Privacy Policy

1. Controller and contact

DARYSE GmbH, Im alten Driesch 5, 51519 Odenthal, Germany, is responsible for the processing it carries out as described in this policy. Managing director: Jonas Sela; Commercial Register: Local Court of Cologne, HRB 108758. For privacy questions and to exercise your rights, contact support@daryse.com.

This policy covers the Daryse apps and web platform and people whose data is processed there, including those without an account. It also covers data other users provide about you, for example in videos, club information or campaigns. Clubs, scouts and campaign organisers are responsible for their own processing purposes.

2. Account, login and security

We process your email address, login and account identifiers, account type and registration details to create your account, sign you in and provide your chosen features. If you sign in with Apple or Google, we receive the information released by that provider, particularly a login identifier and, where supplied, your name and email address. We cannot provide an account without the required login information; additional profile information depends on the feature you choose.

For operation and security we process IP addresses, request times, device, browser and version information, and technical logs. We use these to establish connections, detect errors and prevent unauthorised access or misuse. Necessary account functions are based on Article 6(1)(b) GDPR. Security measures are based on our legitimate interest in a secure, functioning platform under Article 6(1)(f) GDPR; legal obligations on Article 6(1)(c) GDPR.

3. Profiles, content and recommendations

We process your profile and football information, such as name, birth date, picture, location, position, body measurements and club history, together with uploaded photos and videos, descriptions, reactions, followers, saved searches and profile visits. Data comes from you, your use of the service or users posting content relating to you.

Profiles and posts are visible to other users according to their access and visibility settings. Public content may also be accessible outside your network through shared links. Permitted downloads and sharing may create external copies. When you visit a profile, its owner may see who visited. The visitor list is therefore not limited to anonymous counts.

Rankings consider activity, playing position and account characteristics. “Player of the Week” and “Team of the Week” consider players with Premium or verified profiles; factors include posts, views, reactions, followers and invitations, with different weights and less weight for older activity. Campaign recommendations consider how your profile matches eligibility requirements, together with timing and status. These evaluations help discover and order content; they do not decide whether you receive a club contract.

Providing your requested profile, publishing and search features is based on Article 6(1)(b) GDPR. Recommendations, activity evaluations and visitor displays are based on our legitimate interest in making relevant content discoverable and interactions understandable under Article 6(1)(f) GDPR. Section 13 explains your right to object.

Premium may restrict downloads and the visibility of your network lists. When Premium expires, existing posts can again be downloaded within otherwise applicable access rights; previously private network lists become visible under the general access rules.

4. Clubs and information about other people

Clubs and authorised users can manage memberships, invitations, player profiles, search lists and scouting notes. Names, contact details, sporting characteristics, assessments and invitation status may come from other users or clubs. Authorised club members can access jointly managed areas. Actions may be attributed to the member acting and the club represented.

We process this data to provide agreed management features under Article 6(1)(b) GDPR and, for people without a corresponding contract with us, on the basis of the legitimate interest in the requested club organisation and sporting contact under Article 6(1)(f) GDPR. The relevant club or user is responsible for their own scouting purposes, the lawfulness of information entered and informing affected people. You can contact us about your data without an account.

5. Campaigns and participation

When you enter, we process your account, submitted post, entry times, the linked version of the participation rules and any selection or winner status. The organiser and authorised persons receive the data provided for assessment and administration. Your requested participation feature is based on Article 6(1)(b) GDPR.

Entry visibility follows the campaign settings. If the participant list is hidden, only authorised persons can view submitted posts within the campaign. The participant count, winner profiles and their associated posts remain public. Profiles and posts retain their respective visibility settings outside the campaign. Displaying participation and results is based on our legitimate interest in transparent administration under Article 6(1)(f) GDPR.

We record published campaign rules and changes, with dates and information about the people responsible, to document rules and resolve claims (Article 6(1)(f) GDPR). Authorised viewers can consult available versions. Your entry remains linked to the version shown when you entered, even if you replace your post. Deleting a campaign ends public access; necessary records may remain for these purposes.

The organiser explains its own processing and prize fulfilment. It requests additional information such as shipping details where needed for delivery. Entry is not blanket permission for the organiser to advertise or publish further information.

6. Video analysis and AI training

Automatic annotation and movement tracking process video frames and resulting position and movement data. Device-based analysis runs on your device; uploaded videos and edited results are subsequently processed on the platform. Providing your requested analysis is based on Article 6(1)(b) GDPR.

To develop, train and quality-check our own sports analysis features, we use selected uploaded sports videos, extracted frames, annotations and technical metadata. The purposes are player and object detection, movement tracking and sports scene analysis. Authorised staff or engaged service providers may review content, add labels and compile it for training and testing. Engaged providers process it for Daryse and these purposes.

For this training we rely on Article 6(1)(f) GDPR. Our legitimate interest is improving the accuracy and reliability of these features. Use of personal data is limited to what is necessary and requires that the interests or fundamental rights of affected people do not override that interest. Particular consideration must be given to minors, other people filmed and content with restricted visibility. The EULA governs rights to use uploads; your data protection rights also apply.

You can object to training use of your personal data or request erasure, including if you only appear in a video and have no account. Send the content link or other identifying details to support@daryse.com where possible. We consider source content, training copies and further use when handling requests. Whether a model requires measures depends particularly on whether it contains personal data or enables its recovery. Lawfully created models and non-personal results may continue to be used after content or account deletion insofar as statutory rights do not prevent this.

7. Usage analysis, diagnostics and links

We use an analytics service to analyse use of our apps and web platform. Data includes views, screen changes, device, browser and version information, and installation or browser identifiers. Mobile app analytics data is also linked to an internal account identifier. The data is therefore not exclusively anonymous. For usage analysis requiring consent and non-essential device access, your consent is the required basis under Article 6(1)(a) GDPR and applicable device-access rules.

In the mobile apps, our diagnostics provider processes crash reports, diagnostic information and installation identifiers to detect and resolve errors. Necessary diagnostics are based on our legitimate interest in a reliable, secure application under Article 6(1)(f) GDPR. Where device access requires consent, that consent requirement also applies. Analysis and diagnostics are separate processing purposes.

Our link and invitation provider processes link destinations, invitation and referral identifiers, and technical connection, device and access data to open shared links to the relevant profile, post or campaign and attribute invitations. On iOS, a clipboard item intended for link attribution may be checked on first launch. Requested link and invitation features are based on Article 6(1)(b) GDPR; reliable technical attribution on Article 6(1)(f) GDPR. Article 6(1)(a) GDPR applies to additional analysis requiring consent.

Cookies and local identifiers may support login, saved settings and recognition. You can manage browser and device permissions; restrictions may affect features. You can withdraw consent at support@daryse.com. An operating-system permission for camera, photos or push notifications does not provide blanket consent to usage analysis.

8. Messages, support and advertising

For chats we process messages, participants, timestamps and delivery or read status. Recipients and authorised members of jointly managed club areas can see the relevant communication. Push notifications use device and push identifiers; emails use your email address. Communication within features you use and account, security and campaign notices are based on Article 6(1)(b) GDPR or our legitimate interest in secure, reliable communication under Article 6(1)(f) GDPR.

For support requests, reports and complaints we process contact details, affected content and information about the matter. A person handles these cases. The bases are handling your request, our legitimate interests in enforcing rules and protecting affected people, and any legal obligations under Article 6(1)(b), (f) or (c) GDPR.

Advertising messages require consent under Article 6(1)(a) GDPR unless a lawful exception applies. Under such an exception, the basis is our legitimate interest in providing information about our own offers under Article 6(1)(f) GDPR. You can object to advertising at any time at support@daryse.com. You can also turn off push notifications in your device settings; this does not delete stored messages.

9. Premium and purchases

Apple and Google handle Premium purchases through their stores. We process purchase and transaction identifiers, receipts or purchase tokens, the offer purchased, duration and subscription status to verify purchases and provide the appropriate access. We do not receive full credit-card or bank details from these store purchases. The bases are Article 6(1)(b) GDPR, legal record-keeping duties under point (c), and misuse prevention under point (f). Club contracts are concluded separately; we process the necessary contractual and contact information for them.

10. Recipients and service providers

Access is given to the users, clubs and organisers described in the relevant sections, together with authorised staff and technical providers. These include:

• Cloud and hosting providers: operating the platform, storing data, authentication and media delivery.
• Analytics and diagnostics providers: analysing usage and detecting and resolving errors.
• Login and purchase platforms: signing in through external accounts and handling store purchases.
• Communication providers: delivering emails and push notifications.
• Link and invitation providers: opening shared links and attributing invitations and referrals.
• Support and operational service providers: handling requests, reports and technical incidents, which may involve identifiers, affected content and details of the matter.

Processors may process data on our instructions within the agreed scope. Providers' own processing, particularly store billing and external login, is also covered by their privacy information. Authorities, courts or advisers may receive data where required by law or necessary to establish, exercise or defend claims.

11. Processing outside the EEA

These providers and their subprocessors may process data outside the European Economic Area, particularly in the USA. International transfers require an adequate level of protection. Bases used include applicable adequacy decisions, including the EU-US Data Privacy Framework for covered certified recipients, or the European Commission's Standard Contractual Clauses with necessary supplementary measures. The specific basis depends on the recipient and service. You can request information about safeguards applicable to your data and a copy at support@daryse.com.

12. Retention and deletion

We retain data for the purposes described and delete or anonymise it when no longer necessary. In particular:

• Accounts, profiles and content: for the duration of your use or until content or account deletion. Shared communication, data under a club's responsibility and lawfully created external copies may have their own retention grounds.
• Campaigns and rule history: for campaign administration and fulfilment; internal records only as long as needed to resolve specific claims, taking applicable limitation periods into account. Public access ends when the campaign is deleted.
• Contracts, purchase records, support and reports: until the matter is completed and, where necessary, for statutory retention periods or enforcing or defending claims. An ongoing dispute may require longer retention limited to that purpose.
• Operational data: application logs are normally kept for 90 days, database diagnostic logs for 30 days and automated database backups for seven days. Temporary uploads and download exports are scheduled for automatic deletion after one day; deletion may finish later.
• Analytics and diagnostic data: for the comparison period needed for the relevant analysis or until the error is resolved, limited by the relevant deletion and retention settings. Our diagnostics provider specifies 90 days before removal from live and backup systems begins. You can request the retention information applicable to your analytics data from us.
• Training data: for as long as selected content and derivatives are necessary to develop and evaluate the relevant sports analysis features. Erasure requests and objections must also be considered when content is reused. Section 6 applies to models.

You can request account deletion in the app or at support@daryse.com. This concerns your Daryse account and does not cancel your store subscription. The store may retain required billing records. Backups are replaced within the relevant backup cycle; legally required further retention remains limited to its purpose.

13. Your rights

Subject to statutory conditions, you can request access and a copy of your data, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time for the future. Prior processing remains lawful.

Objection: You can object to processing based on legitimate interests for reasons arising from your particular situation. We stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or need the data for legal claims. You can object to direct marketing and associated profiling at any time without giving a reason; processing for those purposes will stop.

Send your request to support@daryse.com, including without an account. We may request information necessary to verify your identity, locate your data and protect it. You can complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The authority responsible for Daryse is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information; email: poststelle@ldi.nrw.de.

14. Minors and international users

Daryse is intended for people aged 13 and over; a higher statutory minimum age applies where required. Minors need legally required parental or legal-representative consent. Processing based on consent is also subject to applicable statutory age and representation rules.

If you are younger: other people can view, share or, where permitted, download the profile information and posts you make visible. Do not publish confidential information about yourself or others. You or your parents can contact support@daryse.com with questions or deletion requests.

Any mandatory additional rights under privacy law where you live remain available, such as rights to further information, objection or complaint. You can also exercise these through our contact address. Processing special categories of data, such as health data, additionally requires a lawful basis applicable to those categories.

15. Changes

We update this policy when our processing or legal requirements change and inform you appropriately about material changes. For new purposes we provide the required information in advance and obtain necessary consent.