Privacy policy
We collect what we need to run a live MMA event and nothing more. We do not sell your data and we do not use advertising trackers. You can see, correct, export or delete your data at any time. The terms for using the app are in our terms of service.
1. Who we are
MMA GALLA ApS ("MMA Galla", "we", "us") is the data controller for the personal data described in this policy. We operate the MMA Galla event platform at mmagalla.live and the website at mmagalla.com.
You can reach us about anything in this policy at info@mmagalla.com.
- Company: MMA GALLA ApS
- Address: Fjordsgade 6, tv., 5000 Odense C, Denmark
- CVR: 44216183
- Email: info@mmagalla.com
2. What this policy covers
This policy explains what we collect when you use the MMA Galla live event app: creating an account, following a fightcard, predicting results, taking part in the leaderboard, chatting during an event, or redeeming a coupon.
It also covers the additional information we collect from fighters, coaches and event staff, who are asked for more than a normal spectator is.
3. What we collect
We only collect what the platform needs to run an event. The categories below reflect exactly what the app stores.
- Account data: your email address, and a password if you create one. If you sign in with Google or Facebook we receive your name, email address and profile picture from them. We never receive your Google or Facebook password.
- Profile data: your username, display name, profile picture, and the contact email you choose to show. Staff and coaches may additionally provide a role/title, phone number and Instagram handle for their contact card.
- Event participation: your fight predictions, scorecards, leaderboard position, coupon redemptions, and any feedback you submit.
- Messages: the content of messages you send in event chat or the event inbox, and any attachments.
- Technical data: a randomly generated session identifier stored in your browser, the pages you open in the app, and standard server logs. This is used to count how many people viewed each screen during an event.
- Date of birth: optional, and used for one purpose only, which is confirming you are 18 or over before we show links to licensed betting operators. It is never shown to other users.
- Fighter and coach data (for people competing at or working an event): name, date of birth, nationality, club, weight, height, reach, stance, fight record, and contact details.
4. Health and identity documents (fighters only)
If you compete at an MMA Galla event, we may ask you to upload documents that the event and the relevant federation require before you are allowed to fight. These can include a doctor's clearance letter, blood test results, a signed waiver, a licence or federation card, and a copy of your ID or passport.
Medical documents are 'special category' personal data under Article 9 of the GDPR, and identity documents are highly sensitive. We treat both with additional care:
- We ask for them only where an event, a federation or a regulator requires them.
- We process them on the basis of your explicit consent, and where applicable for reasons of substantial public interest in the field of sport and athlete safety.
- Access is restricted to the event staff who need it to approve your participation.
- You may withdraw your consent at any time, though we may then be unable to approve you to compete.
- They are deleted once they are no longer needed for the event and any applicable legal retention period has passed.
5. Why we use it, and our legal basis
Under the GDPR we must have a legal basis for every use of your data. Ours are set out below.
| What we do | Why | Legal basis |
|---|---|---|
| Create and secure your account | So you can sign in and we can keep your account safe | Contract (Art. 6(1)(b)) |
| Show your name and picture on the leaderboard and in chat | So the event is social and other fans can recognise you | Contract (Art. 6(1)(b)) |
| Record your predictions and scores | To run the prediction game and rank participants | Contract (Art. 6(1)(b)) |
| Send you event notifications | To tell you when a fight is starting or a result is in | Contract (Art. 6(1)(b)), as part of the event app you signed up for. On by default; turn them off any time in your profile |
| Count page views during an event | To understand which screens are used, so we can improve them | Legitimate interests (Art. 6(1)(f)) |
| Publish fighter profiles and records | To promote the event and inform the audience | Legitimate interests (Art. 6(1)(f)) / contract for fighters |
| Handle medical and identity documents | To meet event, federation and safety requirements | Explicit consent (Art. 9(2)(a)) |
| Keep accounting and legal records | Because the law requires it | Legal obligation (Art. 6(1)(c)) |
7. What we do not do
It is worth being explicit about this, because many apps do the opposite:
- We do not sell your personal data, or share it with data brokers.
- We do not use your data for advertising, and we run no advertising or cross-site tracking cookies.
- We do not send you marketing unless you have explicitly opted in with a separate, unticked checkbox, and you can withdraw it in one click from your profile.
- We do not build behavioural or advertising profiles of you.
- We do not read your Facebook posts, photos, friends or likes. When you sign in with Facebook we ask only for your name, profile picture and email address.
- We do not use your data to train machine learning models.
8. Where your data is stored, and what each part is for
All application data is stored in our Supabase project (a managed PostgreSQL database with file storage) and served through Vercel. The table below is a plain-language summary of what is held there.
| Stored | What it is for | Used for marketing? |
|---|---|---|
| Email address and password hash | Signing you in and securing your account | No |
| Username, name, profile picture | Showing who you are on the leaderboard and in chat | No |
| Contact email, phone, title, Instagram (staff/coaches only) | The contact card other event staff can see | No |
| Fight predictions and scores | Running the prediction game and the leaderboard | No |
| Chat and inbox messages | Delivering messages during an event | No |
| Coupon assignments and redemptions | Checking a coupon is valid and used once | No |
| Page-view counts (anonymous session id) | Statistics: how many people opened each screen | No |
| Feedback you submit | Improving the event. Quoted publicly only if you tick the box | Only with your consent |
| Fighter profiles and records | Publishing the fightcard and promoting the event | Event promotion |
| Medical and identity documents (fighters) | Meeting event and federation requirements | No |
9. Marketing and advertising
We advertise MMA Galla events on platforms such as Meta and Google. Two things are worth separating out, because they work very differently.
Ordinary advertising: we buy ads using those platforms' own targeting tools (location, interests, and so on). This uses no personal data from your account, and nothing about you is sent to them.
Marketing to you directly: we only email you about upcoming events if you have explicitly opted in. That opt-in is a separate, unticked checkbox. It is never bundled with accepting this policy, and never a condition of using the app.
If you opt in, we may also add your email address to a Custom Audience on Meta or Google so we can reach you and people like you with event announcements. Your address is hashed (SHA-256) before it leaves our systems, so the platform never receives it in readable form. This happens only with your consent, and we refresh the list before each campaign so withdrawals take effect.
You can withdraw at any time from your profile page. Withdrawal takes effect immediately and does not affect anything sent beforehand.
- Legal basis: consent (GDPR Art. 6(1)(a)), and Section 10 of the Danish Marketing Practices Act.
- We do not sell your data, and we do not share it with data brokers.
- We do not use information from your Facebook or Google account for advertising. When you sign in with them we receive only your name, email and picture, and we use those solely to set up your profile.
10. Statistics
We count how many times each screen in the app is opened during an event, so we know which parts are actually used. This uses a randomly generated identifier stored in your browser, not your name, email or account.
We look at these numbers in aggregate. They are not used to profile individuals, are not shared with advertisers, and are not combined with your account data to target you.
11. Transfers outside the EU/EEA
Some of our providers are based in, or may process data in, countries outside the EU/EEA, including the United States. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses, by an adequacy decision such as the EU-US Data Privacy Framework, or by another safeguard permitted under Chapter V of the GDPR.
You can ask us for details of the safeguards that apply by writing to info@mmagalla.com.
12. How long we keep it
- Account and profile data: for as long as your account exists. If you delete your account we remove it, except where we must keep something by law.
- Predictions, scores and leaderboard entries: kept for the event and for a reasonable period afterwards for records and statistics.
- Chat and inbox messages: kept for the event and a limited period afterwards to handle disputes.
- Medical and identity documents: deleted once the event is over and any legal or federation retention requirement has expired.
- Page-view counts: held in aggregate form and not used to build a profile of you.
- Accounting records: kept for five years as required by Danish bookkeeping law.
13. Your rights
Under the GDPR you have the following rights. They are free to exercise, and we will respond within one month.
- Access: get a copy of the personal data we hold about you.
- Rectification: have inaccurate or incomplete data corrected. You can edit most of it yourself on your profile page.
- Erasure: ask us to delete your data ('the right to be forgotten').
- Restriction: ask us to pause our use of your data while a concern is resolved.
- Portability: receive the data you gave us in a machine-readable format.
- Objection: object to processing we carry out on the basis of legitimate interests.
- Withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
14. Deleting your account and data
You can ask us to delete your account and the personal data connected to it at any time by emailing info@mmagalla.com from the address on your account, with the subject line "Delete my data".
We will confirm your identity, delete your account, profile, predictions and messages, and confirm to you when it is done, normally within 30 days. Data we are legally required to keep, such as accounting records, will be retained until that obligation expires.
16. How we protect it
Data is transmitted over encrypted connections (HTTPS) and stored on managed infrastructure with access controls. Passwords are never stored in readable form. Access to fighter documents and to the admin tools is limited to staff who need it for their role in an event.
No system is perfectly secure. If a breach occurs that is likely to pose a risk to your rights, we will notify the Danish Data Protection Agency within 72 hours and inform you where the law requires it.
17. Children
The app is not directed at children under 15, which is the age of digital consent in Denmark. If a competitor at an event is under 18, we require the consent of a parent or guardian before processing their data. If you believe a child has given us data without that consent, contact us and we will remove it.
18. Complaints
If you are unhappy with how we handle your data, please contact us first. We would rather fix it directly. You also have the right to complain to the Danish Data Protection Agency:
- Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark
- Telephone: +45 33 19 32 00
- Website: datatilsynet.dk
19. Changes to this policy
We may update this policy as the platform develops. The date at the top of the page always shows the current version. If a change materially affects how we use your data, we will ask you to review and accept the policy again the next time you sign in.