Privacy Policy

1. Who we are

MMA GALLA ApS ("MMA Galla", "we", "us") is the data controller for the personal data described in this policy. We operate the MMA Galla event platform at mmagalla.live and the website at mmagalla.com.

You can reach us about anything in this policy at info@mmagalla.com.

Company: MMA GALLA ApS
Address: Fjordsgade 6, tv., 5000 Odense C, Denmark
CVR: 44216183
Email: info@mmagalla.com

2. What this policy covers

This policy explains what we collect when you use the MMA Galla live event app: creating an account, following a fight card, predicting results, taking part in the leaderboard, chatting during an event, or redeeming a coupon.

It also covers the additional information we collect from fighters, coaches and event staff, who are asked for more than a normal spectator is.

3. What we collect

We only collect what the platform needs to run an event. The categories below reflect exactly what the app stores.

Account data: your email address. You sign in with a one-time code we email you; we do not use passwords (accounts made before 5 October 2026 may still hold an old password hash, which can no longer be used to sign in). If you sign in with Google or Facebook we receive your name, email address and profile picture from them. We never receive your Google or Facebook password.
Profile data: your username, display name, profile picture, and the contact email you choose to show. Staff and coaches may additionally provide a role/title, phone number and Instagram handle for their contact card.
Big screen (optional). If you switch on 'Show me on the big screen if I'm Fan of the night', your name and profile photo may be shown on the screens at the venue when you are Fan of the night. It is off unless you switch it on; we record when you switched it on, and you can switch it off at any time in Profile.
Event participation: your fight predictions, scorecards, leaderboard position, coupon redemptions, and any feedback you submit.
Messages: the content of messages you send in event chat or the event inbox, and any attachments.
Technical data: a randomly generated visit identifier and an anonymous device identifier stored in your browser, the pages you open in the app, and standard server logs. They are used to count visits to each screen and how many different devices visited, around an event.
Date of birth: asked when you create your account, and used for one purpose only, which is confirming you are 18 or over before we show links to licensed betting operators. It is never shown to other users.
About you (asked when you create your account): your gender (you can answer "prefer not to say"). Optional at sign-up: your favourite fighter. Later, if you choose, in your profile and for profile points: your postcode and town, how you heard about us, what you want to hear about (tickets for the next show, VIP seats and tables, merch and clothing, odds and betting, training martial arts yourself), whether you want ticket news by email, phone number, whether you train martial arts (and where and what), your Instagram handle and your T-shirt size. These answers are visible only to you and to MMA GALLA's administrators. They are never shown on the leaderboard, the fan wall or any public page. We use them to plan our shows (where our audience comes from, what they want), to contact you about a prize or merchandise you have won, and, only if you answered yes to ticket news, to email you about tickets: the presale code before general sale and the fight card as it is announced, a few emails a year. Ticket news and event news are the same consent, stored once on your profile. They are never sold or shared with sponsors.

4. Health and identity documents (fighters only)

If you compete at an MMA Galla event, we may ask you to upload documents that the event and the relevant federation require before you are allowed to fight. These can include a doctor's clearance letter, blood test results, a signed waiver, a licence or federation card, and a copy of your ID or passport.

Medical documents are 'special category' personal data under Article 9 of the GDPR, and identity documents are highly sensitive. We treat both with additional care:

We ask for them only where an event, a federation or a regulator requires them.
We process them on the basis of your explicit consent, and where applicable for reasons of substantial public interest in the field of sport and athlete safety.
Access is restricted to the event staff who need it to approve your participation.
You may withdraw your consent at any time, though we may then be unable to approve you to compete.
They are deleted once they are no longer needed for the event and any applicable legal retention period has passed.

5. Recognising fighters and coaches in our event photos

When we sort photos from our events, the app suggests who is in a picture. This happens in a crew member's own browser while they sort photos, and on our own server, which checks photos as they arrive so the crew finds them already sorted.

To recognise a face, the app turns it into a row of numbers: a face fingerprint. Face recognition is part of the fighter guidelines and of the coach guidelines you accept in the app, or of an agreement signed with us. For a fighter or coach who has accepted the current guidelines or signed the agreement, we use the face fingerprints to recognise, tag and sort the photos of them, also in photos from earlier events.

For a fighter on a fight card who has not accepted yet, the comparison with their profile photo only happens in the server's memory while a photo is being checked, and those numbers are discarded when the check is done.

A face we have not linked to a fighter or coach who has accepted (a face nobody has named yet, a name with no profile yet, or a fighter or coach who has not accepted the guidelines yet) is kept only to keep the photos of the same person together, so a crew member can name them, until that person accepts or objects. It is never used to recognise anyone, never compared across events to find someone, never used for anything else, and it is deleted at once if you ask us or object. Faces in the background, such as the crowd, are never kept.

Only our server can read the fingerprints. They are stored in our database, are never shown in the app, are never put in file storage or logs, and are never shared with or sent to anyone else. On the photo itself we only save which fighter it is tagged with, how sure the app was as a percentage, and when. When the app is sure of a fighter on that event's fight card, it tags the photo itself and a crew member can undo it. Any other suggestion only becomes a tag when a crew member confirms it.

Our legal basis for using a fighter's or coach's face fingerprints to recognise them is the explicit consent you give by accepting the fighter or coach guidelines or signing the agreement (Art. 9(2)(a)). You can withdraw it or object at any time: use "I object to face recognition" in your profile or write to info@mmagalla.com. We then delete your face fingerprints at once and keep no new ones. Fingerprints are also deleted together with the photo they come from. The photos themselves are covered by the rest of this policy.

We never use it on spectators or to recognise anyone in the crowd.

6. Why we use it, and our legal basis

Under the GDPR we must have a legal basis for every use of your data. Ours are set out below.

What we do	Why	Legal basis
Create and secure your account	So you can sign in and we can keep your account safe	Contract (Art. 6(1)(b))
Show your name and picture on the leaderboard and in chat	So the event is social and other fans can recognise you	Contract (Art. 6(1)(b))
Record your predictions and scores	To run the prediction game and rank participants	Contract (Art. 6(1)(b))
Send you event notifications	To tell you when a fight is starting or a result is in	Contract (Art. 6(1)(b)), as part of the event app you signed up for. On by default; turn them off any time in your profile
Count page views during an event	To understand which screens are used, so we can improve them	Legitimate interests (Art. 6(1)(f))
Publish fighter profiles and records	To promote the event and inform the audience	Legitimate interests (Art. 6(1)(f)) / contract for fighters
Keep the face fingerprints of fighters and coaches to recognise them in our event photos (section 5)	To tag and sort the photos of them	Explicit consent (Art. 9(2)(a)), given by accepting the fighter guidelines or signing the agreement; you can object at any time
Handle medical and identity documents	To meet event, federation and safety requirements	Explicit consent (Art. 9(2)(a))
Keep accounting and legal records	Because the law requires it	Legal obligation (Art. 6(1)(c))

7. Who we share it with

We do not sell your personal data, and we do not share it for advertising. We use a small number of service providers who process data on our behalf under a data processing agreement:

Supabase: database, authentication and file storage for the platform.
Vercel: hosting and delivery of the application.
Sentry (Functional Software, EU data region): error reports when a screen breaks, so we can fix it. A report holds the error, the page address without its query string and the browser type; never your name, email, account, IP address or cookies.
Google and Meta (Facebook): only if you choose to sign in with them. They tell us your name, email and picture; we do not post anything to your account.
YouTube: event videos are embedded in privacy-enhanced mode, which means YouTube does not set tracking cookies unless you press play.
Google Fonts: the app loads its typefaces from Google's font service, which means your IP address is visible to Google when a page loads.
Event organisers and officials: fighter, coach and document data is shared with the staff running the specific event you take part in.

8. What we do not do

It is worth being explicit about this, because many apps do the opposite:

We do not sell your personal data, or share it with data brokers.
We do not use your data for advertising, and we run no advertising or cross-site tracking cookies.
We do not send you marketing unless you have explicitly said yes to ticket news, a separate yes / no question where neither answer is chosen for you, and you can withdraw it in one tap from your profile.
We do not build behavioural or advertising profiles of you.
We do not read your Facebook posts, photos, friends or likes. When you sign in with Facebook we ask only for your name, profile picture and email address.
We do not use your data to train machine learning models.

9. Where your data is stored, and what each part is for

All application data is stored in our Supabase project (a managed PostgreSQL database with file storage) and served through Vercel. The table below is a plain-language summary of what is held there.

Stored	What it is for	Used for marketing?
Email address (and, for accounts made before 5 Oct 2026, an old password hash that can no longer be used)	Signing you in with a one-time code and securing your account	No
About you: postcode, town, how you heard about us, interests, gender, favourite fighter, phone, club, training, Instagram, T-shirt size (only you and our administrators can see them)	Planning our shows, profile points, contacting you about a prize	Only with your yes to ticket news or event news
Ticket news yes/no, and when you answered	Knowing whether we may email you about tickets	Yes, if you said yes
Username, name, profile picture	Showing who you are on the leaderboard and in chat	No
Contact email, phone, title, Instagram (staff/coaches only)	The contact card other event staff can see	No
Fight predictions and scores	Running the prediction game and the leaderboard	No
Chat and inbox messages	Delivering messages during an event	No
Coupon assignments and redemptions	Checking a coupon is valid and used once	No
Visit counts (anonymous visit and device ids)	Statistics: how many visits each screen had and how many different devices visited	No
Feedback you submit	Improving the event. Quoted publicly only if you tick the box	Only with your consent
Fighter profiles and records	Publishing the fight card and promoting the event	Event promotion
Face fingerprints of fighters and coaches who accepted the guidelines or signed an agreement, and, only to group photos until they accept or object, of faces not yet linked to them; only our server can read them	Recognising fighters and coaches in our event photos (section 5)	No
Medical and identity documents (fighters)	Meeting event and federation requirements

10. Marketing and advertising

We advertise MMA Galla events on platforms such as Meta and Google. Two things are worth separating out, because they work very differently.

Ordinary advertising: we buy ads using those platforms' own targeting tools (location, interests, and so on). This uses no personal data from your account, and nothing about you is sent to them.

Marketing to you directly: we only email you about upcoming events if you have explicitly opted in. That opt-in is a separate yes / no question ("ticket news") where neither answer is chosen for you. It is never bundled with accepting this policy, and never a condition of using the app.

If you opt in, we may also add your email address to a Custom Audience on Meta or Google so we can reach you and people like you with event announcements. Your address is hashed (SHA-256) before it leaves our systems, so the platform never receives it in readable form. This happens only with your consent, and we refresh the list before each campaign so withdrawals take effect.

You can withdraw at any time from your profile page. Withdrawal takes effect immediately and does not affect anything sent beforehand.

Legal basis: consent (GDPR Art. 6(1)(a)), and Section 10 of the Danish Marketing Practices Act.
We do not sell your data, and we do not share it with data brokers.
We do not use information from your Facebook or Google account for advertising. When you sign in with them we receive only your name, email and picture, and we use those solely to set up your profile.

11. Statistics

We count how many times each page of the website and each screen in the app is opened, so we know which parts are actually used. This uses a randomly generated visit identifier and an anonymous device identifier stored in your browser. If you are signed in, the visit is also linked to your account in our own database, so we can count how many different fans took part; that link is never shown to sponsors or anyone outside MMA GALLA. The device identifier lets us count how many different devices visited without knowing who you are.

We look at these numbers in aggregate. They are not used to profile individuals or to target you, and only totals leave MMA GALLA (see section 12).

12. What we measure, and what sponsors get

We use no cookies and no third-party trackers or advertising pixels to count visits. The counting is done by us, in our own database. The list at the end of this section says what we note for each visit.

Sponsors and our analytics partner receive only totals: for example how many visits saw a logo and how many pressed it, per place in the app or on the website. They never receive data about a person, such as a name, an e-mail address, a device number or an account.

Links from our app and website to sponsors and to Ticketmaster end with two labels: utm_source=mmagalla and utm_medium=referral, and often a label for the show and the place the link sat (for example utm_campaign=vol34). The labels only tell the other site that you came from MMA GALLA. They contain no personal data.

Which page or screen was opened, and for how long it was in front of you.
A random visit number and the anonymous device number described in section 11. If you are signed in, the visit can be tied to your account in our own database, so we can count how many different fans took part. We never show this to sponsors.
Whether you used a phone, a tablet or a computer, which of our two languages you read, and whether you opened the app from the home screen, in a browser or inside another app such as Instagram.
Where the visit came from: the address of the page you came from, or a short label on the link you pressed (for example from a poster, the TV screen or a post).
Whether you saw, or pressed, a sponsor logo or a ticket button. We do not store your IP address in these counts.

13. Transfers outside the EU/EEA

Some of our providers are based in, or may process data in, countries outside the EU/EEA, including the United States. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses, by an adequacy decision such as the EU-US Data Privacy Framework, or by another safeguard permitted under Chapter V of the GDPR.

You can ask us for details of the safeguards that apply by writing to info@mmagalla.com.

14. How long we keep it

Account and profile data: for as long as your account exists. If you delete your account we remove it, except where we must keep something by law.
Predictions, scores and leaderboard entries: kept for the event and for a reasonable period afterwards for records and statistics.
Chat and inbox messages: kept for the event and a limited period afterwards to handle disputes.
Medical and identity documents: deleted once the event is over and any legal or federation retention requirement has expired.
Face fingerprints: as long as we keep the photo they come from, or until you object or ask us to delete them; a face not yet linked to a fighter or coach who has accepted, only until that person accepts or objects (it only groups photos meanwhile).
Page-view counts: held in aggregate form and not used to build a profile of you.
Accounting records: kept for five years as required by Danish bookkeeping law.

15. Your rights

Under the GDPR you have the following rights. They are free to exercise, and we will respond within one month.

Access: get a copy of the personal data we hold about you.
Rectification: have inaccurate or incomplete data corrected. You can edit most of it yourself on your profile page.
Erasure: ask us to delete your data ('the right to be forgotten').
Restriction: ask us to pause our use of your data while a concern is resolved.
Portability: receive the data you gave us in a machine-readable format.
Objection: object to processing we carry out on the basis of legitimate interests.
Withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.

16. Deleting your account and data

You can ask us to delete your account and the personal data connected to it at any time by emailing info@mmagalla.com from the address on your account, with the subject line "Delete my data".

We will confirm your identity, delete your account, profile, predictions and messages, and confirm to you when it is done, normally within 30 days. Data we are legally required to keep, such as accounting records, will be retained until that obligation expires.

17. Cookies and local storage

The app is deliberately light on tracking. We do not use advertising cookies and we do not run third-party analytics that profile you across websites.

We store the following in your browser because the app cannot work without it:

Your sign-in session, so you stay logged in between visits.
A random visit identifier and a random device identifier, used only to count visits and different devices. They are not linked to your name or email. Clearing your browser's site data gives a new device identifier.
Small interface preferences, such as which tab you last opened, and which of the two languages you are reading.
Your acceptance of this policy, so we do not ask you again on every visit.

18. How we protect it

Data is transmitted over encrypted connections (HTTPS) and stored on managed infrastructure with access controls. Passwords are never stored in readable form. Access to fighter documents and to the admin tools is limited to staff who need it for their role in an event.

No system is perfectly secure. If a breach occurs that is likely to pose a risk to your rights, we will notify the Danish Data Protection Agency within 72 hours and inform you where the law requires it.

19. Children

The app is not directed at children under 15, which is the age of digital consent in Denmark. Fighters must be at least 18 to fight at MMA GALLA, so we do not take on fighters under 18. If you believe a child under 15 has given us data without the consent of a parent or guardian, contact us and we will remove it.

20. Complaints

If you are unhappy with how we handle your data, please contact us first. We would rather fix it directly. You also have the right to complain to the Danish Data Protection Agency:

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark
Telephone: +45 33 19 32 00
Website: datatilsynet.dk

21. Changes to this policy

We may update this policy as the platform develops. The date at the top of the page always shows the current version. If a change materially affects how we use your data, we will ask you to review and accept the policy again the next time you sign in.