Privacy Policy

Last updated: June 2026

This Privacy Policy explains how TheFinalFan.com (“we”, “us”, “our”) collects, uses, and protects your personal data.

Data Controller

The Data Controller for TheFinalFan.com is:

Personal Data We Collect

We collect the following categories of personal data:

• ·Identity Data: Name, date of birth, profile information
• ·Contact Data: Email address
• ·Location Data: Country of residence (for prize eligibility)
• ·Usage Data: Team picks, round results, lives, game history
• ·Technical Data: IP address, browser type, device information, login timestamps
• ·Cookie Preferences: Your consent choices
• ·Referral Data: Referral codes you create or use

We do not collect any sensitive personal data (such as health, religious beliefs, or political views).

Legal Basis for Processing

Under GDPR, we process your personal data on the following legal bases:

• ·Contract: To provide the service you signed up for (account creation, gameplay, lives tracking, prize promotion eligibility)
• ·Consent: For optional cookies and any marketing communications
• ·Legitimate Interest: For fraud prevention, service improvement, and analytics
• ·Legal Obligation: Where we must retain data for tax, legal, or regulatory purposes

How We Use Your Data

Your personal data is used to:

• Operate the game (process picks, calculate lives, determine winners)
• Manage your account and authenticate logins
• Send transactional emails (round reminders, elimination notifications, prize notifications)
• Process and fulfill prize promotions
• Prevent fraud and abuse
• Comply with legal obligations
• Improve our service

We do not sell your personal data to any third party.

Automated Processing

We use automated processes for:

• Assigning auto-pick favourites when users miss a deadline
• Calculating game outcomes based on match results
• Selecting random prize winners (via certified third-party RNG)

These automated processes do not produce legal effects concerning you and you can contest any decision by contacting us.

Communications

We send transactional emails only (account-related, game updates, prize notifications). We do not send marketing emails. We do not subscribe you to any marketing lists.

How Long We Keep Your Data

• ·Active accounts: Personal data is retained while your account is active
• ·Inactive accounts: Accounts inactive for 24 months will be deleted
• ·Game data: Retained for the duration of the WC 2026 tournament and 12 months after for record purposes
• ·Account deletion: If you request deletion, your personal data is removed within 30 days, except where we are legally required to retain it (e.g. tax records for prize winners)

Third Parties We Share Data With

We share data with the following service providers strictly to operate the service:

• ·Supabase: Database and authentication
• ·Vercel: Hosting and infrastructure — based in the United States
• ·Resend: Transactional email service — based in the United States
• ·Sportmonks: Sports data API — does not receive personal data

We have data processing agreements with each provider ensuring GDPR-compliant handling.

International Data Transfers

Some of our service providers (Vercel, Resend) are based in the United States. Your personal data may be transferred to and processed in countries outside the UK/EU.

We ensure appropriate safeguards are in place through:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) and the European Commission
• Adequacy decisions where applicable
• Data processing agreements with all providers

Your Rights

Under GDPR/UK Data Protection Act 2018, you have the following rights:

• ·Right to Access: Request a copy of your personal data
• ·Right to Rectification: Correct inaccurate data
• ·Right to Erasure: ('right to be forgotten'): Request deletion
• ·Right to Restrict Processing: Limit how we use your data
• ·Right to Data Portability: Receive your data in a portable format (CSV/JSON)
• ·Right to Object: Object to processing based on legitimate interest
• ·Right to Withdraw Consent: At any time, where consent is the legal basis

To exercise any of these rights, contact us at hello@thefinalfan.com. We will respond within 30 days.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know what personal information is collected
• Right to know whether your information is sold or disclosed
• Right to opt-out of the sale of personal information (we do not sell personal information)
• Right to access personal information
• Right to deletion
• Right to non-discrimination for exercising your rights

To exercise California-specific rights, contact hello@thefinalfan.com.

Children's Privacy

The Final Fan is for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. We enforce age verification during signup.

If we discover that we have collected data from a person under 18, we will delete it promptly. If you believe we may have collected such data, please contact hello@thefinalfan.com.

Cookies

We use cookies for:

• ·Essential: Authentication and security (cannot be disabled)
• ·Functional: Saving your preferences and game state
• ·Analytics: With your consent, to improve the service
• ·Referral: To track referral codes (functional)

For full details, see our Cookie Policy. You can update your cookie preferences at any time from the footer or the Cookie Policy page.

Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS)
• Database-level security via Supabase
• Access controls and authentication
• Regular security reviews

Data Breach Notification

In the event of a personal data breach that poses a high risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (ICO) within 72 hours
• Notify affected users without undue delay
• Take appropriate remedial action

Right to Lodge a Complaint

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with:

• United Kingdom: Information Commissioner's Office (ICO) at ico.org.uk
• European Union: Your local data protection authority
• United States / California: Office of the California Attorney General

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or via the Service. Continued use of the Service after changes constitutes acceptance.

Contact Us

For any questions about this Privacy Policy or to exercise your rights: