Privacy policy
Version of 6 November 2026
Draft: pending legal review and the highlighted fields. Do not publish as is.
1. Who we are
FootballTasks is an online platform, sold as a service, for football agencies and agents to keep track of requests from clubs and agents, of players and of the profiles they send. It is operated by EF Techsolutions (legal name, tax number and address to be filled in), referred to in this policy as “we”.
For any privacy question: contact@footballtasks.org.
2. Two different roles
- We are the controller of the data of people who visit this site, request a demo or have an account on the platform.
- Each agency is the controller of the data it puts on the platform: players, contacts, requests, notes and documents. We process that data only on the agency’s behalf, following its instructions and the data processing agreement we sign with each agency (Article 28 GDPR).
If you are a player, a representative or a contact recorded by an agency, please contact that agency first. If you contact us, we will pass the request on and help the agency answer it.
3. Data we process as controller
| Data | Purpose | Legal basis | How long | |
|---|---|---|---|---|
| Visiting the site | IP address and page requested, in the server logs. | Keeping the site secure and preventing abuse. | Legitimate interest | 14 days |
| Demo request | Name, email, agency and whatever you write to us. | Replying and preparing the demo. | Pre-contractual steps | 12 months after the last contact, if you do not become a customer |
| Demo account | Name and email of the person trying it, for 7 days, with made-up data only. | Giving access to the demo. | Pre-contractual steps | Deleted 30 days after it ends |
| Platform account | Name, email, role in the agency, password and recovery codes (stored only as hashes, which cannot be reversed) and the authenticator app secret. | Providing the service and protecting access. | Contract | While the account exists; then together with the agency’s data |
| Security logs | Sign-ins, failed attempts, IP address and which account made each change. Technical logs keep identifiers, never names, emails or free text. | Security, investigating abuse and knowing who changed what. | Legitimate interest | 12 months |
| Invoicing | Company name, tax number, address and invoices. | Meeting tax obligations. | Legal obligation | 10 years, as tax law requires |
We do not sell data, we do not advertise and we do not use the data for any other purpose.
4. Data agencies keep on the platform
The platform stores whatever each agency records there. The agency decides what it keeps, on what legal basis and for how long, and is accountable for it. Some rules apply to every agency:
- No health data and no video files: links only.
- Minors are kept in a separate internal register with its own rules, and never go into player records or PDFs.
- No public links to player records: only people the agency invites can get in.
- We do not use artificial intelligence on players’ data.
- Player suggestions for a request show the reasons, and a person at the agency always makes the decision. Nobody is subject to solely automated decisions (Article 22 GDPR).
We only access an agency’s data when the agency asks us to, for support, or when the law requires it. When the contract ends, the agency can export its data. We then delete it within 30 days, and backups expire in the following cycle, up to 35 days later.
5. Who else has access
We only use providers that help us deliver the service, under contract and bound by confidentiality:
- Server hosting and backups: provider to be chosen, in the European Union.
- Platform emails (invitations and access resets): Resend, sending from its EU region. Resend is a US company; the transfer is covered by safeguard to be confirmed: Data Privacy Framework or standard contractual clauses.
- No personal data: exchange rates (Frankfurter, using European Central Bank data) and transfer window dates (FIFA) are fetched by the server without sending anyone’s data.
If we change providers, this list is updated and agencies are told beforehand.
6. Security
- Two-step verification is mandatory on every account.
- Each agency’s data is kept apart by rules in the database itself: one agency cannot see another’s, not even through a programming error.
- Connections are always encrypted (HTTPS) and sessions use protected cookies.
- Passwords and recovery codes are stored only as hashes.
- Regular backups, with restore tests.
7. Cookies and browser storage
This site does not use cookies. It stores in your browser, only for the visit, which of the two opening animations you have already seen.
The platform only uses strictly necessary cookies: the session cookie, which ends after 8 hours without use or when you log out, and the two-step verification cookie, which lasts 5 minutes. It also stores in your browser the language and theme you choose. There are no analytics or advertising cookies, so we do not ask for consent.
8. Your rights
You can ask to access your data, correct it, delete it, restrict its processing, receive it in a portable format and object to processing based on legitimate interest. Just write to contact@footballtasks.org. We reply within one month and may ask you to confirm your identity.
You can also lodge a complaint with the Portuguese data protection authority (cnpd.pt) or with the authority of the country where you live.
9. Changes
If this policy changes in a way that affects customers, we will tell agency administrators by email before the change takes effect. The version date is at the top.