Privacy policy
Last updated 31 October 2026
This policy explains what personal data Elite Pass collects through elitepassnetwork.com, why, on which legal basis, who receives it, how long we keep it and how you can exercise your rights. Elite Pass works with organisations, youth football academies and tournament organisers, so most of the people we hear from are coaches, directors and staff writing on behalf of their club or event.
Who we are
The controller of your personal data is Magus Group Albania SHPK, registered in Albania under tax number (NIPT) L92228018L, with its registered office at Linzë, Bldg. 30, Entr. 31, Apt. 52, Dajti, 1040 Tirana. Elite Pass is the trading name under which it runs this website and its services, and it is part of Magus Group.
For anything about your personal data, write to management@elitepassnetwork.com. Our activities do not require a data protection officer, so we have not appointed one: this address reaches the person in our team responsible for data protection.
Because we offer our services to academies and organisers in the European Union, the GDPR also applies to how we handle their data (its Article 3(2)). We have not appointed a representative in the European Union: our processing is occasional, does not include special categories of data on a large scale and is unlikely to put anyone's rights at risk (GDPR Article 27(2)). People in the European Union can write to us directly at the address above.
Who this policy covers
This policy covers:
- visitors to elitepassnetwork.com;
- people who send us a request through the website's forms or write to the addresses published on it;
- contacts at academies and tournament organisers with whom we discuss a tournament entry or a listing.
When an academy or an organiser signs an agreement with us, the agreement and the information we give with it explain how we handle the data needed to carry it out. This policy does not cover other websites, including the sites of the tournaments and partners we link to.
The personal data we collect
When you send a request
The forms on the website (contact, academy request and tournament listing) ask for:
- your name and email address (required);
- your phone number, the name of your academy or organisation, your country and your role (optional);
- your message (required);
- for an academy's request, also the tournament you are interested in, the age groups you would bring (for example U13 or U15), the number of players and your preferred dates;
- the language of the page, the address of the page you sent the form from and the date and time;
- your confirmation that you have read this policy;
- your IP address, and the result of the automated check that the form was sent by a person (see "Security checks" below).
We then keep a record of how we handle your request: its status, the member of our team handling it, our internal notes and the replies we send you.
If you write to us by email or phone instead, we receive what you choose to tell us and your contact details.
When you browse the website
Like any website, our server receives the technical data your browser sends with every request: your IP address, the address of the page, the time, your browser and device type and the page you came from. We use it to deliver the pages, to keep the site secure and to find faults.
With your consent only, we also use analytics tools (Google Analytics and Microsoft Clarity) that use cookies to measure how the website is used, and an error-reporting tool in your browser (Sentry). The cookie policy lists every cookie and how to change your choice.
We do not use these tools to identify you, and we never pass your name, email address, phone number, organisation or message to them.
Security checks
To keep automated spam out of the forms, they are protected by Cloudflare Turnstile, which checks in the background that the form is sent by a person. For this check, Cloudflare processes technical data about your browser and connection, including your IP address. We only receive the result of the check.
Players and children
The website is meant for adults acting for academies and tournament organisers. We do not ask for, and do not want to receive, personal data about players through the website: no names, dates of birth, photos, passport details, health information or other details of individual players.
The age groups (for example U12 to U19) and the number of players in an academy's request describe the team as a whole, so that we can match it with tournaments of the right category. They do not identify any player.
Please do not include players' personal data in your message or attachments. If we receive it anyway, we delete it and do not use it, and we ask the sender to share it again only through the channel agreed for a confirmed entry. Where a confirmed tournament entry later requires a list of players (for example for accreditation), the academy sends it to the organiser through the organiser's own registration. If an organiser asks us to pass a list on, we do so only for that entry, on the academy's instructions and under our agreement with it: we act on the academy's behalf, the academy is responsible for the legal basis, including the consent of parents or guardians where required, and we delete our copy within 30 days after the tournament ends.
We do not knowingly collect personal data from children through the website. If you believe a child has sent us their personal data, write to management@elitepassnetwork.com and we will delete it.
Photos on the website, including photos of matches and players, come from licensed photo libraries or from organisers and academies that hold the necessary permissions. We publish photos from real tournaments only when the organiser or academy that provides them confirms in writing that it holds the rights to them and the permissions of the people who can be recognised, including those of a parent or guardian for players under 16. If you see yourself or your child in a photo and want it removed, write to management@elitepassnetwork.com and we will take it down.
Why we use your data, and our legal basis
We process personal data under Albanian Law no. 124/2024 "On personal data protection" and, for people in the European Union, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). The table gives each legal basis with its GDPR article; the matching bases of Law no. 124/2024 are in its Article 7(1): consent (a), a contract or the steps before one (b), a legal obligation (c) and a legitimate interest (dh).
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your request and following it up: proposing tournaments to an academy, discussing a listing with an organiser, preparing an offer | Your request and the record of how we handle it | Our legitimate interest in answering the people who contact us and in developing business with academies and organisers (GDPR Art. 6(1)(f)). Where you contact us for yourself, for example as a sole trader, the steps you ask for before a contract (Art. 6(1)(b)) |
| Sending you a confirmation that we received your request, and notifying our team | Your name, email address and request | The same legitimate interest (Art. 6(1)(f)) |
| Telling an organiser that an academy wants to take part in its tournament, at the academy's request | The academy's details and the contact details of the person in charge | The same legitimate interest, and the academy's request (Art. 6(1)(f)) |
| Keeping the forms and the website secure: blocking spam and abuse, investigating misuse | IP address, the result of the Turnstile check, technical data | Our legitimate interest in protecting the website and our inbox (Art. 6(1)(f)) |
| Running the website and fixing errors on the server | Technical data, error reports without names or contact details | Our legitimate interest in a working website (Art. 6(1)(f)) |
| Measuring how the website is used (analytics) and reporting errors from your browser | Cookie identifiers, pages visited, device and approximate location, interactions | Your consent (Art. 6(1)(a)), which you can withdraw at any time in "Cookie settings" |
| Keeping records when a request leads to an agreement, and meeting our legal obligations (for example accounting and tax) | Contract and invoicing data | The agreement (Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | The records concerned | Our legitimate interest (Art. 6(1)(f)) |
The forms ask you to confirm that you have read this policy. That confirmation is not consent: we answer your request on the bases above.
Where we rely on our legitimate interest, we have weighed it against your interests and rights: we collect only what we need to answer a business request, keep it for a limited time and never use it to build a profile of you. You can object to this processing at any time (see "Your rights").
The name, email address and message are needed to answer you; without them we cannot handle your request. Everything else in the form is optional.
We do not send newsletters or advertising emails, and we do not add you to any mailing list. After you contact us, we may write to you about tournaments that fit the request you sent us, as a follow-up to it; you can ask us to stop at any time, and we will. We never send business emails to people who have not contacted us.
We do not make decisions about you based solely on automated processing, and we do not sell your personal data.
Who receives your data
Our team
Your request is read by the members of our team who handle requests and tournament entries, through our administration area. Access is limited to the people who need it.
Tournament organisers and academies
When an academy asks us to arrange its entry in a tournament, we share with the organiser what the entry requires, usually the academy's name, its teams and the contact details of the person in charge. When an organiser lists a tournament, we present the tournament to academies. We share these details only for the request concerned, and the organiser or academy then uses them under its own responsibility and its own privacy policy.
Service providers
These providers process personal data on our behalf, under our instructions and a data processing agreement:
| Provider | What it does for us | Where the data is processed |
|---|---|---|
| Hetzner Online GmbH | Our dedicated server, managed with the fastpanel control panel: hosts the website, its database (including requests) and our email mailbox | Germany (European Union) |
| Cloudflare, Inc. | Runs the website's domain name service, checks the forms (Turnstile) and stores our encrypted backups (Cloudflare R2); when it serves the website through its network to protect it, every request to the website, with your IP address, passes through it | Cloudflare's global network; backups in the European Union (R2 bucket in the EU jurisdiction) |
| Google Ireland Limited and Google LLC | Google Tag Manager, and Google Analytics with your consent only | European Union and United States |
| Microsoft Corporation | Microsoft Clarity, with your consent only | United States and other countries where Microsoft operates |
| Functional Software, Inc. (Sentry) | Error reports from the server, and from your browser with your consent only; we send no names, contact details or IP addresses | European Union (Sentry's EU region, Germany) |
Our administration area can use artificial-intelligence services to help translate and describe the website's own texts and images. This feature is switched off at the moment; if we switch it on, we will name the providers here first. Those services receive only content we publish on the website; they never receive the requests you send us or your contact details.
Our team signs in to the administration area through Magus ID, the sign-in service of Magus Group. It processes only the data of our own staff, not that of visitors.
Others
We may disclose personal data when the law requires it, to a court or public authority, or to protect our rights, and, if our business or part of it is transferred, to the new owner, who must respect this policy.
Transfers outside Albania and the European Union
We are based in Albania, and our website and database are hosted as described above. When you send us a request from the European Union, you send your data directly to us in Albania; the GDPR still applies to how we handle it.
Some of our service providers (Google, Microsoft, Cloudflare and Sentry) are based in the United States or also process data there. We transfer data only to countries the Commissioner recognises as ensuring adequate protection (Article 40 of Law no. 124/2024) or under the safeguards of its Article 41, such as standard contractual clauses; for people in the European Union, under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses included in these providers' data processing terms.
You can ask us for a copy of the safeguards that apply by writing to management@elitepassnetwork.com.
How long we keep your data
| Data | How long |
|---|---|
| Requests sent through the forms, with our notes and replies | 24 months after the last activity on the request (our last reply or the last change to it in our inbox), then deleted automatically |
| Requests identified as spam | 30 days |
| The IP address of a request | 90 days, then erased from the request automatically |
| Copies of requests and replies in our team's mailboxes | No longer than the request itself: we delete them from the mailboxes when the request is deleted from our inbox |
| Data needed for an agreement that follows a request | For as long as the agreement lasts and up to 5 years after it ends; invoices and accounting records for 10 years, as Albanian accounting and tax law requires |
| Error logs of the website | 14 days |
| Access logs of the web server | 10 days |
| Records of changes made in our administration area (who changed what; never the content of requests) | 12 months |
| Backups of the website and its database (encrypted) | Daily backups for 30 days, then one backup a month for 12 months. Data deleted from the website therefore disappears from the last backup at most about 13 months later; backups are used only to recover from a failure |
| Analytics data (Google Analytics) | 14 months |
| Analytics data (Microsoft Clarity) | Recordings 30 days; heatmaps and other data 13 months |
| Error reports (Sentry) | Up to 90 days |
| Cookies | As listed in the cookie policy |
We may keep data longer when we need it to establish, exercise or defend a legal claim, and only for that purpose.
Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data, when we no longer need it or you object and no overriding reason applies;
- restrict our use of your data while a question about it is being settled;
- receive your data in a common machine-readable format and have it sent to another organisation, where we process it on the basis of your consent or a contract;
- object at any time to our use of your data based on our legitimate interest, and to its use for marketing;
- withdraw your consent at any time, without affecting what we did before. For cookies, use "Cookie settings" at the bottom of every page.
To exercise a right, write to management@elitepassnetwork.com from the email address you used with us, or tell us how we can confirm that the request comes from you. We answer within one month; if the request is complex we may extend this by up to two more months and will tell you why. Exercising your rights is free, unless a request is clearly unfounded or excessive.
Complaints
If you think we have not handled your data properly, please tell us first at management@elitepassnetwork.com so we can try to put it right.
You also have the right to complain to a supervisory authority:
- in Albania, the Commissioner for the Right to Information and Personal Data Protection (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale, IDP), Rr. "Abdi Toptani", Nd. 5, 1001 Tirana, info@idp.al, www.idp.al, under Article 86 of Law no. 124/2024;
- if you live or work in the European Union, or the problem happened there, the data protection authority of that country. The European Data Protection Board lists them at www.edpb.europa.eu.
How we protect your data
We use technical and organisational measures suited to the data we hold, including:
- encrypted connections (HTTPS) to the whole website, and a strict content security policy;
- access to the administration area only for authorised members of our team, through a central sign-in, with two-step verification for administrators;
- automatic deletion of requests, spam and IP addresses at the end of the periods above;
- records of changes in the administration area that never contain the content of requests;
- encrypted backups, with a restore test every week;
- analytics and error reporting configured not to collect names, contact details or the content of forms (text and form fields are masked in Microsoft Clarity).
No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will inform you and the competent authority as the law requires.
Changes to this policy
We update this policy when we change what we collect, the providers we use or the law changes. The date at the top shows the last update. If a change matters for you, for example a new purpose, we will tell you on the website or by email before it applies.
Contact
Magus Group Albania SHPK, Linzë, Bldg. 30, Entr. 31, Apt. 52, Dajti, 1040 Tirana
Privacy questions and requests: management@elitepassnetwork.com
General enquiries: management@elitepassnetwork.com