PRIVACY POLICY
Your privacy matters.
Draft for review before launch — not final or legally approved. This policy describes planned ELOMA app functionality, not a confirmation that it is live. Website: https://eloma.cc. The app’s implementation and the website’s actual data handling must be checked before publication. Effective date: [EFFECTIVE DATE].
Who we are
ELOMA is the consumer-facing brand of ELOMA HOUSE LTD, an active private limited company registered in England and Wales, company number 17536793. Registered office: 5 St. Johns Park, Leeds, England, LS8 2UH. ELOMA HOUSE LTD is the organisation responsible for the ELOMA service and is proposed as the controller for the processing described here, subject to confirmation of its actual role for each processing activity. [CONTROLLER AND PROCESSING ROLES — TO CONFIRM]. Contact support@eloma.cc for privacy enquiries or write to the registered office.
Information you provide
Accounts and profiles are planned features. [ACTUAL ACCOUNT AND PROFILE FIELDS — TO CONFIRM]. The final policy must identify the personal data actually collected, its source, which fields are required or optional, and who can see them. Authentication methods, credential handling and profile uploads have not been verified. If you contact support@eloma.cc, your email address and the information you include will be used to respond to your enquiry. Do not send unnecessary sensitive information.
Games, communications and activity
Planned functionality includes finding and joining football games, creating and organising games, and game communications and related activity. These plans do not confirm that the features are live or that particular data is collected. [GAME, PARTICIPATION AND COMMUNICATION DATA; RECIPIENTS AND VISIBILITY — TO CONFIRM]. Device location tracking and manual location features have not been verified; this policy does not claim they are enabled. [LOCATION INPUTS AND ANY PERMISSIONS — TO CONFIRM].
Level, performance and feedback
Player Levels, Level Reliability, match results and player feedback are planned functionality. [DATA INPUTS, DERIVED INDICATORS, VISIBILITY AND CORRECTION PROCESS — TO CONFIRM]. The final policy must explain any profiling or automated processing actually used, its purposes and relevant effects. It must also assess whether any solely automated decisions have legal or similarly significant effects and identify the safeguards and rights that apply. No such processing is confirmed as live by this draft.
Technical information
[ACTUAL WEBSITE AND APP TECHNICAL DATA — TO CONFIRM]. Verify whether device information, IP addresses, authentication or security logs, diagnostics or usage events are processed, including by hosting and backend services. Identify the purposes, recipients, lawful bases and retention for the data actually processed. No app analytics, advertising service or particular diagnostic collection is asserted by this draft.
How we use information and our legal bases
Proposed UK GDPR bases must be checked against each implemented activity. Account administration and requested game, organising and communication features may rely on Article 6(1)(b), performance of a contract, only where objectively necessary to deliver the service requested. Security, abuse prevention and support may rely on Article 6(1)(f), legitimate interests, after a documented necessity and balancing assessment. Article 6(1)(c), legal obligation, applies only where a specific applicable obligation requires processing. Article 6(1)(a), consent, may apply to genuinely optional processing where appropriate, with a way to withdraw consent. The basis for Level, Level Reliability, results and feedback needs a separate assessment; contractual necessity must not be assumed. [PURPOSE–DATA–LAWFUL BASIS MAPPING, LEGITIMATE INTERESTS ASSESSMENTS AND ANY CONSENT FLOWS — TO CONFIRM].
Communications and marketing
Game and account communications are planned, subject to confirmation of their content, delivery channels and providers. Marketing activity and advertising partners have not been verified; this draft does not state that either is active. [COMMUNICATION CHANNELS, SERVICE/MARKETING DISTINCTION AND ANY CONSENT OR OPT-OUT PROCESS — TO CONFIRM]. Any marketing introduced must comply with applicable UK data protection and electronic marketing rules.
Payments when introduced
If payment features are introduced, we will explain the relevant payment information, roles, providers and legal basis at the point of use and update this policy. Do not send card details to support or post them in game chat. This policy does not confirm that payments are currently available.
Service providers and sharing
ELOMA intends to use Supabase for backend infrastructure. The Supabase products actually enabled, authentication methods, database schema, storage configuration and operational settings have not yet been fully verified. This is a planned use, not confirmation of live processing or use of every Supabase product. Supabase is intended to act as a processor where it handles personal data on ELOMA HOUSE LTD’s instructions, subject to confirmation of contractual roles and the applicable data processing agreement. [ENABLED SUPABASE SERVICES, DATA CATEGORIES, CONTRACTING ENTITY, PROCESSOR TERMS AND SUBPROCESSORS — TO CONFIRM]. Other providers and any disclosures to players or organisers must be identified from the actual implementation. No Supabase Analytics, payment provider, advertising partner or other unverified service is claimed here. [OTHER RECIPIENTS AND DISCLOSURE PURPOSES — TO CONFIRM].
Retention
Personal data should be retained only as long as necessary for its stated purposes and applicable legal obligations. The retention schedule and deletion processes are not yet verified. [RETENTION PERIODS OR SPECIFIC CRITERIA FOR ACCOUNTS, PROFILES, GAME RECORDS, RESULTS, FEEDBACK, COMMUNICATIONS, SUPPORT ENQUIRIES AND LOGS — TO CONFIRM]. [ACCOUNT CLOSURE, DATABASE AND STORAGE DELETION, BACKUP EXPIRY AND ANY LAWFUL RETENTION EXCEPTIONS — TO CONFIRM]. No fixed retention period or completed deletion capability is promised by this draft.
International transfers
Supabase’s project hosting region, storage locations, support access and subprocessor arrangements have not been verified. This policy does not state that information is stored in any particular country or that transfers outside the UK do or do not occur. [HOSTING REGION, RECIPIENT LOCATIONS AND INTERNATIONAL TRANSFER ASSESSMENT — TO CONFIRM]. If a restricted transfer occurs, an applicable lawful mechanism and any necessary additional safeguards must be established, such as UK adequacy regulations or appropriate UK-approved contractual safeguards. [ACTUAL TRANSFER MECHANISMS AND HOW TO OBTAIN DETAILS — TO CONFIRM]. Enquiries: support@eloma.cc.
Security
Appropriate technical and organisational measures must be established for the data actually processed. Planned safeguards include access restricted to authorised people and services, appropriate authentication and permissions, and controls preventing unauthorised access to user records or files. These are intended requirements, not verified claims about the current configuration. [SUPABASE ACCESS POLICIES, DATABASE ROW-LEVEL SECURITY WHERE APPLICABLE, STORAGE PERMISSIONS, ADMINISTRATIVE ACCESS, SECRET MANAGEMENT, BACKUPS AND INCIDENT RESPONSE — TO VERIFY]. No online service is completely secure. Report suspected unauthorised access to support@eloma.cc.
Your rights
Subject to applicable legal conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw consent where processing relies on consent, without affecting earlier lawful processing. Rights concerning solely automated decisions may apply where the statutory conditions are met. Contact support@eloma.cc or write to ELOMA HOUSE LTD at its registered office. Identity verification may be needed, and applicable legal response deadlines apply. [REQUEST HANDLING, EXPORT, CORRECTION AND DELETION WORKFLOWS — TO VERIFY]. You may complain to the UK Information Commissioner’s Office at ico.org.uk without contacting us first.
Children’s privacy
Eligibility and the minimum user age are [MINIMUM AGE — TO CONFIRM]. This must be settled before launch. The service should not be used by anyone below its published minimum age. Contact us if you believe a child’s information has been collected contrary to the applicable requirements so we can investigate and act.
Cookies, analytics and third-party services
The website and app must be assessed separately. The website’s actual cookies, local storage, scripts and any analytics configuration remain subject to audit; see the Cookie Policy. Supabase’s planned backend use does not establish that website analytics, marketing cookies or advertising are active. [ACTUAL TECHNOLOGY INVENTORY, PURPOSES, DURATIONS AND ANY REQUIRED CONSENT CONTROLS — TO CONFIRM]. Third-party services linked from ELOMA may have their own privacy policies.
Changes and contact
This draft must be checked against the actual website and app before publication as an operative policy. We will update it as verified processing and product functionality change, with notice of material changes where appropriate. Effective date: [EFFECTIVE DATE]. Privacy enquiries: support@eloma.cc. Website: https://eloma.cc.