Privacy policy
Last updated on Friday 4 September. Version 1.0.
1. Who is responsible for your data
[legal name], trading as Football Surprise, [address], company number [company number].
Questions about this policy or about your data: [e-mail address].
We have not appointed a data protection officer; we are not required to. Your questions come straight to us.
2. What this policy covers
The data we process when you visit our website, order a box, buy a gift card or sign up for our newsletter.
3. Which data we process and why
What | What for | On which ground |
|---|---|---|
Name, e-mail address, phone number, delivery address | Carrying out your order and contacting you about it | Performance of the contract |
Your starting point, radius, chosen weekends, excluded teams | Finding a match that fits your conditions | Performance of the contract |
The names of the people coming along, and their date of birth where the club requires it | Having tickets issued in their names | Performance of the contract |
Information about a wheelchair space or assistance | Requesting the right seats from the club | Your explicit consent (see article 5) |
Payment details | Processing your payment | Performance of the contract |
Invoicing and accounting data | Meeting our tax obligations | Legal obligation |
Your remarks and our correspondence | Handling your questions and complaints | Performance of the contract, and our legitimate interest in improving our service |
We never ask for more than we need, and we do not sell your data on.
4. What we do not do
We show no third-party advertising on our site, we do not follow you across other websites, and we do not build a profile of you.
5. Health data
When you order, we ask whether anyone in your party needs a wheelchair space or assistance. You are not obliged to answer — your order goes through without that detail as well — but without that information we cannot request those seats.
This is health data. That is why:
we ask for your explicit consent separately, apart from the rest of your order;
we use it solely to request the right seats from the club of your match;
we pass it on to that one club only, and to no one else;
we delete it within 5 days of the match, even where we keep the rest of your order data for longer.
You can withdraw that consent at any time through [e-mail address]. If you do so before the match, we may no longer be able to arrange the adapted seats.
6. The data of the people coming with you
When you give us the names of other people, we process data about people who have ordered nothing from us themselves.
What we do: we use those names only to have the tickets issued, we pass them on to the club of your match alone, and we delete them according to the periods in article 7.
What we ask of you: tell those people that you are passing on their name and what for. When you order, you confirm that you have done so. Feel free to send them the link to this policy.
If you are coming along on someone else's order: you may always contact us at [e-mail address] to ask which data we hold about you, or to have it deleted. All the rights in article 10 apply to you too.
7. How long we keep your data
What | How long |
|---|---|
Order data and the preferences you gave us | 1 year after your order |
Names of the people coming along | Up to 6 months after the match |
Health data | Up to 5 days after the match |
Invoices and accounting records | 7 years, as tax law prescribes |
Correspondence about a complaint | 3 years after it is settled |
E-mail address for the newsletter | Until you unsubscribe |
Gift card data | Up to 1 year and 1 week after the card expires |
After that we delete it, or make it irreversibly anonymous for statistics.
8. Who we share your data with
With whom | What for | Where |
|---|---|---|
The club of your match | Issuing tickets, requesting seats | The country of the selected club |
Mollie | Processing your payment | European Economic Area |
Bpost | Delivering your box | European Economic Area |
Brevo | Sending our e-mails | France |
Hetzner | Running our website and database | Germany |
Our accountant | Our legal obligations | Belgium |
With each of these parties we have a data processing agreement setting out what they may do with your data.
We pass your data on to no one else, unless the law obliges us to.
9. How the match is chosen
Our system proposes a list of matches that fit your conditions. The final choice is always made by a person. So there is no fully automated decision with legal consequences for you.
10. Your rights
You have the right to:
see which data we hold about you, and receive a copy of it;
have it corrected when it is wrong;
have it deleted, as far as we do not need it for a current order or a legal obligation;
have the processing restricted;
object to processing based on legitimate interest;
receive your data in a readable format or have it passed on;
withdraw your consent, without affecting what happened before that.
Send your request to [e-mail address]. We answer within thirty days. To avoid handing data to the wrong person, we may ask you to identify yourself.
If you are not satisfied with our answer, you can lodge a complaint with the Data Protection Authority, Drukpersstraat 35, 1000 Brussels, [email protected].
11. Security
Our website works over a secure connection only. Access to order data is limited to the people who need it, with personal accounts. We take encrypted backups and keep our systems up to date.
No system is completely watertight. If you notice anything suspicious, let us know at [e-mail address].
12. Measuring without cookies
We measure how many people visit our site and which pages they look at, but without cookies and without identifying you. More about that in our cookie policy.
13. Changes
We adapt this policy when the way we work changes. The date and version number at the top show when that last happened. In the event of significant changes we will notify you by e-mail if we have your address.