Privacy Policy · BALLON

Version 3.3 — Last updated: 2026-09-23

Ballon ("Ballon", the "Platform", "we", "our" or "us") is a social sports score prediction platform where users can create and join leagues, submit match predictions, compete in rankings and enjoy sports competitions with friends and other users around the world.

Your privacy is important to us. This Privacy Policy explains how we collect, use, store, share and protect your Personal Data when you use the Platform. We process Personal Data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") and other applicable data protection laws.

Please read this Privacy Policy carefully before using Ballon.

1. Key Principles

When processing your Personal Data, we are guided by the following principles:

Data minimisation – we collect only the Personal Data necessary to provide and improve the Platform.

Transparency – we explain clearly what Personal Data we process, why we process it and how long we retain it.

Security – we protect Personal Data through appropriate technical and organisational measures.

User control – wherever possible, you remain in control of your Personal Data and may exercise your GDPR rights at any time.

Privacy by design – privacy considerations are incorporated into the design and development of new features before they are made available to users.

2. Data Controller

The controller of your Personal Data is:

Ballon League Sp. z o.o., address: ul. Szlak 77/222, 31-153 Kraków, Poland, NIP: PL 6762725466, registered under the KRS number: 0001259577

Privacy enquiries: privacy@ballonleague.com

General support: support@ballonleague.com

If you have any questions regarding this Privacy Policy or the processing of your Personal Data, please contact us using the details above.

3. Scope of this Privacy Policy

This Privacy Policy applies whenever you use Ballon, including when you create or manage your account; sign in using your email address or a supported authentication provider; create, join or participate in leagues; participate in rankings, reputation features and gameplay or contact us regarding support or privacy matters.

It also applies to Personal Data generated automatically while you use the Platform for security, authentication and technical operation purposes.

Ballon does not provide:

AI-powered features involving the processing of users' Personal Data,
behavioural advertising,
cross-site tracking,
automated decision-making producing legal or similarly significant effects.

If any of these features are introduced in the future, this Privacy Policy will be updated before they become available.

Ballon is intended exclusively for individuals who are 18 years of age or older. When creating an account, users are required to confirm that they are at least 18 years old. Ballon does not intentionally provide the Platform to persons under the age of 18. If we become aware that an account belongs to a person under 18, we may close the account and delete or anonymise the associated Personal Data in accordance with this Privacy Policy.

4. Personal Data We Process

Depending on how you use Ballon, we process different categories of Personal Data.

Unless stated otherwise below, the processing activities described in this section are necessary to provide and operate the Platform and to perform our contract with you.

Please note, that your country is provided by you as a profile field. Ballon does not determine your country using IP-based geolocation.

Push notifications are optional. If you enable them, Ballon processes a device push token through Firebase Cloud Messaging in order to deliver the notifications you have chosen to receive. You may withdraw your consent or change your notification preferences at any time through the available Platform or device settings.

If you turn on live match updates on your lock screen (off by default), your device shows your own prediction, points, league rank and league name there during the match. This is visible to anyone who can see your screen. You can turn it off at any time in Settings.

Account and profile information (including your email address, username, profile avatar and country) — purpose: account management, authentication and profile functionality. Legal basis: Article 6.1.b) GDPR (performance of a contract). Processed when you create and use your account.
Gameplay and user-generated content (including leagues, predictions, optional prediction reasons, rankings, reputation, achievements and duel statistics) — purpose: providing gameplay features, league interactions, rankings, competitions and statistics. Legal basis: Article 6.1.b) GDPR. Processed throughout your use of the Platform and when you choose to submit an optional prediction reason. Displaying your prediction reasons on venue screens, where you have turned this on, is based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in Settings.
Push notification data (including device push token and notification preferences) — purpose: sending push notifications, such as match reminders, results and ranking updates. Legal basis: Article 6.1.a) GDPR (consent). Processed only if you enable push notifications.
Marketing communications data (email address and marketing preferences) — purpose: sending information about new Ballon features, sports and other promotional updates. Legal basis: Article 6.1.a) GDPR (consent). Processed only where the user has opted in and until consent is withdrawn.
Reports and moderation data (including reporting user, reported user, report reason, optional free-text note and moderation outcome) — purpose: handling reports, preventing abuse, enforcing Platform rules and protecting the security and integrity of the Platform. Legal basis: Article 6.1.f) GDPR (legitimate interests). Processed only when a report is submitted and during its review and resolution.
Promotional content (including your handle, avatar, prediction results and other Platform content associated with your profile) — purpose: promoting and publicising Ballon and its services, including through our website and official social-media channels. Legal basis: Article 6.1.f) GDPR. Processed where we select Platform content for promotional use.
Technical and security data (including authentication logs, device information, IP address, diagnostic information and security logs) — purpose: security, diagnostics, fraud prevention and maintaining the reliability of the Platform. Legal basis: Article 6.1.f) GDPR (legitimate interests). Processed automatically while you use the Platform.
Usage data (including records of Platform features used, associated user ID and league ID) — purpose: understanding how the Platform is used, improving functionality, diagnostics and maintaining service reliability; legal basis: Article 6(1)(f) GDPR (our legitimate interests in improving and maintaining the Platform).
Support and communication data (including correspondence relating to support or privacy requests) — purpose: responding to enquiries, providing customer support and handling GDPR requests. Legal basis: Article 6.1.f) GDPR. Processed whenever you contact us.

Authentication Providers

You may choose to sign in using a supported authentication provider, such as Google or Apple. If you do so, we receive only the Personal Data made available by that provider in accordance with your account settings, such as your email address or profile information. We do not receive or store your password for your Google or Apple account. We use the name and, where the provider supplies one, the profile picture to pre-fill your Ballon profile, which is visible as described in Visibility of Your Information. You can change them at any time.

Visibility of Your Information

Ballon includes social and competitive features that make certain information visible to other users. Your profile — your handle, display name, avatar, country (if you provide it) and game statistics such as reputation tier, accuracy, exact scores, best rank, streak, achievements and follower counts — is visible to all signed-in Ballon users, as are the standings of public leagues and who follows whom. The standings of private leagues are visible to their members. Your prediction reasons may be visible to members of leagues in which you participate. Predictions remain sealed until the relevant match locks and become visible to league members afterwards. Anyone with a league invite link can see basic information about that league, including its name, the organiser’s display name or handle and the number of members.

If you turn on “Show my reasons on venue screens” in Settings, prediction reasons attached to your successful calls may also be displayed on a venue screen used for a league you belong to, together with your handle, avatar, points and the relevant final score. This setting is off by default. You can turn it off at any time, which will prevent your reasons from being used in future venue displays. Venue mode can only be activated by a signed-in member of the relevant league. However, information displayed on a venue screen may be visible to users present at the venue.

If you choose to use Ballon's sharing functionality, certain information, such as your handle, avatar and results, may also be made publicly accessible through a shareable signed link. Using this sharing functionality is optional.

Business, sponsored or branded league organisers may be provided with the handles and standings of league participants for purposes connected with operating the relevant league. They are not provided with participants' email addresses or other contact details.

When selecting user content for promotional purposes, we take into account the nature of the content, the context in which it was originally shared and the reasonable expectations of users.

5. Sources of Personal Data

We obtain Personal Data from the following sources:

Directly from you — most Personal Data is provided directly by you when you register an account, complete your profile, submit predictions, update your settings or contact us.
Authentication providers — if you choose to sign in using Google or Apple, we receive the Personal Data made available by your selected provider in accordance with your account settings.
Automatically generated data — certain technical and security-related information is generated automatically when you access and use the Platform.

We do not obtain Personal Data from data brokers, advertising networks or other third-party marketing databases.

External sports-data services, including API-Sports, provide Ballon with sports and match information. Ballon does not provide users' Personal Data to API-Sports for this purpose.

6. Recipients of Personal Data

We share Personal Data only where it is necessary to operate the Platform, comply with legal obligations or protect our legitimate interests. Ballon does not sell your Personal Data. We do not serve advertising or use cross-site tracking technologies.

Where third-party service providers process Personal Data on our behalf, they do so as data processors under data processing agreements compliant with Article 28 GDPR.

Infrastructure providers (Supabase, Vercel, Upstash) — hosting, authentication, database, storage, caching and operation of the Platform.
Communication providers — Push notifications are delivered through Google Firebase Cloud Messaging and, on Apple devices, the Apple Push Notification service.
SendGrid (Twilio Inc.) — sending service and transactional emails and, where you have opted in, marketing emails.
Technical support providers (Sentry) — error monitoring, diagnostics and security.

We may also disclose Personal Data:

where required by applicable law;
to courts, regulatory authorities or law enforcement agencies where legally required;
to professional advisers where necessary to establish, exercise or defend legal claims.

All processors are required to implement appropriate technical and organisational measures to protect Personal Data.

We may create and use anonymous and aggregated statistics derived from Platform activity, for example overall prediction trends or sentiment. Such statistics are designed so that they cannot identify individual users and, once irreversibly anonymised, do not constitute Personal Data under the GDPR.

7. International Transfers of Personal Data

Ballon uses service providers configured, where available, to store and process Personal Data within the European Union (EU). In particular, our current production infrastructure with Supabase, Upstash and Sentry is configured for EU data hosting.

Some of our service providers or their subprocessors may nevertheless process or access Personal Data from countries outside the EU. Where Personal Data is transferred outside the EU, we ensure that an appropriate transfer mechanism is implemented in accordance with Chapter V GDPR. Depending on the relevant provider, such safeguards may include:

an adequacy decision adopted by the European Commission,
certification under the EU–US Data Privacy Framework, where applicable,
the European Commission's Standard Contractual Clauses (SCCs),
additional technical and organisational safeguards where appropriate.

We periodically review our international data transfers to ensure that they continue to provide an appropriate level of protection.

8. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes described in this Privacy Policy or to comply with applicable legal obligations.

Account and profile information — until your account is deleted.
Gameplay data — personal identifiers are removed upon account deletion. Historical gameplay data may be retained only in an anonymised form that no longer identifies you.
Technical and security data — for as long as necessary to ensure the security, integrity and proper operation of the Platform.
Usage data — retained for up to 12 months and then deleted or anonymised.
Support and communication data — up to 12 months, unless a longer retention period is required to resolve an ongoing matter or comply with legal obligations.
Reports and moderation records — up to 12 months after the report is resolved, unless longer retention is necessary in connection with an ongoing investigation, repeated abuse, a legal claim or legal obligation.
Backup copies — deleted Personal Data may remain in encrypted backup copies for up to 7 days before being permanently removed through the normal backup rotation process.
Data relating to legal claims — until the expiry of applicable limitation periods or the final resolution of the relevant proceedings.

Account Deletion

You may delete your account directly within the Platform at any time.

If you are unable to do so, you may request account deletion by contacting us at privacy@ballonleague.com

Once your account is deleted:

your Personal Data used to identify you (including your email address, profile avatar and country) is permanently removed from the active system,
your public profile is replaced with "Deleted player",
historical predictions, rankings and gameplay records are retained only in an anonymised form that can no longer be linked to an identifiable individual.

Reports and moderation records may be retained for the applicable retention period described above, even after an account is deleted, where necessary for moderation, security or legal purposes. Account identifiers are removed or replaced where reasonably possible.

Once Personal Data has been irreversibly anonymised, it is no longer considered Personal Data under the GDPR.

After account deletion, Ballon will not use your Personal Data in new promotional materials. Where your Personal Data appears in promotional materials already published and remaining under Ballon's control, we will assess whether it should be removed or anonymised in accordance with the GDPR and any applicable legal or contractual requirements.

9. Your GDPR Rights

Under the GDPR, you have the following rights in relation to your Personal Data:

the right of access,
the right to rectification,
the right to erasure,
the right to restriction of processing,
the right to data portability,
the right to object to processing based on our legitimate interests,
the right to withdraw your consent at any time where processing is based on consent (push notifications, marketing emails and displaying your prediction reasons on venue screens), without affecting the lawfulness of processing carried out before its withdrawal,
the right to lodge a complaint with the competent supervisory authority.

You may exercise your rights at any time by contacting us at privacy@ballonleague.com

Where available, you may also manage your Personal Data and preferences directly within the Platform.

We will respond without undue delay and normally within one month of receiving your request, subject to any extension permitted under the GDPR. Where necessary to verify your identity, we may ask you to contact us using the email address registered with your Ballon account. We do not require copies of identity documents and exercising your rights is free of charge.

You may object to the use of your Personal Data for promotional purposes on grounds relating to your particular situation by contacting us at our email address above. We will consider your objection in accordance with Article 21 GDPR and will stop such processing unless we can demonstrate compelling legitimate grounds for continuing it or the processing is necessary for the establishment, exercise or defence of legal claims. Where reasonably possible, we will also remove your Personal Data from promotional materials under our control following a successful objection.

You also have the right to lodge a complaint with the competent supervisory authority. In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.

10. Data Security

Protecting Personal Data is an integral part of the design and operation of Ballon. We implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our security measures include, where appropriate:

encryption of Personal Data in transit,
secure cloud infrastructure hosted by trusted service providers,
role-based access controls and the principle of least privilege,
authentication and access management mechanisms,
encrypted backups and disaster recovery procedures.

Although we apply appropriate safeguards, no method of electronic transmission or storage can be guaranteed to be completely secure. We therefore encourage users to use strong passwords and protect access to their own devices and accounts.

11. Cookies and Similar Technologies

Ballon currently uses only strictly necessary cookies and similar technologies required to operate core Platform functionality.

Detailed information about the technologies used by Ballon is provided in our separate Cookie Policy.

If we introduce non-essential cookies or similar technologies in the future, we will update our Cookie Policy and obtain consent where required by applicable law.

12. Changes to this Privacy Policy

We review this Privacy Policy periodically and whenever material changes are made to the Platform or our processing activities. This includes reviewing our service providers, international data transfers and references to applicable privacy practices.

The "Last updated" date at the beginning of this Privacy Policy indicates the latest version.

We believe that privacy is an essential part of building trust. We are committed to processing Personal Data responsibly, transparently and in accordance with the GDPR. As Ballon evolves, we will continue to review and improve our privacy practices to ensure that your Personal Data remains protected.