Privacy policy
Last updated: September 2026
1. Who is responsible
La Liguilla KG
Flotowgasse 26/3/4, 1190 Vienna, Austria
E-mail: info@laliguilla.com · Support: support@laliguilla.com
2. What this covers
The laliguilla.com website, the web applications, the mobile applications for iOS and Android, the Match Center, and the custom applications La Liguilla provides to leagues and federations.
3. Two different roles, and they are worth understanding
- La Liguilla decides about your account data, payments, support and website analytics.
- The league or federation decides about competition data: players, line-ups, results, sanctions. They enter that data, and La Liguilla processes it on their instructions.
If you want competition data corrected or deleted, the decision belongs to the league; we put you in touch with them and help them carry it out.
4. What data is processed
Account: e-mail address — which is also your username — first and last name, sex, date of birth, password (stored only as a cryptographic hash, never in clear text), role and the organisation you belong to.
If you sign in with Apple, Google or Facebook, we receive the identifier those services send us. With “Sign in with Apple” this may be an anonymous relay address.
Player: first and last name, shirt name, squad number, date of birth, identity document number, e-mail, telephone, town, country, sex, height, weight, website and photograph.
Sporting: line-ups, substitutions, goals, assists, cards, suspensions, results, standings, statistics and transfers.
Payment: plan, billing period, payment status and the payment provider's identifiers. We never see or store your full card number: Stripe collects it directly.
Technical: IP address, the country derived from it, device type and operating system, language, notification identifier and error logs.
5. Why, and on what legal basis
- Giving you an account and access — performance of the contract.
- Running and publishing the competition — performance of the contract, and the league's instructions.
- Identifying each player unambiguously by their identity document, in order to prevent impersonation, check who is eligible to play and apply suspensions to the right person — performance of the contract and the legitimate interest of the competition.
- Charging and invoicing — performance of the contract and legal obligation.
- Keeping invoices — legal obligation.
- Support — performance of the contract and legitimate interest.
- Security and abuse prevention — legitimate interest.
- Measuring visits with Google Analytics — your consent.
- Sending push notifications — your consent, the one your phone asks for.
- Deriving your country to show the right price — legitimate interest.
- Artificial intelligence features — performance of the contract, on the league's instructions.
6. What is public, and what is not
Sporting data is public by its nature. Line-ups, goals, cards, suspensions, standings and player profiles can be seen on the website and in the applications without signing in, and search engines may index them.
Never public and never shown: e-mail address, telephone number, identity document number, password and payment data.
7. Who else is involved
- Hostinger — hosting of the platform, the database and e-mail. Paris, European Union.
- Stripe — payments. Ireland and the United States.
- OpenAI — artificial intelligence features. United States.
- Mistral AI — optical reading of match sheets. France, European Union.
- MaxMind — deriving the country from the IP address. United States.
- Google — analytics (only with consent), sign-in and notifications. United States.
- Apple — sign-in, App Store distribution and notifications. United States.
The database and the servers are in the European Union. Where data goes to the United States, it relies on the safeguards under Chapter V of the GDPR applied by each provider. You can ask us for the details at info@laliguilla.com.
8. Artificial intelligence
OpenAI models are used to generate fixtures, read match sheets and import player and team data. The scanned image of the match sheet is first read by Mistral AI, in France, which converts it into text.
Reading a match sheet may send players' names and, if it appears on the sheet, their identity document number. The results are suggestions: the administrator reviews them before they are saved, and no automated decision is made about anyone.
9. Minors
A large share of the players in grassroots competitions are minors.
Their data is entered by the league, and it is the league that must hold the consent of a parent or guardian, or another valid legal basis. In Austria, the age at which a minor can consent on their own is 14.
If you are a parent or guardian and want a minor's data removed, write to info@laliguilla.com and we will handle it with the league concerned.
10. How long data is kept
- Your account: until you delete it.
- Competition data: for as long as the league keeps it; afterwards, as the league decides.
- Invoices: seven years, as Austrian tax law requires.
- Technical logs: as long as needed for the security of the service, then deleted.
If you delete your account, we delete its data. Results already published for a competition remain part of its history, because they belong to the league's record.
11. Your rights
You may request access to your data, its rectification, its erasure, restriction of processing, portability, and you may object to processing. Where you gave consent, you can withdraw it at any time; that does not affect what was done before.
Write to info@laliguilla.com. If your request concerns data entered by a league, we pass it to that league and help them answer it.
You also have the right to complain to the supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna, Austria
dsb@dsb.gv.at · www.dsb.gv.at
12. Cookies and analytics
What the service needs to work — keeping your session, remembering your language — is stored without asking, because without it the site does not work.
Google Analytics is only loaded if you accept it. If you decline, no script is loaded and no analytics cookie is stored, and the site works exactly the same. You can change your mind at any time.
We do not show personalised advertising and we do not use advertising identifiers.
13. Notifications
Push notifications are only delivered if you allow them on your phone, and you can withdraw that permission in your system settings at any time. A device identifier is stored in order to send them.
14. Security
Information always travels encrypted. Passwords are stored only as a cryptographic hash, never in clear text. Access to production data is limited to the people who need it, and within the platform each person only sees their own organisation's data.
15. Changes
We will update this policy when the way we process data changes. The current version is always available on the website and inside the applications.