Privacy Policy
Last updated: 11 June 2026
This policy explains what personal data Bundesliga Draft ("we") collects about you, why, and what rights you have. We process as little data as possible — the site is built for a circle of friends, not to sell data.
1. Data controller
Bundesliga Draft is the data controller for the processing of your personal data. If you have questions or want to exercise your rights, you can contact us at cbakolesen@gmail.com.
2. What we collect
Account details. When you create an account, we store your email address and your chosen display name. Your password is never stored in plain text — it is handled securely by our provider (Supabase).
League and draft data. The team names, player picks, lineups and captain choices you make in your leagues, and which leagues you belong to.
Anonymous page-view statistics. We record which pages are visited, along with a randomly generated visitor id stored locally in your browser. This id is not linked to your account, and we store neither name, email nor IP address with it. Its sole purpose is to see how many people use the site.
Traffic and performance analytics (Vercel). We use Vercel Analytics and Speed Insights for aggregate statistics on visits and page speed. These tools are cookie-free and collect aggregated, anonymised data — not information that identifies you personally.
3. Why we process this data (legal basis)
- To provide the service (create an account, run drafts, show leagues) — legal basis: performance of a contract, UK GDPR Article 6(1)(b).
- To understand and improve use of the site (anonymous statistics and performance) — legal basis: our legitimate interest in a well-functioning site, Article 6(1)(f).
4. Who we share data with
We never sell your data. We use a small number of trusted processors to run the site:
- Supabase — database and login (storing account, league and draft data).
- Vercel — hosting of the website plus traffic and performance analytics.
These providers process data only on our behalf and on our instructions. Data may be processed on servers outside the UK; where that happens, the transfer relies on appropriate safeguards such as the UK International Data Transfer Agreement or standard contractual clauses.
5. How long we keep data
- Account details are kept for as long as you have an account.
- League and draft data are kept for as long as the league exists. Leagues that are never started are deleted automatically after 24 hours of inactivity.
- Anonymous page-view statistics are kept on an ongoing basis for statistical purposes and cannot be traced back to you.
6. Your rights
Under data protection law you have the right to:
- access the data we hold about you,
- have incorrect data corrected,
- have your account and personal data deleted,
- object to the processing,
- receive your data in a portable form (data portability).
Write to cbakolesen@gmail.com to exercise any of your rights — for example, to have your account deleted.
7. Cookies and local storage
We do not use advertising or tracking cookies. To keep you signed in we store a necessary login cookie (from Supabase). We also store a random, anonymous visitor id in your browser's local storage (localStorage) for the anonymous page-view statistics. You can clear this at any time via your browser settings.
8. Changes to this policy
We may update this policy if the site changes. The latest version will always be on this page, with an updated date at the top.
9. Complaints
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) via ico.org.uk.