FSS App LogoLoading...
image

Privacy Policy

Last Updated: September 3, 2026

1. Introduction

Welcome to the FSS App. This Privacy Policy explains how the Football Association of Serbia ("FSS") and Fanzeal Holding AB ("Fanzeal") process personal data when you use the FSS App and related services (collectively, the "Platform"). The Platform is developed and operated by Fanzeal in cooperation with and under the authorization of FSS, the national governing body for football in Serbia. This Privacy Policy is intended to provide information in accordance with the Law on Personal Data Protection of the Republic of Serbia ("Serbian Data Protection Law" or "LPDP"), Official Gazette of the Republic of Serbia No. 87/2018, and, where applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Depending on the relevant processing activity, FSS and/or Fanzeal may act as a data controller, while Fanzeal and other service providers may act as data processors processing personal data on behalf of a controller. By using the Platform, you acknowledge that your personal data may be processed as described in this Privacy Policy.

2. Data Controller and Data Processor

For the purposes of the Serbian Data Protection Law and, where applicable, the GDPR, the relevant controller(s) are: Football Association of Serbia (FSS)

  • Address: Terazije 35 11103 Belgrade Serbia
  • Email: office@fss.rs FSS may determine the purposes and means of processing personal data relating to FSS services, official football content, FSS-related activities, fan engagement activities, and other services for which FSS determines the purpose of processing. Fanzeal Holding AB
  • Address: Kammakargatan 41, Lgh 1002 Stockholm 111 24 Sweden
  • Email: developer@fanzeal.com Fanzeal develops and operates the Platform and may act as a processor on behalf of FSS where it processes personal data according to FSS's documented instructions. For processing activities where Fanzeal independently determines the purposes and means of processing, Fanzeal may act as a separate data controller. Where FSS and Fanzeal jointly determine the purposes and means of a processing activity, they may act as joint controllers. Where this applies, their respective responsibilities will be determined through an appropriate arrangement in accordance with applicable data protection law.

3. Principles of Personal Data Processing

We process personal data in accordance with applicable data protection principles, including:

  • Lawfulness, fairness and transparency;
  • Purpose limitation;
  • Data minimisation;
  • Accuracy;
  • Storage limitation;
  • Integrity and confidentiality; and
  • Accountability. We collect and process personal data only where it is necessary and appropriate for the purposes described in this Privacy Policy or otherwise permitted by applicable law.

4. Personal Data We Collect

We may collect the following categories of personal data.

a. Account and Registration Data

When you create an account, we may collect:

  • Name;
  • Email address;
  • Date of birth, where optional;
  • Username;
  • Password or authentication credentials;
  • Account identifiers; and
  • Other information necessary to create and manage your account.

b. Profile Data

You may choose to provide:

  • Profile photo/avatar;
  • Username;
  • Other profile information; and
  • Other information you voluntarily add to your profile. Some profile information may be visible to other Users depending on the Platform's functionality and your settings.

c. User-Generated Content

We may process information contained in content you submit or create through the Platform, including:

  • Comments;
  • Reactions;
  • Posts;
  • Survey responses;
  • Quiz answers;
  • Predictions;
  • Competition entries;
  • Game participation data; and
  • Other content or interactions you voluntarily provide.

d. Membership, Subscription and Transaction Data

If you purchase a membership, subscription, points, rewards, or other services, we may process information necessary to verify and manage the transaction. Payments may be processed by third-party payment providers, including Apple, Google, or other authorized payment providers. We do not generally receive or store your full payment card number when payment is processed by these providers. We may receive transaction identifiers, purchase status, subscription information, product information, currency, transaction date, and other limited information necessary to provide the purchased service.

e. Usage and Technical Data

We may automatically collect:

  • Features and services used;
  • Content viewed;
  • Matches viewed;
  • Games played;
  • Points earned;
  • Rewards redeemed;
  • Taps and interactions;
  • Session information;
  • Approximate time spent using the Platform;
  • Crash reports;
  • IP address;
  • Device type;
  • Operating system;
  • App version;
  • Language and regional settings;
  • Mobile network information; and
  • Device or advertising identifiers, where permitted by applicable law and your device settings.

f. Location Data

We may process approximate location information derived from technical information such as your IP address for purposes such as security, analytics, localization, and service improvement. We will not collect precise geolocation information unless the relevant functionality requires it and you have provided the required permission or consent under applicable law.

g. Communications

If you contact us, we may process information contained in your communication, including your contact details, support requests, feedback, and correspondence.

5. Legal Bases for Processing

We process personal data only where a valid legal basis exists under applicable data protection law. Depending on the processing activity, the legal basis may include:

a. Performance of a Contract

We may process personal data where it is necessary to:

  • Create and manage your account;
  • Provide Platform functionality;
  • Provide memberships and subscriptions;
  • Process purchases;
  • Deliver rewards and benefits;
  • Provide customer support; or
  • Perform obligations arising from the Terms and Conditions.

b. Legal Obligation

We may process personal data where necessary to comply with legal or regulatory obligations, including accounting, tax, consumer protection, fraud prevention, or lawful requests from competent authorities.

c. Legitimate Interests

We may process personal data where necessary for our legitimate interests or those of a third party, provided that these interests are not overridden by your fundamental rights and freedoms. Examples may include:

  • Platform security;
  • Fraud and abuse prevention;
  • Network and information security;
  • Service improvement;
  • Technical troubleshooting;
  • Analytics;
  • Protection of legal rights; and
  • Enforcement of our terms and policies. Where required, we conduct an appropriate balancing assessment before relying on legitimate interests.

d. Consent

Where required by applicable law, we will request your consent before processing personal data for specific purposes. Examples may include certain:

  • Marketing communications;
  • Advertising or tracking activities;
  • Precise location processing; or
  • Other optional processing activities requiring consent. You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

e. Other Legal Bases

Where applicable, personal data may also be processed where necessary to protect vital interests, perform a task carried out in the public interest, or exercise official authority, where such legal basis is available under applicable law.

6. How We Use Your Personal Data

We may process personal data for the following purposes:

  • Providing and operating the Platform;
  • Creating and managing User accounts;
  • Authenticating Users;
  • Providing memberships and subscriptions;
  • Processing purchases and transactions;
  • Providing points, rewards, benefits, and fan engagement services;
  • Providing football news, matches, statistics, and other FSS-related content;
  • Operating quizzes, predictions, games, competitions, lucky draws, and other fan engagement activities;
  • Managing rankings and participation records;
  • Personalizing Platform content and functionality;
  • Providing customer support;
  • Sending service-related communications;
  • Sending marketing communications where permitted and, where required, with your consent;
  • Monitoring and improving Platform performance;
  • Conducting analytics and statistical analysis;
  • Detecting and preventing fraud, abuse, and security incidents;
  • Protecting the rights, property, and safety of FSS, Fanzeal, Users, and other parties;
  • Enforcing our Terms and Conditions;
  • Complying with legal and regulatory obligations; and
  • Exercising or defending legal claims. Where possible, we use aggregated or anonymized information for analytics and reporting.

7. Sharing and Disclosure of Personal Data

We do not sell your personal data. We may disclose or otherwise make personal data available to the following categories of recipients where necessary and lawful.

a. Football Association of Serbia

Fanzeal may process and provide personal data to FSS where necessary for the operation of the Platform and FSS-related services. This may include information required to:

  • Provide official FSS services;
  • Manage fan engagement activities;
  • Verify eligibility for FSS-related benefits;
  • Manage competitions or rewards;
  • Provide official football content;
  • Analyze Platform usage; or
  • Fulfil legal obligations. Only personal data necessary for the relevant purpose should be shared.

b. Data Processors and Service Providers

We may appoint third-party processors to provide services such as:

  • Cloud hosting;
  • Infrastructure;
  • Analytics;
  • Authentication;
  • Payment processing;
  • Subscription management;
  • Customer support;
  • Email and communication delivery;
  • Security and fraud prevention;
  • Crash reporting;
  • Advertising and measurement; and
  • Other technical services necessary to operate the Platform. Where required by applicable law, processors will be subject to appropriate contractual obligations regarding confidentiality, security, data protection, and processing instructions.

c. Other Users

Certain information may be visible to other Users where you voluntarily make it available or where visibility is necessary for a Platform feature. This may include your:

  • Username;
  • Avatar;
  • Rankings;
  • Scores;
  • Public profile information; and
  • User-generated content.

d. Legal and Regulatory Authorities

We may disclose personal data to courts, regulators, law enforcement authorities, tax authorities, or other competent public authorities where required or permitted by applicable law.

e. Business Transactions

Personal data may be transferred as part of a merger, acquisition, restructuring, financing, bankruptcy, or sale of assets, subject to applicable data protection requirements.

8. International Transfers of Personal Data

Your personal data may be processed or stored outside Serbia and/or outside the European Economic Area ("EEA"), including by service providers located in other countries. Where applicable data protection law requires safeguards for international transfers, we will use an appropriate transfer mechanism, which may include:

  • An applicable adequacy decision;
  • Standard Contractual Clauses approved by the European Commission;
  • Appropriate safeguards under applicable Serbian law;
  • Binding Corporate Rules; or
  • Another legally recognized transfer mechanism. Where required, additional safeguards will be implemented to ensure that the level of protection provided to your personal data is not undermined by the transfer. The GDPR requires appropriate safeguards for transfers to third countries where no adequacy decision applies.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law. Retention periods may depend on:

  • The nature and purpose of the processing;
  • Whether your account remains active;
  • Contractual requirements;
  • Legal and regulatory requirements;
  • Accounting and tax obligations;
  • Dispute resolution;
  • Fraud prevention;
  • Security requirements; and
  • The establishment, exercise, or defence of legal claims. When personal data is no longer necessary, we will securely delete, anonymize, or otherwise dispose of it in accordance with applicable law.

10. Your Data Protection Rights

Subject to applicable law and any applicable limitations or exceptions, you may have the following rights: Right of Access You may request confirmation as to whether we process your personal data and request access to that data. Right to Rectification You may request correction of inaccurate or incomplete personal data. Right to Erasure You may request deletion of your personal data where the legal requirements for erasure are met. Right to Restriction of Processing You may request restriction of processing in circumstances provided by applicable law. Right to Data Portability Where applicable, you may request to receive certain personal data in a structured, commonly used, and machine-readable format and request that it be transmitted to another controller. Right to Object You may object to certain processing activities, including processing based on legitimate interests and, where applicable, direct marketing. Right to Withdraw Consent Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. Rights Regarding Automated Decision-Making Where applicable, you may have rights relating to solely automated decision-making, including profiling, where such processing produces legal or similarly significant effects. Right to Lodge a Complaint You have the right to lodge a complaint with the competent data protection supervisory authority. To exercise your rights, please contact us using the contact details in Section 16. We may need to verify your identity before responding to certain requests. We will respond within the time period required by applicable law.

11. Supervisory Authority in Serbia

The competent supervisory authority for personal data protection in Serbia is: Commissioner for Information of Public Importance and Personal Data Protection 15 Bulevar kralja Aleksandra Belgrade 11120 Serbia Email: office@poverenik.rs Phone: +381 11 3408 900 The Commissioner is the independent supervisory authority responsible for overseeing and enforcing the Serbian Law on Personal Data Protection. You may contact the Commissioner if you believe that your personal data protection rights have been infringed.

12. Children's Privacy

The Platform is not intended for children under the age of 16, unless otherwise permitted by applicable law and appropriate consent has been obtained where required. We do not knowingly process personal data of children in violation of applicable data protection requirements. If we become aware that personal data has been collected from a child in circumstances where the required legal conditions have not been satisfied, we will take appropriate steps to delete the information. Where consent is relied upon as the legal basis for an online service offered directly to a child, the applicable age threshold and parental consent requirements will be determined in accordance with applicable law.

13. Cookies and Similar Technologies

The Platform and related websites may use cookies, SDKs, pixels, device identifiers, and similar technologies. These technologies may be used for:

  • Essential Platform functionality;
  • Authentication and security;
  • Preferences;
  • Analytics;
  • Performance monitoring;
  • Advertising and measurement, where applicable. Where consent is required for non-essential technologies, we will request consent before activating them. You may manage certain tracking and advertising preferences through your device settings and, where available, the Platform's privacy or cookie settings.

14. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against:

  • Unauthorized access;
  • Unauthorized disclosure;
  • Accidental or unlawful destruction;
  • Accidental loss;
  • Alteration; and
  • Other unlawful or unauthorized processing. Security measures may include access controls, authentication, encryption, monitoring, logging, backup procedures, and other safeguards appropriate to the nature and risk of the processing. No Internet transmission or electronic storage system can be guaranteed to be completely secure. Where a personal data breach occurs that triggers a notification obligation under applicable law, the relevant controller will take the required steps to notify the competent supervisory authority and/or affected individuals within the applicable legal timeframes.

15. Third-Party Services and Links

The Platform may contain links or integrations with third-party websites, applications, services, or platforms. These may include:

  • Official FSS websites;
  • Ticketing platforms;
  • Merchandise stores;
  • Payment providers;
  • Social media platforms;
  • Analytics providers;
  • Advertising providers; and
  • Other third-party services. Third-party services operate independently and may have their own privacy policies and terms. We encourage you to review the privacy notices of third-party services before providing them with personal data.

16. Data Protection Officer and Privacy Contact

Where applicable, the relevant controller will designate a Data Protection Officer ("DPO") in accordance with applicable data protection law. For privacy-related questions, requests, or concerns regarding the FSS App, please contact: Football Association of Serbia (FSS)

  • Address: Terazije 35 11103 Belgrade Serbia
  • Email: office@fss.rs

For technical or operational matters relating to the Platform: Fanzeal Holding AB

  • Address: Kammakargatan 41, Lgh 1002 Stockholm 111 24 Sweden
  • Email: developer@fanzeal.com If a DPO has been formally appointed, the DPO's contact details will be made available through the Platform and/or this Privacy Policy.

###17. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect:

  • Changes to the Platform;
  • Changes to our processing activities;
  • Changes in applicable laws or regulatory requirements; or
  • Changes in our service providers or business arrangements. When we make material changes, we will provide appropriate notice, such as by posting the updated Privacy Policy on the Platform and updating the "Last Updated" date. Where required by law, we will obtain your consent before implementing changes that require consent.

18. Contact Us

For questions about this Privacy Policy or the processing of your personal data, please contact: Football Association of Serbia (FSS)

  • Address: Terazije 35 11103 Belgrade Serbia
  • Email: office@fss.rs

For technical or operational matters relating to the Platform: Fanzeal Holding AB

  • Address: Kammakargatan 41, Lgh 1002 Stockholm 111 24 Sweden
  • Email: developer@fanzeal.com