Legal

Privacy Policy

Last updated: 29 May 2026

1. Who we are and how to contact us

Elevens XI Limited (“Elevens XI”, “we”, “us”, “our”), company number 17223543, registered in England and Wales.
Registered office: The Mills, Canal Street, Derby, Derbyshire, England, DE1 2RJ.
Contact: support@elevens.app

This policy explains how we collect, use, share, and protect your personal data when you use our fantasy football website and related services (the “Service”). It complements, and is incorporated by reference into, our Terms and Conditions.

2. Who can use the Service

18+: may use the Service and receive prizes directly.
13–17: may use the Service only with verifiable parental or legal guardian consent. Any prize must be claimed by the parent/guardian and paid to the parent/guardian’s PayPal account.
Under 13: not permitted. If we learn we hold data about a child under 13, we will delete it.

3. What data we collect (data minimisation)

We operate on a minimal data basis. Currently we collect:

Account email address: required to create and operate an account, authenticate access, send essential service communications, notify winners, and manage support.
PayPal email address:
- Adults: the winner’s PayPal email for cash prize payouts.
- Minors (13–17): the parent/guardian’s PayPal email for payout.
Security/operational data: standard server and application logs (e.g., IP address, device and browser details, timestamps, request and error metadata) used for security, fraud prevention, diagnostics, and service reliability.
Anti-abuse signals: limited technical indicators used to enforce “one account per person” and fair play (e.g., device fingerprint or identifier, IP/subnet patterns, overlap with payout emails).

We do not intentionally collect names, postal addresses, dates of birth, payment card details, special category data, or detailed behavioural profiles. If you later provide additional information voluntarily (e.g., in support emails), we will process it only to handle your request.

4. How we collect your data

Directly from you when you register, log in, update account settings, enter Promotions, or claim a prize.
From a parent/guardian for users aged 13–17 (consent and payout details).
Automatically from your device through cookies and similar technologies that are necessary to run and secure the Service (see section 11).

5. How we use your data and our legal bases

We use personal data for:

Operating the Service: account creation, authentication, session management, essential service messaging (deadlines, integrity fixes, finality notices), and user support.
- Legal basis: performance of a contract (our Terms) and our legitimate interests in operating a secure, reliable Service.
Promotions and prize administration: eligibility checks, winner notifications, and paying cash prizes via PayPal (including the Finality Window process set out in the Terms).
- Legal basis: performance of a contract; for minors, parental/guardian consent and authorisation.
Fair play and fraud prevention: enforcing “one account per person,” investigating suspected abuse or collusion, and applying sanctions described in the Terms.
- Legal basis: our legitimate interests in preventing fraud and protecting Service integrity.
Compliance and enforcement: record keeping, responding to lawful requests, exercising or defending legal claims, satisfying tax/audit obligations relating to prize payouts.
- Legal basis: legal obligation and our legitimate interests.

We do not sell your data and we do not share it with advertisers. We do not conduct automated decision-making that produces legal or similarly significant effects without the possibility of human review.

6. Sharing your data

We share personal data only as needed with:

Service providers acting under contract (processors), including:
- Hosting, infrastructure, and security (e.g., cloud hosting, DDoS protection, logging/monitoring).
- Email delivery (transactional emails).
- Anti-abuse and verification tools (limited signals for duplicate account detection and integrity).
PayPal (payouts): Your or your guardian’s PayPal email is used to send prizes. PayPal acts under its own terms and privacy policy as an independent controller.
Professional advisers and authorities: Where required by law, to protect our rights or users, or to investigate suspected unlawful activity.

We require processors to safeguard data and use it only according to our instructions.

7. International transfers

Our providers may process data in the UK, EEA, and other countries. Where data is transferred outside the UK/EEA, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), and supplementary measures where necessary. Details are available on request.

8. How long we keep your data (retention)

Account email: retained while your account is active and for up to 24 months after closure for security, fraud prevention, and dispute handling, unless a longer period is required by law or necessary for an active claim.
PayPal payout records (including payout email): retained for up to 6 years to meet UK accounting/tax obligations.
Security/operational logs and anti-abuse signals: typically retained up to 12 months, or longer if needed for investigations or legal purposes.

At end of retention, we delete or irreversibly anonymise the data.

9. Your rights

Depending on where you live, you have rights to:

Access your personal data and receive a copy.
Rectify inaccurate or incomplete data.
Erase your data where no longer needed or where we rely on consent and you withdraw it.
Restrict or object to certain processing based on our legitimate interests.
Data portability for information you provided to us where processing is based on contract and carried out by automated means.
Complain to a supervisory authority (see section 14).

For users aged 13–17, parents/guardians may exercise rights on the minor’s behalf. To make a request, email support@elevens.app from the registered email. We may need to verify your identity/authority. We aim to respond within one month (or as permitted in complex cases).

10. Children’s data and parental consent (13–17)

We request a parent/guardian email to confirm consent for a 13–17 user’s account. If we cannot verify consent within 14 days of request, we may suspend the minor’s account and void prize eligibility until verification is completed.
If a minor wins a prize, the parent/guardian must contact support@elevens.app to claim within the stated period; payouts are made only to the parent/guardian’s PayPal account. Where PayPal policy or local law prevents payout, we may offer a suitable non-cash alternative or declare the prize void where prohibited.

11. Cookies and similar technologies

Necessary cookies: used for sign-in/session management, security (e.g., CSRF), and essential site functions. Legal basis: performance of a contract and/or our legitimate interests.
No analytics/advertising cookies at present. If we add them, we will provide a consent banner and update this policy and our cookie details.

12. Security

We use appropriate technical and organisational measures to protect personal data, including:

TLS encryption in transit and encryption at rest where applicable.
Access controls and least privilege practices.
Monitoring, logging, and vulnerability management.
Segregation and restricted access for payout data.

No system is perfectly secure; please keep your credentials confidential and notify us promptly of any suspected compromise.

13. How our Terms interact with this policy

Our Terms describe how scoring data and standings are finalised (including the 12-hour Finality Window) and set out integrity investigations, anti-abuse measures, and payout conditions. Where the Terms require us to process data (e.g., duplicate account detection, investigation holds, winner verification), we process your data for those purposes under the legal bases stated in section 5.

14. Complaints and contact details for regulators

If you have concerns, contact us first at support@elevens.app. You also have the right to complain to your local data protection authority. In the UK:

Information Commissioner’s Office (ICO): ico.org.uk

15. Third-party services and links

Our Service may link to third-party sites or services (e.g., PayPal). Their processing is governed by their own privacy policies; we are not responsible for those third parties.

16. Changes to this policy

We may update this policy from time to time. We will post updates with a new “Last updated” date and, for material changes, notify you in app or by email. Your continued use of the Service after changes take effect indicates acknowledgement of the updated policy.