Privacy Policy

1. Controller and contact

The controller of personal data is the association “Latvian Professional Footballers Association” (“LPFA”):

• registration No. 40008162090;
• registered in the Register of Associations and Foundations on 30.06.2010;
• registered address: Krišjāņa Valdemāra iela 33A - 4A, Rīga, LV-1010, Latvia;
• email: info@lpfa.lv;
• phone: +371 28337337.

Send questions about personal data and requests to exercise your rights to info@lpfa.lv (preferably with the subject “Personal data”) or by post to the registered address. LPFA has not appointed a data protection officer, as Article 37 GDPR does not require one for an association of this kind; the LPFA board is responsible for data protection matters.

2. Summary

• The website uses no cookies, analytics, advertising or third-party trackers.
• The only online form that collects personal data is the application for membership. The online confidential assistance form is currently not in operation.
• Applications are sent by email to LPFA's mailbox info@lpfa.lv; they are not stored on the website (except in a temporary encrypted queue if immediate delivery fails).
• Data is processed only by LPFA and its processors (Netlify, Resend, Google). We do not sell data or use it for marketing.

3. Visiting the website

To deliver and protect the website, the hosting provider Netlify processes the technical data of each request – IP address, requested address, time, browser and device information – and keeps it briefly in server logs.

• Purpose: operating and securing the website, detecting errors and attacks.
• Legal basis: LPFA's legitimate interest in a secure and available website (Article 6(1)(f) GDPR).
• Retention: according to Netlify's log retention (depending on the service plan, from one day to 30 days). LPFA does not use these logs to identify visitors.

4. Application for membership

What we collect. First name and surname; personal identity code (for persons without a Latvian personal code – date of birth); declared residential address; phone number; email address; optionally – club and additional information; your declarations on the application form; submission time and reference number.

Purposes and legal bases.

Purpose	Legal basis
Receiving and considering the application and contacting you about signing it and the decision	Steps taken at your request before entering into membership (Article 6(1)(b) GDPR)
Keeping the register of members if you are admitted	LPFA's legal obligation to keep a register of members under the Associations and Foundations Law (Article 6(1)(c) GDPR)
Information about membership of an organisation defending footballers' interests (may be special-category data – see section 8)	Legitimate activities of a not-for-profit body relating to its members and persons in regular contact with it (Article 9(2)(d) GDPR)
Preventing abuse and duplicate submissions	LPFA's legitimate interests (Article 6(1)(f) GDPR)

Is the information mandatory. Name, surname, personal identity code or date of birth and residence are required because they must be entered in the register of members; phone and email are needed to contact you. Without them the application cannot be considered. Club and additional information are optional.

About the box “I consent to the processing of my personal data…”. This text reproduces the declaration on LPFA's official application form. Processing of application and member data is not based on consent – it is based on the grounds listed in the table above. “Withdrawing” this box therefore does not prevent LPFA from processing data needed for the register of members or to meet legal obligations; you can exercise the other rights listed in section 12.

How it works technically.

• Your details are sent over an encrypted connection (HTTPS) to a server function (Netlify) that checks them and fills in LPFA's official application form (PDF and DOCX).
• The application with the filled form is sent by email to info@lpfa.lv using the email delivery service Resend. The info@lpfa.lv mailbox is hosted on Google Workspace.
• You can download the filled form right after submitting; it is handed to your browser and not stored on the website.
• If the application cannot be delivered immediately, it is stored in encrypted form (AES-256-GCM) in Netlify's data storage and the system retries delivery every 10 minutes. After successful delivery the encrypted record is deleted. Only the reference number and the submission and delivery times remain on the website.
• To prevent abuse, a keyed hash of your IP address (pseudonymised, without the IP address itself) is used and deleted within 24 hours. To prevent accidental duplicate submissions, a keyed hash of the personal code (or date of birth), name and email is kept for 24 hours.
• LPFA decides on admission in accordance with its statutes; no automated decision-making or profiling takes place.

5. Confirmation email to the applicant

After you submit, a confirmation is sent to your email address containing only the reference number and LPFA's contact details – no application data. It is sent through Resend. Legal basis: Article 6(1)(b) GDPR. No open or click tracking is used in emails.

6. Membership administration

If you are admitted, LPFA processes the register-of-members data, information on the start and end of membership, membership fee payments, attendance at members' meetings and communication with you.

• Register of members: Article 6(1)(c) and Article 9(2)(d) GDPR. Under the Associations and Foundations Law, information about members is available only to the association's members and to supervisory and law-enforcement authorities.
• Membership fees and accounting: Article 6(1)(b) GDPR (obligation under the statutes) and Article 6(1)(c) GDPR (Accounting Law).
• Communication with members about the association's activities, meetings and members' rights: Article 6(1)(b) and (f) GDPR. If LPFA sends newsletters unrelated to membership, it will do so only in accordance with the Information Society Services Law, and you will be able to unsubscribe at any time.

7. Legal assistance and confidential player inquiries

The online confidential assistance form is currently not in operation. If you contact LPFA by email or phone for assistance (for example about a contract, unpaid salary or a dispute with a club), LPFA processes your contact details, the description of your situation and the documents you provide.

• Purpose: to assess the situation, provide information or assistance and, if agreed, represent your interests.
• Legal basis: for members – a service under the statutes (Article 6(1)(b) GDPR); otherwise – your request and LPFA's legitimate interest in defending footballers' interests (Article 6(1)(f)); where needed to establish or defend LPFA's own legal claims – also Article 6(1)(f).
• Special-category data (for example about injuries or health) – see section 8.
• Confidentiality: access is limited to persons authorised by LPFA. Without your consent LPFA does not disclose your inquiry to your club or anyone else, unless required by law. LPFA is not a law firm of sworn advocates; contacting LPFA does not in itself create a lawyer–client relationship.
• Please do not send medical records or other sensitive information by ordinary email until we have agreed a secure way to send them.

8. Special categories of data (Article 9 GDPR)

• Membership of LPFA. Because LPFA defends the employment and social interests of professional footballers, information about membership of LPFA may reveal membership of a trade-union-like organisation. LPFA processes this data under Article 9(2)(d) GDPR – only in relation to its members, former members and persons in regular contact with it, and does not disclose it outside LPFA without your consent.
• Health and other sensitive data in assistance matters. LPFA processes such data only if you provide it and it is necessary to deal with your matter: for members – under Article 9(2)(d); where necessary for the establishment, exercise or defence of legal claims – under Article 9(2)(f); otherwise – with your explicit consent (Article 9(2)(a)), which you can withdraw at any time.

9. Recipients, processors and transfers outside the EEA

We do not sell personal data or share it with third parties for marketing. Data may be received by public authorities where required by law (for example the State Revenue Service in accounting matters) and – only with your consent or on your instructions to defend your interests – by others, for example the Latvian Football Federation or FIFA for the handling of a case.

The following processors process data on LPFA's behalf under data processing agreements in accordance with Article 28 GDPR:

Processor	What it does	Where data is processed	Transfer safeguards
Netlify, Inc. (USA)	Website hosting, the server function, the temporary encrypted queue and server logs	Global content delivery network; server functions and data storage may be in the USA	EU–US Data Privacy Framework (where the company is certified) and the European Commission's Standard Contractual Clauses
Plus Five Five, Inc., trading as Resend (USA)	Sending emails: applications to info@lpfa.lv and confirmations to applicants	USA (account data, logs and email content); sending infrastructure may be in the EU or the USA	EU–US Data Privacy Framework and Standard Contractual Clauses
Google Cloud EMEA Limited (Ireland), Google Workspace	LPFA's mailbox info@lpfa.lv, where applications and correspondence are received	Google data centres, including outside the EEA	Google's data processing addendum; for onward transfers – the EU–US Data Privacy Framework and Standard Contractual Clauses

Resend keeps the content and metadata of sent emails (including the application with its attachments) for up to 30 days; they are then deleted under Resend's terms.

10. Security

LPFA uses an encrypted connection (HTTPS), a strict Content Security Policy without third-party scripts, server-side validation, spam protection and rate limiting, encryption of temporarily stored applications (AES-256-GCM) with a key held only in the server environment, and restricts access to LPFA's mailbox to authorised persons. No measure can guarantee complete security, so we review our measures regularly. LPFA notifies personal data breaches to the Data State Inspectorate and, where required, to the persons concerned, as provided in Articles 33 and 34 GDPR.

11. Retention periods

Data is kept only as long as needed for the purpose for which it was collected or as required by law. Periods marked with an asterisk (*) are not set by law – they are LPFA's internal periods, set with regard to the purpose of processing.

Data	Retention period	Period starts
Application, if you are admitted	Throughout membership, then as former-member data	Decision on admission
Rejected application	12 months* (if disputed – until the dispute ends)	Notification of the decision
Withdrawn or unsigned application	6 months*	Withdrawal or submission
Register of members entry	Throughout membership (Associations and Foundations Law)	Admission
Former member's core data (name, surname, personal code, membership period, decisions on admission and exclusion)	10 years* – the limitation period for possible legal claims (Civil Law)	End of membership
Other former-member data	12 months*	End of membership
Accounting source documents for membership fees	At least 5 years; accounting registers – 10 years (Accounting Law)	As provided by the Accounting Law
Confidential inquiries that do not become a case	12 months*	Last contact
Legal assistance case files	10 years* (review after 5 years*)	Closure of the case
General email correspondence with LPFA	12 months*, unless it becomes part of a member or case file	Last message
Confirmation and application emails in Resend	Up to 30 days (set by Resend)	Sending
Encrypted delivery retry queue	Until successful delivery; if delivery keeps failing, LPFA reviews and deletes the record	Submission
Hashes of IP addresses and application data	24 hours	Submission
Reference number with submission and delivery times (no other data)	As long as needed to keep numbers unique; reviewed annually*	Submission
Netlify server logs	As set by Netlify (1 to 30 days)	Request

When the period ends, data is deleted or anonymised. A period may be extended only where the data is needed to establish or defend a specific legal claim or where the law requires it.

12. Your rights

Under Articles 15–22 GDPR you have the right to:

• access your data and receive a copy;
• have inaccurate data corrected;
• have your data erased where it is no longer needed or there is no other legal ground for keeping it;
• restrict processing;
• object to processing based on legitimate interests;
• data portability for data you provided, where processing is based on a contract or consent;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

How to exercise your rights. Write to info@lpfa.lv or by post to LPFA's registered address. To avoid disclosing data to the wrong person, we may ask you to confirm your identity. We will reply without undue delay and within one month at the latest; in complex cases this may be extended by two further months, in which case we will tell you. Exercising your rights is free of charge.

13. Complaints

If you believe your data is being processed unlawfully, please contact us first. In any case you have the right to lodge a complaint with the supervisory authority – the Data State Inspectorate of Latvia (Datu valsts inspekcija): Elijas iela 17, Rīga, LV-1050; email pasts@dvi.gov.lv; www.dvi.gov.lv – or with the supervisory authority of the EU Member State where you live or work.

14. Cookies

The website does not use cookies and does not store data on your device. See the Cookie Policy for details.

15. Changes

We will update this policy when the processing changes, for example when the confidential assistance form opens. We will announce material changes on the website and, for members, also by email. The current version is always available on this page; the date of the last update is shown at the top.