Privacy Notice (GDPR + KVKK)

Version 0.9 · Effective date: · Placeholders in must be completed before publication.

Maçoku Privacy Policy

This policy explains how Brújula SL handles personal data when you use macoku.com and when we analyse a match video. It meets the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Spanish Organic Law 3/2018 (LOPDGDD) and, for people in Türkiye, Law No. 6698 on the Protection of Personal Data (KVKK, see section 13).

1. Short version

• We analyse match videos to produce team-level reports. We do not identify players by face, name or shirt number, and we do not produce individual player reports.
• Videos are deleted no later than 7 days after download. Reports are kept 30 days after delivery. If a report is never downloaded, the video and the report are deleted 30 days after delivery, with a reminder email on day 23.
• Optional keep-longer consent: a separate, unticked box lets you ask us to keep your video and report for 12 months so you can re-run or compare reports across the season. Legal basis: your consent (GDPR art. 6(1)(a); KVKK art. 5(1)). You can withdraw it at any time using the link in your report email or on your order status page, or by replying to that email or writing to efe@brujula.eu, and we then delete the video within 7 days. If you don't tick it, the standard periods above apply.
• AI language models receive anonymised numbers only, never images or video.
• We never sell personal data, never use your videos for advertising and never use them to train AI models.
• Anyone who appears in a video can ask us to delete it: efe@brujula.eu.

2. Who is responsible (controller)

Brújula SL,, CIF. Contact for all privacy matters: efe@brujula.eu.

Paddle (Paddle.com Market Limited, United Kingdom) is our merchant of record. It processes your payment and billing data as an independent controller under its own privacy notice (paddle.com/legal/privacy).

When a club orders under a signed club agreement, the agreement may set out that we act as the club's processor for that club's matches; in that case the club is the controller and this policy applies together with the club's own notice.

3. Whose data and which data

a) Customers (people who reserve or order a report)

• Reservation (before checkout opens): email address, country and language only.
• Email address, and name if you give it; country; language.
• Order data: order ID, product, price, date, Paddle transaction ID and status (Paddle shares these with us; we do not receive full card details).
• The video link you submit and a technical fingerprint (hash) of the file.
• Your Uploader Declaration: which boxes you ticked, the text version, date and time, and the IP address used.
• Messages you send us.

b) People who appear in a match video (players of any age, referees, coaches, spectators)

• Their image and movements as recorded in the video.
• Derived data our software creates: anonymous position points on the pitch over time, which are combined into team-level figures.
• We do not use face recognition, do not read names or shirt numbers, and do not create profiles of individuals. We do not process special categories of data (such as health or biometric data used to identify a person).

c) Website visitors

• Technical data such as IP address, browser type and request logs, kept for security; strictly necessary cookies only (see the Cookie Notice).

4. Why we use data and on what legal basis

We do not send marketing messages. If we ever do, we will ask for your separate consent first.

Where we rely on legitimate interest, we have weighed our interest against the rights and interests of the people concerned. You can ask us for that balancing note at efe@brujula.eu.

5. How we protect people who appear in videos

Most people in a match video are not our customers. We protect them by design:

• Uploader responsibility: the uploader must confirm they have the right to share the footage and that filming was known to participants (see the Uploader Declaration).
• Team-level output only: no individual reports, rankings, names or shirt numbers.
• No identification: no face recognition; anonymous position points only.
• Short retention: video deleted within 7 days; no copies kept for training or marketing.
• No AI on images: only anonymised numbers go to AI language models.
• Access limited: staff see a video only to handle support, rights requests or legal matters.
• Easy objection: anyone in a video can object and ask for deletion at efe@brujula.eu; we act within 72 hours.

6. Minors

Many amateur matches include players under 18, and some of our customers are youth clubs, coaches and parents.

• Our service is sold only to adults (18+). We do not knowingly collect data directly from children.
• When anyone under 18 appears in a video, the uploader must confirm that they have the consent of the parents or legal guardians of the minors shown, or the authorisation of the club or organiser responsible for the team.
• We apply the protections in section 5 to every video. Minors are never singled out in reports.
• In Spain, persons aged 14 and over may exercise their own data protection rights; for younger children, a parent or guardian acts for them (LOPDGDD art. 7). In Türkiye, requests for minors are made by their legal representative.

7. Automated processing and AI

Our analysis is automated, but it does not make decisions about any person that have legal or similarly significant effects (GDPR art. 22). Part of the report text is drafted by AI language models from anonymised numbers (for example zone percentages and team distance). Those providers receive no images, video, names or shirt numbers, and their contracts forbid using our data to train their models.

8. Who receives data (processors and recipients)

We use these service providers. They act on our instructions under data processing agreements, except Paddle, which is an independent controller.

We may also disclose data to courts, authorities or advisers where the law requires it or to defend legal claims. We never sell personal data.

9. International transfers

Some providers are outside the European Economic Area. We transfer data only where there is an adequacy decision (for example the United Kingdom, or US companies certified under the EU-US Data Privacy Framework) or under the European Commission's Standard Contractual Clauses with additional measures where needed. You can request a copy of the safeguards at efe@brujula.eu. Videos stay on servers in the EU.

10. How long we keep data

11. Security

We use encryption in transit, access controls, separate storage for videos, automatic deletion, and contracts with providers that require appropriate security. If a personal data breach is likely to put people at risk, we will notify the supervisory authority and, where required, the people affected.

12. Your rights under the GDPR

You can ask us to: access your data; correct it; delete it; restrict its use; receive it in a portable format; and object to processing based on legitimate interest, including processing of a video in which you appear. You can withdraw any consent at any time. Write to efe@brujula.eu. We reply within one month, at no cost to you; we may ask for information to confirm your identity, as little as needed.

If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the authority in your EU country.

13. Information notice for people in Türkiye (KVKK art. 10)

13.1 Data controller: Brújula SL,, CIF, efe@brujula.eu.

13.2 Purposes and legal reasons: as in section 4 (KVKK art. 5/2 c, ç, e and f). We do not process special categories of personal data (KVKK art. 6).

13.3 Method of collection: electronically, through the website, the order form, the video link you send, Paddle and emails.

13.4 Transfers: to the recipients in section 8, including recipients abroad (Spain/EU, United Kingdom, USA), under the conditions of KVKK art. 9 (appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority, or other grounds the law allows).

13.5 Your rights (KVKK art. 11): to learn whether your data is processed; to request information; to learn the purpose and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction; to request deletion or destruction under art. 7; to request that third parties be notified of corrections or deletions; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.

13.6 How to apply: in writing to, by registered email (KEP) or secure electronic signature, or from the email address registered with us to efe@brujula.eu, under the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer within 30 days at no cost (a fee may apply only where the law allows).

13.7 Complaint: if your application is rejected, our answer is insufficient, or we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of our answer and in any case within 60 days of your application (KVKK art. 14). www.kvkk.gov.tr

14. People who appear in a video and are not our customers

If you think you (or your child) appear in a video sent to Maçoku and you do not agree, write to efe@brujula.eu with the match date, place and teams. We will stop processing and delete the video and derived data within 72 hours, unless we must keep a minimal record to defend a legal claim. You can also complain to the AEPD or the KVKK Board.

15. Changes

We will publish any update here with a new date. If a change significantly affects you, we will tell you by email before it applies.

Brújula SL · · CIF · efe@brujula.eu