Privacy policy.

TRANXFER.MARKET

1. Introduction

This Privacy Policy explains how TRANXFER MARKET LTD(“tranxfer.market”, “we”, “our”, “us”) collects, uses, stores, and shares personal data when you use our football player discovery platform, through our app or at tranxfer.market. It applies to everyone who uses the platform, including players, parents and guardians, scouts, agents, coaches, and visitors to our website.

We treat everyone under the age of 18 as a child, and take particular care with their personal data. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection legislation.

2. Data We Collect

2.1 Player Profile Data

When a player, or their parent or guardian, creates a profile, we may collect:

• Full name
• Date of birth
• Gender
• Playing position(s) and preferred foot
• Physical attributes relevant to football (e.g. height, weight)
• Photographs and video footage added to the profile
• Playing history, experience, achievements, performance log entries, and statistics
• Country of residence and general location (town/city and county only; we do not collect full home addresses)

2.2 Account Data

• Email address and password. Passwords are handled by our sign-in provider and are only ever stored in hashed form.
• Account type (player, parent/guardian, scout, agent, or coach)
• For players under 18: the link between the player and their parent or guardian, the relationship the parent or guardian declares (parent or legal guardian), and the settings they choose for the player

2.3 Scout, Agent and Coach Data

• Name, role, organisation or club, and contact details (such as telephone number and general location)
• For agents: FA registration number
• DBS certificate details, governing body affiliations, and coaching qualifications, where provided

2.4 Identity Verification Data

Scouts, agents, coaches, parents and guardians, and players aged 18 or over must complete an identity check before they can use certain features. The check is carried out by our verification provider, ComplyCube. You take a photo of a government-issued photo ID and a live photo or video of your face, and ComplyCube compares the two.

Comparing your face with your ID photo involves processing biometric data, which is special category data under the UK GDPR. ComplyCube holds the images and biometric data on our behalf. We store only the result of the check and the reference numbers needed to link it to your account. See Section 4.2 for the lawful basis we rely on.

2.5 Messages and Activity

• Messages you send and receive on the platform
• Contact requests, and a parent or guardian’s decisions to approve, decline, or revoke them
• Endorsements, players you track, and notifications sent to you

2.6 Technical and Usage Data

• IP address, browser type, operating system, and device information
• A push notification token for your device, if you allow notifications
• Features used and pages visited

Our app stores a sign-in token securely on your device so you stay signed in. Our website does not use advertising or analytics cookies.

3. How We Use Your Data

We process personal data for the following purposes:

• Providing the service: to create and maintain profiles, and to make player profiles available to other users and to scouts, agents, and coaches searching for players.
• Identity verification: to confirm that scouts, agents, coaches, parents and guardians, and adult players are who they say they are before they can use features such as full search and messaging.
• Safeguarding and age-based controls: to apply the controls described in Section 5 based on a player’s date of birth and country, to link players under 18 to their parent or guardian, and to route contact requests to the parent or guardian for approval.
• Communication: to deliver messages between users, and to send service emails and push notifications.
• Safety and enforcement: to investigate concerns reported to us, remove content and suspend accounts that breach our Terms, and keep records of safeguarding matters.
• Legal compliance: to fulfil our obligations under data protection, safeguarding, and other applicable legislation.
• Service improvement: to analyse aggregated or anonymised usage data to improve the platform’s functionality and user experience.

4. Lawful Basis for Processing

4.1 Personal Data

Under Article 6 of the UK GDPR, we rely on the following lawful bases:

• Performance of a contract: processing that is necessary to deliver the service you have registered for.
• Legitimate interests: platform security, fraud prevention, safeguarding, and service improvements, where these interests do not override your rights and freedoms.
• Legal obligation: where processing is required to comply with safeguarding, data protection, or other statutory requirements.
• Consent: where we ask for it, including a parent or guardian’s consent to their child’s profile being visible on the platform (see Section 5).

4.2 Biometric Data

Under Article 9 of the UK GDPR, we rely on your explicit consent to process biometric data during the identity check described in Section 2.4. We ask for this consent before the check starts. You can withdraw it at any time by contacting us, but you will then be unable to use the features that require a verified identity.

5. Children and Young People

The protection of children is our highest priority. Everyone under 18 is treated as a child on the platform, and the controls below apply automatically based on the date of birth given at registration.

5.1 Under 13

• A profile for a child under 13 can only be created and held by their parent or guardian. The child does not have a login of their own.
• Scouts, agents, and coaches cannot contact a child under 13 directly. Any contact goes through the parent or guardian.

5.2 Ages 13 to 17

• A young person can have their own login, either by signing up themselves or by using a one-time code generated by their parent or guardian.
• A young person who signs up themselves stays hidden from other users, and cannot be found or messaged, until a parent or guardian has linked to their account and passed our identity check.
• A scout, agent, or coach’s first message to a player under 18 is treated as a contact request. The message is held and hidden from the player until their parent or guardian approves it. If the parent or guardian declines, that professional cannot message the player.
• Players aged 13 to 15 can read approved conversations but cannot send messages. Their parent or guardian replies on their behalf.
• Players aged 16 and 17 can reply personally only if their parent or guardian switches on player-managed messaging. It is off by default.
• Players under 18 cannot start a conversation with a scout, agent, or coach themselves. A parent or guardian can start one on their behalf.
• A linked parent or guardian can see every conversation on their child’s account.

5.3 Parent and Guardian Controls

• Every parent or guardian must pass our identity check before their link to a child becomes active.
• A parent or guardian must confirm their relationship to the child. We may ask for evidence of the relationship, and giving false information is a breach of our Terms.
• A parent or guardian can edit their child’s profile, add to it, hide or delete content, approve, decline, or revoke contact with any professional, and close conversations.
• A parent or guardian can withdraw consent at any time. The child’s profile is deactivated immediately, messaging is switched off, and the child’s data is permanently deleted after 30 days.

5.4 Turning 18

• At 18, a player still linked to a parent or guardian is offered the choice to manage their own account. If they accept, the parent or guardian’s link is removed and the parent or guardian is told. The parent or guardian’s own account is not deleted.
• Players aged 18 or over must pass our identity check before they appear in search or can be messaged.

5.5 Players Outside the UK

Players can live anywhere, but scouts, agents, and coaches on the platform are UK-based. A player under 18 whose country is not the United Kingdom can be seen by professionals but cannot be messaged or tracked by them. This lifts when the player turns 18, or if their parent or guardian changes their country to the United Kingdom.

6. Who We Share Your Data With

We do not sell your personal data. We only share it where necessary to run the platform, keep users safe, or meet our legal obligations.

6.1 Service Providers

We use trusted third-party providers to operate the platform. They process personal data only on our instructions, under written data processing agreements, and may not use it for their own purposes.

• Supabase: database hosting, where account, profile, and message data is stored.
• Clerk: sign-in and account security, including email addresses and hashed passwords.
• ComplyCube: identity verification, including photo ID images and biometric data (see Section 2.4).
• Mux: video hosting and streaming for videos added to profiles.
• Resend: email delivery for service messages such as sign-up confirmations.
• Vercel: website hosting and privacy-friendly visitor analytics, which process technical data such as IP addresses and pages visited.
• Expo, Apple, and Google: push notification delivery, using your device’s notification token.

6.2 Other Platform Users

Player profiles, including photos and videos, are visible to other users of the platform. Scouts, agents, and coaches see limited search results until they pass our identity check, after which they can view full profiles and send contact requests. The controls in Section 5 apply to every player under 18. The profiles of scouts, agents, and coaches, including whether they have provided DBS details, are visible to players and to parents and guardians.

6.3 Legal and Safeguarding Disclosures

We may share personal data with the police, local authority children’s services, football governing bodies, or other public authorities where we are legally required to, or where we believe it is necessary to protect a child or other person from harm.

6.4 Professional Advisers and Business Changes

We may share personal data with our legal, accounting, and insurance advisers where needed. If TRANXFER MARKET LTD is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the new owner, who will be bound by this Privacy Policy.

7. International Transfers

Some of our service providers are based in, or process data in, the United States. Whenever personal data is transferred outside the UK, we make sure it receives an equivalent level of protection by relying on one of the following safeguards:

• The UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), where the provider is certified under it.
• The International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as approved by the UK Information Commissioner.
• A UK adequacy decision covering the destination country.

If you live outside the UK, your data is processed in the same way as described in this policy. You can contact us at hello@tranxfer.market for more information about the safeguards we use.

8. How Long We Keep Your Data

We keep personal data only for as long as we need it for the purposes set out in this policy:

• Waitlist sign-ups: until we have notified you that the platform has launched, after which your email address is deleted unless you create an account. You can ask to be removed at any time.
• Conversations: a conversation closes after 30 days without a new message. Any conversation with no new message for 90 days is permanently deleted, together with its messages.
• Account and profile data: for as long as your account is active. You can ask us to delete your account at any time by emailing hello@tranxfer.market, and we will do so within one month.
• Children’s profiles: deleted 30 days after a parent or guardian withdraws consent, as described in Section 5.3.
• Parent and guardian accounts: when a parent or guardian account is closed, it is deleted after 30 days, including the sign-in account held by our sign-in provider.
• Identity verification: we keep the result of your check while your account is active. ComplyCube keeps the images and biometric data only for as long as its agreement with us allows.
• Technical and log data: for a short period, normally no longer than 30 days, unless needed to investigate a security incident.
• Safeguarding records: where a safeguarding concern has been raised, we keep the related records securely for as long as UK safeguarding guidance recommends, which for a child can be until they reach 25.

9. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Have inaccurate or incomplete personal data corrected.
• Have your personal data deleted, where there is no good reason for us to keep it.
• Restrict how we process your personal data in certain circumstances.
• Object to processing based on our legitimate interests.
• Receive your personal data in a portable format, or have it sent to another organisation.
• Withdraw your consent at any time, where we rely on consent. This does not affect processing carried out before you withdrew it.

A parent or guardian can make a request on behalf of their child. Young people aged 13 or over can also make requests themselves. To make a request, email hello@tranxfer.market. We will respond within one month, and there is normally no charge. We may need to verify your identity before acting on a request.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@tranxfer.market and we will do our best to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or by calling 0303 123 1113.

11. Changes to This Policy

We may update this Privacy Policy from time to time, for example when we add new features or change service providers. The “Last reviewed” date at the top of this page shows when it was last updated. If we make significant changes, we will let you know by email or through the platform before they take effect.