SC840565, whose registered office is at 12 Dale lane, East Kilbride , G75 9DL (“Business”, “we”, “our”, and “us”).
The App: “Fantasy Champions” (the “App”), our fantasy golf mobile application, available via the Apple App Store and Google Play
Contact details: contact@fantasychampions26.com . You may also write to us at our registered office above, marked for the attention of the data privacy manager.
Website: [APP/WEBSITE URL], including the App and any related web or mobile application as applicable from time to time (together, the “Website”).
Legal Documentation: This includes any legal information and documentation relevant to our processing of personal data, including our Terms and Conditions, a separate cookie policy, and additional contracts, terms, policies or notices (for example, a Data Retention Schedule, Data Processing Terms or Addendum(s), and a Third Party Providers/Processors list), which may be supplied directly to you, linked in the footer of our Website and/or made available via a contract or upon request.
Cookies and similar technologies: Please see our cookie settings banner/widget and the cookie policy in section 7 below. In a mobile app, similar technologies include software development kits (SDKs) and mobile advertising identifiers.
This privacy notice applies to you and describes how and why we collect and use personal data and provides information about your rights. It applies to any personal data we collect or obtain about you, or that you provide to us, through the App and Website, or any related platforms, websites or apps (including social media sites), when you download or use the App, register an account, purchase or manage a subscription, play in contests, appear on leaderboards, take part in a competition or survey, contact our support team, or communicate or interact with us in any other way.
Children. The App is a game of skill intended for a general audience. You must be at least 13 years old (or the minimum age of digital consent in your country of residence, if higher) to use the App. Users who are under 18 (or the age of majority in their jurisdiction) may only use the App with the consent and supervision of a parent or legal guardian, who is responsible for the minor’s use, including any subscription purchases. Because the App is likely to be accessed by children, we apply additional protections in accordance with Section 81 of the DUAA and applicable children’s privacy standards (such as the ICO’s Age Appropriate Design Code), having regard to children’s higher protection matters and how best to protect and support children when using the service. We do not knowingly collect more personal data from a child than is necessary to provide the App, and a parent or legal guardian may review, correct or request deletion of a child’s personal data, or withdraw consent, at any time using our Contact Details.
It is important that you read this privacy notice together with any other privacy or data protection notice, clauses or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements those other notices and is not intended to override them, except where otherwise stated. Please also read the Glossary (section 14), which explains the meaning of some of the terms used in this notice.
Controller
The Business described in the Legal Information is the data controller and responsible for your personal data (collectively referred to as “Business”, “we”, “us” or “our” in this privacy notice). We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any request to exercise your legal rights, please contact the data privacy manager using the Contact Details in the Legal Information.
Complaints
You have the right to make a complaint at any time to your local data protection authority in your country of residence. For example, if you are in the UK, this is the Information Commissioner’s Office (ICO). We would, however, appreciate the chance to deal with your questions or concerns, and invite you to contact us in the first instance.
Statutory Data Protection Complaints Procedure (s.164A DPA 2018 and DUAA as in force and amended). Under Section 164A of the Data Protection Act 2018 (as inserted by the DUAA), we operate a formal data protection complaints procedure. If you have a concern about how we handle your personal data, please: (1) submit your complaint using our complaints form at the end of this notice and email it to us; (2) we will acknowledge your complaint within 30 days of receipt; and (3) we will take appropriate steps to investigate, respond, and keep you informed of progress.
If you remain dissatisfied after using our complaints procedure, you have the right to complain to the ICO at ico.org.uk/concerns or on 0303 123 1113. If you are based in the EU, you may instead complain to your local supervisory authority. We would, however, appreciate the chance to deal with your questions or concerns, and invite you to contact us in the first instance.
Changes to the privacy notice and your duty to inform us of changes
We keep our privacy notice under regular review. We reserve the right to change it at any time and we encourage you to read it periodically. Any changes are effective upon posting to our Website or, where required, upon written notice to you; where changes are material we will take reasonable steps to notify you. This version was last updated on the date shown above. It is important that the personal data we hold about you is accurate and current; please keep us informed if your personal data changes.
Third-party links
The App and Website may include links to third-party websites, plug-ins, applications and/or other materials which are not provided by us (for example, App Store Providers, social media, and links to golf tour or tournament sites). Clicking on those links or enabling those connections may allow third parties to collect or share data about you.
These are not under our control and we are not responsible for their privacy notices or policies. We recommend that you check their privacy notices before you submit any personal data to them.
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you, which we have grouped as follows:
Identity Data includes first name, last name, username or similar identifier, date of birth and/or age confirmation (used to confirm eligibility and apply age-appropriate protections), and, where you choose to provide it, your gender, country and profile image or avatar.
Contact Data includes email address and, where you provide it, telephone number.
Financial Data is generally handled by the relevant App Store Provider (Apple or Google) and is not collected or stored by us. We do not receive or store your full payment card or bank details. Where you contact us about a payment, we may process limited transaction references you provide.
Transaction Data includes details about your subscription and in-app purchases, including plan type, start and renewal dates, and confirmations of payments made to and from you (as reported to us by the App Store Provider).
Gameplay Data includes your team selections, line-ups, contest entries, in-app choices, scores, rankings, leaderboard standings, achievements and other information generated through your play.
Technical Data includes information about how you use the App and Website and device-specific data such as the device’s IP address (captured and stored in an anonymised format where practicable), device type and unique device or advertising identifiers, operating system, app version, screen resolution, geographic location (country only), language settings, and log data (referring URL/domain where applicable, pages or screens visited, and the date and time of access).
Profile Data includes your username and password, your subscription and purchase history, your interests and preferences, and your feedback and survey responses.
Usage Data includes information about how you use the App, Website, products and services.
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties, and your communication preferences.
Not all categories of personal data listed in this notice will apply to every individual. We only process the personal data necessary for the specific purposes relevant to our relationship with you.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as it does not directly or indirectly reveal your identity (for example, we may aggregate Usage Data to calculate the percentage of users accessing a specific feature). If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data.
Special category data. We do not seek to collect Special Categories of Personal Data (such as data about your race or ethnicity, religious or philosophical beliefs, health, sex life, sexual orientation, political opinions, trade union membership, or genetic or biometric data) and the App does not require it. Please do not submit such data to us. We do not routinely collect information about criminal convictions and offences. Where any such information is processed, it will only be to the extent necessary, permitted by law, supported by a lawful basis, and accompanied by appropriate safeguards.
If you fail to provide personal data. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide the App or a subscription). In that case we may have to suspend or cancel a service, and we will notify you if this is so at the time.
We use different methods to collect data from and about you, including:
(a) Direct interactions
You may give us your Identity, Contact, Profile and Gameplay Data by using the App or by corresponding with us. This includes personal data you provide when you: download and use the App; register or create an account; confirm your age or eligibility; subscribe to, renew or manage a subscription; set up a team, enter contests or play the game; join any group, newsletter or community; enter a competition, promotion or survey; request marketing; take part in market research; give us feedback or contact our support team; or interact with us in any other way.
(b) Automated technologies or interactions
As you interact with the App and Website, we may automatically collect Technical, Usage and Gameplay Data about your device, actions and patterns. We collect this using cookies, SDKs, mobile identifiers, server logs and other similar technologies. Please see our cookie policy (section 7) for further details.
(c) Third parties or publicly available sources
We may receive personal data about you from third parties operating in the UK, your country of residence and globally, including: Technical and Usage Data from analytics providers and, where applicable, advertising networks; Transaction Data and subscription/purchase confirmations from App Store Providers (Apple and Google) and payment/technical service providers; sports and tournament data from third-party golf data providers (which is generally not personal to you); and Identity or Contact Data where you register or sign in using a third-party account (for example, Apple, Google or a social login).
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances: where we need to perform the contract we are about to enter into or have entered into with you; where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; where processing falls within a category of “recognised legitimate interests” under Article 6(1)(ea) UK GDPR and Annex 1 (as introduced by the DUAA), for which no balancing test is required; where we need to comply with a legal obligation; and where we have obtained your active agreement (consent) to use your personal data for a specified purpose.
Generally, we do not rely on consent as a legal basis for processing your personal data, although where legally required we will obtain your consent before using certain cookies/similar technologies for advertising or before sending third-party direct marketing. You have the right to withdraw consent at any time by contacting us. Where the user is a child, we obtain consent from a parent or legal guardian where required by law.
We have set out below a description of the ways we plan to use your personal data, and the legal bases we rely on to do so. Note that we may process your personal data on more than one lawful ground depending on the specific purpose. Please contact us if you need details of the specific legal ground where more than one has been set out.
Purpose / Activity | Type of data | Lawful basis for processing |
To register you as a new user and verify your eligibility/age. | Identity, Contact. | Performance of a contract with you; compliance with a legal obligation (age-appropriate protections). |
To provide the App, run fantasy contests and leaderboards, calculate scores and standings, and deliver gameplay features. | Identity, Profile, Gameplay, Usage, Technical. | Performance of a contract with you; legitimate interests (to operate and improve the game). |
To process and manage subscriptions and in-app purchases, renewals and cancellations, and to keep records of transactions (payments are taken by the App Store Provider). | Identity, Contact, Transaction. | Performance of a contract with you; legitimate interests (to keep accurate records and recover sums due); compliance with a legal obligation. |
To manage our relationship with you, including notifying you about changes to our terms, policies or this notice, providing support, and requesting reviews or surveys. | Identity, Contact, Profile, Marketing and Communications. | Performance of a contract with you; compliance with a legal obligation; legitimate interests (to keep records updated and study how the App is used). |
To enable your participation in prize draws, competitions or surveys. | Identity, Contact, Profile, Usage, Marketing and Communications. | Performance of a contract with you; legitimate interests (to develop the App and grow our business). |
To administer and protect our business, the App and Website, including troubleshooting, data analysis, testing, security, fraud/anti-cheating prevention, system maintenance, support, reporting and hosting. | Identity, Contact, Technical, Gameplay. | Legitimate interests (running our business, IT and network security, preventing fraud and cheating, and business reorganisation); compliance with a legal obligation. |
To deliver relevant content and, where applicable, advertisements, and to measure their effectiveness. | Identity, Profile, Usage, Marketing and Communications, Technical. | Legitimate interests (to develop the App and inform our strategy); consent (for targeted advertising). |
To use data analytics to improve the App, Website, products, marketing, and user experience. | Technical, Usage, Gameplay. | Legitimate interests (to keep the App updated and relevant and to develop our business). |
To make suggestions and recommendations about features, contests, goods or services that may interest you. | Identity, Contact, Technical, Usage, Profile, Marketing and Communications. | Legitimate interests (to develop the App and grow our business); consent where required. |
To send direct marketing communications to you. | Identity, Contact, Marketing and Communications. | For individual consumers: consent (soft opt-in may apply to existing customers). For business contacts: legitimate interests. You may opt out at any time. |
We, and where relevant our approved service providers, may use technology (including artificial intelligence, machine learning and other automated systems) as part of delivering and improving our services, for purposes such as: delivering and enhancing the App and its features; managing operations, systems and user support; detecting fraud, cheating and misuse; carrying out research, analytics and marketing; supporting legal, regulatory and risk management requirements; and generally supporting the purposes set out in section 5A above.
Where such tools involve the processing of personal data, this will be done in accordance with applicable laws, with appropriate safeguards, and only for the purposes described in this notice. We apply data minimisation appropriate to the context. Lawful bases may include our legitimate interests, your consent (where required), performance of a contract, and/or compliance with legal obligations.
Automated Decision-Making — Updated Rules (Articles 22A–22D UK GDPR as amended). These rules permit automated decision-making that produces significant effects on individuals, subject to safeguards. Where we make such a decision (for example, an automated anti-cheating or fraud decision that significantly affects you): (a) we will inform you before the decision is made, including information about the logic involved and its likely consequences; (b) you have the right to request human review; (c) you have the right to contest the decision; and (d) where special category data is involved, an additional Article 9 condition must be satisfied. Please contact us for further details of any such tools, the data processed and the safeguards in place.
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. You can change your preferences by following the opt-out links on any marketing message sent to you, by adjusting the settings in your account, or by contacting us at any time using the Contact Details.
Marketing to consumers
Where you have indicated your consent to receiving marketing about our products, features or promotions (for example, by ticking a relevant box or opting in), or where the soft opt-in applies because you have purchased or enquired about similar products from us and have not opted out, we will use your Contact and Profile Data for these purposes. Where the user is a child, we will not send marketing without an appropriate lawful basis and, where required, parental consent.
Third-party marketing
We will obtain your express opt-in consent before we share your personal data with any third party for their own marketing purposes.
Opting out
You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message, by adjusting your account preferences, or by contacting us. Where we rely on consent, you may withdraw it at any time, and it will always be as easy to withdraw as it was to give; withdrawing consent will not affect the lawfulness of processing carried out before withdrawal. Opting out of marketing will not apply to service-related communications that are essential for administrative, customer service, security or legal/compliance purposes.
We use cookies and similar technologies (including, in the App, SDKs, local storage and mobile advertising identifiers) as set out via the Legal Information above, or as detailed in the cookie consent tool, settings or banners on the Website. A cookie is a small file of letters and numbers stored on your browser or device. Similar technologies in a mobile app perform equivalent functions. We use these to distinguish you from other users, to provide a good experience, and to improve the App and Website.
The DUAA amended the Privacy and Electronic Communications Regulations 2003 (PECR) to introduce consent exemptions for certain cookies. Statistical/analytics technologies used solely to measure performance without significantly affecting users, and functionality technologies used solely to improve user experience, may be deployed without prior consent, provided an opt-out is available. Advertising, targeting and cross-site/cross-app tracking technologies continue to require your prior consent.
Strictly necessary. Required for the operation of the App and Website (for example, to log in, keep you signed in, and maintain security).
Analytical or performance. Allow us to recognise and count users and see how they move around the App/Website so we can improve it. Under amended PECR, these may be deployed without prior consent where they do not significantly affect users and an opt-out is provided.
Functionality. Recognise you when you return and remember your preferences (such as language or region). Under amended PECR, these may be deployed without prior consent where they do not significantly affect users and an opt-out is provided.
Targeting/advertising. Record your activity to make content and any advertising more relevant, and may be shared with third parties for this purpose. These continue to require your prior consent.
Third parties may also use cookies or similar technologies over which we have no control, such as analytics and advertising providers. To change your settings, use the cookie settings banner/widget on the Website or the privacy settings on your device or operating system (for example, resetting or limiting your mobile advertising identifier, or adjusting app tracking permissions). You can also configure your browser to block cookies, though blocking essential cookies may prevent parts of the Website from working. You can find more about cookies at www.aboutcookies.org or www.allaboutcookies.org.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If you wish to get an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so. We may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We may share your personal data with the parties set out below, and as further detailed in our Third Party Providers/Processors list (or similar), which we update from time to time, for the purposes set out above:
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Because the App is available globally, your personal data may be transferred to, and processed in, countries other than your own. Different countries have different rules for how personal data can be transferred internationally. We follow the standards required under the data protection laws that apply to you, so that your personal data is protected wherever it goes.
We may share your personal data with Affiliates and External Third Parties based outside the country in which our business is registered or operates, including, where relevant, the United States, the European Economic Area, Canada, Australia and other jurisdictions where those persons are located.
Whenever we transfer your personal data internationally, we ensure it is protected in accordance with the applicable data protection laws by implementing at least one of the following safeguards: transferring only to countries recognised as providing an adequate level of protection; and/or using specific contractual safeguards, such as UK International Data Transfer Agreements (IDTAs), the UK Addendum to the EU Standard Contractual Clauses, EU Standard Contractual Clauses, or other approved mechanisms, to ensure your personal data receives a level of protection equivalent to that in your country of residence.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We seek to apply data protection by design and default where appropriate, and implement measures that are reasonable and proportionate under applicable laws, taking into account the nature of the data, the risks involved and available technology. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality.
We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator (including the ICO) within 72 hours of becoming aware of a breach where we are legally required to do so under UK GDPR Article 33. We will also notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms. However, no electronic transmission or storage technology can be guaranteed to be 100% secure, so, although we do our best to protect your information, transmission of personal data to and from the App and Website is at your own risk.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. To determine the appropriate retention period we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and the applicable legal requirements. By law we have to keep basic information about our customers (including Contact, Identity, Transaction and, where applicable, Financial Data) for six years after they cease being customers, for tax purposes. In some circumstances you can ask us to delete your data (see your legal rights below). In some circumstances we will anonymise your personal data for research or statistical purposes, in which case we may use it indefinitely without further notice.
A Data Retention Schedule is available on request, setting out the specific retention periods we apply to each category of personal data. Where we use third-party technology service providers, including software and AI tools, some may retain limited data for their own limited purposes and for longer than our standard practices; we take steps to minimise the personal data shared with such providers and to use providers that apply appropriate safeguards.
Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please see the Glossary for more detail. These include the right to: request access to your personal data; request correction of your personal data; request erasure of your personal data; object to processing of your personal data; request restriction of processing; request transfer of your personal data; withdraw consent; and, in relation to automated decision-making (Articles 22A–22D UK GDPR), the right to be informed before a significant automated decision is made, to obtain human review, and to contest the decision. If you wish to exercise any of these rights, please contact us.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.
What we may need from you
We may need to request specific information from you to confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request to speed up our response. Where a request is made in relation to a child’s data, we may need to verify the identity and authority of the parent or guardian.
Time limit to respond
With reference to the DUAA: (a) we are only required to conduct “reasonable and proportionate” searches in response to a subject access request; (b) the response time (ordinarily one month) starts from the latest of receipt of your request, receipt of any identity verification we reasonably require, or receipt of any permitted fee; and (c) the clock pauses if we ask you for clarification we reasonably need, and restarts when that information is received. We will keep you updated if your request is particularly complex or numerous and an extension (of up to two additional months) is required.
Additional rights. Depending on your location and the laws that apply to you, you may have additional rights (for example, under EU GDPR or other national or state privacy laws). We will respect and facilitate these rights where and to the extent required by applicable laws.
Affiliates means our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us.
App Store Provider means Apple Inc. (Apple App Store) or Google LLC (Google Play), through which the App is distributed and subscriptions are billed.
Legal Information means the information and documentation about our business supplied to you in writing and/or published on the Website, or available upon request, including at the start of this document.
Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best products and services and the best and most secure experience. We consider and balance any potential impact on you and your rights before processing for our legitimate interests, and we do not use your data where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law).
Recognised Legitimate Interests (Article 6(1)(ea) UK GDPR, inserted by the DUAA) means processing that falls within one of the five categories in Annex 1 of the UK GDPR, for which no balancing test is required: (1) prevention or detection of crime; (2) safeguarding vulnerable individuals; (3) responding to emergencies threatening life, health or safety; (4) national security or defence; and (5) supporting a public interest task. This basis does not ordinarily apply to commercial processing activities.
Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.
Consent means that you have given us permission to process personal information for a given purpose. You have the right to withdraw this consent at any time using the Contact Details or your account settings.
Your legal rights (detail). You have the right to: request access to your personal data (a “data subject access request”); request correction of inaccurate or incomplete data; request erasure where there is no good reason for us to continue processing (subject to legal exceptions); object to processing based on legitimate interests or for direct marketing; request restriction of processing in certain circumstances; request transfer (portability) of certain data you provided; withdraw consent where we rely on it; and exercise rights in relation to solely automated decisions with significant effects. These rights do not apply in all situations and may be subject to the provisions of relevant data protection laws; for example, we may be required by law to retain some personal data despite an erasure request. If you have any questions or would like more information, please contact us using the Contact Details in the Legal Information.
