Privacy Policy

How we collect, use, and protect your personal data under GDPR.

Last updated: 25 June 2026 · Startelffantasy GmbH

This Privacy Policy explains how Startelffantasy GmbH collects, processes, and protects personal data when you use startelffantasy.com, in accordance with the GDPR and BDSG.

1. Data controller

The controller under Art. 4(7) GDPR is Startelffantasy GmbH, Leopoldstraße 244, 80807 Munich, Germany.

Data protection enquiries: datenschutz@startelffantasy.com.

Startelffantasy GmbH implements this policy transparently and in compliance with German and EU law, including the GDPR, BDSG, and applicable consumer protection regulations. Our legal team reviews these documents regularly and updates them when required.

This policy applies to your use of startelffantasy.com, including registration, login, premium subscriptions, the Squad Builder, leagues, virtual stadiums, and all related services. By continuing to use the platform, you confirm that you have read and understood this section.

2. Scope of this policy

This policy covers data processed through our website, web application, account area, contact forms, payment flows, and support channels.

It does not cover third-party websites linked from our platform.

If you have questions or wish to exercise your rights, contact support@startelffantasy.com or write to Startelffantasy GmbH, Leopoldstraße 244, 80807 Munich, Germany. We respond diligently within statutory time limits.

3. Categories of personal data

We may process: identity data (name, username), contact data (email), account credentials (encrypted passwords), usage data (pages visited, features used), technical data (IP, browser, device), payment metadata, and communications you send us.

4. Registration and account data

When you register, we collect email, username, and password. Profile data may include saved squads, league memberships, and preferences.

You must provide accurate information. You may update or delete your account via profile settings or by contacting support.

5. Usage and technical data

We automatically collect technical information necessary to deliver and secure the service, including IP address, timestamps, browser type, and error logs.

With your consent, we also collect analytics data to improve UX and performance.

6. Payment data

Premium subscriptions are processed by Stripe. We receive transaction IDs and billing status but do not store full card numbers on our servers.

7. Cookies and local storage

We use cookies and localStorage for sessions, preferences, and — with consent — analytics. See our Cookie Policy for details.

8. Purposes of processing

We process data to provide the platform, manage accounts, process payments, communicate with you, prevent fraud, comply with law, and improve our services.

9. Legal bases

Processing is based on Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligation), and Art. 6(1)(f) GDPR (legitimate interests such as security).

10. Retention periods

Account data is kept until deletion plus a short backup window. Invoices are retained 10 years under tax law. Support tickets: 3 years. Server logs: up to 90 days.

11. Recipients and processors

We use EU-based hosting, Stripe for payments, and optional analytics providers. All processors are bound by Art. 28 GDPR agreements. We do not sell personal data.

12. Transfers outside the EEA

Transfers to third countries occur only with adequacy decisions or Standard Contractual Clauses and appropriate safeguards.

13. Your rights

You have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact datenschutz@startelffantasy.com — we respond within 30 days where possible.

14. Right to lodge a complaint

You may complain to the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

15. Security measures

We use TLS encryption, encrypted passwords, access controls, monitoring, and regular security reviews to protect your data.

16. Children

Services are intended for users aged 16+. We do not knowingly collect data from children under 16.

17. Automated decision-making

We do not use automated decision-making under Art. 22 GDPR that produces legal or similarly significant effects.

18. Changes to this policy

Material changes will be communicated to registered users. Last updated: 25 June 2026 — Startelffantasy GmbH.