1Who controls your data
The data controller is the Egyptian Professional Clubs Association, based in Cairo. It has an appointed data protection officer whom you can write to directly at dpo@eglfantasy.eg.
Your data is stored inside the Arab Republic of Egypt. If we ever need to transfer it abroad, this will only happen with a licence from the Center and with prior notice to you.
2Exactly what we collect
We collect only what the service actually needs. This is everything:
| Category | Example | Legal basis | Retention |
|---|---|---|---|
| Account data | Name · email · phone number · favourite club | Performance of the contract | Life of the account + one year |
| Gameplay data | Squad · transfers · points · ranking | Performance of the contract | Five seasons |
| Payment data | Last four digits and the transaction reference only | Legal obligation | Five tax years |
| Content you post | Posts · comments · articles | Your consent | Until you delete it + 30 days |
| Device data | Device type · operating system · notification ID | Legitimate interest | Eighteen months |
| Usage log | The screens you opened and when | Legitimate interest | Twelve months |
3What we do not collect
We say it explicitly so there is no doubt:
- We do not collect your precise location
- We do not read your contacts or your photos
- We do not keep your bank card number
- We do not listen to the microphone or access the camera, except when you upload a photo yourself
4Your consent and how to withdraw it
Where the basis is your consent, we ask for it explicitly and specifically before collecting, and we state the purpose clearly. Consent is always optional, and the core service never depends on it.
You can withdraw any consent at any time from “Account → Privacy and my data”, and withdrawing does not affect the lawfulness of what happened before.
5Who we share your data with
We do not sell or rent your data to anyone. We share it only with those needed to run the service, under a processing agreement that obliges them to protect it:
- The match data provider — receives no personal data from you
- The payment gateway — only to complete the transaction
- The notifications provider — the device ID only
- The competent judicial authorities — on a formal written request
6Your rights
The Personal Data Protection Law gives you rights that we fulfil from inside the app, without intermediaries, and we respond within thirty days:
- Access your data and download it as a file
- Correct anything that is wrong
- Delete your account and your data
- Withdraw consent and object to processing
- Move your data to another provider in a readable format
- Know who viewed your hidden content, and when
“Account → Privacy and my data” — every one of these rights is there, one button each.
7Data of people under fifteen
We process the data of anyone under fifteen only with the explicit written consent of their guardian, under Article 3 of Law No. 151 of 2020.
We show no personalised ads to this group, and we block all betting-related content for them on every network. If we learn of an account created without this consent, we suspend it and delete its data.
8Ads and tracking
The free version shows ads in the feed, blogs and prizes only. We show no ads on the live match screen or on the points screen.
Ads are primarily contextual, and we do not build an advertising profile of you from your behaviour outside the app. You can remove them for good with a one-time payment or with a subscription.
9Security and breach notification
We protect data with encryption in transit and at rest, with role-based separation of permissions, and with a tamper-proof audit log that records every sensitive access.
If a breach affects your data, we will notify the Personal Data Protection Center and you within the periods set by law, and explain what happened, what we did and what you should do.
10Changes to this policy
If we make a material change, we will notify you in the app fourteen days before it takes effect, and we keep previous versions available to read.
11Complaints
If you are not satisfied with our response, you can complain directly to the Personal Data Protection Center of the Ministry of Communications and Information Technology.
To contact us: dpo@eglfantasy.eg — we reply within three business days.