Privacy Policy — Gokulam Kerala FC

Gokulam Kerala FC (“GKFC”, “we”, “us”) respects your privacy. This policy explains what personal data we collect when you use this website, why we collect it, and what choices you have.

Last updated: 12 October 2026

1. Who we are

Gokulam Kerala FC is a football club registered in India, with its office at No.2, EMS Corporation Stadium, SK Temple Road, Kozhikode – 673004, India. For any privacy question or request, contact us at gkfcweb@gmail.com.

2. What we collect

We only collect what we need to run the site and the BATTALIA fan programme.

Fan account data (BATTALIA). When you register for a free fan account we collect your first name, last name, email address, Indian mobile number, and a securely hashed version of your password. We also record whether you have verified your email address, your points total, your fan level, and your activity history (for example sign-in streaks and rewards you have claimed).
Consent record. We store the fact that you accepted our Terms of Service and this Privacy Policy, the version of those terms you accepted, and the date and time you accepted them.
Order data. If you buy tickets or merchandise we collect your billing name, delivery address, email address, phone number and order contents. Payment card details are handled by our payment provider and are never stored on this website.
Match discussion data. When you post in a match discussion we store your message, any photo you attach, your display name and profile photo, the reaction you choose, and the IP address of the device you posted from (for security and moderation).
Technical data. Our server logs record your IP address, browser and device type, the pages you visit, and the time of your visit. This is used for security and to keep the site running.
Communications. If you contact us or enter a giveaway, quiz or poll, we keep your message and your entry.

We do not knowingly collect personal data from anyone under 13 years of age.

3. Why we use it

To create and operate your fan account, and to keep you signed in.
To send you a one-time verification code by email, so we can confirm an address really belongs to you. This is required to keep fan accounts secure.
To send you a password reset code if you ask us to.
To calculate and award BATTALIA points, badges, leaderboard positions and rewards, and to publish your fan name and points on public leaderboards.
To run the match discussions: publish your messages and photos to other verified members, and notify you of replies and reactions.
To process and deliver your ticket or merchandise orders, and to provide support.
To prevent fraud, abuse and spam, and to keep the site secure.
To meet our legal, tax and accounting obligations.

We rely on your consent for accepting these terms, on performing the contract of providing you with the service you asked for, on our legitimate interests in operating and securing the club’s website, and on legal obligations where applicable.

4. Verification codes and email

When you register, we email you a six-digit code to confirm your email address. Until that code is entered, your account is not fully active and you cannot open your dashboard. Password resets work the same way. Each code is short-lived, can only be used once, and is deleted as soon as it is used.

We do not send marketing email unless you separately ask us to. Every message we send as part of your account (verification, password reset, ticket delivery) is transactional and necessary to operate your account.

5. Public leaderboards

The BATTALIA leaderboard is public. It shows your display name, your fan level and your points total. It does not show your email address, phone number, or any other contact detail. You may ask us to remove or rename your leaderboard entry at any time.

6. Match discussion: messages and photos

The match discussion opens after each finished match, only for members who are signed in with a verified email address. The discussion pages are not listed in search engines and cannot be viewed by guests. When you post, other members see your display name, your profile photo (or your initials), your message, any photo you attach, your reaction and the time — never your email address or phone number.

Photos. You may attach one image per post: JPEG, PNG or WebP up to 8 MB. We resize it to a maximum width of 450 pixels and re-encode it before storing it under a random file name. Photos are served from a public address, so anyone who has the direct link can view the image even without signing in — only attach pictures you are happy to be reachable that way.
Your control. You can edit or delete your own messages at any time. Deleting removes the message from everyone’s view. Edited messages carry an “Edited” marker. You can also delete your account before its discussion history is anonymised (section 10).
Moderation. Every post carries a report button with a fixed list of reasons. Club staff review reports and can hide or remove posts. Posting is limited to a few messages per minute, message text is limited to 2,000 characters, and HTML is stripped so only plain text is published. Our Terms of Service’ acceptable-use rules apply to everything you post.
Notifications. When someone replies to or reacts to your post, we send you an in-app notification that includes that member’s display name and the opening words of their message. If you use the Android app with notifications enabled, the same notice is delivered as a push notification through Google Firebase. Discussion content is never sent to you or anyone else by email.

7. Cookies

We use a small number of cookies to keep the site working:

Essential. A session cookie that keeps you signed in to your fan account, and a cookie that protects forms against automated abuse. The site cannot work properly without these.
Cart and checkout. Cookies that remember what is in your shopping cart and your checkout progress.
Analytics. Where enabled, cookies that tell us in aggregate which pages are useful, so we can improve the site. You can decline these in your browser or a cookie banner.

We do not use advertising cookies and we do not sell your data to advertisers.

8. Sharing your data

We do not sell or rent your personal data. We share it only with the service providers who help us operate the site, and only to the extent needed:

Our web hosting and email delivery providers, who store the data on our behalf.
Google Firebase, which delivers push notifications to the Android app. It receives the notification text and an anonymous device token — no contact details.
Our payment provider, to take payment for your order.
Couriers and ticket delivery partners, to fulfil your order.
Law enforcement or regulators, where we are legally required to disclose.

9. How long we keep it

We keep fan account data for as long as your account is active. When you delete your account (section 10), your profile and reward records are removed straight away, except for the records listed there. Order records are kept for the period required by Indian tax and accounting law. Verification and password reset codes expire within minutes of being created. Technical identifiers we use for security, such as IP addresses and device tokens, are blanked after 90 days.

10. Deleting your account

You can delete your account yourself from the Fan Settings page: choose “Delete account”, type DELETE and confirm your password. The deletion happens immediately and cannot be undone. If you cannot sign in, contact us and we will help you.

What is removed: your name, email address, mobile number, date of birth, gender, location, profile photo, password, points, level, sign-in streak, badges, rewards and vouchers you claimed, notifications, activity history, referral records, saved sessions, verification codes, and any tickets or bookings made through your account.

What we keep, and why:

Payment and order records we must keep for tax, accounting or legal reasons. We never hold your card details; those stay with our payment provider.
Security and anti-cheat records that help us detect fraud and abuse. IP addresses and device tokens in those records are blanked after 90 days.
Your match discussion messages and photos, so conversations you were part of are not broken. They are no longer linked to your name — they appear as “BATTALIA Fan”. If you prefer, delete your own messages before you delete your account.

11. How we protect it

Your password is never stored in readable form – only a salted one-way hash. The site is served over encrypted HTTPS. Access to fan records is limited to club staff who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

12. Your rights

You can ask us at any time to:

Tell you what personal data we hold about you, and give you a copy.
Correct anything inaccurate.
Delete your account and erase your personal data (see section 10).
Stop you appearing on the public leaderboard.
Withdraw your consent, where our use relies on consent.

Email gkfcweb@gmail.com and we will respond within 30 days. You also have the right to complain to the relevant data protection authority.

13. Children

The site is not directed at children under 13. If you believe a child has given us personal data, contact us and we will delete it.

14. Security of external links

Our privacy policy applies only to this website. Pages or payment pages operated by third parties have their own policies, which we recommend you read.

15. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top always reflects the current version. Where a change is significant, we will tell you through the site or by email.