Privacy policy
Last updated: 19 August 2026
This is a courtesy translation for information purposes. The German version is the authoritative one.
1. Controller
Nils-Ole Kief
Neugärtenring 17
68766 Hockenheim, Germany
Email: kontakt@elftipp.com
2. Overview
elftipp is a prediction and manager game for football competitions. A host (e.g. circle of friends, bar, club, company, event) sets up a prediction round; players join via link or QR code and play free of charge — with a freely chosen nickname, no real name required. Only optional extras and host offerings are chargeable. You can also join a waiting list on our start page to be informed about the launch (section 5).
3. Player data
- Nickname: freely chosen; only used for display in the ranking.
- Device/recognition token: a technical identifier (anonymous session) stored locally on your device so your score can be re-assigned to you without a password.
- Game data: predictions, line-ups, points, ranking position.
- Optionally your email address: if you want to secure your score across devices (login link, no password). Playing without an email address remains possible.
- Identification code: a code identifying you to the host if the host offers prizes.
Legal basis: Art. 6 (1)(b) GDPR (performance of the game participation you initiated) and Art. 6 (1)(f) GDPR (technically sound operation). Please do not use a nickname that identifies you or others.
4. Host data
If you set up a prediction round, we process your email address (sign-in via login link) and your round settings. When booking paid services we additionally process name or company/owner name, contact person, billing address and payment/booking data.
Legal basis: Art. 6 (1)(b) GDPR (contract performance) and Art. 6 (1)(c) GDPR (statutory retention obligations).
4a. Data of professional footballers (sports data)
To display fixtures, results and statistics we process publicly available data on professional footballers (name, position, match events such as goals, assists, cards, ratings). We obtain this data from our sports data provider Sportmonks B.V., Netherlands, not from the individuals themselves (Art. 14 GDPR).
Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in reporting on public professional sport). Only match-related performance data is processed — no special categories of data (e.g. no health or injury data).
5. Early-access waiting list
You can voluntarily join a waiting list on our start page. We process your email address (required), optional details (name of your round, postcode, type of use), proof of your consent (timestamp, consent text shown to you, and a non-reversible hash of your IP address — we do not store the IP itself), and campaign/referral parameters from the link you used.
Double opt-in: your entry only becomes active once you click the confirmation link (valid for 48 hours). Unconfirmed entries are deleted automatically after that period.
Legal basis: Art. 6 (1)(a) GDPR (your consent). You can withdraw it at any time with future effect via the unsubscribe link in every email or informally to the address in section 1.
Bot protection (Cloudflare Turnstile): to protect the sign-up form from automated abuse, we use Cloudflare Turnstile. We use the same protection in the app at app.elftipp.com for registration, sign-in, password reset, and resending the confirmation email. Cloudflare (Cloudflare, Inc., USA / Cloudflare Germany GmbH) processes technical connection and interaction data (including IP address and browser characteristics). No advertising cookies, no cross-site tracking. Legal basis: Art. 6 (1)(f) GDPR; US transfers are safeguarded via the EU-US Data Privacy Framework and EU standard contractual clauses (section 10).
6. Photo gallery / photo upload
Images on our start page are curated by us; visitors cannot upload photos there. We deliberately use images in which no persons are identifiable. Where the app offers an event photo upload, each photo is stored non-publicly first and only shown after review and approval. Uploading requires confirmation that all depicted persons consent to upload and publication (for minors, their legal guardians). For abuse prevention we store a non-reversible hash of the IP address (no raw IP) and the confirmed consent text.
7. Server log files
Technical data is collected automatically on access (truncated IP address, date and time, requested resource, HTTP status, browser type, operating system) via our provider Cloudflare. Legal basis: Art. 6 (1)(f) GDPR (security and stable operation). Retention: max. 30 days.
8. Cookies and local storage
We store the recognition token described in section 3 locally on your device. It is technically required for the game and therefore stored without consent under Section 25 (2) no. 2 of the German TDDDG. We do not use marketing or third-party advertising cookies.
9. Service providers and recipients
- Cloudflare (hosting, CDN, security, Turnstile bot protection — used on the start page and in the app at app.elftipp.com for registration, sign-in, password reset, and resending the confirmation email —, email forwarding) — Cloudflare, Inc., USA / Cloudflare Germany GmbH. US transfers safeguarded via the EU-US Data Privacy Framework and EU standard contractual clauses. Any Cloudflare analytics we use runs cookieless.
- Stripe (payment processing) — Stripe Payments Europe Ltd., Ireland (and Stripe, Inc., USA where applicable). For core payment processing (including fraud prevention and legal obligations) Stripe acts as an independent controller; see Stripe's privacy policy. Where Stripe processes on our behalf, a data processing agreement is in place.
- Resend (transactional emails) — Resend (Plus Five Five, Inc.), USA. US transfer safeguarded via EU standard contractual clauses.
- Sportmonks (sports data) — Sportmonks B.V., Netherlands (EU). No user data is transmitted to Sportmonks (see section 4a).
- Supabase (database, authentication, storage) — Supabase, Inc., USA; data is processed and stored on servers within the EU. A data processing agreement under Art. 28 GDPR is in place; any US access (e.g. support) is safeguarded via EU standard contractual clauses.
- Backblaze (encrypted backups) — Backblaze, Inc., USA; backups stored in the EU region, safeguarded via EU standard contractual clauses.
- Sentry (error diagnostics) — Functional Software, Inc. (dba Sentry), USA; our instance stores data in the EU (Frankfurt). Technical error and device data only (e.g. truncated IP, browser type, error message), no form contents. Legal basis: Art. 6 (1)(f) GDPR.
10. Transfers to third countries
Where data is transferred outside the EU/EEA (in particular the USA), this is based on an adequacy decision (EU-US Data Privacy Framework) or EU standard contractual clauses under Art. 46 GDPR.
11. Retention
Player game data is deleted after the end of the respective season or round once no longer needed. Server logs are deleted after 30 days at the latest. Host billing and contract data is retained per statutory retention periods (in particular Section 147 of the German Fiscal Code, 10 years). Unconfirmed waiting-list entries are deleted automatically after 48 hours; confirmed entries are stored until you unsubscribe. After unsubscribing we retain only the proof of your original consent and your email address on a suppression list (Art. 6 (1)(c) and (f) GDPR).
12. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). An informal message to the address in section 1 is sufficient.
13. Right to lodge a complaint
You may complain to a data protection supervisory authority. Our competent authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
14. No automated decision-making
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.
15. Contact by email
If you contact us by email, we process your email address and the contents of your message to handle your request. Incoming mail is forwarded via Cloudflare to our mailbox hosted by Google Ireland Limited (Gmail). Correspondence is deleted once no longer required, unless statutory retention obligations apply. Legal basis: Art. 6 (1)(b) or (f) GDPR.
16. Changes
We update this privacy policy when the data processing or the legal situation changes. The version published on this page applies.