Privacy Policy

Last updated: 30 October 2026. Site owner: Exclusive Sports Portal, available at https://exclusivesportsportal.life/en/ (the Portal). This policy describes how personal data is handled for people who visit the Portal or send the contact form, in line with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 on information-society services (LSSI-CE).

1. Data controller

The controller is Exclusive Sports Portal. We do not publish a postal address. Contact is [email protected]. To exercise a right or ask a privacy question, use that address with the subject “Privacy”. We reply within the legal period of one month, which can be extended under Article 12 of the GDPR when the request is complex.

2. Data we collect and why

The Portal is an informational Fantasy Football NFL site. It does not create user accounts or marketing profiles. The data that may be processed are: (a) technical browsing data the browser sends as standard (a shortened or full IP address, browser type, pages visited and the date), needed for security and to keep the service running; (b) the notice preference stored in local storage on the device under the key cookie_consent, which only records whether the person accepted or closed the notice; (c) the board roster, stored on the same device under the key esp_lineup, with only the identifier of each slot, with no name or email, and with no upload to our server; (d) the data the person voluntarily types into the contact form: name, email, subject and message, plus the mark that this policy was accepted.

Those categories are used for these purposes: to answer the message that was sent; to keep a minimal record of communications in case of a claim; to keep the site secure against abusive use; and to remember the cookie-notice choice so it is not shown again. We do not build profiles, we do not take automated decisions with legal effects, and we do not sell data to third parties.

3. Legal basis

Answering enquiries is based on consent (Article 6.1.a GDPR) and, when the person is a client or a pre-contract contact, on steps taken before a contract (Article 6.1.b). Legitimate interest (Article 6.1.f) covers the site's technical security and legal defence. The technical cookie preference is handled under the LSSI-CE and the Spanish Data Protection Agency's cookie guidance: cookies or equivalents that are strictly necessary to remember a user's choice may be stored without a separate advertising consent, as long as their existence is explained, which the Portal's notice does.

4. Retention and recipients

Contact messages are kept for as long as it takes to reply and, at most, eighteen months if there is no open claim. Technical server logs are rotated on short cycles, usually under ninety days, unless there is a security incident. The keys cookie_consent and esp_lineup stay on the device until the person clears local storage. There are no commercial transfers. Hosting and email providers may access the data as processors, under a contract that meets Article 28 of the GDPR and, if they operate outside the European Economic Area, with Chapter V safeguards (standard contractual clauses or another valid exception).

5. People's rights

Anyone may request access, rectification, erasure, objection, restriction and portability, and may withdraw consent without affecting the lawfulness of processing already carried out. They may also complain to the Spanish Data Protection Agency (sedeagpd.gob.es). You do not have to provide data in the form; if you do not, we cannot reply. The Portal is not aimed at children under fourteen: if we detect data from a child below that age, we will delete it.

6. Security measures and changes

We apply technical and organisational measures proportionate to the risk of an editorial site: encryption in transit when the host allows it, access control on the desk's email, and data minimisation. No transmission over the internet is absolutely secure. If this policy changes in a material way, we will update the date at the top and, if the change adds new purposes, we will ask for consent again when the law requires it. Continuing to use the Portal after a minor wording change means you have been able to read the current version at this same canonical URL.

7. The form, field by field

On Contact we ask for four pieces of data and one checkbox. The name tells us who we are answering. The email is the way back: without it, the message has no return address. The subject sorts the desk's inbox. The message is the content of the enquiry. The Privacy Policy checkbox is not stored as a profile: it records that the person sent the form after having the link to the text. There is no field for a phone number, an identity document, a bank account or a paid league. If you type an extra detail inside the message, we treat it as part of that enquiry and delete it when we delete the message, unless you ask us to remove it sooner.

8. No map and no postal address

The Contact page does not show a map and does not embed a third-party service. We do not publish a postal address. The channel is the email [email protected]. We do not load OpenStreetMap or any other external frame on that page.

9. Children

The Portal does not open accounts and does not check age on every visit. Even so, the form is not meant for children under fourteen, the age from which the LOPDGDD allows, with conditions, a minor's consent to the processing of their data in information-society services. If a parent or guardian tells us that a message was sent by a child below that age, we will delete the message and the associated email. Fantasy editorial content can be read as sports information. We do not ask a child to register in order to keep reading.

10. How to exercise a right

For access, rectification, erasure, objection, restriction or portability, write to [email protected] with the subject “Privacy” and tell us which right you are exercising and which message it concerns. If the email on the request does not match the one on the form, we may ask you to reply from that same address, so we do not hand an enquiry to someone else. The reply period is one month from the moment the request is clear, with the extension in Article 12 of the GDPR if the case is complex. Portability, on a site with no account and no structured history, is limited to sending back the text you sent us.

11. What this site does not do with the data

We do not sell lists. We do not match the form to a sportsbook. We do not build a manager profile in order to show you an ad. There is no user area, so there is no password to guard and no lineup history on a server of ours: the draft board runs in the browser. The cookie_consent key and the esp_lineup key live on your device. If you press neither Accept nor Close, the notice comes back, and that does not mean we have stored a file on you.

12. If there is an incident

If a breach affected contact messages or technical logs and posed a risk to people, we will assess it under Articles 33 and 34 of the GDPR. Where the law requires it, we will notify the Spanish Data Protection Agency within 72 hours of becoming aware, and the people affected if the risk is high. A design fault on a public page, with no access to the inbox, is not by itself a personal-data breach. The desk email is the channel for telling us if you believe one of your messages has been exposed.

13. Complaints to the AEPD

You can complain to the Spanish Data Protection Agency (aepd.es) if you believe the processing does not meet the GDPR or the LOPDGDD. You do not have to come to us first, although a note to [email protected] usually fixes a misfiled email or a cookie notice that will not close. We do not publish a postal address. The channel for a complaint to us first, if you want to use it, is [email protected]. No data-protection officer has been appointed: the volume and risk of an editorial site without accounts do not require one. If the processing later changes scale, that conclusion will be reviewed.

14. Version, language and archive

The current version is the one at https://exclusivesportsportal.life/en/privacy-policy/ with the date at the top. The reference language is Spanish. If a passage is translated into another language, the Spanish text controls if there is any doubt. We do not keep a wall of old versions on the site: the update date marks the cut. A change of purpose, processor or category of data is written here before it is applied. Continuing to read the glossary after a minor wording change is not a new contract. Sending the form does require the checkbox for this policy in the version of the day you write.