Privacy policy

[LEGAL REVIEW REQUIRED] This privacy policy is a structured template. It describes what the website actually processes – legal bases, retention periods and the overall assessment must be reviewed by a lawyer before launch.

1. Controller

Domenik Schelawski, trading as "Mountain Fight League", Widukindplatz 5, 49086 Osnabrück, Germany, email: info@mfl-fight.de

Data protection officer: No data protection officer has been appointed. [LEGAL REVIEW REQUIRED]

2. Hosting and server logs

This website is hosted by [HOSTING PROVIDER, e.g. Netlify Inc. / Vercel Inc.]. When you visit, technically necessary data (IP address, date and time, page requested, browser type) is processed in server log files to provide the website securely and reliably. Legal basis: Art. 6 (1) (f) GDPR. Log files are deleted after 30 days at the latest. [LEGAL REVIEW REQUIRED]

The database and file storage are operated by [DATABASE / STORAGE PROVIDER, e.g. Supabase]. [LEGAL REVIEW REQUIRED]

3. Contact form and email

When you write to us via the contact form we store your name, email address, optional company, topic, subject and message to handle your request. You receive an automatic confirmation. Legal basis: Art. 6 (1) (b) GDPR or (f) GDPR. Retention: 12 months after the request has been closed. [LEGAL REVIEW REQUIRED]

4. Fighter applications ("Fight for MFL")

With an application you submit name, date of birth, gender, height, weight, requested weight class, nationality, gym, discipline, level, fight record, Instagram, optional Tapology link, email, phone, a profile photo and, if requested, your coach's contact details. We use this data solely for matchmaking and to contact you. The photo is never shown publicly. Legal basis: Art. 6 (1) (b) GDPR and your consent (Art. 6 (1) (a) GDPR). Applications by minors require the consent of a parent or legal guardian. Retention: up to 12 months after the event you applied for; we delete earlier on request. [LEGAL REVIEW REQUIRED]

5. Sponsorship inquiries

For a sponsorship inquiry we store company, contact person, email, phone, optional website and Instagram, requested event, interests, budget indication and message to prepare an offer. Legal basis: Art. 6 (1) (b) GDPR. Retention: 24 months after the last contact; if a contract is concluded, statutory retention periods apply. [LEGAL REVIEW REQUIRED]

6. Media accreditation

For an accreditation request we store the type of activity, name, email, phone, outlet/channel, Instagram or website and the planned coverage. Legal basis: Art. 6 (1) (b) GDPR. Retention: up to 6 months after the event. [LEGAL REVIEW REQUIRED]

7. Newsletter (double opt-in)

For the newsletter we store your email address, optional name, time of sign-up and confirmation and a shortened, pseudonymised form of your IP address as proof of consent. The subscription becomes active only after you click the confirmation link. You can unsubscribe at any time via the link in every email. Legal basis: Art. 6 (1) (a) GDPR. Sent via [EMAIL SERVICE PROVIDER]. [LEGAL REVIEW REQUIRED]

8. Ticket purchase

When you buy tickets we process first name, last name, email address, the tickets ordered, price, payment status, order number and the ticket codes (QR). This data is required to fulfil the contract and for accounting. Legal basis: Art. 6 (1) (b) and (c) GDPR. Retention according to commercial and tax law: [10 years]. [LEGAL REVIEW REQUIRED]

At the entrance tickets are scanned; the time and result of each scan are stored to prevent double use.

8a. Payment via Stripe

For card, Apple Pay or Google Pay payments your payment data is transmitted directly to Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We never receive full card data. Stripe processes some data under its own responsibility (e.g. fraud prevention). Stripe privacy policy: https://stripe.com/privacy [LEGAL REVIEW REQUIRED]

8b. Payment via PayPal

For PayPal payments your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal is independently responsible for payment processing. PayPal privacy policy: https://www.paypal.com/webapps/mpp/ua/privacy-full [LEGAL REVIEW REQUIRED]

9. Customer account and MFL LIVE (pay-per-view)

Stream access requires a customer account (email address, hashed password, time of verification). When you purchase we store the order, payment status, your confirmation of early performance and the age confirmation. To limit playback to one device at a time we store playback sessions (time, shortened IP address, device type). Legal basis: Art. 6 (1) (b) GDPR. [LEGAL REVIEW REQUIRED]

10. Live stream delivery

The stream is delivered via [STREAMING PROVIDER, e.g. Mux, Inc. / Cloudflare, Inc.]. Technical data (IP address, device, time of access) is processed by the provider. A data processing agreement is in place; transfers to the USA are based on the EU-US Data Privacy Framework or the EU Commission's standard contractual clauses. [LEGAL REVIEW REQUIRED]

11. Cookies and consent management

We use strictly necessary cookies (session, cart, security, storage of your cookie choice). Beyond that, cookies and services in the categories Analytics, Marketing and External media are only used with your consent. You can change your choice at any time via "Cookie settings" in the footer. Legal basis: Section 25 (1) and (2) TDDDG, Art. 6 (1) (a) and (f) GDPR. [LEGAL REVIEW REQUIRED]

12. Google Analytics, Google Tag Manager, Google Ads

Only with your consent do we load Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Usage data (e.g. pages visited, ticket purchases as conversions, shortened IP address) is processed; Google may transfer data to the USA. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw consent at any time in the cookie settings. [LEGAL REVIEW REQUIRED]

13. Email delivery

Transactional emails (tickets, confirmations, newsletter) are sent via [EMAIL SERVICE PROVIDER]. Email address, content and delivery status are processed. Legal basis: Art. 6 (1) (b) or (f) GDPR. [LEGAL REVIEW REQUIRED]

14. Retention

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations. Specific periods are listed with each processing activity. [LEGAL REVIEW REQUIRED]

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future. Contact: info@mfl-fight.de.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, Germany. [LEGAL REVIEW REQUIRED]

17. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.