Privacy Policy

PRIVACY POLICY

on the data processing related to the free and subscription-based (software-as-a-service) services of the CUBE data analytics software web application available via the www.cubefootball.com website

(Annex 2 to the GTC)

Effective from: 5 November 2026

1. Introductory provisions

1.1. The purpose of this Privacy Policy (hereinafter: Policy) is for CUBE Football Analytics Zrt. (hereinafter: Service Provider or Controller) to present the data processing it carries out in connection with the www.cubefootball.com website (hereinafter: Website), the CUBE data analytics software available via the app.cubefootball.com web application (hereinafter: Software) and its free (Freemium) and subscription-based services (hereinafter together: Service). This Policy is Annex 2 to the General Terms and Conditions of the Service (hereinafter: GTC).

1.2. Data processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR), Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Info Act), and other applicable laws.

1.3. The Service is available exclusively to professional football stakeholders (organisations) for business use (Section 3 of the GTC); the Contract is concluded between the Service Provider and the User/Subscriber organisation. Data relating to organisations (e.g. company name, registered office, tax number) do not qualify as personal data. This Policy applies to the processing of the personal data of natural persons acting on behalf of the organisation or using the Service – in particular the Administrator and the Authorised Users –, other contact persons of the organisation, and natural persons (in particular football players) included in the Source Data displayed in the Software.

1.4. Capitalised terms used but not otherwise defined in this Policy (e.g. User, Subscriber, Administrator, Authorised User, User ID, User Account, Plan, Café, Hudl, Source Data, Analysis Result, Payment Service Provider, Invoicing Service Provider) have the meaning given to them in Section 2 of the GTC.

1.5. During registration, the Administrator and the invited Authorised User declare that they have read this Policy (Section 5.1 d) of the GTC). The User/Subscriber is responsible for ensuring that the transfer of the Authorised Users' personal data to the Service Provider is lawful and that the Authorised Users become acquainted with this Policy (Section 15.2 of the GTC).

1.6. This Policy is continuously available on the Website in Hungarian and English. In the event of any discrepancy between the two language versions, the Hungarian version shall prevail.

2. Details of the Controller

• Company name: CUBE Football Analytics Zártkörűen Működő Részvénytársaság (private company limited by shares)
• Short name: CUBE Football Analytics Zrt.
• Registered office and mailing address: Seregély utca 11., 1037 Budapest, Hungary
• Company registration number: 01-10-143332 (registered by the Company Registry Court of the Budapest-Capital Regional Court)
• Tax number: 32846904-2-41; EU VAT number: HU32846904
• Represented by: Attila Csernus, CEO
• Data protection contact e-mail address: support@cubefootball.com
• Person responsible for data protection matters: Attila Csernus, CEO, e-mail: attila.csernus@cubefootball.com

The Service Provider is not required to designate a data protection officer under Article 37 GDPR.

3. Definitions, categories of data subjects

3.1. Personal data: any information relating to an identified or identifiable natural person (Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier (e.g. a name, an identification number, an online identifier) or to one or more factors specific to that person.

3.2. Data Subjects under this Policy:

a) Administrator: the natural person who carries out the registration on behalf of the Subscriber and manages the organisational account, the Authorised Users and the Subscription;

b) Authorised User: a natural person who is an employee of the Subscriber or is in another work-related legal relationship with it, and who has named-user access;

c) other contact person: a natural person associated with the Subscriber's billing e-mail address, or any other natural person contacting the Service Provider;

d) persons included in the Source Data: primarily football players whose sports performance data are included in the Source Data provided by Hudl (Section 5.12);

e) visitors to the Website: data processing related to cookies is governed by the Cookie Policy (Section 5.13).

3.3. The Service is not available to consumers and is not intended for use by persons under the age of 16. If the Service Provider becomes aware that data of a person under the age of 16 have entered the system, it will delete such data without delay.

4. Legal bases for data processing in the case of the B2B Service

4.1. As the Contract is concluded between the Service Provider and the User/Subscriber organisation, the processing of the personal data of the Administrator and the Authorised Users – unless Section 5 provides otherwise – is based on the legitimate interest of the Service Provider and the User/Subscriber [Article 6(1)(f) GDPR] in performing the Contract concluded with the organisation and providing the Service through named-user access. Where the Data Subject personally accepts the provisions of the GTC applicable to them (Sections 5.6 and 16.7 of the GTC) or is personally liable under Section 3.6 of the GTC, the legal basis for the processing is also the performance of a contract with them [Article 6(1)(b) GDPR].

4.2. With regard to processing based on legitimate interest, the Service Provider has carried out a legitimate interest assessment (balancing test), which it will make available to the Data Subject upon request via the contact details provided in Section 2. The Data Subject may object to processing based on legitimate interest in accordance with Section 9.

4.3. Providing the Data Subject's personal data – with the exception of the consent-based data under Sections 5.2 and 5.8 – is a precondition for concluding the Contract and using the Service; in the absence of such data, the User Account cannot be created and the Service cannot be used.

5. What data do we process, for what purposes, on what legal basis and for how long?

5.1. Registration, User Account, login

• Data Subjects: Administrator, Authorised Users.
• Data processed: e-mail address (preferably a personal work e-mail address belonging to the organisation's official domain), interface language, name, job title, User ID, the unique system-generated internal identifier of the User Account, the organisation (User/Subscriber) to which the account belongs, role and permission level, the Plan used, the date and time of creation and last modification of the account; the one-time verification code valid for 10 minutes used to verify the e-mail address, and the password (these are processed exclusively by Microsoft's authentication service; the Service Provider does not have access to the password – Section 5.2 of the GTC); the fact and time of acceptance of the GTC and of the non-standard terms under Section 19, and the version number of the accepted GTC (Section 19.2 of the GTC), the declaration of having read this Policy; in the case of the Administrator, furthermore, the declarations under Section 3.3 of the GTC (eligibility, business use, authority to represent, accuracy of the data).
• Purpose of processing: creating and maintaining the User Account, identifying the Data Subject and logging them in, providing named-user access, concluding and performing the Contract, proving the contractual declarations and the acceptance of the GTC.
• Legal basis: legitimate interest under Section 4.1 or performance of a contract [Article 6(1)(f) and (b) GDPR]; with regard to proving acceptance and the declarations, the Service Provider's legitimate interest in the establishment, exercise and defence of legal claims [Article 6(1)(f) GDPR].
• Retention period: for as long as the User Account exists; thereafter in accordance with Section 5.14. The Service Provider retains data relating to the acceptance of the GTC and to the declarations under Section 3.3 of the GTC for 5 years following the termination of the Contract (the general limitation period under Section 6:22 of Act V of 2013 on the Civil Code).

5.2. Optional profile data

• Data Subjects: Administrator, Authorised Users.
• Data processed: mobile phone number, own team (from the league selected by the organisation) – Section 5.1 d) of the GTC.
• Purpose of processing: facilitating communication, personalising the Software (e.g. displaying content related to the favourite team).
• Legal basis: the Data Subject's voluntary consent [Article 6(1)(a) GDPR]. Providing these data is not a precondition for using the Service; consent may be withdrawn at any time by deleting the data from the profile or by a request sent to the e-mail address provided in Section 2.
• Retention period: until consent is withdrawn, but no later than the deletion of the User Account.

5.3. Inviting Authorised Users, managing roles, transferring access

• Data Subjects: Authorised Users, Administrator.
• Data processed: the e-mail address of the invited person, the date and status of the invitation, the inviting Administrator, the assigned role and access; in the event of a transfer of named-user access (Section 5.8 of the GTC), the name and e-mail address of the previous and the new Authorised User, the reason for and date of the transfer, and the Service Provider's consent.
• Source of data: the Authorised User's data are provided by the Administrator (the User/Subscriber) in the Settings menu (Section 5.6 of the GTC).
• Purpose of processing: allocating and managing the named-user access rights included in the Plan, enforcing the number of user seats, enforcing the rules on the transfer of access.
• Legal basis: legitimate interest of the Service Provider and the User/Subscriber [Article 6(1)(f) GDPR].
• Retention period: for as long as the User Account exists; the Service Provider deletes the data of unaccepted invitations 30 days after the invitation; data relating to the transfer of access are retained for 5 years following the termination of the Contract.

5.4. Eligibility verification (Sections 3.3–3.5 of the GTC)

• Data Subjects: Administrator, natural persons named in the submitted supporting documents.
• Data processed: the Administrator's name, e-mail address and its domain, and their declarations under Section 3.3 of the GTC; personal data contained in documents submitted to prove eligibility (e.g. company extract, club/federation registration certificate, agent/intermediary registration, media service provider registration) (e.g. name of executive officer, registration number); the date and result of the verification, and the fact of and reason for rejecting the registration or order or terminating the Contract.
• Purpose of processing: ensuring that the Service is used exclusively by professional football stakeholders, excluding consumers, fulfilling obligations arising from the Hudl Licence Agreement and preventing abuse.
• Legal basis: legitimate interest of the Service Provider [Article 6(1)(f) GDPR].
• Retention period: for the term of the Contract and for 5 years following its termination; in the case of a rejected registration, for 1 year from the rejection. The Service Provider deletes the submitted supporting documents within 30 days of completing the verification, while recording the fact of the finding.

5.5. Ordering, payment, invoicing

• Data Subjects: Administrator, the contact person associated with the billing e-mail address (if the billing data contain personal data).
• Data processed: billing name, subscriber type, registered office (country, address), tax number and the declaration regarding the EU VAT number, billing e-mail address, the selected payment method (Section 5.3 of the GTC); order data (Plan, Commitment Period, Additional Services, Fee, VAT, total amount payable, coupon code, internal order ID), the date and time of the order and of its confirmation; data received from the Payment Service Provider: payment status, the reason for rejection where applicable, card type, last four digits and expiry date; data on recurring charges, failed charges, refunds and chargebacks; data of the invoices issued.
• Bank card data: the Service Provider does not have access to, store or process bank card data (card number, expiry date, CVC, cardholder name); these are processed directly by the PCI DSS-compliant interface of the Payment Service Provider (Revolut) as an independent controller, in accordance with its own privacy notice (Sections 7.3 and 15.4 of the GTC). The Service Provider transmits to the Payment Service Provider only the order data (amount, currency, products, internal order ID), the Subscriber's e-mail address and billing address, and the browser data required for 3-D Secure authentication.
• Purpose of processing: concluding and performing the Subscription, collecting the Fee and processing recurring monthly charges, issuing and sending electronic invoices through the system of the Invoicing Service Provider (Billingo), handling refunds, recording and enforcing claims.
• Legal basis: with regard to the data of natural person contact persons, the Service Provider's legitimate interest in performing the Contract concluded with the organisation [Article 6(1)(f) GDPR]; with regard to accounting records, compliance with a legal obligation [Article 6(1)(c) GDPR; Section 169 of Act C of 2000 on Accounting; Sections 159–169 of Act CXXVII of 2007 on Value Added Tax].
• Retention period: accounting records (invoices) for 8 years following their issue; other data relating to orders and payments for 5 years following the termination of the Contract – irrespective of any earlier deletion of the User Account.

5.6. Communication, service-related notifications

• Data Subjects: Administrator, Authorised Users, billing contact person.
• Data processed: name, e-mail address, interface language, the subject, content and date of sending of the notification.
• Purpose of processing: sending system messages and notifications related to the use of the Service, in particular: confirmation of registration and order (Section 7.4 of the GTC), pre-renewal reminder (Section 8.3 of the GTC), notification of a failed charge (Section 8.6 of the GTC), notification of changes to the Fee, the GTC and this Policy (Sections 6.4 and 20.2 of the GTC), notification of suspension and termination (Section 18 of the GTC), security notifications (Section 5.10 of the GTC). The Service Provider sends system messages via the Microsoft Azure Communication Services service or, following its discontinuation, from a Brevo contact list, and sends invoices through the system of the Invoicing Service Provider (Section 21.1 of the GTC). The Service Provider does not send newsletters or advertisements on this basis. For the purpose of providing information related to the GTC, the above data of all registered Users – irrespective of newsletter subscription – are added to the language-specific contact list of the data processor Brevo; the Controller does not send newsletters or advertisements on this basis.
• Legal basis: legitimate interest under Section 4.1 or performance of a contract [Article 6(1)(f) and (b) GDPR].
• Retention period: for as long as the User Account exists; data evidencing the sending of notifications with legal effect (e.g. renewal, fee change, amendment of the GTC, termination) for 5 years following the termination of the Contract.

5.7. Use of the Software, access control, logging

• Data Subjects: Administrator, Authorised Users.
• Data processed: date and time of logins and logouts, failed login attempts, IP address, browser and device type, session ID, data on concurrent sessions and device restrictions; usage log (modules used, analyses run and use of the monthly unique analysis quota, date and subject of PDF exports, selection of League slots); content created and saved by the Authorised User in the Software (e.g. watchlists, saved analyses); error logs; in the event that two-factor authentication is introduced, the data required for it (Section 5.10 of the GTC).
• Purpose of processing: providing the Software and making saved content available; verifying named-user access and the prohibition of access sharing (Section 5.7 of the GTC); security of the Software, the Source Data and the Service Provider's systems (Sections 5.10 and 18.1 of the GTC); enforcing the limits of the Plan; monitoring the use of Source Data and Analysis Results (Section 10.8 of the GTC); troubleshooting and measuring availability (Section 9 of the GTC); developing the Software exclusively on the basis of aggregated statistics.
• Legal basis: the Service Provider's legitimate interest in operating the Service securely, lawfully and in compliance with the Hudl Licence Agreement [Article 6(1)(f) GDPR]; with regard to data stored in the browser that are necessary for maintaining the logged-in state, storage strictly necessary for providing the Service [Section 155(4) of Act C of 2003 on Electronic Communications].
• Retention period: login, usage and error logs for 12 months from recording; in the event of a suspected infringement, until the investigation thereof or the final conclusion of any resulting proceedings; saved content until deleted by the Authorised User, but no later than the deletion of the User Account.

5.8. Café (artificial intelligence-based assistant)

• Data Subjects: Authorised Users using Café; furthermore, persons whose data the Authorised User enters into Café.
• Data processed: questions and requests (prompts) entered in the Café interface, the responses given by Café, their date and time, the internal identifier of the User Account, the start and end of trial access, use of the Café quota, the fact and date of giving consent.
• Purpose of processing: generating Café responses (providing the Service); recording prompts linked to the given Authorised User in order to improve the user experience (Section 4.5 of the GTC); preventing and detecting abuse aimed at circumventing the limitations of the Software (e.g. prompt injection, Section 11.3 g) of the GTC).
• Legal basis: with regard to recording prompts and linking them to the Data Subject, the Data Subject's explicit, separate consent [Article 6(1)(a) GDPR; Section 4.5 of the GTC]; with regard to preventing abuse, the Service Provider's legitimate interest [Article 6(1)(f) GDPR]. Consent may be withdrawn at any time in the Settings menu of the Software or by a statement sent to the e-mail address provided in Section 2; withdrawal does not affect the lawfulness of processing prior to withdrawal. Under Section 4.5 of the GTC, Café can only be used with this consent; therefore, Café cannot be used after consent has been withdrawn.
• Data processor: Café is operated by OpenRouter Inc. on servers located in the European Union (Sections 6 and 7). The Service Provider does not use the prompts entered into Café or the responses to train artificial intelligence models, and contractually ensures that neither OpenRouter nor the model providers engaged by it use them for this purpose.
• Warning: it is prohibited to enter into Café special categories of personal data (e.g. health data), trade secrets of third parties, or personal data not necessary for performing the task (Section 4.5 of the GTC).
• Retention period: until consent is withdrawn, but no later than 12 months from the deletion of the User Account or the termination of the Contract; prompts concerned by suspected abuse until the final conclusion of the related proceedings.

5.9. Customer service (support), contact

• Data Subjects: the person submitting a report or making contact (Administrator, Authorised User, other contact person, a person completing the contact form on the Website).
• Data processed: name, e-mail address, organisation, User ID, the content and attachments of the report or message (e.g. screenshot), date and time of receipt, the response, the handling history of the report.
• Purpose of processing: receiving, investigating and responding to error reports, questions, comments and complaints (Section 9.2 of the GTC), correcting data entry errors (Section 5.4 of the GTC), handling contact enquiries (Section 21.1 of the GTC).
• Legal basis: legitimate interest of the Service Provider [Article 6(1)(f) GDPR]. As the Service is not available to consumers, the complaint-handling rules of Act CLV of 1997 on Consumer Protection do not apply.
• Retention period: for 1 year following the closure of the report; if the report concerns a claim related to the Contract, for 5 years following the termination of the Contract.

5.10. Compliance with the Hudl Licence Agreement, audits, reporting to Hudl

• Data Subjects: Administrator, Authorised Users.
• Data processed: the name of the User/Subscriber, the start and end dates of access to the Analysis Results (these are data relating to the organisation); in the event of an infringement or suspected infringement, the name and User ID of the Authorised User concerned, a description of the infringing conduct, relevant parts of the usage logs; information provided by the User/Subscriber at the Service Provider's request (Section 10.8 of the GTC); the certificate of deletion of Source Data and Analysis Results (Section 10.10 of the GTC).
• Purpose of processing: fulfilling obligations arising from the Hudl Licence Agreement: verifying the lawful use of Source Data, notification of infringements and regular reporting (at least twice a year) to Hudl (Sections 10.8–10.9 of the GTC); Hudl and its affiliates may access the Software for the purpose of verifying the lawful use of Source Data.
• Recipient: Hudl B.V. (Smalle Haven 151, 5211TK Den Bosch, the Netherlands), as an independent controller.
• Legal basis: legitimate interest of the Service Provider and Hudl in protecting the intellectual property rights in the Source Data and in performing the Hudl Licence Agreement [Article 6(1)(f) GDPR].
• Retention period: for 5 years following the termination of the Contract; in the event of a legal dispute, until its final conclusion.

5.11. Suspension, termination, enforcement of claims

• Data Subjects: Administrator, Authorised Users.
• Data processed: facts and evidence of a breach of contract (e.g. Sections 5.7, 8.6, 8.9 and 10–12 of the GTC), identification data of the persons concerned, correspondence between the parties, data on suspension and termination, data related to the personal liability of the Administrator or the Authorised User (Sections 3.6 and 16.7 of the GTC), data on the claim.
• Purpose of processing: suspension and termination of the Contract, establishment, exercise and defence of the Service Provider's legal claims.
• Legal basis: legitimate interest of the Service Provider [Article 6(1)(f) GDPR].
• Retention period: for 5 years following the termination of the Contract; in the event of court or official proceedings, until their final conclusion.

5.12. Data of persons (football players) included in the Source Data – information under Article 14 GDPR

• Data Subjects: natural persons included in the Source Data, primarily football players.
• Data processed: name, date of birth, nationality, club, team, position, shirt number, photograph of the player, match data and sports performance statistics (e.g. minutes played, goals, passes, cards), metrics derived from these (e.g. expected threat – xT), and Analysis Results generated from these by the Software (e.g. player profile, heat map, similar player search, watchlists).
• Source of data: Hudl (Hudl B.V.), which provides the Source Data to the Service Provider under a licence agreement (Sections 10.1 and 15.3 of the GTC); the Objective Data are also publicly available.
• Purpose of processing: providing a sports data analytics service to professional football stakeholders (in particular player scouting, opposition analysis, education, coaching and sports analysis).
• Legal basis: legitimate interest of the Service Provider and the Users/Subscribers in the professional sports analysis of professional football [Article 6(1)(f) GDPR]; the data relate to the players' sports performance in public matches. The Service Provider does not process special categories of personal data (e.g. health data) within the Source Data.
• Recipients: the Authorised Users of the Users/Subscribers via the Software; where Café is used, OpenRouter Inc. as data processor. If the User/Subscriber uses personal data relating to players obtained from the Software for its own purposes, it qualifies as an independent controller in that respect (Section 15.3 of the GTC).
• Retention period: during the term of the Hudl Licence Agreement, for as long as the data are necessary for providing the Service; the Service Provider deletes the data at Hudl's request or upon termination of the Hudl Licence Agreement.
• Objection: under Article 21 GDPR, players may object to the processing via the contact details provided in Section 2 (Section 9).

5.13. The Website, cookies

Cookies used on the Website and in the Software and the related data processing are governed by the Cookie Policy available on the Website at https://www.cubefootball.com/en/policies/cookie-policy. Cookies strictly necessary for login and for the operation of the Software are used without consent, while statistical and marketing cookies (e.g. Google Analytics) are used only with the Data Subject's consent.

5.14. Consequences of the deletion of the User Account and of the termination of the Contract

(a) Upon termination of the Contract, access to the Software ceases (Section 18.6 of the GTC). If the Administrator terminates the access of an Authorised User (e.g. due to the termination of their employment), the Authorised User's User Account is deactivated.

(b) In accordance with Section 18.6 of the GTC, the deletion of the User Account or the termination of the Contract does not result in the automatic deletion of all related personal data. The Service Provider retains the data for the periods specified in Sections 5.1–5.11, exclusively for the purposes indicated therein and with restricted access, and thereafter deletes or irreversibly anonymises them.

(c) At the same time as or after the deletion of the User Account, the Data Subject may request the deletion of the data stored about them (in particular profile data, usage data linked to the account and prompts entered into Café) by a request sent to the e-mail address provided in Section 2. The Service Provider will fulfil the request, except for data which it is obliged or entitled to retain under a legal obligation (e.g. accounting records) or a legitimate interest overriding the Data Subject's interests (e.g. enforcement of legal claims).

6. Data processors and recipients

6.1. As a general rule, the Service Provider does not transfer personal data to third parties. Exceptions are the following data processors acting on behalf of and on the instructions of the Service Provider, with which the Service Provider has concluded contracts compliant with Article 28 GDPR:

• Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) – hosting (Microsoft Azure, with data centres located in the European Union), login authentication (Azure AD B2C) and sending of system messages (Azure Communication Services); scope of data: the data under Sections 5.1–5.11.
• OpenRouter Inc. (169 Madison Avenue, Ste 2404, New York, NY 10016, United States of America; with servers located in the European Union) – operation of Café; scope of data: prompts and responses, without user identification (Section 5.8). Artificial intelligence model provider(s) engaged by OpenRouter: the GPT6-Sol, GPT6-Luna, Gemini 3.5 Flash Light, GPT5-Mini and Claude-Sonnet5 models, via the Azure and Google Vertex providers.
• Billingo Technologies Zrt. (Árbóc u. 6., 1138 Budapest, Hungary) – issuing and sending electronic invoices; scope of data: billing name, address, tax number, billing e-mail address, content of the invoice (Section 5.5).
• KAT Könyvszakértő Adószakértő, Tanácsadó Zrt. (Pannonhalmi út 36-38., 1118 Budapest, Hungary) – accounting; scope of data: data contained in accounting records (Section 5.5).
• Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) – Google Analytics web analytics, in accordance with the Cookie Policy.

6.2. Recipients acting as independent controllers:

• Revolut Bank UAB (Konstitucijos ave. 21B, 08130 Vilnius, Lithuania) – processing bank card payments, storing the bank card for recurring charges, refunds (Sections 7.2–7.3 and 15.4 of the GTC), in accordance with its own privacy notice.
• Hudl B.V. (Smalle Haven 151, 5211TK Den Bosch, the Netherlands) – recipient of the reporting and audits under Section 5.10, and source of the Source Data under Section 5.12.
• Authorities, courts: on the basis of a legal obligation, upon request (e.g. the National Tax and Customs Administration, investigating authorities, courts), to the extent necessary to fulfil the request.
• Legal successor, affiliated company: in the event of an assignment of the Contract under Section 21.5 of the GTC, the data necessary for the performance of the Contract.

6.3. Within the User/Subscriber's organisation, the Administrator may view, in the Settings menu, the names, e-mail addresses, roles and access status of the organisation's Authorised Users, as well as aggregated data on the use of the Plan limits.

7. Transfer of data to third countries

7.1. As a general rule, the Service Provider stores personal data in data centres located in the European Union. Any access by OpenRouter Inc. or by US-based members of the Microsoft group (e.g. operational support) may qualify as a transfer of data to a third country.

7.2. Transfers of data to the United States of America take place on the basis of the European Commission's adequacy decision on the EU–US Data Privacy Framework [Article 45 GDPR] where the recipient is listed under the framework (Microsoft Corporation; OpenRouter Inc.), and otherwise by applying the standard data protection clauses adopted by the European Commission [Article 46(2)(c) GDPR]. The Data Subject may request information about the safeguards applied via the contact details provided in Section 2.

8. Data security, automated decision-making

8.1. The Service Provider ensures the security of personal data through appropriate technical and organisational measures, in particular: login authentication is performed by Microsoft's authentication service and the Service Provider does not have access to the password; data are transmitted via an encrypted (TLS) channel; access to data is role-based, limited to the necessary minimum and logged; bank card data are processed exclusively by the PCI DSS-compliant Payment Service Provider; the Service Provider performs regular backups and may introduce additional authentication factors (e.g. two-factor authentication) where necessary (Section 5.10 of the GTC).

8.2. In the event of a personal data breach, the Service Provider – where the breach is likely to result in a risk – will notify the NAIH (Hungarian National Authority for Data Protection and Freedom of Information) without undue delay and, where feasible, within 72 hours in accordance with Article 33 GDPR and – in the case of a high risk – will inform the Data Subjects in accordance with Article 34 GDPR. The Service Provider keeps a record of data breaches.

8.3. The Service Provider does not make any decision concerning the Administrator or the Authorised Users based solely on automated processing which produces legal effects concerning them or similarly significantly affects them. The analyses and profiles of players prepared by the Software (Section 5.12) and the responses of Café constitute professional sports information; the Service Provider does not make decisions affecting players on that basis, and the User/Subscriber is responsible for decisions made on the basis of the Analysis Results (Section 16.1 of the GTC).

9. Rights of the Data Subjects

9.1. During the period of data processing, the Data Subject may exercise the following rights – in accordance with Articles 15–22 GDPR and Sections 14–23 of the Info Act:

• Right to information: the Data Subject is informed of the essential circumstances of the data processing by means of this Policy.
• Right of access: the Data Subject may request confirmation as to whether their personal data are being processed and, if so, may obtain access to the data and to the information listed in Article 15 GDPR (purpose of processing, categories of data, recipients, retention period, rights, source of the data), and may request a copy of the data. For any further copies, the Service Provider may charge a reasonable fee based on administrative costs.
• Right to rectification: the Data Subject may request the rectification of inaccurate data concerning them and the completion of incomplete data. Profile and billing data can also be modified directly in the User Account (Section 5.4 of the GTC).
• Right to erasure (“right to be forgotten”): the Data Subject may request the erasure of their data in the cases set out in Article 17(1) GDPR (e.g. the data are no longer necessary, consent has been withdrawn, a successful objection has been made, the processing is unlawful). Erasure cannot be carried out if the processing is necessary for a reason under Article 17(3) GDPR – in particular for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
• Right to restriction of processing: the Data Subject may request the restriction of processing if they contest the accuracy of the data, if the processing is unlawful but they oppose erasure, if the Service Provider no longer needs the data but the Data Subject requires them for legal claims, or if they have objected to the processing.
• Right to data portability: in the case of processing carried out by automated means based on consent or contract, the Data Subject is entitled to receive the data they have provided in a structured, commonly used and machine-readable format, and to request their transmission to another controller.
• Right to object: the Data Subject may object at any time, on grounds relating to their particular situation, to processing based on legitimate interest. In this case, the Service Provider may no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or which relate to the establishment, exercise or defence of legal claims.
• Right to withdraw consent: in the case of consent-based processing (Sections 5.2 and 5.8), the Data Subject may withdraw their consent at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal.

9.2. Exercising rights: the Data Subject may send their request to the e-mail address or postal address provided in Section 2. The Service Provider will respond to the request within a maximum of one month of receipt; this deadline may be extended by a further two months, taking into account the complexity and number of requests, in which case the Service Provider will inform the Data Subject within the one-month deadline, stating the reasons for the delay. Information and action are free of charge, except for manifestly unfounded or excessive requests. The Service Provider may request proof of the Data Subject's identity before fulfilling the request. If the Service Provider does not take action, it will inform the Data Subject, within one month at the latest, of the reasons for this and of the possibility of lodging a complaint and seeking a judicial remedy.

9.3. Complaint to the supervisory authority: the Data Subject may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement.

• Address: Falk Miksa utca 9–11., 1055 Budapest, Hungary
• Postal address: 1363 Budapest, Pf. 9.
• Telephone: +36 1 391 1400
• E-mail: ugyfelszolgalat@naih.hu
• Website: www.naih.hu

9.4. Judicial remedy: in the event of a violation of their rights, the Data Subject may bring an action before a court against the Service Provider or the data processor. The case falls within the jurisdiction of the regional court (törvényszék); at the Data Subject's choice, the action may also be brought before the regional court competent for their place of residence or stay (Section 23 of the Info Act). The Data Subject may also turn to a court against a legally binding decision of the supervisory authority concerning them, or if the authority does not handle the complaint or does not inform them within three months.

10. Amendment of this Policy

10.1. The Service Provider is entitled to amend this Policy unilaterally, in particular in the event of changes in legislation, official decisions, development of the Service, engagement of a new data processor or changes in data processing operations.

10.2. The Service Provider will inform the Data Subjects of any amendment materially affecting them by a message sent to the registered e-mail addresses of the Administrator and the Authorised Users and by publication on the Website, at least 15 days before the amendment enters into force (Section 20.2 of the GTC). The Service Provider will commence any new processing requiring consent only with the Data Subject's consent. Previous versions of this Policy are available on the Website.

Budapest, 5 November 2026

CUBE Football Analytics Zrt.