Privacy Policy

1. Scope

This Privacy Policy explains how personal data is processed when you visit the canonical Campaign website identified in the Campaign Notice, football-dreamz.com/kanu-challenge, nexargroup.se or a related Campaign page; make a Kanu Challenge Contribution; subscribe to updates; contact us; interact with Campaign content; or use a talent, nomination or scouting process that links to this Policy (together, the Services).

During the initial Kanu Challenge pilot (the Pilot), the Contribution flow does not provide a Participant application or nomination route. Any future nomination, scouting or Participant process will be operated separately and will be subject to the additional notices, agreements and safeguards applicable to that process.

This Policy is intended to provide transparency under the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act, the Nigeria Data Protection Act 2023 (NDPA) and other applicable privacy laws. A payment process, participant application, safeguarding activity, production or regional service may provide a more specific notice. That notice controls only for the processing it specifically describes.

2. Controllers, Responsibilities and Pilot Registration Status

Nexar Group AB (publ.). Nexar Group AB (publ.), Swedish company registration number 556899-2589, at Engelbrektsgatan 9-11, 114 32 Stockholm, Sweden, is controller for the Website, central Website security, central Campaign administration, aggregate reporting, central support and Nexar marketing.

Nigerian Campaign Operator. Nexar Football Development Ltd, CAC registration no. RC8382579, of No. 2, Garba Ndama Close, Apo Legislative Quarters, Zone E, Abuja, FCT, Nigeria, is controller for local Campaign operation, Contribution receipt, refunds, Nigerian accounting and compliance, local fund administration and local Campaign delivery. It is the same entity identified in the Terms and at checkout. Its public contact route is info@nexargroup.se.

Jointly determined processing. Nexar Group AB and the Nigerian Campaign Operator are joint controllers where they jointly determine the purposes and essential means of Campaign design, Contributor support, Campaign-wide communications, aggregate reporting and Biggest Supporters recognition. They allocate notice, security, rights-request, incident, retention and regulator responsibilities in a written joint-controller arrangement. Nexar Group AB acts as the central contact point, without limiting your right to contact either controller. The essence of the arrangement is available on request at info@nexargroup.se, which is also the contact for rights requests.

Football and participant processing. Nexar Football AB, company registration number 559205-8019, acts under documented instructions when it provides scouting or production administration for these controllers. If it later enters a direct player-management, representation or other Participant relationship and independently determines the processing, it becomes a separate controller for that defined relationship and provides a Participant-specific notice before collecting detailed player, guardian, medical, travel, image or production data.

Payment provider. The authorised fiat payment provider is Paystack. It normally acts as an independent controller for payment credentials, identity checks, fraud prevention and its regulatory obligations, and as a processor or service provider only for functions performed strictly on the Campaign Operator's instructions.

Pilot registration status. During the limited Pilot, the Nigerian Campaign Operator's donor-facing processing is limited to the personal data reasonably necessary for adult Contributions, payment confirmation, receipts and refunds, fraud prevention, state or FCT selection, supporter communications and optional Biggest Supporters recognition. The Campaign Operator currently processes no more than 200 unique data subjects within the applicable six-month period. On the basis of the Pilot's current scope and volume, and provided that no separate statutory or regulatory designation applies, the Campaign Operator is not currently required to register with the Nigeria Data Protection Commission (NDPC) as a Data Controller or Data Processor of Major Importance.

This is a current-status statement and does not exempt the Campaign Operator, Nexar Group AB or any other party from compliance with the NDPA, GDPR, Swedish law or other applicable requirements. The Campaign Operator will monitor the volume and scope of processing and will reassess its registration, data protection officer and related obligations before or when the Pilot is materially expanded, the applicable threshold is exceeded or another designation trigger applies. Nexar Group AB separately assesses and complies with the obligations arising from its own role under the GDPR and applicable Swedish law.

Primary privacy contact: info@nexargroup.se

3. Personal Data We Collect

We may collect:

• Identity and contact data: name, email address, telephone number, confirmation that you are 18 or over, state or FCT, country and organisation or authority where relevant.
• Contribution and fiat transaction data: amount, currency, selected state or FCT, payment-method category, provider, transaction reference, status, date, receipt, refund or chargeback information and limited fraud or compliance indicators. We do not ordinarily receive complete card numbers, CVV codes, bank passwords or payment-account credentials.
• Technical and usage data: IP address, device and browser type, operating system, language, approximate location derived from IP, pages visited, referral URL, timestamps, error logs, security events, cookie identifiers and consent choices.
• Communication data: support messages, enquiries, survey answers, call or meeting notes, newsletter choices and email delivery or engagement information.
• Campaign and public-interaction data: state or FCT support choice, consent to display your name publicly, any optional short message attached to a Contribution of NGN 1,000,000 or more, public social-media interaction and publication permissions.
• Future nomination data: only if a separate nomination route is introduced after or outside the Pilot, the minimum referral information described in Section 9, such as the player's name, age band, state, club or academy, nominator identity and relationship, and guardian contact details where appropriate.
• Future Participant data: through a separate process, name, date of birth, nationality, guardian and emergency contact, football history, club or academy, images or video, assessment notes, eligibility documents, travel information and other data needed for scouting, safeguarding, production or placement.
• Sensitive data: only when necessary and lawfully collected through a separate Participant process, such as health, injury, disability, medical-fitness, biometric-identification or safeguarding information.

4. Where We Obtain Data

We obtain personal data:

• directly from you when you complete a form, contribute, subscribe, contact us or use a separate application process where one is offered;
• from a parent, guardian, authorised representative or nominator who confirms their authority, only where a separate Participant process is operating;
• from the authorised fiat payment provider or financial institution when it confirms a payment, refund, fraud alert or compliance result;
• automatically from your device and cookies or similar technologies;
• from disclosed Football Dreamz project partners, scouts, academies, clubs, production partners or public authorities where lawful and relevant; and
• from public sources or social-media interactions where you made the information public and our use is necessary, proportionate and within reasonable expectations.

5. Purposes, Legal Bases and Retention Map

The table maps each principal purpose to its usual legal basis and retention period. The exact basis may vary where a mandatory local law applies, but we do not rely on a basis unrelated to the stated purpose. "Legitimate interests" means a documented, proportionate interest balanced against your rights. Consent can be withdrawn at any time, and direct marketing consent is never a condition of contributing.

Where we rely on consent, withdrawal does not affect processing already carried out. Where we rely on legitimate interests, you may object as explained in Section 15.

6. Required and Optional Information

Fields marked as required are needed to process a Contribution, issue a receipt, prevent fraud, comply with law or respond to you. If required information is not provided, we may be unable to complete the requested process.

During the Pilot, the Contribution flow does not ask for player nominations or detailed Participant data. If a separate nomination or Participant process is introduced, its required fields will be identified in the applicable notice and will not be a condition of contributing. Newsletters, non-essential cookies and publicity permissions are not a condition of contributing.

7. Fiat Payments

The Campaign accepts only the fiat payment methods displayed at checkout. The final authorised payment provider and the Campaign Operator as recipient will be identified before payment.

The payment provider receives payment credentials directly from you and applies its own privacy notice to identity checks, fraud prevention, payment processing and regulatory compliance. We normally receive only the information needed to confirm and reconcile a transaction: name, contact details, amount, currency, provider reference, status, date, selected state or FCT, receipt or refund information and limited risk indicators.

We do not intentionally obtain or store complete card numbers, CVV codes, bank passwords or payment-account credentials. Banks, card networks, mobile-money operators and fraud-prevention services may process additional information under their own notices.

8. Public Campaign Reporting and Biggest Supporters

The Campaign may display periodic aggregate amounts and Contributor counts by state/FCT and overall. Published figures update in step with Campaign activity, from immediately after confirmation to within twenty-four hours, and each relevant page labels its figures "Data as of" with a date and, where material, a time and time zone. We do not publish a Contributor's email address, telephone number or transaction reference.

One publication is not aggregate: a state's public "Biggest Supporters" list may show the name of a Contributor who gave NGN 1,000,000 or more and any optional short message they submitted, but only where that Contributor gave specific consent at checkout. The list does not show the Contribution amount. Its order may reflect Contribution size, but the order has no effect on support weight, judging, Participant selection or fund allocation. If consent is withdrawn, we remove the public entry without affecting the Contribution.

Small-number reports may be grouped, delayed or suppressed where disclosure could reasonably identify a person. Figures may change after reconciliation, refunds, chargebacks, payment fees or currency conversion. Aggregate statistics that no longer identify a person may be retained indefinitely.

9. Children, Young Players and Future Nominations

Contributions and newsletter sign-ups are intended for adults aged 18 or over. If we learn that a child submitted Contributor data without valid authorisation, we will investigate and delete or restrict it as appropriate.

During the Pilot, the Website does not provide a Participant application or nomination route through the Contribution flow, and no player or child data is collected through the Contribution form.

Football Dreamz talent activities may involve players aged 16 to 19. If a separate talent or scouting process is introduced, enhanced safeguards and parent or guardian involvement apply for a player under 18 wherever required. Before collecting detailed player, health, travel, image or production data, we provide a Participant-specific notice and obtain the necessary agreements, releases and consent. The player's best interests and safeguarding take priority over publicity or fundraising.

If a separate nomination form is introduced after or outside the Pilot, it will be limited to minimum referral data and must not accept a child's photograph, video, identity document, precise address, health information or other sensitive information at the initial referral stage. The nominator must identify themselves, state their relationship and confirm authority. We then contact the player or guardian directly with the appropriate notice. If authority or interest cannot be confirmed within 90 days, the referral is deleted or irreversibly anonymised.

No player or child's name, image, story or selection status is made public without an appropriate legal basis, notice and permission. Access to nomination and Participant data is limited to personnel with a documented role in selection, safeguarding or administration.

10. Cookies and Similar Technologies

The current Website uses only strictly necessary technologies needed for security, access and requested functionality. Non-essential analytics, advertising, marketing pixels and embedded-media technologies are not currently enabled. Before any such technology is introduced, a functioning consent-management platform will keep it disabled until you make a valid choice wherever consent is required. Rejecting non-essential technologies will not prevent basic Website access or a Contribution, although some optional convenience features may be limited.

The Campaign's own pages set no cookies and write no local-storage or session-storage items, in any category in the table below. One strictly necessary cookie can appear on this Website's domain: CookieConsent, set by the Cookiebot consent-management platform for football-dreamz.com when you make your consent choice, storing that choice for twelve months. Password-protected preview deployments authenticate with HTTP Basic Authentication and set no cookie.

If non-essential technologies are introduced, Cookie Settings will list each current cookie or technology, provider, purpose and duration and will permit accept, reject and later withdrawal choices. For users in the EEA, analytics, advertising, social-media pixels and third-party media are treated as non-essential and must not load until prior, freely given, specific and informed consent. We do not rely on legitimate interests to place or read those technologies. Only strictly necessary technologies and aggregate server-side metrics that do not store or access information on a user's device and do not track or single out a person may operate without cookie consent, where otherwise lawful. The live implementation, not only this Policy, must enforce these choices.

11. Marketing Communications

If you opt in, we may send Football Dreamz, Kanu Challenge or Nexar news and Campaign information through a disclosed delivery provider. You may withdraw consent at any time using the unsubscribe link or by contacting us. We may retain a minimal suppression record so we respect your choice. Unsubscribing does not stop receipts, security messages, replies or material service updates.

12. Who We Share Data With

We disclose personal data only as necessary to:

• Nexar entities: Nexar Group AB, the named Nigerian Campaign Operator, Nexar Football AB and other specifically disclosed entities with a documented role.
• Fiat payment and financial providers: the provider identified at checkout, banks, card networks, mobile-money operators and fraud-prevention services.
• Technology providers: hosting, database, content-delivery, security, monitoring, consent-management, analytics, customer-support and email-delivery services.
• Authorised football and Campaign partners: only named or clearly categorised scouts, academies, coaches, clubs, event, safeguarding and production partners that need data for the disclosed Nigerian Campaign purpose and are covered by an appropriate agreement.
• Professional advisers: lawyers, auditors, accountants, insurers, banks and advisers bound by confidentiality.
• Authorities: courts, regulators, tax, law-enforcement, data-protection, consumer-protection or sanctions authorities where disclosure is required or lawfully requested.
• Corporate transaction recipients: a genuine buyer, investor, lender or successor in a merger, financing, restructuring or sale, subject to confidentiality and legal safeguards.

An organisation mentioned in earlier planning material is not a data recipient merely because it appeared in that material. It receives data only if it has a current documented role, a lawful basis, an appropriate contract and is identified in the relevant notice.

We do not sell personal data for money. Where a law defines advertising disclosures as a "sale" or "sharing", the technology is used only after required consent and the relevant opt-out is provided.

13. International Data Transfers

Nexar Group AB is established in Sweden and the Campaign Operator and Campaign activities are in Nigeria. Service providers or authorised partners may operate in the EEA, Nigeria, the United Kingdom, the United States or other disclosed locations. Personal data may therefore be processed outside your country and outside the European Economic Area (EEA).

Where the GDPR applies and a destination is not recognised as adequate, we use an approved transfer mechanism such as the European Commission's Standard Contractual Clauses, supported by a transfer-risk assessment and supplementary measures where appropriate. Where the NDPA applies, we document the lawful transfer basis and required Nigerian safeguards. You may request information about the relevant safeguard, subject to protection of confidential and security information. Because Nexar Group AB is established in Sweden, routine Contribution, receipt and contact data are transferred from Nigeria to the EEA as a normal part of operating the Campaign and must be covered by the documented safeguards described above.

14. Detailed Retention Schedule

We keep identifiable data only for the period needed for the stated purpose, the period below or a longer mandatory legal period. The periods run from the end of the relevant Campaign, financial year, activity or matter as indicated.

When a record is no longer needed, we delete or irreversibly anonymise it. A documented legal hold may suspend deletion only for the affected records and only for as long as necessary.

15. Your Privacy Rights

Depending on applicable law, you may have the right to:

• receive information and obtain access to your personal data;
• correct inaccurate or incomplete data;
• request deletion where the legal conditions are met;
• restrict processing while an issue is considered;
• receive data you provided in a structured, commonly used and machine-readable format where portability applies;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time without affecting earlier lawful processing;
• not be subject to a solely automated decision producing legal or similarly significant effects, subject to legal exceptions; and
• complain to a competent data-protection authority.

Email info@nexargroup.se to exercise a right. We may request proportionate information to verify identity and authority. The central contact will coordinate with the Nigerian Campaign Operator or another controller where necessary. We respond within the period required by applicable law and explain any lawful limitation.

If the GDPR applies, you may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se or the authority where you live or work. If the NDPA applies, you may complain to the Nigeria Data Protection Commission at www.ndpc.gov.ng. You may contact a regulator without first contacting us.

16. Automated Decision-Making

Nexar does not use Contributor data for solely automated decisions that produce legal or similarly significant effects. Payment providers may use automated fraud, sanctions or identity screening under their own notices. Football talent selection involves qualified human judgement; Contribution amount and public totals do not automatically select a Participant.

17. Security and Personal-Data Breaches

We apply technical and organisational safeguards appropriate to the data and risk. Measures may include encryption in transit, role-based access, multi-factor authentication, environment separation, controlled backups, logging, vendor due diligence, confidentiality duties, incident procedures and data minimisation.

We maintain an incident-response procedure and will notify the competent supervisory authority and, where required, affected individuals of a personal-data breach within the timeframes required by the GDPR, the NDPA and other applicable law. Where a type of processing is likely to result in a high risk to individuals, including large-scale Campaign processing or processing involving children, we carry out a data protection impact assessment before that processing begins.

No online service is completely secure. Use trusted devices and networks, verify the Website address and never send us card PINs, passwords or banking credentials. Contact us promptly if you suspect fraud or a personal-data incident involving the Services.

18. External Websites and Social Media

The Services may link to clubs, broadcasters, sponsors, payment providers, social platforms or other websites. Their privacy practices are independent. Review their notices before providing data. Public comments or social posts may be visible to others and are controlled by the platform and the person who posted them.

19. Changes to This Policy

We may update this Policy for legal, operational, vendor or Campaign changes. The updated version will state its date and be published on the Website. We will provide prominent notice or direct communication where a change materially affects your rights or the use of existing data.

20. Contact Us

Nexar Group AB (publ.): Company registration no. 556899-2589, Engelbrektsgatan 9-11, 114 32 Stockholm, Sweden.

Nigerian Campaign Operator: Nexar Football Development Ltd, CAC registration no. RC8382579, registered office No. 2, Garba Ndama Close, Apo Legislative Quarters, Zone E, Abuja, FCT, Nigeria.

Privacy contact for both entities: info@nexargroup.se

Website: www.nexargroup.se

Telephone: +46 709 956 383