ONEFOOTBALL HEAD CUSTOMIZER
PRIVACY NOTICE
1. Introduction and Scope
1.1 This Privacy Notice explains how OneFootball Capital GmbH (“the Company”, “we”, “us”, “our”) processes personal data in connection with the OneFootball Head Customizer avatar-creation and digital-collectible minting tool (the “Service”), as described in the Head Customizer Terms and Conditions (the “Terms”).
1.2 This Notice is specific to the Head Customizer and supplements, rather than replaces, the Company’s general Privacy Policy, available at https://promo.onefootball.com/legal/website-privacy-policy/en, which continues to apply to your OneFootball Account and your use of the wider OneFootball App and website. Where this Notice and the general Privacy Policy address the same matter, this Notice governs for the Head Customizer specifically.
1.3 This Notice should be read together with § 15 of the Terms. Capitalised terms not defined in this Notice have the meaning given to them in the Terms.
2. Who We Are and How to Contact Us
2.1 The controller responsible for the personal data described in this Notice is OneFootball Capital GmbH, Donaustraße 44, 12043 Berlin, Germany, registered with the Commercial Register (Handelsregister) of the Local Court (Amtsgericht) of Charlottenburg, Berlin, under registration number HRB 131613 B.
2.2 You can contact us about privacy matters at:
Email: privacy@onefootball.com.
Postal address: OneFootball Capital GmbH, Donaustraße 44, 12043 Berlin, Germany.
3. Personal Data We Process, and Why
3.1 OneFootball Account Data. Accessing the Head Customizer requires a valid, registered OneFootball Account (see § 4 of the Terms). The personal data associated with your OneFootball Account (for example, your login credentials and profile information) is processed under, and described in, the general Privacy Policy. This Notice covers only the additional personal data processed specifically because you use the Head Customizer, as set out below.
3.2 Wallet Address and On-Chain Transaction Data. When you connect a Wallet, we process your public Wallet address and related on-chain transaction data (for example, minting transaction identifiers). We use this data to: verify your eligibility to mint; route, record, and authorise the minting of a Head; enforce the scarcity and exclusivity rules described in § 7 of the Terms (for example, to prevent duplicate premium or “one-of-one” combinations); and display your Head’s ownership status within the Service. Legal basis: performance of a contract with you (Art. 6(1)(b) GDPR), namely the Terms.
3.3 Interface Interaction and Product Analytics Data. We process interface interaction events, including avatar_selected, mint_started, and mint_completed, together with general analytics on page visits and session drop-offs. We use this data for interface optimisation, funnel monitoring, troubleshooting, and product improvement. Legal basis: the Company’s legitimate interest in understanding, maintaining, and improving the Service (Art. 6(1)(f) GDPR).
3.4 On-Chain Attribution Data. We process technical attribution data generated via Base developer analytics and on-chain Builder Codes, to track smart-contract deployment activity and technical network attribution. Legal basis: the Company’s legitimate interest in monitoring the technical performance of the Service and participating in Base ecosystem attribution (Art. 6(1)(f) GDPR).
3.5 Age Self-Certification. We process your confirmation that you are at least 18 years old (given by the checkbox or button described in § 16.2 of the Terms). Legal basis: necessary for us to perform the Terms and to comply with our policy of restricting the Service to adults (Art. 6(1)(b) GDPR), and our legitimate interest in protecting minors from the financial and technical risks described in § 14 of the Terms (Art. 6(1)(f) GDPR).
3.6 Embedded Wallet / Login Data (Privy). The Head Customizer uses Privy to support both embedded (for example, email or social) logins and connections to external Web3 wallets (see § 17.2 of the Terms). Where you use an embedded login, Privy processes certain authentication data (for example, the email address or social account identifier used to create your embedded wallet) as a processor on the Company’s behalf, under a data processing agreement between the Company and Privy.
4. Special Notice: Public Blockchain Data
4.1 Your Wallet address and your minting and transfer transactions are recorded on the Base Blockchain, which is a public, decentralised ledger. This means that this data is, by design, visible to anyone who inspects the Blockchain (for example, via a public block explorer), and is not stored or controlled exclusively by the Company.
4.2 Once recorded on the Blockchain, this data generally cannot be altered, restricted, or deleted by the Company or by you, even where you would otherwise be entitled to exercise a data-protection right in relation to it (see § 9 below). This is an inherent feature of Blockchain technology, not a choice made by the Company.
4.3 If you are concerned about the public visibility of your Wallet address or on-chain activity, you should consider this before connecting a Wallet to the Service, and you may wish to use a Wallet address that is not otherwise linked to your real-world identity, subject to the eligibility and self-certification requirements in §§ 4 and 16 of the Terms.
5. Cookies and Similar Technologies
5.1 The interface-event tracking and analytics described in § 3.3 above are carried out under the Company’s existing analytics, cookie, and ePrivacy consent framework applied across OneFootball products.
5.2 The heads.onefootball.com subdomain uses the same cookie banner and consent-management tool as the main OneFootball App and website. The categories of cookies used (for example, strictly necessary and analytics cookies) and their specific purposes and durations are set out in that cookie banner / consent-management tool, which forms part of this Notice by reference.
6. Who We Share Your Data With
We do not sell your personal data. We share personal data described in this Notice only with the following categories of recipients, and only to the extent necessary for the purposes described in § 3:
Blockchain infrastructure. Your Wallet address and transaction data are, by the nature of the Service, transmitted to and recorded on the Base Blockchain, a public network that is not operated or controlled by the Company.
Wallet and authentication providers. Privy (see § 3.6), and the provider of any external Wallet you choose to connect (for example, Coinbase Wallet, MetaMask, Rainbow, Phantom, or Rabby Wallet), each of which processes data under their own respective privacy terms once you interact with them directly.
Analytics and attribution service providers, who support the processing described in §§ 3.3–3.4 (interface analytics and on-chain attribution).
Group companies and professional advisers, where necessary for the purposes described in § 3 or to obtain professional advice.
Regulators, courts, and law enforcement authorities, where we are required to disclose personal data by law or in connection with legal proceedings.
A successor entity, in the event of a merger, acquisition, or sale of assets relating to the Service, consistent with § 24.5 of the Terms.
7. International Data Transfers
7.1 Some of the recipients described in § 6 may be located outside the European Economic Area (EEA), for example, Privy. Where this is the case, we rely on appropriate safeguards recognised under Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, to protect your personal data.
7.2 Separately, because the Base Blockchain is a public, decentralised, and globally distributed network operated by independent validators worldwide, data recorded on it (such as your Wallet address and transaction history) is inherently accessible globally once recorded, independently of any transfer mechanism the Company puts in place. The application of international-transfer rules to public blockchain data is a developing area of law and regulatory guidance, and the Company keeps its position under review as that guidance develops.
8. How Long We Keep Your Data
8.1 We retain the personal data described in § 3 only for as long as necessary for the purposes for which it was collected. As a general rule: Wallet address and on-chain transaction data (§ 3.2) linked to your OneFootball Account are retained for as long as your OneFootball Account remains active, and for up to 3 years afterwards for fraud-prevention, legal, and accounting purposes. Interface interaction and product analytics data (§ 3.3) are retained on a rolling basis for up to 26 months. On-chain attribution data (§ 3.4) is retained for up to 12 months.
8.2 Regardless of our internal retention practices, data recorded on the Blockchain persists indefinitely and is not deleted when we delete our own copies of it, for the reasons explained in § 4.
9. Your Rights
9.1 Subject to the conditions and exceptions set out in applicable data protection law, you have the right to: request access to your personal data; request rectification of inaccurate personal data; request erasure of your personal data; request restriction of processing; object to processing based on our legitimate interests; request data portability; and, where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
9.2 Limits Specific to Blockchain Data. As explained in § 4, the Company cannot rectify, restrict, or erase personal data once it has been recorded on the Blockchain, because the Company does not control the Blockchain. Where you exercise a right under § 9.1 in relation to such data, we will rectify, restrict, or erase the data we hold directly (for example, in our own databases) to the extent technically and legally possible, but the corresponding on-chain record will remain unaffected.
9.3 To exercise any of these rights, please contact us using the details in § 2.2. You also have the right to lodge a complaint with a supervisory authority, in particular: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, Email: mailbox@datenschutz-berlin.de, Website: www.datenschutz-berlin.de; or the supervisory authority of your own EU member state of residence, place of work, or place of the alleged infringement.
10. Children
The Head Customizer is restricted to Users aged 18 and over (see § 16 of the Terms), and we do not knowingly collect personal data from persons under that age in connection with the Service. If you believe that a person under 18 has used the Head Customizer or connected a Wallet, please contact us at privacy@onefootball.com; we will promptly investigate and take appropriate action, including deletion of any associated data where required and technically possible (subject to § 9.2 above in relation to on-chain data).
11. Automated Decision-Making
The Company’s review of avatar configurations under § 11.3 of the Terms may be supported by automated screening tools, but any decision to block, delist, or restrict a Head involves human review before it is finalised, and is not based solely on automated processing. Accordingly, this processing does not constitute automated decision-making producing legal or similarly significant effects on you within the meaning of Art. 22 GDPR. If this changes, this Notice will be updated accordingly.
12. Changes to This Notice
We may update this Notice from time to time, for example to reflect changes to the Service or to applicable law. Material changes will be notified to you in accordance with § 21 of the Terms. The date at the top of this Notice indicates when it was last updated.
13. Relationship to the Terms and the General Privacy Policy
This Notice forms part of the contractual framework referenced in § 15.1 of the Terms. In the event of any inconsistency between this Notice and the general OneFootball Privacy Policy on a matter specific to the Head Customizer, this Notice governs.
14. Contact Us
If you have any questions about this Notice or about how we process your personal data in connection with the Head Customizer, please contact us at: Email: privacy@onefootball.com. Postal address: OneFootball Capital GmbH, Donaustraße 44, 12043 Berlin, Germany.
Version: 1/2026
Status: July 2026