This notice applies to the MySportCal website, account, calendar and football-personalisation features. If you want a product overview rather than the data detail, see About MySportCal.
Who we are
MySportCal is a football calendar and match-intelligence service. This policy explains how personal data is handled when you browse the public site, create an account, choose football preferences, connect a calendar, use fantasy features, follow players or contact support.
For privacy questions, rights requests or data-protection complaints, email [email protected].
Personal data we use
The data involved depends on which parts of MySportCal you use.
Name, email address, password hash, email-verification state, timezone and account metadata needed to operate and secure your account.
Teams, competitions, home club, rivals, follow mode, reminders, calendar filters, odds visibility, player watchlists and fantasy-profile or fantasy-selection data you choose to use.
Connected provider, provider identifier/profile data returned during authorisation, granted scopes, encrypted access and refresh tokens, token expiry, sync state, provider event identifiers, ICS feed tokens, filters and feed-access records.
Service events such as page paths, feature interactions, errors, request identifiers and calendar-sync activity. Server-side records can also include IP address and user-agent data where needed for security, feed access or outbound-link logging.
If you choose an outbound odds or betting link, MySportCal can record the fixture, market, selection, bookmaker, displayed price, signed-in user identifier, IP address and user agent for that click.
The content and contact details you provide when you ask for help, make a privacy request or choose to receive product updates and offers.
Public football pages such as fixtures, players, odds and fantasy football can still generate ordinary technical and service logs even when you are not signed in.
What happens when you connect a calendar
MySportCal currently supports direct Google and Microsoft calendar connections. When you choose one, you are sent to that provider to authorise the permissions configured for the connection. We receive the authorisation result, provider profile information needed to identify the connection, the granted scopes and access credentials.
Access and refresh tokens stored by MySportCal are encrypted. The calendar integration uses the permissions you grant to create, update or remove MySportCal fixture events and to locate MySportCal-managed events so that retries and fixture changes do not create unnecessary duplicates.
The integration is built around managing MySportCal fixture events and the identifiers and sync state needed to keep those events up to date. The permission shown by Google or Microsoft is the authoritative description of what access you grant at connection time.
If you use an ICS subscription feed instead, MySportCal stores the feed token and settings needed to serve it. Feed-access logs may include the request time, status, IP address and user agent. Treat a private ICS URL as a secret link; signed-in users can rotate or revoke feeds and manage direct calendar connections from calendar settings.
Why we use personal data
- Provide your account, football preferences, followed teams and competitions, rivals, watchlists and fantasy features.
- Build and maintain your football calendar, reminders, filters, direct calendar connections and subscription feeds.
- Keep fixture events in sync when relevant match details change.
- Operate, diagnose and protect the service, including preventing abuse, investigating failures and maintaining sync reliability.
- Understand product usage where the relevant analytics choice or other lawful condition permits it.
- Send product updates and offers when you have chosen to receive them, and send service or security communications when needed to operate your account.
- Record outbound partner-link activity for attribution, diagnostics and abuse prevention when you choose those links.
- Respond to support, rights requests, complaints and legal obligations.
Our lawful bases
Under UK data-protection law, the lawful basis depends on the purpose. The main bases we rely on are:
| Basis | Where it applies |
|---|---|
| Contract | To create and operate the account and provide features you ask us to use, including personalisation and calendar services. |
| Legitimate interests | To secure and operate the service, prevent abuse, diagnose faults, maintain reliability, understand service performance and keep appropriate operational records, where those interests are not overridden by your rights. |
| Consent | For optional processing where consent is the appropriate basis, including product-update or offer emails you opt into and optional analytics or marketing storage where consent is required. |
| Legal obligation | Where we must use or retain information to comply with applicable law, regulatory duties, valid legal requests or data-protection complaint obligations. |
Where we rely on legitimate interests, the interests are operating a useful and reliable football service, protecting users and systems, preventing misuse and understanding whether core features are working as intended.
Cookies, local storage & analytics
MySportCal uses storage that is necessary for functions such as sessions, authentication, security and remembering essential service state. The consent interface also stores your analytics and marketing choices in your browser so the site can remember them.
The current consent interface presents optional Analytics and Marketing categories separately. If you have not made a current-version choice, those optional categories start off. You can accept all, reject all or save a combination.
Analytics is used to measure how the service is used and where it needs improvement. Marketing storage or partner tracking is used only where the relevant choice and legal requirements allow it. Rejecting optional categories does not stop the core MySportCal service from working.
Use the control below. It clears the saved consent decision and reloads this page so the consent panel opens again.
Who we share data with
We do not sell your personal data. We share data only where it is needed for the service, a choice you make, or a legal requirement.
- Google or Microsoft: when you choose to connect that calendar provider. Their own privacy terms also apply to the provider account and API services.
- Infrastructure and communications providers: providers used to host, secure, operate or send service communications for MySportCal, limited to what is needed for that role.
- Analytics or marketing services: where such a service is configured and the relevant consent or other lawful condition applies.
- External odds or betting destinations: only when you choose to follow an outbound link. The destination then receives the normal web request and processes it under its own privacy policy; MySportCal also keeps the outbound-click record described above.
- Authorities or professional advisers: where disclosure is required by law or reasonably necessary to establish, exercise or defend legal rights.
International processing
Some providers may process personal data outside the UK. Where UK data-protection law restricts a transfer, we use an applicable lawful transfer mechanism and any additional safeguards required for that transfer. You can ask us for more information about a relevant transfer.
How long we keep data
We keep personal data only for as long as it is needed for the purpose described in this policy, taking account of whether your account or feature is active, security and diagnostic needs, legal obligations, disputes and the lifecycle of backups and logs. Different data therefore has different retention periods.
Disconnecting a Google or Microsoft calendar removes that connection record from MySportCal and stops future syncing through it. ICS feeds can be rotated or revoked. Other account data may need to be retained for a period after a request where a legal, security or dispute-related reason requires it.
If you want us to assess or erase personal data we hold about you, use the contact details in the rights section below.
Your data-protection rights
Depending on the processing and the circumstances, UK data-protection law can give you rights to:
- access personal data we hold about you;
- correct inaccurate or incomplete personal data;
- ask for erasure in circumstances where the right applies;
- ask us to restrict processing in circumstances where the right applies;
- receive or transfer certain data where the right to portability applies;
- object to certain processing, including processing based on legitimate interests; and
- withdraw consent at any time for processing that relies on your consent.
You can object to processing based on legitimate interests. You can also object to direct marketing at any time; if you do, we will stop using your personal data for that direct-marketing purpose.
Email [email protected] to exercise a right. We may need enough information to verify your identity and understand the request. Rights are not absolute in every circumstance, and if an exemption applies we will explain the position.
Automated processing
Football predictions, rankings and recommendations on MySportCal concern matches, teams, players or football choices. They are not decisions about you that produce legal or similarly significant effects.
How we protect account and connection data
MySportCal hashes account passwords. Calendar OAuth access and refresh tokens are stored using encrypted application casts, and calendar authorisation uses a state value to verify the return from the provider. Access is scoped through authenticated application routes and connection ownership checks.
No online service can promise absolute security. If you think your account, private ICS link or calendar connection has been exposed, contact support and rotate or disconnect the affected access where that control is available.
Children
The MySportCal account service is not intended for children under 16, and the Terms of Service require users to be at least 16. If you believe an under-16 user has provided personal data through an account, contact us so we can review the situation and take appropriate action.
Contact, complaints & policy changes
For a privacy question, rights request or data-protection complaint, email [email protected]. If you are making a complaint, putting “Data protection complaint” in the subject line will help us route it correctly.
We will acknowledge a data-protection complaint within 30 days and investigate and respond without undue delay. If you remain unhappy, you can also complain to the UK Information Commissioner’s Office (ICO).
How to make a data-protection complaint to the ICO →
We may update this policy when the service, providers or legal requirements change. The date at the top records the last substantive update; we do not change it merely because you revisit the page.