Privacy Policy

This Privacy Policy explains how personal data is collected, used, stored and protected in connection with the OneBall app and related services, under Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019 and other applicable law.

Controller: ΤΣΕΚΛΙΔΗΣ ΨΗΦΙΑΚΕΣ ΕΦΑΡΜΟΓΕΣ ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (trade name: OneBall) AFM: 803246831 · GEMI: 192976806000 · Tax Office: Ampelokipon Seat: Melissochori, PC 57018, Municipality of Oreokastro, Thessaloniki, Greece Privacy: privacy@oneball.gr · Contact: stefan@oneball.gr · https://oneball.gr

Account data: name / display name, email, date of birth / age, nationality, playing position, avatar settings, Terms/Privacy acceptance version and timestamp.

Usage data: app interactions, bookings and match history, searches, chat messages (Stream Chat), notification preferences, device/technical data and analytics where used.

Payment data: processed by Stripe. We do not store full card numbers, CVV or equivalent. We store transaction references, amounts, receipt metadata and records needed for tax and support.

Website oneball.gr: waitlist email and source, plus technical logs needed to operate the site.

• Contract performance (Art. 6(1)(b) GDPR): account, bookings, credits, subscriptions.
• Legitimate interests (Art. 6(1)(f)): service improvement, security, fraud prevention — balanced against your rights.
• Consent (Art. 6(1)(a)) where required: optional features such as push notifications.
• Legal obligation (Art. 6(1)(c)): tax and accounting duties.

Account management; processing bookings, subscriptions and credit purchases; enabling player communication; personalising suggestions; transactional emails (confirmations, receipts, password resets); analytics-based improvement; enforcing Terms and preventing abuse; handling support and refund requests.

• Supabase (database, auth, functions) — EU region
• Stripe (payments) — PCI-DSS
• Stream (chat) — with a data processing agreement
• Email delivery providers for transactional mail
• Analytics providers where used, preferably anonymised/aggregated

We do not sell personal data.

• Account data: while the account is active and up to 30 days after deletion, unless law requires longer.
• Payment/tax records: up to 7 years under Greek tax rules.
• Chat: for the relevant match/team channel duration or as needed for safety/legal claims.
• Analytics: anonymised after 24 months where applicable.
• Terms acceptance records: for the account lifetime and a reasonable period thereafter for evidence.

Access, rectification, erasure (Settings → Delete Account, subject to legal retention), restriction, portability (request a structured copy via privacy@oneball.gr), objection to legitimate-interest processing, and withdrawal of consent where applicable.

Exercise rights via privacy@oneball.gr or in-app Settings where available.

Appropriate technical and organisational measures, including TLS in transit, access controls, database security policies (e.g. Row Level Security) and secure authentication.

Data is primarily stored in the EU. Where transfers outside the EU/EEA occur (e.g. certain Stripe or Stream processing), appropriate safeguards such as Standard Contractual Clauses apply.

Accounts and purchases: 18+. We ask for date of birth to compute/store age only. The Service is not directed at anyone under 18. If we learn we collected such data, we will delete it without undue delay.

The native App does not use browser cookies. Device identifiers may be used for push and analytics. You may disable pushes in App or device settings. If oneball.gr uses non-essential cookies, appropriate notice and consent will be provided as required by law.

Material changes will be notified in the App and/or by email. The “Last updated” / policy version reflects the current revision.