1. Who processes your data
The responsible party (controller) is Epsylon Dev (trading as Epsylon), NIF 5000509442, with its registered office in Camama, Condª Austin, Luanda, Angola.
For anything to do with your personal data, write to epsylo.geral@gmail.com.
2. What data we collect
Account data: name, email address, nationality and the photo you upload (chosen from your gallery — the app does not use the camera or the microphone).
Player data, which you fill in if you wish: date of birth, address, height, weight, position, stronger foot, shirt number and team, plus the statistics generated by the matches you play in.
Identity verification, requested from people who organise competitions: full name, date of birth, nationality, address, phone number, document type, number and expiry date, photos of the document and a selfie. These are kept in private storage and only the Gollero team can see them.
Wallet transactions, purchases, help requests and the comments you write during broadcasts.
Usage data: the technical logs needed to keep the service running and understand faults and, only with your consent on the website, cookie-free visit statistics.
We do not collect your location, your contacts or advertising identifiers.
Adverts: Gollero only shows its own adverts, managed by us — no third-party ad networks and no advertising cookies. So that you are not shown the same advert too often, your browser (or the app) stores, on your device only, when you saw each one. On our side we only count how many times each advert was seen or tapped in total, without knowing by whom.
3. What we use it for, and on what legal basis
Performance of the contract (the terms you accept when you create an account): keeping your account, showing your profile, entering your team, calculating standings and statistics, processing purchases and top-ups, and answering your help requests.
Legal obligation: keeping payment and invoicing records for the period required by commercial and tax law, and responding to requests from the authorities.
Legitimate interest: protecting the platform (preventing fraud, fake accounts and fixed results), verifying the identity of people who organise paid competitions, and keeping technical logs to fix faults. You may object to this processing (section 7).
Consent, which you can withdraw at any time: visit statistics and external videos on the website (“Cookie preferences”), promotional emails (off by default) and push notifications on your phone.
We do not sell your data or use it for targeted advertising, and we do not take automated decisions with legal effects on you.
4. What is public
Your name, photo, position, team and match statistics appear on the public pages of the platform — that is what makes the standings and profiles useful.
Your email address, wallet balance and purchase history are never public.
5. Who we share it with
With the providers needed to run the service, and only for that purpose: Vercel (website and API hosting), Google Firebase (sign-in and notifications), Neon (database), Cloudinary (photos and identity documents), the email delivery service, and the payment processor when you top up your wallet. All connections are encrypted (HTTPS).
With competition organisers, only the data needed to run the competition your team takes part in.
6. International transfers
Several of these providers — Vercel Inc., Google LLC (Firebase), Neon Inc. and Cloudinary Ltd. — process data on servers in the United States and in other countries outside Angola, the European Union and Switzerland.
These transfers are made with the safeguards the law requires: the standard contractual clauses approved by the European Commission in these providers’ data processing agreements and, where the provider has signed up to it, the EU-US Data Privacy Framework (and its Swiss extension). For the data of people in Angola, the rules of Law no. 22/11 on transfers to countries without adequate protection apply.
You can ask us for a copy of these safeguards using the contact details in section 1.
7. Your rights
Depending on the law that applies to you — the GDPR (European Union and Portugal), the revised FADP (Switzerland), Law no. 22/11 on the Protection of Personal Data (Angola), the LGPD (Brazil) or POPIA (South Africa) — you have the right to access your data, correct it, delete it, restrict or object to processing, withdraw consent and receive your data in a portable format.
Access and portability, free of charge and without having to ask: in your profile, “Download my data” gives you a JSON file with your profile, teams, matches, wallet and statement, notifications and consents.
Correction: in your profile. Deleting your account: in the app or on the website, as explained at /apagar-conta.
For your other rights, write to epsylo.geral@gmail.com. We reply within one month (which may be extended by two more months for complex requests, in which case we will let you know).
If you believe we have mishandled your data, you can lodge a complaint with the supervisory authority in your country:
Angola: Agência de Protecção de Dados (APD) — www.apd.ao
Portugal: Comissão Nacional de Protecção de Dados (CNPD) — www.cnpd.pt
Mozambique: no authority of its own has been designated — you may contact the Angolan authority (Agência de Protecção de Dados (APD) — www.apd.ao).
South Africa: Information Regulator (South Africa) — inforegulator.org.za
Namibia: no authority of its own has been designated — you may contact the Angolan authority (Agência de Protecção de Dados (APD) — www.apd.ao).
Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd
Switzerland: Préposé fédéral à la protection des données et à la transparence (PFPDT / EDÖB) — www.edoeb.admin.ch
8. How long we keep it
Account and profile: for as long as the account exists. When you delete it, your personal data is deleted straight away.
Identity verification: for as long as you organise competitions, and at most until you delete your account.
Results and statistics of matches played: they stay in the competition history, but without your name — they appear as “Deleted account”.
Wallet transactions and invoicing: without identification once the account is deleted, for up to 10 years, the period set by commercial and tax law.
Help requests: up to 2 years after they are resolved. Technical server logs: 30 days at most.
Your cookie choice: 6 months in your browser; after that we ask again.
9. Security
Sign-in is handled by a specialist provider and Gollero does not store your password. Identity documents are kept in private storage.
Even so, no system is foolproof: use a password you do not use anywhere else. If we become aware of a breach that affects you, we will tell you and the authorities within the time limits set by law.
10. Cookies and browser storage
We only store what is essential for the website to work in your browser: your signed-in session and the choices you make, such as light or dark mode.
Visit statistics (Vercel Analytics and Speed Insights) and YouTube and Vimeo videos only load with your consent, which you give or withdraw under “Cookie preferences” in the footer. The full list is in the cookie policy, at /cookies.
11. Changes
When this policy changes in a significant way, we announce it on the platform before the change takes effect.