Provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003 ("Privacy Code"), as amended by Legislative Decree 101/2018.

Last updated: September 28, 2026

RecFootball SRL SB, with its registered office at Via Fabio Filzi 2, 20124 Milan (MI), VAT/Tax ID 13872470961.
Website: https://recfootball.club, Email: email@recfootball.club

RecFootball acts as the Data Controller for your account data and the App's technical data.

Data regarding players and staff (rosters, team sheets, and match reports) is entered by sports club officials or uploaded by the tournament organizer. For this data, the sports club is the Data Controller, processing it for the purpose of participating in the event. RecFootball processes this data on behalf of the club in the capacity of Data Processor (Art. 28 GDPR). The sports club is responsible for informing players, families, and staff and obtaining any necessary consents. Requests regarding this data should be addressed to the sports club; if we receive them, we will forward them to the relevant club and assist them in responding.

4.1 Accounts (officials, coaches, administrators)
- email address and unique account identifier;
- login method: email and password, Google, or Apple. The password is managed by Firebase Authentication and cannot be read by RecFootball;
- profile name and photo provided by Google or Apple, displayed in the App but not stored in the RecFootball database;
- the team and schedule associated with the account;
- acknowledgment of this policy and the date the App was last used.

‍

4.2 Team
Team name and the email address for receiving match reports.

‍

4.3 Players
First name, surname, date of birth, FIGC registration number, jersey number, and category. Most of these individuals are minors (Pulcini and Esordienti categories).

‍

4.4 Staff
First name, surname, phone number, FIGC registration number, ID document number, and role (coach, team manager, team doctor, referee).

‍

4.5 Matches and reports
Squad list and staff present, scores, details regarding the conduct of the match (e.g., fair play, pre-match greetings, standard substitutions), free-text notes, and an image of the handwritten signatures made on the device by the team manager and the referee. Signatures are saved simply as images; the App does not capture pressure, speed, or other parameters, nor does it perform biometric processing. We ask that you do not include health data or other special categories of personal data (Art. 9 GDPR) in the notes.

‍

4.6 Photo of the opposing team's roster
If the opposing team does not use the App, you can take a photo of their paper roster. The photo remains only on your device and is included in the match report PDF; it is not uploaded to RecFootball servers.

‍

4.7 Technical and diagnostic data
In the event of errors or crashes, the App sends an error report to Firebase Crashlytics containing device information (model, operating system, App version), the account identifier, and log messages from previous operations—which may include email addresses and the names of teams, players, or staff.
To display fonts, the App downloads them from Google Fonts; in doing so, Google Fonts receives the device's IP address. The service hosting recfootball.club also receives the IP address when the App downloads this notice.

The App does not use statistical analysis or advertising tools, does not track the device's location, and does not engage in profiling.

a) Creating and managing the account and enabling you to use the App, including linking to a team via invitation. Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).

b) Compiling, signing, generating, and sharing match rosters and reports on behalf of the sports club. The legal basis is determined by the sports club acting as the data controller—typically the membership relationship and the competition regulations.

c) Ensuring the security and proper functioning of the App and correcting errors. Legal basis: RecFootball’s legitimate interest (Art. 6(1)(f) GDPR).

d) Complying with legal obligations and exercising or defending legal claims. Legal basis: Art. 6(1)(c) and (f) GDPR.

The data is not used for marketing purposes, is not sold, and is not subject to decisions based solely on automated processing (Art. 22 GDPR).

The email address is required to create the account. Data regarding rosters, staff, and matches is required to complete team sheets and match reports. Without this data, it is not possible to use the corresponding App functions.

- Google (Google Ireland Limited and Google LLC), acting as a data processor for Firebase services: Firebase Authentication (accounts), Cloud Firestore (database), and Firebase Crashlytics (diagnostics). The Cloud Firestore database is located within the European Union (multi-region eur3: Belgium and the Netherlands). Information: https://firebase.google.com/support/privacy
- Google and Apple, if you choose to log in using your Google or Apple account. Authentication takes place via these providers, who act as independent data controllers in accordance with their own privacy policies: https://policies.google.com/privacy and https://www.apple.com/it/legal/privacy/
- Google, for the Google Fonts service: https://policies.google.com/privacy
- [INSERT recfootball.club HOSTING PROVIDER], acting as a data processor for the website.
- Tournament administrators and organizers with access to the management panel; they access team, account, roster, staff, and match report data, and can import/export this data to spreadsheets.
- The opposing team: the match report contains data for both teams; therefore, the selected players, staff present, and signatures are visible to the other team as well.
- Recipients of your choice: the match report PDF can be shared using your device's functions (email, messaging apps, etc.). From the moment of transmission, the recipient and the app used process the data as independent data controllers.
- Competent authorities, when required by law.

Within RecFootball, data is processed only by authorized and instructed personnel (Art. 29 GDPR and Art. 2-quaterdecies of the Privacy Code).

Google LLC and Apple Inc. are based in the United States; specifically, data from Firebase Authentication and Firebase Crashlytics may be processed in the United States. Transfers take place based on the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework of July 10, 2023 (for certified companies), and Standard Contractual Clauses (Art. 46 GDPR).

- Account: until you delete it. You can delete it at any time via the App using the "Delete me" function: this deletes the account and—if you choose—also the data regarding your team's players, staff, and matches.
- Squads and staff: until deleted by the sports club or tournament organizer, or upon account deletion.
- Match reports: once finalized with the referee's signature, the report can no longer be modified or deleted within the App, to ensure its integrity. Match reports are retained for until the end of the following sports season and then deleted. The section of the report completed by the opposing team remains associated with that team.
- Crashlytics diagnostic data: 90 days.
- Photos of the opposing team's roster and generated PDFs: these remain on your device until you delete them or uninstall the App. PDFs that have already been sent remain with the recipients. Data may be retained for longer periods only if necessary to comply with a legal obligation or to defend a legal claim.

The App is intended for adult managers, coaches, and organizers; minors must not create an account. Data regarding minor players is entered by the sports club, which acts as the data controller and must have informed the person(s) exercising parental responsibility.

Communications between the App and the servers are encrypted (HTTPS/TLS), and data is also encrypted within the database. Access is governed by rules allowing each user to view and modify only the data related to their own team and its matches; tournament administrators have separate permissions.

You may exercise the rights provided for in Articles 15–22 of the GDPR at any time: access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest. Please write to recfootball@gmail.com: we will respond within one month, a period that may be extended by two months in complex cases (Art. 12 GDPR).

For data concerning players and staff, please contact the sports club acting as the data controller (see point 2).

You also have the right to lodge a complaint with the Italian Data Protection Authority (*Garante per la protezione dei dati personali* – Piazza Venezia 11, 00187 Rome, https://www.garanteprivacy.it) or to seek judicial remedy.

This notice may be updated. The date of the last update is indicated at the top of the document.