Privacy policy

ElevenPro is a service of Seonictech S.L., Spanish tax ID ESB90074337, registered office at Calle Parsi 12, Nave 18, 41016 Sevilla, Spain.

You can reach us at any time at privacidad@elevenpro.es, both to exercise your rights and for any question about this policy.

Account data: email, name and, if you register with a password, its hash (never the password itself).

Professional profile: role, position, club, location, age, bio, experience, skills, and any images or video you upload.

Usage data: posts, comments, likes, connections, messages, applications and profile views.

Technical data: access timestamp, user agent and an irreversible hash of your IP address. We never store the IP in the clear.

When we email you (welcome, password reset), we record whether and when it is opened, and the type of email client, to know if our messages get through. We do not record your IP address when you open them. You can prevent even that by keeping images blocked in your email client.

Providing the service and managing your account — performance of a contract (GDPR art. 6(1)(b)).

Security, fraud prevention and abuse limiting — legitimate interest (art. 6(1)(f)).

Marketing communications and non-essential cookies — consent (art. 6(1)(a)), withdrawable at any time.

Legal obligations and retention of audit records — art. 6(1)(c).

We calculate an "EP rating" from your profile information and your activity, and we use it to order search and scouting results. That is profiling within the meaning of Article 4(4) GDPR, which is why we tell you here.

No automated decision with legal effects is taken about you: that score influences the order in which you appear, not whether you can use the service or whether a club signs you. You can object by writing to us, and we will stop using it to rank you.

Your profile is visible to other users unless you hide it in settings. Each post has its own visibility: public, contacts only, or private.

We do not sell your data and we do not share it for advertising. It is processed only by the providers needed to run the service, always under a data processing agreement: server hosting, email delivery, Stripe for payments and Google (Firebase Cloud Messaging) to deliver notifications to your phone.

Some of those providers may process data outside the European Economic Area. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission.

For as long as your account is active. When you delete it we irreversibly anonymise your personal data and keep only what the law requires (audit records, unlinked from your identity).

Access, rectification, erasure, objection, restriction and portability. You can exercise them yourself: download all your data or delete your account from the app settings.

You can also write to privacidad@elevenpro.es. If you believe we haven't handled your request properly, you may lodge a complaint with your national data protection authority.

We hash passwords with bcrypt, rate-limit sign-in attempts, enforce a strict content security policy and log sensitive backoffice actions.

The postal code catalogue comes from GeoNames (geonames.org), under the Creative Commons Attribution 4.0 licence.

Postal codes from countries not in that catalogue are resolved with Nominatim, by the OpenStreetMap Foundation. OpenStreetMap data is published under the Open Database License (ODbL).

That lookup is made by our server, never by your device, and the result is stored so it is not repeated: neither OpenStreetMap nor anyone else receives your IP address when you use this feature.

Push notifications are delivered through Firebase Cloud Messaging, operated by Google Ireland Limited. So the alert can be shown on your lock screen, its title and text — which may include the name of the person writing to you and the beginning of their message — pass through their servers. Google acts as a data processor and cannot use that data for anything else.

If you'd rather no content appeared in alerts, turn off message notifications in Settings: you'll still see them when you open the app.

If you accept analytics, public pages use Google Analytics 4, operated by Google Ireland Limited, acting as a data processor. It receives your IP address — which Google truncates before storing — the page you are viewing and basic device data. This happens only on the public website and only with your prior consent; if you choose "necessary only", your browser never contacts Google.

Google may process that data in the United States. The transfer relies on the EU-US Data Privacy Framework, to which Google is certified, and on the European Commission's standard contractual clauses as an additional safeguard. Analytics data is kept for fourteen months.