Who is responsible
The operator named in our Imprint at https://proclubsworld.com/imprint is the controller responsible for the personal data processed through ProClubs World. For privacy questions and requests, email [email protected]. We have not appointed a data protection officer because the law does not require us to.
Data we process and where it comes from
Depending on the features you use, we process the following personal data:
Account and sign-in: your email address, password (stored only as a hash), display name, language and time zone, your confirmation of your age and acceptance of our terms, and sign-in and security records such as IP address, browser and approximate location. When you sign in with Discord, we receive your Discord account details and the email address of your Discord account. If Discord reports it as verified, we use it as your account email, connect Discord to an existing account that already uses that email and, while your account has no password, update your account email when it changes in Discord.
Profile and history: your public profile details, such as EA ID, nationality, positions and the social media handles you add, the Store items you choose to show, and the recorded history of your display name and EA ID, club memberships, roles and match statistics.
Teams and competitions: team memberships and roles, registrations, availability answers including an optional reason or note, lineups, match result reports and complaints with their proof, reschedule requests, competition access records, competition bans and the network ban alerts sent about them, and the evidence submitted for official-club verification, including the name, role and contact details of a representative of the real club. Embedded metadata such as location data is removed from uploaded screenshots.
If you answer a club's availability check in Discord without a ProClubs World account, we store your Discord ID, Discord name and answer for that club and day. The club's staff and the members of that channel can see your name and answer, and staff can link your answers to a club member. We do this based on our legitimate interest in letting clubs plan their sessions (Art. 6(1)(f) GDPR); you can object at any time.
Messages and community: messages and reactions, your online status and when you were last active, blocks, and reports about messages or members, including their reason, any details added and a copy of the reported message. The reported member is not told who made a report.
Transfer Market: the listings you publish, and your shortlist and saved searches with their alerts, which only you can see.
EA game data: EA account names and identifiers, club, player and match statistics including goalkeeper statistics, match completion information, the match results we capture from EA for competition administration and, where available, the height and overall rating of your virtual pro. Virtual pro height describes an in-game character, not your physical height.
Devices and technical data: IP address, browser and device information, the pages requested and any errors, usage statistics if you consent and, if you turn on browser notifications, for each device your browser's push address and keys, a label naming the browser and operating system, whether the device was added from the installed app, and when it was added and last used.
Support and hosting requests: the messages and requests you send us, the contact details you give for our reply and, if you are signed in, a link to your account, and our replies.
Sources: we collect most of this data from you. We also receive data from EA (public Pro Clubs club, player and match data), from Discord (when you sign in with Discord, link your account or use the bot), from other members, competition organisers and club representatives (for example rosters, results, reports, bans and verification requests) and, for purchases, from our payment provider.
Purposes and legal bases
We use personal data only for the following purposes and on these legal bases under the General Data Protection Regulation (GDPR). We do not sell personal data.
Contract (Art. 6(1)(b) GDPR): to create and run your account and to provide the team, competition, Transfer Market, messaging, notification and other features you choose to use, including showing your public profile and competition activity.
Legitimate interests (Art. 6(1)(f) GDPR): to keep the service secure and prevent abuse and fraud, to moderate content and handle reports, to publish and keep verifiable competition records, EA statistics and competition bans so competitions stay fair, to send network ban alerts to the communities that chose to receive them, to let clubs plan their sessions with availability answers from people without an account, to answer support requests and to keep the service reliable. You can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
Consent (Art. 6(1)(a) GDPR): for usage statistics, for external media such as embedded Twitch streams, and for browser notifications. You can withdraw your consent at any time with effect for the future.
Legal obligation (Art. 6(1)(c) GDPR): to keep accounting and tax records and to answer lawful requests from authorities.
To create an account you must provide an email address and a password, or sign in with Discord, and confirm that you are at least 13 years old and accept the Terms of Use. Without this data we cannot provide an account. All other information is optional, although some features need it to work.
We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). Some checks run automatically under published rules: virtual pro heights from EA data can flag a possible breach of competition rules, which a person reviews before anything is decided; a competition ban can automatically apply to a new team created by the same owner; and rewards paid for a match result are automatically taken back when that result is corrected. You can ask for a person to review any of these outcomes at [email protected].
Who can see or receive data
Public and other members: your display name, public profile and profile history, the Store items you choose to show, team and competition activity, Transfer Market listings and content you publish can be visible to anyone, including visitors who are not signed in; Discord details and contact options in Transfer Market listings are shown only to signed-in members. While you are online, members who share a conversation or a club with you can see this and when you were last active, unless you turn off your online status. Teammates, team staff, opposing clubs and competition staff see the team and competition data their role requires, such as availability answers, lineups, result reports and reschedule requests; opposing teams never see your availability answers.
Organisers and Discord servers: competition organisers and their staff see the registrations, results, reports and bans of their competitions. When a competition bans a team, the Discord servers whose competition staff chose to receive network ban alerts receive the team's name and tag, the owner's display name, the banning competition, the reason and the dates. Messages the bot posts in a server channel can be read by the members of that channel.
We share data only when needed to provide the service, such as with hosting, security, email or Discord-related providers acting on our instructions, or when disclosure is required by law. We do not give advertisers a list of our members' personal data.
We use Hetzner to host the service and Cloudflare for network delivery and security. When requests are handled by Cloudflare, this includes IP addresses, requested URLs, browser and traffic information, and the request and response content needed to deliver the website and protect it against abuse. These providers process information for hosting, availability and security. Cloudflare's privacy notice is at https://www.cloudflare.com/privacypolicy/.
We use Proton Mail to send account and notification emails and to send and receive correspondence at our proclubsworld.com addresses, including messages our staff start or answer. This involves sender and recipient addresses, subjects, message content, attachments, timestamps and delivery information. Authorised ProClubs World staff can access correspondence and delivery records needed for support and service operation. Account emails are not end-to-end encrypted. Proton's mailbox encryption does not extend to copies held in ProClubs World systems, backups or recipients' mailboxes. Proton's privacy notice is at https://proton.me/mail/privacy-policy.
Club crests from EA and avatars and server icons from Discord are loaded through our own servers, so your browser does not contact EA or Discord to show them. If you choose to play an embedded Twitch stream, Twitch receives your IP address and browser information; Twitch's privacy notice is at https://www.twitch.tv/p/legal/privacy-notice/. If you turn on browser notifications, your browser's push service (for example from Google, Mozilla, Apple or Microsoft) delivers them.
Discord processes the data it receives when you use Discord sign-in or the bot as an independent controller under its own privacy policy. Authorised ProClubs World staff can access data where needed for support, moderation and running the service.
International transfers
Some of these providers, including Cloudflare, Discord, Twitch and browser push services, may process personal data outside the European Economic Area, in particular in the United States. We only allow this where the European Commission has found the level of protection adequate, such as for companies certified under the EU-US Data Privacy Framework, or where the provider has agreed to the Commission's Standard Contractual Clauses.
How long we keep data
We keep personal data only as long as needed for the purposes above, as follows:
Account and profile data, including your profile history: while your account exists. When accounts are merged, the profile history moves to the account that is kept.
Sign-in and security records, including IP address, browser and approximate location: 90 days. After that, the record of the action stays in your account history without these details. When you delete your account, these records keep only the action, without your email address, IP address or browser details.
Messages between members: until the sender deletes them or the conversation or account is deleted. Blocks and message settings: until you change them or delete your account. Reports about a message or a member: 12 months after staff close them.
Team availability answers, including any reason or note: 90 days after the day they are for. Daily check posts in Discord are removed 10 hours after the day's last match or session ends, or earlier if your team's staff take them down.
Availability answers given in Discord without an account: 90 days after the session day. A link to a club member: until staff remove it, at most 90 days after your last answer.
Delivery records of Discord direct messages, such as availability reminders, Transfer Market alerts and reschedule requests: 90 days after they were sent or answered, or earlier when you delete the related saved search or your account.
Competition results and the EA match records captured to evidence them: as long as the competition record exists. Result reports and complaints: uploaded screenshots are deleted 90 days after the season ends, or together with their match if it is deleted earlier; the reported score and who sent it stay with the competition record. Reschedule requests and their answers: with the match. Competition bans: kept with the competition records, also after a ban ends or is lifted. Network ban alert records: failed and cancelled ones are deleted after 90 days; the others are kept as long as the ban they concern.
Competition access records: 12 months after the access ends, or 12 months after a request that never led to access.
Official-club verification evidence: an undecided request expires 10 days after submission and the evidence for an approved request 10 days after approval; rejection or withdrawal deletes it immediately. The verified status may remain after the evidence is deleted.
Club data after closure: when a club is deleted or its last member leaves, its recovery data is kept for 90 days; then membership, recruitment, scouting and session data are cleaned up. Minimal club identity, played competition results, financial and audit records and shared conversations may remain under their own retention rules.
Transfer Market shortlist and saved searches: until you remove them or delete your account.
Browser notification devices: until you remove the device in your notification settings, sign out on it or turn notifications off, the push service reports its address as no longer valid, it has not been used for 90 days, or you delete your account.
Usage statistics: 13 months.
Records that stop a news view or poll vote from being counted twice: 30 days.
Support correspondence: 2 years after the last message.
Messages sent to [email protected] are not handled as support requests and may be automatically deleted. For help or to exercise your rights, contact [email protected].
Billing and accounting records: as long as tax and commercial law requires.
Backups: server backups roll over after 30 days, so deleted data is removed from backups within 30 days.
Security
We protect personal data with appropriate technical and organisational measures, such as encrypted connections, access controls and limited staff access. No online service can guarantee absolute security.
Your choices and rights
You can update much of your account information in the service, download a copy of your data in your account settings and delete your account there.
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time; this does not affect processing that took place before. Contact [email protected] to make a request. We may need to verify your identity before responding.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where you believe an infringement took place.
Cookies and browser storage
We use our own small consent banner with three categories. You can change your choice at any time with the Cookie settings link at the bottom of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal of usage statistics unless you turn them on yourself.
Necessary: the sign-in and security cookies that keep you signed in and protect forms, your language choice (pcw.lang), your consent choice (pcw.consent), and browser storage that keeps the site's texts and version up to date. If you vote in a public poll, we store a random identifier in your browser so your vote is counted once. A usual week you save for team availability is stored only in your browser on that device. To stop automated sign-ups, the registration form asks your browser to solve a small calculation (ALTCHA); it runs on our own server, sends no data to a third party and sets no cookie. These are needed for the site to work and do not require consent (§ 25(2) TDDDG).
Statistics (only with your consent): we record which pages and features are used, page performance and errors, and the type of device and browser, linked to your account when you are signed in. We use this to improve the service and do not share it with advertisers. We keep it for 13 months.
External media (only with your consent, or when you load an item yourself): embedded Twitch streams, which are loaded from Twitch.
Browser notifications are turned on only after your browser asks for your permission; you can turn them off at any time in your notification settings or your browser.
Children
You must be at least 13 years old to create an account. If you are younger than the age at which the law of your country lets you use online services on your own, you need the consent of a parent or guardian. ProClubs World is not directed to children under 13; if we learn that a child under 13 has created an account, we will delete it.
Changes to this policy
We may update this policy as our services or legal obligations change. We announce material changes on the site and by email to members at least 30 days before they take effect, together with that date. Members may object to the changes or close their account before that date. Where a change requires your consent, it applies to you only once you have given it.
Questions about this document?
Contact ProClubs World at [email protected].