Privacy Policy
Last updated: 23 April 2026 · Effective: 23 April 2026
1. Introduction
Playfield operates a talent marketplace for the sport business industry at this Platform. We are committed to protecting your personal data and complying with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have.
Data Controller:Playfield · privacy@playfield.sport
2. Who This Policy Applies To
- Candidates / Job Seekers — sport business professionals creating talent profiles
- Employers / Organisations — clubs, federations, agencies, and brands posting job opportunities
- Website Visitors — anyone browsing the Platform without an account
3. Data We Collect
3.1 Candidates (Job Seekers)
| Category | Examples | Source |
|---|---|---|
| Identity | Full name | Provided by you |
| Contact | Email address | Provided by you |
| Professional | Job role, specialisations, experience | Provided by you |
| Location | City, country | Provided by you |
| Biography | Professional summary | Provided by you |
| Social | LinkedIn profile URL | Provided by you |
| Availability | Current availability status | Provided by you |
3.2 Employers / Organisations
| Category | Examples | Source |
|---|---|---|
| Organisation identity | Name, type (club, federation, agency, brand) | Provided by you |
| Organisation details | Description, website, location | Provided by you |
| Job listing data | Title, description, location, contract type, salary range | Provided by you |
| Contact | Email address | Provided by you |
| Payment records | Transaction amounts, Stripe session IDs | Stripe |
We do not store full card numbers or payment credentials. All payment processing is handled by Stripe.
3.3 All Users (Automatically Collected)
| Category | Examples | Source |
|---|---|---|
| Usage data | Pages visited, features used, clicks | Analytics beacon |
| Technical | IP address, browser type, OS, device | Server logs |
| Session | Session identifiers | Cookies / server |
4. Legal Basis for Processing
We only process your personal data when we have a valid legal basis under Article 6 GDPR.
| Processing Activity | Legal Basis |
|---|---|
| Creating and hosting your talent profile | Contractual necessity (Art. 6(1)(b)) |
| Displaying your profile to relevant employers | Contractual necessity (Art. 6(1)(b)) |
| Creating and publishing job listings | Contractual necessity (Art. 6(1)(b)) |
| Processing payments | Contractual necessity (Art. 6(1)(b)) |
| Analytics and platform improvement | Legitimate interests (Art. 6(1)(f)) |
| Sending transactional emails | Contractual necessity (Art. 6(1)(b)) |
| Sending marketing emails | Consent (Art. 6(1)(a)) |
| Legal obligations (e.g. accounting records) | Legal obligation (Art. 6(1)(c)) |
5. Data Sharing and Third-Party Processors
We do not sell your personal data. We share data only where necessary with trusted service providers acting as data processors under a data processing agreement:
- Vercel, Inc. — Cloud hosting provider. Processes all data transmitted through the Platform. Safeguards: EU–US DPF + SCCs.
- Neon, Inc. — Database provider. Stores all structured application data (profiles, organisations, listings). Safeguards: SCCs.
- Stripe, Inc. — Payment processor. Processes payment data for employer billing. Safeguards: EU–US DPF + SCCs.
- NanoCorp / phospho — Analytics provider. Collects pseudonymised usage events and page views.
We may also disclose data to comply with legal obligations, protect vital interests, or in connection with a merger or acquisition.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Candidate profiles | Until deletion requested, or 2 years after last login |
| Employer / organisation data | Until deletion requested, or 2 years after last activity |
| Job listings | Archived 90 days after expiry; deleted after 2 years |
| Payment records | 7 years (legal/tax obligation) |
| Server logs | 90 days |
| Analytics data | 13 months (aggregated data kept indefinitely) |
7. Your Rights Under GDPR
As a data subject in the EEA, you have the following rights:
| Right | What It Means |
|---|---|
| Access (Art. 15) | Request a copy of all personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate or incomplete data |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") |
| Restriction (Art. 18) | Ask us to pause processing your data in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format (JSON or CSV) |
| Object (Art. 21) | Object to processing based on legitimate interests or for direct marketing |
| Withdraw consent | Withdraw consent at any time without affecting prior processing |
To exercise your rights, email privacy@playfield.sport with subject “Data Subject Request”. We will respond within 30 days.
You also have the right to lodge a complaint with your national supervisory authority (e.g. CNIL in France — www.cnil.fr).
8. Security
We implement appropriate technical and organisational measures including encrypted connections (HTTPS/TLS), encrypted storage at rest, and access controls. If you believe your data has been compromised, notify us at privacy@playfield.sport.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or emailing registered users. Continued use after changes constitutes acceptance.
10. Contact
For privacy enquiries or data subject requests:
Playfield — Data Privacy
privacy@playfield.sport
This document is a production-ready draft reviewed for GDPR compliance. We recommend having it reviewed by qualified EU data protection counsel before launch.