Privacy Notice

1. Who We Are

Major Fantasy Golf Limited operates Major Fantasy Golf, a free-to-play fantasy golf website and app that allows users to create a Team, and create or join Public or Private Leagues. If you have any questions about this Privacy Notice or how we handle your personal data, you can contact us using the details in Section 13 (Contact Us and Your Right to Complain).

2. Personal Data We Collect

We collect the following categories of personal data directly from you when you register for and use the Platform:

• Identity and account data: your email address, display name, and password (stored in encrypted/hashed form, unless you sign in with Google, in which case we use your Google-authenticated identity instead).
• Gameplay and activity data: your team name, golfer selections, captain and reserve picks, and the Public and Private Leagues you join or create.
• Consent and preference records: timestamps recording your acceptance of our Terms and Conditions, your marketing opt-in choices, and your notification preferences (for example, deadline reminders and results notifications).
• Technical and session data: strictly necessary authentication tokens stored in your browser, your IP address, and basic connection information used for security and spam prevention.

We do not use advertising, cross-site tracking, or marketing cookies, and we do not knowingly collect special category data (such as health, racial or ethnic origin, or religious belief data) through the Platform. You should not submit such data to us, including within any team name, league name, or other content you post.

3. How We Use Your Personal Data and Our Legal Bases

We only use your personal data where we have a valid legal basis to do so under the UK GDPR. The table below sets out our main purposes and the legal basis we rely on for each.

We may also use your personal data where necessary to comply with a legal obligation, such as responding to a lawful request from a regulator or law enforcement body, or to establish, exercise, or defend legal claims, which we do in reliance on our legitimate interests and, where applicable, legal obligation as the legal basis.

4. Service Messages and Marketing Communications

We will send you service messages relevant to your Account and use of the Platform, such as password resets, tournament deadline reminders, round recap emails, security notices, and important changes to the Service. These communications are necessary for us to operate your Account and the Platform, and you cannot opt out of them while you hold an Account, consistent with the Privacy and Electronic Communications Regulations 2003 ("PECR"), which permit such service communications as part of performing our contract with you. You can, however, adjust certain notification toggles (such as deadline or results notifications) in your Account settings.

We will only send you marketing or news emails about the Platform where you have given your consent, in accordance with PECR. We keep a timestamped record of your marketing opt-in choice. You can withdraw your consent to marketing communications at any time, free of charge, by using the unsubscribe link in any marketing email or by updating your communication preferences in your Account settings. Withdrawing consent will not affect your ability to use the Platform or to receive necessary service messages.

5. Cookies and Similar Technologies

Our website and app use cookies and similar technologies that are strictly necessary for the Platform to function, such as authentication tokens that keep you logged in. These strictly necessary cookies do not require your consent under PECR. We do not currently use advertising, cross-site tracking, or marketing cookies.

If we introduce any non-essential cookies in the future, such as analytics or advertising cookies, we will ask for your consent before setting them, in accordance with PECR, and will provide further detail in a dedicated Cookie Policy or cookie banner at that time.

6. Where in the World Your Personal Data Is Processed

• Primary database and authentication storage (Ireland, EEA): Your Account data and authentication records are physically hosted within the European Economic Area, specifically in Ireland. Because the UK Government recognises the EEA under the UK's data protection adequacy regulations, transfers of your personal data between the UK and this EEA location do not require any additional transfer safeguard.
• Application delivery (UK, EU, and global edge network): The Platform's website and app front end are delivered through a distributed content delivery and edge network with points of presence across the UK and Europe, which provides fast page loading and encrypts traffic in transit using SSL/TLS. This network may route traffic through edge locations outside the EEA as part of its global infrastructure.
• Optional third-party sign-in (United States and global): If you choose to sign in using "Sign in with Google", Google processes your authentication tokens and verifies your identity using its global infrastructure, which may involve processing in the United States. This transfer is covered by the UK Extension to the EU-US Data Privacy Framework, a UK Government-approved transfer mechanism.

7. Who We Share Your Personal Data With

We do not sell your personal data. We share your personal data only with the following recipients, where necessary to operate the Platform.

We also disclose personal data to regulators, law enforcement, or other third parties where required by law, or to protect our rights, property, or the safety of our users. Where we use third-party providers to process personal data on our behalf, we enter into data processing agreements with them requiring them to protect your personal data in accordance with applicable data protection law.

In addition, your team name, league name, and League standings are visible to other members of the same League and, for Public Leagues, to other registered users, as part of the normal functioning of the Service.

8. International Transfers of Personal Data

As set out in Sections 6 and 7, your personal data is primarily stored in Ireland (within the EEA), which the UK Government recognises as adequate, so no additional transfer safeguard is required for that storage location.

Where you choose to sign in with Google, or where our content delivery network routes traffic outside the UK and EEA, your personal data (or elements of it, such as authentication tokens) may be transferred to, or processed in, the United States or other countries. In each such case, we ensure an appropriate safeguard is in place as required by the UK GDPR, such as the UK Extension to the EU-US Data Privacy Framework, Standard Contractual Clauses with the UK Addendum, or another lawful transfer mechanism recognised under UK data protection law.

9. How Long We Keep Your Personal Data

We keep your personal data for as long as your Account remains active, so that we can provide the Platform to you.

If you close your Account, we will retain your personal data only for as long as reasonably necessary thereafter, for example to deal with any outstanding queries, to comply with legal or regulatory obligations, or to establish, exercise, or defend legal claims, after which it will be deleted or anonymised.

We review our retention practices periodically and will update this Privacy Notice if our approach to retention periods changes materially.

10. How We Protect Your Personal Data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure, including encrypting or hashing passwords, encrypting traffic in transit using SSL/TLS, restricting access to personal data on a need-to-know basis, and using reputable hosting, authentication, and email service providers.

No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your personal data, but we will notify you and any applicable regulator of a personal data breach where we are required to do so by law.

11. Children and Age Requirements

The Platform is intended for users aged 16 and over. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have collected personal data from someone under this age, we will take reasonable steps to delete that data.

12. Your Rights Under UK Data Protection Law

Subject to certain exceptions and conditions under the UK GDPR, you have the right to:

• request access to the personal data we hold about you;
• request that we correct any inaccurate or incomplete personal data;
• request that we erase your personal data in certain circumstances;
• request that we restrict our processing of your personal data in certain circumstances;
• object to our processing of your personal data where we rely on legitimate interests;
• request a copy of certain personal data you have provided to us in a structured, commonly used, and machine-readable format, and ask us to transfer that data to another controller (data portability); and
• withdraw your consent at any time where we rely on consent, such as for marketing communications, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us using the details in Section 13 (Contact Us and Your Right to Complain). We will respond to your request within one month, in accordance with the UK GDPR, though this may be extended by a further two months for complex or numerous requests.

14. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our data practices or applicable law. We will post the updated notice on the Platform and update the "Last updated" date at the top of this document. Where changes are material, we will take reasonable steps to notify you, such as by email or an in-app notice.