Privacy Policy

Lady Arena is a professional career and recruitment network for women’s football. It connects players, parents and legal guardians, football agents and agencies, clubs, scouts and other authorised football professionals.

For the purposes of this Policy, the data controller is Lady Arena, operating through www.ladyarena.pro and based in Limassol, Cyprus, EU (“Lady Arena”, “we”, “us” or “our”).

Privacy enquiries and data-rights requests may be sent to info@ladyarena.pro. Correspondence may be addressed to Lady Arena, Limassol, Cyprus, EU.

This Policy applies to ladyarena.pro, our waiting list, demo and contact forms, and the Lady Arena platform, accounts, profiles, messaging, verification, recruitment and related services (together, the “Service”). It explains what personal data we process, why we process it, who receives it, how long we keep it and the choices and rights available to individuals.

This Policy does not govern a club, agency, agent or other organisation’s independent use of personal data outside Lady Arena. Those organisations may be separate controllers and should provide their own privacy information.

Depending on your role and use of the Service, we may process the categories below.

A. Account and identity data — name, email address, telephone number, country, date of birth or age band, preferred language, password or authentication identifiers, role, organisation, account status and profile photograph.

B. Player profile and career data — playing name, citizenship/nationality, city or region, football position, dominant foot, current and former clubs, playing history, sporting achievements, availability, career preferences, CV, biography, links, photographs, videos, match footage and social-media accounts. We discourage users from uploading medical records, injury details, racial or ethnic origin, religion, sexual orientation, biometric templates or other special-category data. Where a feature genuinely requires special-category data, we will provide a specific notice and identify an Article 9 GDPR condition before collecting it.

C. Guardian and minor data — for a player under 18, we may process the player’s name, age/date of birth, football information and media, together with the guardian’s name, relationship to the player, contact details, declarations of parental responsibility, verification evidence, permissions and account activity. We may request proportionate evidence of age or authority. Verification documents are access-restricted and not displayed publicly.

D. Professional and organisation data — for agents, agencies, clubs and scouts: job title, employer or represented organisation, business contact details, company information, websites, professional history, licence or accreditation details, issuing body, licence number, validity date, roster, territorial scope and verification records.

E. Relationship and recruitment data — requests, approvals and rejections concerning player–agent or player–club relationships; opportunity preferences; shortlist activity; applications; messages; interview or trial requests; status changes; reports; blocking; and records necessary to evidence platform interactions. A status such as “mutually confirmed”, “documents reviewed” or “licence checked” records a platform process only. It is not proof that a representation, employment, transfer or other legal contract exists or is enforceable.

F. Communications and support data — messages sent through the Service, enquiries, demo requests, survey responses, feedback, support requests, complaints, safeguarding reports and correspondence with us.

G. Technical, security and usage data — IP address, device and browser information, session identifiers, login history, timestamps, pages and features used, referral source, approximate location derived from IP, cookie choices, security events, audit logs and fraud or abuse indicators.

H. Payment data — if paid services are introduced, we may process billing name and address, tax information, subscription and transaction status, invoices and limited payment metadata. Full card details should be processed by our payment provider and not stored by Lady Arena.

Where a profile is created from third-party or public data, we will provide the information required by Article 14 GDPR within the applicable period and offer a clear method to claim, correct, object to or remove the profile. We will not create public profiles for minors from scraped or public data without an appropriate lawful basis, safeguards and guardian involvement.

We process personal data only where a lawful basis applies:

Adult users control profile visibility through available settings. Users should publish only information suitable for a professional audience. Public information may be indexed by search engines, copied, captured or shared by others despite our controls.

Email addresses, telephone numbers, identity documents, guardian evidence, private messages and precise home addresses are private by default. A minor’s direct contact details are never publicly displayed. Minor profiles must use the highest privacy setting by default and communications must be routed through the verified guardian or another approved safeguarding workflow.

Lady Arena is not a general social network for children. A player under 18 may use the Service only through, or with the verified authorisation and continuing supervision of, a parent or legal guardian and subject to our age-appropriate design and safeguarding controls.

In Cyprus, where consent is relied upon for an information-society service offered directly to a child, parental authorisation is required below the age set by applicable Cyprus law. Because Lady Arena involves recruitment and public professional information, we apply guardian involvement to all players under 18 irrespective of the minimum digital-consent age.

Guardians must use adult contact details, confirm their authority, review profile visibility, approve relevant relationship requests and supervise communications. We may suspend a minor profile until authority is verified. If we learn that a minor’s data was submitted without proper authority, we will restrict the profile and investigate, delete or regularise the data as appropriate.

We may verify identity, age, guardian authority, organisation affiliation, professional credentials and agent licences using documents, trusted databases, professional bodies or verification providers. Verification is risk-based and not a guarantee of character, conduct, competence, solvency, legal authority or future behaviour.

Verification documents are available only to authorised personnel and service providers who require access. Unless retention is required for fraud, dispute or legal reasons, raw identity documents should be deleted within 30–90 days after verification, with a limited verification record retained.

Lady Arena may use filters, ranking or recommendation tools to help users discover profiles or opportunities. We will explain the principal parameters where required. We do not intend to make solely automated decisions that produce legal or similarly significant effects without an applicable lawful basis, safeguards and a method to obtain human review.

We may disclose personal data to:

We do not sell personal data. We do not permit third parties to use minor data for behavioural advertising. We do not publish user contact lists.

We aim to host and process personal data in the European Economic Area (“EEA”). Some suppliers may process data outside the EEA. Where no European Commission adequacy decision applies, we use an approved transfer mechanism—such as Standard Contractual Clauses—together with supplementary safeguards where required.

Information about applicable safeguards may be requested from info@ladyarena.pro, subject to lawful redactions.

We retain data only as long as necessary. Unless a different period is justified and documented, the intended schedule is:

We may retain limited information to respect opt-outs, prevent repeat abuse, comply with law or establish, exercise or defend legal claims.

We use proportionate technical and organisational measures, including access controls, encryption in transit, password hashing, backups, logging, vulnerability management, supplier controls, staff confidentiality and incident response. No online service is completely secure. Users must protect login credentials and report suspected compromise promptly.

Subject to the GDPR and applicable law, you may request access, correction, erasure, restriction, objection, portability, withdrawal of consent, information about safeguards for international transfers, and human intervention where applicable automated decision rights arise.

Send requests to info@ladyarena.pro. We may ask for proportionate information to verify identity or authority. We normally respond within one month, subject to lawful extensions. Rights are not absolute, and we will explain any lawful refusal.

Guardians may exercise rights for a minor where authorised. As the player matures, we will give appropriate weight to her views and rights.

We send electronic marketing only where permitted by law. You may unsubscribe through the message or by contacting us. Service and safety communications are not marketing and may still be sent where necessary.

Our use of cookies and similar technologies is described in the Cookie Policy. Non-essential technologies are used only after valid consent where required.

Please contact us first so we can try to resolve the issue. You also have the right to complain to the Office of the Commissioner for Personal Data Protection, Republic of Cyprus, through its official website at https://www.dataprotection.gov.cy, or to another competent EEA supervisory authority where applicable.

We may update this Policy to reflect legal, technical or service changes. We will post the new version and effective date and, where a change materially affects users, provide appropriate notice or seek fresh consent where required.