Privacy policy

Last updated: 3 October 2026

This policy explains how personal data is processed on xFive Club's public website (xfive.club) and its internal application, xFive Hub (hub.xfive.club), in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

Data controller

• Controller: José Manuel Fernández
• Tax ID (NIF): 53 ** 9 ** K
• Address: 29780 Nerja (Málaga), Spain
• Contact: [email protected]

The controller is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR, as none of the circumstances requiring one apply.

Data we process and why

On the public website

The public website has no forms, sign-up or newsletter, and uses no analytics tools. It processes personal data only in these cases:

• Email enquiries. If you write to [email protected], we process your email address, your name if you give it, and the content of your message, solely to reply to you.
• Player and creator profiles. We publish the nickname, photo, country, role and social media links of the people who represent the club, with their consent.
• Server logs. We log the IP address, date, requested page and browser to keep the service running and to detect abuse.
• Admin panel. Club staff with a panel account sign in with their name, email address and a password. The password is stored as a hash, never in readable form. The sign-in form uses Cloudflare Turnstile to tell people apart from bots.

On xFive Hub

xFive Hub has no public sign-up: the club creates accounts for its members. On the Hub we process:

• Account data: name, email address, hashed password, roster, role and permissions. We also process session data (IP address and browser) to keep you signed in and to protect your session.
• Roster activity: the calendar entries, VODs, tactics, scrim statistics and notes that members create, linked to their author.
• Match demos. Because of how the game works, uploaded CS2 demos contain the in-game name and Steam identifier of every participant in the match, opponents included. They are processed to replay and analyse rounds.
• Linked FACEIT accounts: the identifier, nickname, avatar, country, ELO, level and the statistics FACEIT publishes, used to track the roster players' performance.
• Scouting and opponent analysis: data about players and teams outside the club. The next section gives the full details.

Information for players included in Scouting or opponent analysis

This information is provided under Article 14 of the GDPR, because this data is not obtained directly from you.

• What data: nickname or display name, country, role, gaming platform accounts and public statistics. From FACEIT: ELO, level, matches, win rate, K/D and headshot percentage. From Steam, if your profile is public: profile name and real name if you show it, avatar, country, account creation date, last seen, hours played, bans (VAC and game bans) and CS2 statistics. On top of this come the coaching staff's internal notes.
• Where it comes from: public FACEIT and Steam profiles, queried through their official APIs; demos of matches you took part in; and whatever you share with the club yourself.
• Why: to assess potential roster signings and to prepare for matches against other teams.
• Legal basis: the club's legitimate interest in its competitive activity (Article 6.1.f of the GDPR). No automated decisions are made about you and no profiling with legal effects takes place.
• Who sees it: only the authorised coaching staff of the relevant roster. This data is neither published nor shared.
• Your right to object: you can object at any time by writing to [email protected]. We will delete your profile unless there are compelling legitimate grounds that override your objection, which we do not expect in this context.

Legal basis

• Email enquiries: your consent when you write to us (Article 6.1.a of the GDPR). If the enquiry leads to a relationship with the club, the performance of that relationship (Article 6.1.b).
• Public player and creator profiles: the consent of the person concerned (Article 6.1.a).
• Hub and panel accounts, and roster activity: the relationship between the member and the club (Article 6.1.b).
• Security, server logs and bot protection: the legitimate interest in protecting the systems (Article 6.1.f).
• Scouting, opponent analysis and demo processing: the club's legitimate interest in its competitive activity (Article 6.1.f).

Minors

If a club member is under 14, processing their data on the Hub and publishing their profile on the website require the consent of their parents or legal guardians (Article 7 of the LOPDGDD). The club obtains that consent before creating the account or publishing the profile.

Cookies

The public website sets no cookies of its own and uses no analytics or advertising cookies. The admin panel and the Hub use only technical cookies, to keep you signed in, and customisation cookies, for the side menu state. Full details are in the Cookies policy.

Recipients

Data is not disclosed to third parties unless the law requires it. It may be processed, as processors and under the agreements required by Article 28 of the GDPR, by the hosting and email providers and by Cloudflare (Turnstile).

To fetch public data, the Hub sends the identifier of the player being looked up to the FACEIT and Steam APIs. Those platforms receive no other data from the club.

Within the club, Hub data is visible only to members of the relevant roster who have permission for that module, and to the club's administrators.

International transfers

Cloudflare, Inc. is based in the United States. Where a provider processes data outside the European Economic Area, it does so with the safeguards the GDPR requires: the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

Retention periods

• Email: for as long as necessary to handle the enquiry and, where applicable, for as long as any resulting relationship lasts. After that, the data is kept blocked for the legally required periods and then deleted.
• Hub and panel accounts: for as long as the person is part of the club. The account is deleted when they leave. Content they created for the roster (tactics, notes, statistics) may be kept without being linked to them.
• Demos: the original file may be deleted after a period without use. Round data is kept for as long as it is useful to the roster.
• Scouting: for as long as the profile is relevant to the roster. It is deleted when it stops being relevant or when you exercise your right to object.
• Public profiles: for as long as the person represents the club, or until they ask for removal.
• Server logs: for a limited period, after which they are rotated out.

Your rights

You may exercise the following rights at any time:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure of your data when it is no longer necessary.
• Restriction of processing in certain circumstances.
• Objection to processing.
• Data portability.
• Withdrawal of consent, without affecting the lawfulness of earlier processing.

To exercise them, write to [email protected] stating which right you wish to exercise. We will respond within the time limits set by law (generally one month).

Complaint to the supervisory authority

If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es.

Security and accuracy of the data

The controller applies appropriate technical and organisational measures to protect personal data against alteration, loss, unauthorised processing or access. These include encrypted connections (HTTPS), hashed passwords, sign-in attempt limits, and permissions by roster and role. If you give us data, you guarantee that it is accurate and undertake to tell us about any changes.

Changes to this policy

If this policy changes, we will publish the new version here with its revision date. If the change is significant, we will also notify members with a Hub account.