Privacy notice

1. Who is responsible for your data

1.1 General Website controller

For the general Website, editorial content, security, contact requests, press and partnership enquiries, newsletter activity when activated, and the Website's general operation, the controller is:

Nexar Group AB (publ.)
Swedish company registration number: 556899-2589
Engelbrektsgatan 9-11
114 32 Stockholm
Sweden
Email: info@nexarfootball.com

Nexar Group AB (publ.) is referred to as "Nexar", "we", "us" or "our" in this Policy.

1.2 Kanu Challenge roles

The Kanu Challenge is a distinct campaign within the Football Dreamz ecosystem. For campaign operation, local campaign administration, contribution receipt and related payment activity, the relevant Nigerian operator is:

Nexar Football Development Ltd
Nigerian company registration number: RC8382579
No. 2, Garba Ndama Close, Apo Legislative Quarters, Zone E
Abuja, FCT, Nigeria

The dedicated Kanu Challenge Privacy Policy describes the campaign-specific purposes, data flows, payment provider and roles in more detail. If that policy conflicts with this general Policy about a Kanu contribution, supporter-recognition feature, campaign selection or campaign reporting, the Kanu policy controls for that processing.

1.3 Other Nexar entities and partners

Nexar Football AB, Swedish company registration number 559205-8019, may provide scouting, production, player-development or related services. Depending on the service and agreement, it may act as a processor for Nexar Group AB, a separate controller, or a contracting party with the player. The applicable player or service notice will explain the relationship where it differs from this general Website role.

Where Nexar entities jointly decide why and how a particular activity is carried out, they will allocate their responsibilities in an internal arrangement and provide the information required by applicable law. You may contact info@nexarfootball.com regarding the Website, and we will route the request to the responsible entity where necessary.

Payment providers, social-media platforms, video platforms and other independent services may be separate controllers for their own processing. Their own privacy notices apply to that processing.

2. Regulatory scope and the NDPC point

Nexar Group AB is a Swedish company and the general Website processing is designed to comply with the EU General Data Protection Regulation (GDPR) where the GDPR applies, together with applicable Swedish data-protection law.

The Nigerian Data Protection Act (NDPA) may also be relevant to processing involving people in Nigeria, Nigerian players, Nigerian contributors or activities targeted at Nigeria. The Nigerian campaign operator's status and obligations are assessed for the Kanu Challenge and other Nigerian operations based on the actual activity, sector, data subjects, volume and statutory criteria.

This general Website Policy does not make a blanket statement that NDPC registration is unnecessary for the whole Football Dreamz platform. Any limited pilot or threshold position described for the Kanu Challenge applies only to the facts and operator covered by the dedicated Kanu documents; it must not be used to characterise the root Website, player scouting, public player profiles or future campaign activity without a fresh assessment.

Where a formal data protection officer, representative, registration or other regulatory contact is required for a particular controller or processing activity, the responsible controller will provide the applicable details through the relevant notice or contact route.

3. Personal data we may collect

The categories depend on how you use the Website and what you choose to send us.

3.1 Contact, press and partnership enquiries

The Website contact form may collect:

• name;
• email address;
• subject and message;
• selected topic;
• for a player enquiry: country, playing position and current club or academy;
• for a press enquiry: media outlet and optional deadline; and
• for a partnership enquiry: organisation and optional website.

The message itself may contain additional information that you choose to provide. Please do not include unnecessary identity documents, payment details, passwords, precise home addresses, detailed medical information or other sensitive information in the general form.

3.2 Player and talent information

If you or an authorised representative contacts us about scouting, a trial, a player profile or player development, we may later process information such as age or date of birth, nationality, country or state, position, club or academy, football history, match or training footage, photographs, public profile information, contact details, guardian details, eligibility information, travel or safeguarding information, and information needed for a separate player or representation arrangement.

The general contact form is not intended to collect a full scouting dossier, health record or government identification document. If those data are needed, we will use a separate process and provide any additional notice and consent or authority requirements that apply.

3.3 Newsletter

The optional footer sign-up may collect your email address and records associated with the subscription, such as the time, source, consent status, unsubscribe status and basic delivery events. The newsletter is activated only when Nexar has connected a sending service. If the visible form has not been connected to a receiving system, a front-end validation message does not transmit or store the address.

3.4 Technical and security data

When you visit the Website, we and our service providers may process:

• IP address and approximate location inferred from it;
• browser, device, operating-system and language information;
• pages, links, referring pages, timestamps and interaction events;
• error, performance and availability information;
• consent records and consent-preference identifiers; and
• information needed to detect abuse, malicious traffic, fraud or security incidents.

The Website also uses limited first-party Web Storage for interface behaviour; the campaign-promotion prompt keeps its state in memory only. The exact current keys are described in the Cookie Policy.

3.5 Kanu Challenge data

If you use the Kanu Challenge, we may process contribution, payment-status, supporter-recognition, campaign-communication and related verification information described in the Kanu Challenge Privacy Policy. We do not ordinarily receive your full payment-card number or CVV from the payment provider.

4. Where data comes from

We may obtain personal data:

• directly from you through the Website, email, social-media contact or another communication;
• from a parent, guardian, agent, club, academy, scout, partner, media organisation or authorised representative;
• from public football, media or social-media sources where permitted and relevant to a legitimate scouting, editorial or verification purpose;
• from payment, hosting, security, email, form or communications providers; or
• automatically from the browser or device when the Website is used, subject to the consent rules in the Cookie Policy.

If you provide another person's data, you must have the required authority and should direct them to this Policy where appropriate.

5. Why we process data and our legal bases

We process data only for relevant, proportionate purposes. The legal basis depends on the circumstances and may include:

Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may ask us for information about that balancing where the law provides a right to do so.

6. Contact form and player registration

The contact form is intended for an initial enquiry. We use the information to understand the request, route it to the appropriate team, communicate with the sender, assess whether a legitimate follow-up is possible, and maintain a record of the relationship where reasonably necessary.

A player enquiry is not a selection, contract or guarantee. If a player is under 18, we expect a parent or legal guardian to submit or authorise the enquiry and any later consent. We may request age and authority information before a minor's data, image, footage or story is used for scouting, production or publication.

If a player is not selected or a relationship ends, we will not keep a detailed talent file indefinitely. Retention periods are described in Section 12, subject to consent, an active agreement, safeguarding needs, legal obligations and claims.

7. Newsletter

The footer newsletter is optional. When active, we use the email address to send the categories of information described at sign-up. We may use a delivery provider to send messages and record basic delivery or unsubscribe events.

You can withdraw consent at any time using the unsubscribe link or by contacting info@nexarfootball.com. Withdrawal does not affect processing already carried out lawfully before withdrawal. We may retain a minimal suppression record so that we do not send further marketing to an address that opted out.

We do not sell newsletter subscriber lists. We do not require a newsletter subscription to contact Football Dreamz or enquire about a player.

8. Public profiles, stories and media

Football Dreamz may publish player names, positions, countries or states, club or academy information, photographs, video, match information, interviews, programme appearances and related stories. We publish only information we consider relevant to the format and the permission, licence, contract, public-source basis or other lawful ground available for the publication.

A public player page is not a guarantee of current representation, club status, availability, selection or future opportunity. Public pages may be corrected, archived or removed when the relationship, permissions or editorial need changes.

For a minor, we use parent or legal-guardian authority and apply additional safeguarding care. A general contact-form submission is not unlimited permission to publish a child's information.

9. Cookies and Web Storage

The Website uses Cookiebot to present and record cookie choices. Strictly necessary consent functionality may operate before a choice. Non-essential analytics, marketing cookies and embedded YouTube content should load only after the consent required by applicable law.

The current cookie inventory, Cookiebot identifier, YouTube cookies and first-party sessionStorage/localStorage keys are set out in the separate Cookie Policy. You can change or withdraw non-essential consent through the Cookiebot settings link on that page.

10. Who may receive data

We may disclose relevant data, limited to what is needed, to:

• Nexar group companies and personnel involved in Website operation, scouting, production, safeguarding, communications or administration;
• hosting, infrastructure, security, form, email, newsletter, customer-support and IT providers acting on our instructions;
• scouts, clubs, academies, production partners, broadcasters, sponsors and other Football Dreamz partners where relevant to a requested or authorised activity;
• payment providers and fraud-prevention providers for Kanu Challenge transactions;
• professional advisers, insurers, auditors, banks and financing or corporate-transaction advisers under confidentiality obligations;
• courts, regulators, law-enforcement bodies, safeguarding services or other authorities where required or reasonably necessary; and
• a buyer, successor or reorganised entity if the Website or relevant business is transferred, with appropriate safeguards.

We do not sell personal data or share it for another company's independent direct marketing without the required permission. An independent provider, such as YouTube, Cookiebot/Usercentrics or a payment platform, may process data under its own role and notice.

11. International transfers

Nexar is based in Sweden, and Website operations or suppliers may involve Sweden, the European Economic Area, Nigeria, the United Kingdom, the United States or other countries where our group or service providers operate.

Where GDPR-restricted data is transferred outside the EEA, we use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission's Standard Contractual Clauses, supplementary measures or another permitted safeguard. Where Nigerian law applies, the responsible controller will apply the transfer safeguards required by the NDPA and applicable guidance.

You may contact us for information about the relevant safeguard for a specific transfer, subject to confidentiality and security limitations.

12. Retention

We retain personal data only for as long as reasonably needed for the purpose collected, legal duties, safeguarding, dispute resolution, fraud prevention or evidence of consent.

Typical periods are:

We may keep data longer where necessary to establish, exercise or defend a legal claim, comply with accounting or other legal duties, protect a child or vulnerable person, investigate fraud or honour a valid suppression request. We securely delete, anonymise or restrict data when the retention reason ends.

13. Your rights

Depending on the applicable law and the controller involved, you may have the right to:

• obtain confirmation and access to your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• request restriction of processing;
• receive portable data where the right applies;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• withdraw consent at any time where processing is based on consent; and
• receive information about significant automated decision-making where applicable.

To exercise a right, contact info@nexarfootball.com. We may need to verify your identity and may ask for clarification so that a request does not expose another person's data. We will respond within the period required by applicable law.

If you are unhappy with our response, you may complain to the competent supervisory authority. For Nexar Group AB's Swedish GDPR processing, the relevant authority is generally the Swedish Authority for Privacy Protection (IMY). For processing within the scope of Nigerian data-protection law, you may also have a right to contact the Nigeria Data Protection Commission (NDPC).

14. Automated decisions

We do not make a decision producing legal or similarly significant effects about a player, contributor or contact solely by automated means. Scouting, editorial, campaign and player-development decisions involve human review and may also involve eligibility, safeguarding, availability and professional assessment.

Payment or security providers may use automated fraud or risk checks. Those checks can delay, decline or reverse a transaction under their rules. Contact us or the relevant provider if you need information about a specific decision.

15. Security and incidents

We use reasonable technical and organisational safeguards appropriate to the data and risk, including access controls, service-provider controls, HTTPS where available, separation of operational roles, minimisation, retention limits and procedures for security or safeguarding incidents.

No internet transmission or storage system is completely secure. Do not send credentials, card data or unnecessary sensitive information through a general form.

If we become aware of a personal-data incident, we will assess it and notify regulators or affected people where required by applicable law. High-risk player, minor, safeguarding or health-data processing may require additional risk assessment, contractual controls and a separate notice before it is activated.

16. External websites and social platforms

The Website links to clubs, academies, broadcasters, partners, YouTube, Instagram, Facebook, LinkedIn, X and other external services. We are not responsible for their privacy practices. Review the applicable third-party notice before submitting data or interacting with an embedded or linked service.

Where an embedded service is optional, the Website waits for the relevant Cookiebot consent before loading it. Following a link to a social platform may allow that platform to process data independently.

17. Changes to this Policy

We may update this Policy when the Website, forms, newsletter, campaign, group structure, service providers or law changes. We will publish the new version with a new "Last updated" date. If a change materially affects an active relationship or consent, we will use reasonable means to communicate it and will not apply the change retroactively where prohibited by law.

18. Contact

For privacy questions or rights requests concerning the general Football Dreamz Website:

Nexar Group AB (publ.)
Engelbrektsgatan 9-11
114 32 Stockholm, Sweden
Email: info@nexarfootball.com

For Kanu Challenge-specific questions, the same email may be used and the request will be routed to the Campaign Operator where required. The campaign-specific notice is available at football-dreamz.com/kanu-challenge/privacy.