This Privacy Policy explains how Draffte Inc. collects, uses, shares and protects your personal data across the Draffte platform — and the rights you have, wherever you are in the world. By creating an account you accept this Policy together with our Terms & Conditions.
1. Who we are (the data controller)
Draffte Inc. ("Draffte", "we", "us") is the controller responsible for the personal data described in this Policy. We operate the Draffte platform, the Draffte Passport, the Draffte coach and scouting tools, and the Draffte AI camera (together, the "Platform").
- Legal form: Corporation, State of Delaware, USA (State File Number 7593457)
- Registered address: 16192 Coastal Highway, Lewes, Delaware 19958, USA
- Website: www.draffte.com
- Privacy contact: privacy@draffte.com
2. Scope and legal frameworks
This Policy applies to everyone who uses the Platform, anywhere in the world. Because we operate internationally, we comply with the data-protection laws that apply to you, including:
- Colombia — Law 1581 of 2012, Decree 1377 of 2013, Decree 1074 of 2015, and SIC Circulars 002/2015 and 003/2022 (AI & data protection); Law 1098 of 2006 (Children & Adolescents Code).
- European Economic Area & United Kingdom — the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR.
- United States — the California Consumer Privacy Act, as amended by the CPRA ("CCPA"), comparable state privacy laws, and the Children's Online Privacy Protection Act ("COPPA") for children under 13.
- Rest of the world — equivalent local data-protection laws where they apply to you.
Where a specific law gives you stronger rights than this Policy, that law prevails for you.
3. Personal data we collect
We collect the following categories of personal data, each with the legal basis on which we rely:
- Identity data — full name, date of birth, identity-document number, nationality, email, phone, club. Basis: performance of our contract with you; parental consent for minors.
- Sporting-performance data — statistics, heat maps, positioning, ratings and the Draffte Ranking. Basis: performance of contract; our legitimate interests.
- Audiovisual data — match video and highlights. Basis: specific consent.
- Biometric data — AI processing of video to identify players by movement patterns may constitute biometric data under Art. 5(f) of Law 1581/2012 and Art. 9 GDPR. We process it only under specific, granular consent collected on a separate screen, independent of general sign-up. Without this consent, video is never processed to identify an individual. Basis: explicit consent for biometric data.
- Usage & device data — IP address, device, sessions, and PTAF traceability logs. Basis: legitimate interests; performance of contract.
- Payment data — payment history; card numbers are processed exclusively by certified third-party payment gateways and are not stored by Draffte. Basis: performance of contract; legal/tax obligations.
4. How we use your data
We use personal data to:
- provide the Draffte Passport, ratings and Ranking (contract);
- publish highlights on the Platform (specific consent);
- provide live-streaming (specific consent);
- send you Draffte marketing (specific consent — you can opt out anytime);
- train AI models using anonymised data (specific consent);
- license anonymised, aggregated datasets to non-betting third parties such as scouting organisations, sports media, federations and sports-investment funds (specific consent);
- maintain PTAF traceability (contract; legitimate interests);
- provide security and fraud prevention (legitimate interests; legal obligation);
- provide customer support (contract); and
- meet legal and regulatory obligations (legal obligation).
5. Legal bases (EEA / UK)
If you are in the EEA or UK, we rely on the following GDPR legal bases: contract (Art. 6(1)(b)) to operate your account and the Passport; consent (Art. 6(1)(a), and Art. 9(2)(a) for biometric and other special-category data) for video, highlights, live-streaming, marketing, AI training and data licensing; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, product analytics and PTAF traceability; and legal obligation (Art. 6(1)(c)) for tax, accounting and regulatory duties. You can withdraw consent at any time without affecting prior processing.
7. International data transfers
Draffte is based in the United States, so your data may be processed there and in other countries where our providers operate. We protect international transfers with appropriate safeguards:
- From the EEA/UK: the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, with transfer-impact assessments where required. A copy is available on request.
- From Colombia: contractual guarantees equivalent to Art. 26 of Law 1581/2012.
- Other regions: the transfer mechanism required by your local law.
8. How long we keep data
- Identity & identifiable performance data: life of the account + 2 years.
- Raw match video: 12 months from filming.
- Published highlights: indefinitely, unless you request deletion.
- Anonymised / aggregated datasets: indefinitely (no longer personal data).
- Usage logs: 12 months.
- PTAF traceability: 7 years (contractual-limitation period).
- Financial & billing records: 10 years (tax obligation).
- Minors' data: life of the minor's account + 2 years, or until consent is withdrawn.
- Raw biometric data: 12 months.
9. Your privacy rights
Subject to your local law, you have the right to access your data, correct inaccurate data, request deletion, request portability, object to processing based on legitimate interests, restrict processing, withdraw consent, and not be subject to solely automated decisions with significant effects without human review.
EEA / UK (GDPR)
You have the full set of rights in Arts. 15–22 GDPR and may lodge a complaint with your local supervisory authority (in the UK, the ICO at ico.org.uk).
United States (CCPA / CPRA)
California residents may request to know, access, correct and delete personal information, and may opt out of any "sale" or "sharing" of personal information. Draffte does not sell personal data, and does not share it for cross-context behavioural advertising. We will not discriminate against you for exercising your rights.
Colombia (Law 1581/2012)
You may exercise the rights in Arts. 8, 14, 15 and 16. Our response times are: queries 10 business days; complaints 15 business days (extendable by 8). For deletion, our internal channels resolve within 5 business days; requests to third-party platforms within 15 business days; with a report to you within 30 days. Data already incorporated into anonymised datasets cannot be individually deleted. You may complain to the SIC at www.sic.gov.co.
To exercise any right, email privacy@draffte.com with your name, identification, the data concerned and a reply address.
10. Children's privacy
Draffte is designed for youth football, so we treat minors' data with the highest care. We process a minor's data only under the specific, granular consent of a parent or legal guardian, including a separate biometric consent. In the United States we comply with COPPA for children under 13.
Absolute prohibition: no data relating to a minor, in any identifiable form, is ever licensed to sports-betting operators.A parent or guardian may review, correct, delete or withdraw consent for their child's data at any time by contacting privacy@draffte.com.
12. Automated decision-making
The Draffte Ranking is generated in part by automated processing and can affect eligibility for the Draffte trials programme. We publish the general weighting criteria, and you have the right to obtain human review of, express your point of view on, and contest a Ranking decision that significantly affects you.
13. Security
We protect data with TLS encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, continuous monitoring and periodic audits. If a data breach occurs, we notify the competent authorities and affected individuals within the legally-required time limits. Clubs that administer accounts must notify Draffte within 72 hours of becoming aware of any breach affecting player data.
14. Changes to this Policy
For non-material changes we give 30 days' notice, and continued use means acceptance. For changes affecting sensitive data, biometric data or minors' data, we obtain fresh express consent before the change takes effect — continued use is not sufficient for these changes. Previous versions are archived and available on request.
15. Contact and complaints
For any privacy question or to exercise your rights, contact our privacy team at privacy@draffte.com. You also have the right to complain to your local data-protection authority — for example, the SIC in Colombia (www.sic.gov.co), the ICO in the UK, your national authority in the EEA, or your state Attorney General in the United States.