Privacy Policy

Ahmed Tambal, trading as FPL Master, of Dubai, United Arab Emirates, is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are accountable for it.

For anything to do with your data, write to info@fantasypremierleaguemaster.com.

We are established in the United Arab Emirates, so UAE Federal Decree-Law 45 of 2021 on the Protection of Personal Data applies to us directly. Because we offer this service to people in the United Kingdom and the European Union, the UK GDPR and the EU GDPR also apply to us under article 3(2) of each, and we hold ourselves to them. We additionally cover the California Consumer Privacy Act as amended by the CPRA, and the comparable laws of Virginia, Colorado, Connecticut, Utah and other US states with equivalent statutes.

We are in the process of appointing a representative in the United Kingdom under UK GDPR article 27. Until that is in place, please contact us directly at info@fantasypremierleaguemaster.com, and we will answer within the same statutory deadlines.

We are in the process of appointing a representative in the European Union under EU GDPR article 27. Until then, contact us directly at info@fantasypremierleaguemaster.com.

UK and EU law requires a specific lawful basis for every purpose. Ours are set out in full below.

Where we rely on legitimate interests we have weighed our interest against your rights, and you can object at any time using the contact address above.

This section exists because saying only that a product uses AI tells you nothing useful. Here is exactly where it is used and what it can see.

You are not subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of UK GDPR art.22. Our models forecast football, not people.

This section is about people who are not our users. A professional footballer is an identifiable living individual, so information about them is personal data and the law applies to it just as it applies to yours. Most football tools ignore this. We would rather set out what we do.

We do not profile players as individuals for any purpose beyond forecasting sporting performance, we make no judgement about their character, conduct or private life, and we do not sell or license player data to anyone.

Youth and academy players are excluded. We hold data only on players listed in the senior Fantasy Premier League game, and we do not knowingly process data about a player under 18.

If you are a player, a club or an agent and you want to know what we hold, or you object to it, write to info@fantasypremierleaguemaster.com. You have the same rights as any other data subject, including the right to object to processing based on legitimate interests, and we will respond within one month.

We do not sell your personal data and we never have. We share it only with the service providers we need to run the product, each bound by a contract that limits them to acting on our instructions.

We will also disclose data where the law requires it, to enforce our Terms, or to protect the rights and safety of our users. If the business is ever transferred, your data may transfer with it, and we will tell you first.

We keep data in the United Kingdom or the European Economic Area wherever we can. Where a provider processes data elsewhere, we rely on one of the legal safeguards permitted under UK GDPR chapter V and EU GDPR chapter V:

• an adequacy decision covering the destination country;
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum;
• and, in each case, an assessment of whether extra technical protections are needed.

You can ask us for a copy of the safeguards in place by writing to info@fantasypremierleaguemaster.com.

Under the UK GDPR and the EU GDPR you have the right to:

• be told what we hold about you, and get a copy of it (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure), which Settings does immediately;
• restrict how we use your data while a concern is resolved;
• receive your data in a portable, machine readable format, which the export button in Settings provides;
• object to processing we base on legitimate interests, including any direct marketing;
• withdraw consent at any time, without affecting anything done before you withdrew it;
• not be subject to a solely automated decision with legal or similarly significant effect, which we do not make.

Most of these are self-service in Settings and take effect at once. For anything else, write to info@fantasypremierleaguemaster.com. We will answer within one month, and we will not charge you for exercising a right.

If you are unhappy with how we have handled your data, you can complain to a regulator. Being established outside the UK and the EU does not put us beyond their reach, and it does not remove your right to complain about us.

• In the United Kingdom: the Information Commissioner's Office, ico.org.uk, or 0303 123 1113.
• In the European Economic Area: the supervisory authority of the country you live or work in.
• In the United Arab Emirates: the UAE Data Office, which supervises the federal data protection law we are directly subject to.

Please consider telling us first, at the address above, so we have a chance to put it right. You are not obliged to, and complaining to us does not use up your right to complain to a regulator afterwards.

If you live in California, Virginia, Colorado, Connecticut, Utah or another state with a comprehensive privacy law, you have the right to know what personal information we collect and why, to get a copy of it, to correct it, to delete it, and to be free from discrimination for exercising any of those rights. Use the export and delete controls in Settings, or write to info@fantasypremierleaguemaster.com.

We do not collect sensitive personal information as the CPRA defines it, and so we do not use or disclose it for any purpose requiring a right to limit. You may use an authorised agent to make a request, and we will verify the request through the email address on the account.

• Everything travels over HTTPS with modern TLS, and the site is served with HTTP Strict Transport Security.
• Passwords are stored only as salted hashes using an industry standard algorithm. Nobody at our end can read your password, and we will never ask you for it.
• New passwords are checked against known public breach corpora using a method that never sends your password anywhere.
• Database access is enforced row by row, so a query can only ever return rows belonging to the signed-in user.
• Sessions end automatically after 7 minutes of inactivity, enforced both in the browser and by the authentication service.
• A strict Content Security Policy limits what the page is allowed to load or execute, which blunts cross-site scripting.
• IP addresses are stored only as salted hashes, so security logs are useful for investigating account compromise without us holding an identifier in the clear. Our authentication provider records the address for a few minutes as part of its own sign-in log; an automated job runs every ten minutes to replace it with a salted hash and erase the original, and the whole record is deleted after 30 days.
• We keep what we collect small, because data you do not hold cannot leak.

No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours as required, and tell you without undue delay where the risk to you is high.

The service is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to info@fantasypremierleaguemaster.com and we will delete it.

Cookies and similar technologies are covered in a separate document, including exactly what is set and how to change your mind.

Read the Cookie Policy

We will update this policy when what we do changes. If a change is material we will tell you in the product or by email before it takes effect. The date at the top of the page always shows the current version.