Privacy policy
Premier League · Last updated: 1 October 2026
This version describes accurately how COTA90 works for the Premier League, but it is not final and has not yet been reviewed by a lawyer. The details marked in amber are still pending.
This policy covers your COTA90 Premier League account, wherever you live. We are established in Spain, so the EU GDPR protects every user, and the UK GDPR also protects users in the United Kingdom. Your Premier League account is separate from any COTA90 La Liga account, even with the same email, and we hold its data apart.
1Who is the controller
- Controller: COTA90 — company name pending, tax ID pending
- Address: Barcelona, Spain
- Contact: hola@cota90.com
- Data Protection Officer: pending
- UK representative (UK GDPR art. 27): pending
2What we hold
| Data | When we get it |
|---|---|
| Name | At registration |
| At registration, and to verify the account | |
| Password | At registration. Stored hashed with scrypt, never in the clear |
| Date of birth | At registration, to check you are 18 or over |
| City and country of residence | At registration |
| Language | At registration, so we write to you in English or Spanish |
| Country you connect from | At registration, from the network. For information only: it never blocks anything |
| Your portfolio, and the players you sign and sell | While you compete |
| Site usage | Views, actions, language, screen width, browser, referrer, and your account email when you are signed in |
| IP address | Not stored. We keep an irreversible hash and the country code |
If you sign in with Google or Apple we receive your name and email from them. We never receive your password for those services.
3Why, and on what legal basis
| Purpose | Legal basis (EU GDPR and UK GDPR, art. 6) |
|---|---|
| Creating and running your account | Performance of a contract |
| Verifying your email and your age | Legal obligation and legitimate interest |
| The ranking, and any prize competition you enter | Performance of a contract |
| Service emails, such as your verification and password reset codes | Performance of a contract |
| Measuring use to improve the product, linked to your account when you are signed in | Legitimate interest, with the IP disassociated |
| Security and fraud prevention | Legitimate interest |
4How long we keep it
- Account: while it exists, and period pending after you close it.
- Prize and accounting records: the statutory tax retention period.
- Usage data: period pending.
5Who else processes it
| Provider | What for |
|---|---|
| Netlify | Hosting the site and its functions |
| Hetzner | Server and database, in the European Union |
| Resend | Sending the service's emails |
| Google / Apple | Only if you choose to sign in with them |
We do not sell your data or share it for advertising.
Other registered fans can see on the leaderboard your display name, your growth and, for each of the last 3 gameweeks, your signings and sales (player and day) and the players you held, with no amounts. You can hide this in Account.
6Transfers outside the EU and the UK
The database is in the European Union. Some providers are based in the United States. Where data leaves the EU or the UK, the transfer relies on an adequacy decision or on standard data protection clauses, as the EU GDPR and the UK GDPR require.
7Your rights
Wherever you live, you may exercise access, rectification, erasure, objection, restriction and portability, and withdraw consent where that is the basis. Write to hola@cota90.com.
If you are not satisfied you may complain to the Spanish Data Protection Agency (aepd.es), to the data protection authority of the country where you live or, in the UK, to the Information Commissioner's Office (ico.org.uk).
8Cookies and local storage
We use no advertising cookies and no third-party profiling.
- Signing in: your session is kept in your browser (
cota90_session_epl) so you stay signed in. Signing in with Google or Apple also sets a ten-minute cookie (cota90_oauth_epl) that ties the sign-in to your browser. - Measuring use: a random identifier for your browser (
cota90_aid_epl) and one for each visit (cota90_sid_epl) link the site usage records in section 2. - Preferences: kept on your own device, such as language (
cota90_lang_epl), theme (cota90_theme_epl) and, if you ask, your email for signing in (cota90_remember_email_epl). They stay in your browser; only the language also reaches us, with the site usage records in section 2.
9Security
Passwords are stored with scrypt. Traffic is encrypted. IP addresses are kept only as a
hash. Database access is restricted. If a breach created a risk to your rights we would notify you and
report it to the competent supervisory authority within the legal deadline.
10Under 18s
The service is for adults only. If we find an account belonging to a minor we close it and delete the data.
11Changes
If we change this policy in a way that matters we will tell you by email before it takes effect.