Fields marked with an asterisk are required.
Privacy policy
Last updated: 27 October 2026.
Who processes your data
golazo is the Luxembourg futsal portal, successor to futsalweb.lu. The data described below is hosted and processed by the operator of the site.
What is collected, and why
If you do not create an account
Simply browsing the site does not identify you: only actions that change something, and refused accesses, leave a trace, IP address included, for 90 days. The site sets two cookies, both technically necessary:
__Host-golazo-session— keeps your session for the length of the visit;XSRF-TOKEN— protects forms against forged requests.
A third, golazo_langue, is set only if you choose a language in the selector: it remembers that choice for one year.
If you tick “Stay signed in” when signing in, an extra cookie, remember_web_…, recognises you for 400 days at most; it disappears when you sign out. It is never set for accounts that hold a role.
The site also keeps a few items in your browser, on your device only: the open themed tab (for as long as the tab lasts), the language of your notification subscription and, when a match is being entered, the facts waiting to be sent. None of it is sent to a third party, and clearing the site's data removes it.
If you write to us through the contact form, your name, your e-mail address, your phone number if you give one and your message are kept so that we can reply, and the reply goes by e-mail to that address. Like any write on the site, sending it leaves a trace in the security log, IP address included, for 90 days. Write to us to have your message erased. A questionnaire open to everyone can be filled in without an account: only your answers are recorded, with the same trace in the security log. Reporting content requires an account with a confirmed e-mail address: the report records the reason, your explanation and your account, so that we can tell you the moderators’ decision. Reports made without an account before this rule, which sometimes carry an e-mail address, are deleted like the others in due course.
There is no analytics, no advertising cookie and no third-party content — no social widgets, no embedded video, no font loaded from an external server. No data about you leaves for a third party.
Two sections reuse content published elsewhere, copied rather than embedded. “On Instagram” shows the latest posts from the clubs’ Instagram accounts and golazo’s own, fetched by the server from Meta; “Press” keeps the title, standfirst, image and link of articles from Luxembourg media. The images are stored on this server: your browser does not contact Instagram or those outlets unless you follow a link, and nothing about you is sent to Meta. A post may show people: to ask for its removal, write to the address below.
Articles offer share links to social networks. They are ordinary links: nothing is loaded from those sites, and nothing is sent to them until you click. Clicking takes you off golazo, and the destination site's policy applies from there.
There are five exceptions. The first four do not go through your browser: they are administration screens. The first, reserved to general administration, allows a conversation with an assistant, and what is typed there is sent to Anthropic — no visitor, account or player data is attached, only the text the administrator types and a numeric summary of the portal, such as “357 clubs, 2,056 fixtures”.
A second screen has the report of a fixture written. The facts of that fixture are then sent to Anthropic — the competition, the date, the venue, the clubs, the score, the recorded events and the team sheet, including players' names, since a report without the scorer's name does not exist. These are names this site already publishes, but passing them to a third party is not publishing, and that is said. Nothing else from a player's record is attached: no date of birth, no height, no weight, no nationality. The same service is also used to write the report of a whole matchday, from the same facts, and to translate an article or a club's page or product: only the text to translate is then sent.
A third screen reads a photograph of a team sheet to extract the players' names. The image is sent to Anthropic as it is: it is a document, and its contents are not chosen field by field — an official team sheet carries names and shirt numbers, and may carry signatures or licence numbers. It is stored nowhere, neither on this server nor in the database, and the names taken from it disappear with the administrator's session.
A fourth screen transcribes voice recordings. Each recording is then sent to Groq, in the United States, under standard contractual clauses, to be converted into text: it is the voice of the recorded person, and what they say. Groq keeps none of it after the transcription, and this server does not store the audio either. Only the text is kept, in the database, until the administration deletes it. The person recorded must have been told and have agreed before it is sent: the administrator who uploads the recording answers for that. Write to the address below to have a text about you erased. The resulting text may then be sent to Anthropic, at the administration's request, to be translated into French, summarised and to extract quotes from it. The result is kept with the transcription, and is deleted with it.
The fifth concerns you directly, and only happens if you ask for it. If you subscribe to notifications, your browser issues a delivery address — at Google, Mozilla or Apple depending on the browser — which this site stores in order to write to you. Every notification therefore passes through that service, which sees the address and the time but not the content: that is encrypted for your browser alone. The address identifies a device, not a person; it appears in your data export when you are signed in, disappears with your account, and the button that subscribed you unsubscribes you. If you are signed in when you subscribe, the subscription is linked to your account: that is what lets us notify you of what you follow, according to your notification preferences.
That is why no consent banner is shown to you: consent is required for whatever is not necessary to operate the site, and there is nothing of that kind here. A banner shown anyway would protect nobody — it would only train people to click without reading.
If you create an account
The data you provide, and the data the site produces about you:
| Data | Why |
|---|---|
| Surname, first name, username | Identifying you and attributing your contributions |
| E-mail address | Signing in and password reset |
| Password | Stored as a hash, never in clear text |
| Two-factor authentication key | Checking the code from your app; encrypted, never published |
| Known devices (accounts that administer the portal) | Reporting a sign-in from an unknown device: a golazo_appareil cookie, the browser and the IP address, forgotten after 90 days unused |
| Failed login attempts | Stop repeated password guesses: one counter per identifier, per IP address and per account, forgotten after an hour at most |
| Date of birth, avatar | Optional, shown on your profile |
| Your cover image, phone number and e-mail address shown on your profile | Dress your profile on your wall. The phone number is stored only if you enter it; neither it nor your e-mail address is shown until you tick the matching box, and only to people who may open your wall. Untick the box or empty the field to remove them. |
| Roles and attached club | Determining what you may administer |
| The requests you write to the administration, and the replies received | Track where your request stands, and be able to reply to you |
| Your private messages to other members | Deliver them to their recipient. Only you and they read them: neither moderation nor administration consults them. You can refuse to receive any. |
| Your classified ads, your comments and the private messages you write to their authors | Publish your listing; relay a private message by e-mail without showing any address — yours is only given to the author if you tick the box |
| Your forum discussions, their replies and the posts on your wall | Publish them in the forum or on your wall; notify the person you reply to. The wall is readable only by signed-in accounts, unless its owner opens it to visitors. |
| Club and golazo walls | Show match facts that are already public on the site (results, streaks, milestones), reuse a club’s Instagram posts only if the club asked for it — with a note and a link to the original — and name who posts when they choose to sign. Several people can run a wall; each must have confirmed their address and enabled two-factor authentication, and what they write stays traced to their name while their account exists. |
| Your comments on articles and matches | Publishing them under the article or the match; notifying the person you reply to |
| The clubs, players and competitions you follow | Finding them on a page of your own with their feed, and highlighting them in the standings, the calendar and on the home page. What you follow notifies you in the browsers subscribed from your account — a club or a competition of its matches, a player of his goals; no e-mail is sent to you, except the daily summary if you turn it on. |
| Your favourites, your classified-ad alerts and the list of members you block | None of this is public: it lets you find ads again, be told of new ones and stop seeing certain members’ content. |
| The reviews you leave about a seller | To inform other members; the review carries your name and the person rated can read it. |
| Your choice of a private account and the requests to follow your wall | To decide who reads your wall; a pending request is visible only to you and its sender. |
| Your saved posts, your likes and your reactions (posts, comments, private messages) | To find and count them. A reaction to a private message is seen only by the two people in the conversation. |
| The images, videos and link previews attached to your content | To illustrate your posts and ads; they are erased with your account. |
| The notifications golazo sends you | Letting you reread them on your Notifications page, even if notifications are not enabled on your devices |
| Your notification preferences | Knowing what is sent to you, and through which channel |
| The daily summary, if you turn it on | Sending you each morning by e-mail the notifications left unread; off until you turn it on |
| The content you report, and why | Passing them on to the moderators, and telling you their decision |
| Your votes in polls | One vote per account, counted in the results |
| Your predictions, and your choice to appear in the ranking | To settle them and work out your balance; your public name appears in the ranking until you hide it from “My predictions” |
| Your answers to the questionnaires assigned to you | Passing them on to the portal; they may be used in an interview published on the site, except the closing remark |
| IP address and pages visited during a write or a refused access | Security: detecting a bypass of the access controls |
Ordinary page views are not recorded. Only actions that change something, and refused access attempts, are.
If the site publishes data about you and you have no account
This is the commonest case: the portal publishes profiles for 5 179 players and 164 staff members. None of them has an account here, and the data does not come from them — it comes from the golazo.lu database, maintained by the clubs and the federation since 2014.
What is published, where the source carries it:
- the name, and the nickname the person is known by;
- the date of birth — 4 593 of 5 343 profiles carry one;
- nationality — 4 112 players declare one —, height and weight;
- a photograph, where the club has supplied one;
- the club, the periods of membership, and the fixtures played.
For a player under 18, the date of birth, height and weight are not published; only the age is.
This is published because reporting on a sporting competition means naming who takes part in it: that is the portal's purpose, and the legitimate interest it rests on. Nothing is sold or transferred; the only disclosures to a third party are those of the administration screens described above, to write a match report.
You may ask for a profile about you to be corrected, and for your photograph, date of birth, height or weight to be removed. Write to the address below, naming the page concerned.
One limit, said plainly: your name on a team sheet is the record of a competition that took place. Erasing it would not make you anonymous — it would falsify the published result, leaving your goal or your card without an author. That point is discussed case by case with the club concerned; everything else is granted on request.
On what basis
Each processing activity rests on one of the bases set out in the GDPR (Article 6):
- your account, your contributions, your predictions and your votes: performing the service you ask for by signing up;
- the security log, the limit on sign-in attempts and known devices: the legitimate interest in protecting the site and its accounts;
- the publication of players and staff, and the reuse of content published elsewhere: the legitimate interest in reporting on competitions, to which you may object;
- contact messages, reports and requests to the administration: the legitimate interest in answering you and moderating the site;
- push notifications, the daily summary and your name in the predictions ranking: your consent, which you withdraw at any time by switching the feature off, without affecting what happened before.
Minors
When a wall post contains a link, the golazo server reads the cited page once to keep its title, description and image. Your browser never contacts that site from golazo; only the server is seen there.
An account requires being at least 16, the age of digital consent in Luxembourg: sign-up asks for it. Published players may be minors; their profiles come from the clubs and the federation. A legal guardian may at any time ask, at the address below, for a photograph, a date of birth, a height or a weight to be removed, or for a profile to be corrected.
For how long
- Your account: for as long as you keep it. The administration can list accounts with no activity for three years and decides case by case; nothing is deleted automatically.
- Security log: 90 days.
- Form drafts saved by administration accounts: 30 days after their last change.
- Browser security-blocking reports (address of the page concerned, no IP address): 30 days.
- Change history of records (players, clubs, fixtures, articles): 365 days, with the account that made the change. It disappears with the record, and the account is removed from it when the account is deleted.
- Your requests to the administration: for as long as you keep your account. They disappear with it.
- What you follow: as long as you follow it, and never beyond your account.
- A content item that you or moderation remove (comment, discussion, post) stays hidden for 90 days so the decision can be contested, then is permanently deleted, image included.
- Your notifications: 90 days, then they are deleted. They also disappear with your account.
- Your classified ads, comments and private messages: as long as you keep your account. They disappear with it.
- Your private messages to other members: for as long as you keep your account. They disappear with it, including on the recipient’s side.
- Your comments on articles and matches: as long as you keep your account. They disappear with it.
- Your discussions, their replies and the posts on your wall: for as long as you keep your account. They disappear with it.
- Replies from other members placed under your discussions and comments stay: your text, your name and your earlier versions are erased, and the other member’s reply keeps its meaning under the mention “content deleted by its author”.
- Your cover image and phone number: as long as you keep your account, or until you remove them. They disappear with it.
- Your votes: as long as you keep your account. They disappear with it.
- Your questionnaire answers: they stay with the portal, without your name, after your account is deleted; write to us to have them erased.
- Contact form messages: one year after they are received, then erased with their replies; you may ask for erasure sooner.
- Transcriptions of voice recordings: one year after the batch is uploaded, or sooner if the administration deletes them.
- Reports: until the moderators decide, then 180 days.
- Cookies: the session expires after eight hours of inactivity.
Who else has access
Nobody outside the running of the site and the providers named above. Data is never sold or transferred. The exceptions described above send some outside the European Union: to Anthropic and Groq, in the United States, and, if you subscribe to notifications, to your browser's service, which may be located there too. Club administrators see their club's content, not account data. These transfers rely on standard contractual clauses.
Your rights
European law gives you the right to access, correct, erase, port and object to the processing of your data. Two of those can be exercised straight from the site, without writing to anyone:
Sign in to export your data or delete your account.
You also have the right to restrict processing, and you may withdraw a consent you have given at any time.
Exactly what deletion does
Your account and roles are deleted. Your articles stay published but no longer carry your byline — the content belongs to the site, the byline to you.
Your requests to the administration are deleted, along with the replies they received. That is the opposite of the choice made for articles, and for the same reason: the content of an article belongs to the site, the message of a request is data you supplied. Download your data first if you wish to keep a copy.
What you follow is deleted: a preference exists only for the person who set it. Your notifications are deleted with it.
Your classified ads, comments, private messages and votes are erased; poll results lose your votes. Your answers to questionnaires remain, without a respondent: they were passed on to the portal. Your reports remain, without your name: they serve moderation. Your predictions are erased, and you leave the predictions ranking.
Security log entries are kept but de-identified: your identifier and IP address are removed, the record of the action remains. Those entries answer a legitimate interest — knowing whether an access control was bypassed — and erasing them entirely would remove exactly what they exist to prove. After deletion, you know an action took place, no longer who did it. Log files kept on the server are not altered at deletion: they expire by themselves, after 90 days at most.
Contact us
For any question about your data, or to exercise a right not listed above, use the site's contact address. You may also lodge a complaint with the Commission nationale pour la protection des données (CNPD) in Luxembourg.