Privacy Policy

Data Controller: Marcrist International Limited, registered in England and Wales under Company No. 03799367.

Registered address: Marcrist House, Kirk Sandall Industrial Estate, Doncaster, DN3 1QR, United Kingdom.

Data protection contact: info@marcrist.com

We are responsible for how we collect, use, and store your personal data. This policy explains our practices under the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

We collect the following when you use Marcrist Match Picks 2026:

• Email address. Used to create your account, sign you in, verify your identity, send transactional emails, and to send marketing communications from Marcrist (which you can unsubscribe from at any time). Encrypted at rest.
• Real name.Used for prize delivery and your public leaderboard entry if you don’t set a team name.
• Team name (optional). Displayed on the public leaderboard alongside your score.
• Trade or industry category. Helps us understand our user base and improve the service.
• Password (hashed). Stored only after you set one. Hashed using scrypt; we never see your actual password.
• Match predictions. Your outcome and score predictions for each fixture.
• Tiebreaker predictions. Your answers for tournament winner and Golden Boot.
• Email verification timestamp. Records when you verified your account.
• IP address. Used solely for rate limiting on signup, login, and password reset. Kept in a transient 24-hour cache, not stored permanently in our main database.
• Audit log entries. Administrative actions touching your record are logged with timestamp and reason.
• Email log entries. Every transactional email sent to you is logged: template, status, and timestamp.

Account management and sign-in

• To create your account and verify your email address.
• To authenticate you when you log in.
• To allow you to set and reset your password.

Running the competition

• To record, calculate, and score your match predictions.
• To compile and display the live leaderboard.
• To determine winners and administer prize fulfilment.
• To send you transactional emails (confirmation of picks, stage releases, deadline reminders, results, and final standings).

Service security and improvement

• To monitor and prevent fraud, abuse, and unauthorised access.
• To rate-limit signup, login, and password reset against brute-force attempts.
• To analyse aggregated, anonymised competition data to improve the service.
• To maintain audit logs of administrative actions for security and compliance.

Prize fulfilment

• If you win a prize, we share your name and email address with Marcrist staff to arrange delivery.

We will not use your data for any other purpose without first seeking your explicit consent.

We process your personal data on the following lawful bases:

• Contract and pre-contractual steps. Necessary to enter and deliver the competition (email verification, predictions, leaderboard, scoring, prize fulfilment).
• Legitimate interest. Fraud prevention, abuse detection, service security, transactional email delivery, and aggregated service-improvement analysis.
• Consent. If you tick the optional mailing-list checkbox when you create an account, Marcrist will add your email address to its mailing list and may send you marketing communications about products, future competitions, and news. Ticking the box is not a condition of entering the competition, and you can withdraw this consent and unsubscribe at any time using the link in any email or by contacting us.
• Consent (advertising cookies). The Meta (Facebook) Pixel on our public pages relies on your consent under the Privacy and Electronic Communications Regulations (PECR). You can refuse or withdraw it at any time through your browser and your Facebook and Instagram ad settings (see section 12).

Your personal data is shared only with the following:

• Brevo (Sendinblue). Email service provider for transactional emails. Receives your email address, name, and the email content. Brevo is EU-based and the transfer is covered by Standard Contractual Clauses.
• football-data.org. Third-party API for fixture and result data. No personal data is shared; only public fixture and competition identifiers.
• Marcrist International Limited staff. If you win a prize, your name and email are shared with Marcrist staff to fulfil the prize.
• Pixelish. A UK digital agency engaged by Marcrist as the technical operator of Marcrist Match Picks. Pixelish develops, deploys, and maintains the platform on Marcrist’s instructions and has restricted operational access to the application database for support and incident response.
• Meta Platforms Ireland Limited. Our public marketing pages run the Meta (Facebook) Pixel. When you visit, Meta receives information about your visit (the page viewed, your IP address, and browser and device details) so that Marcrist can measure its Facebook and Instagram advertising and show ads to people who have visited. Transfers to Meta in the United States are covered by the UK Extension to the EU-US Data Privacy Framework. See section 12 for details and how to opt out.
• Regulatory authorities. We may disclose data to law enforcement or regulators when required by law (e.g. court order).

Other than the limited information shared with Meta through the Meta Pixel (described in section 12), we do not sell, rent, or otherwise share your personal data with third parties for marketing or advertising purposes.

• Account and predictions. Kept for the duration of the competition and for 12 months after the final concludes. After that, your account and predictions are deleted unless you re-engage or a legal hold applies.
• Email logs. 24 months for deliverability auditing and troubleshooting.
• Audit logs. 24 months for security and compliance.
• Backups. Rolling 30-day retention cycle. After deletion from the live database, data is removed from backups within 30 days.
• IP address logs. Kept only in a 24-hour rolling cache for rate limiting; never stored permanently.

If you request deletion at any time, we will comply unless a legal hold or regulatory obligation applies.

• Encryption. Your email address is encrypted at rest using AES-256-CBC. Passwords are hashed using scrypt. All traffic between your browser and our server uses HTTPS (TLS).
• Session cookies. Set as HTTP-only, Secure, and SameSite=Lax to prevent cross-site attacks.
• Access control. Access to personal data is limited to Marcrist staff and trusted processors. Admin actions are logged and auditable.
• Data minimisation. We collect only the personal data necessary to run the competition.
• Limited third-party tracking. The only third-party tracker we use is the Meta (Facebook) Pixel on our public marketing pages, for advertising measurement (see section 12). We do not use Google Analytics or fingerprinting libraries.

While we take extensive measures to protect your data, no system is 100% secure. If you believe your data has been compromised, please contact us immediately at info@marcrist.com.

You will receive transactional emails for the following purposes:

• Email verification when you sign up.
• Password reset when you request one.
• Picks confirmation when you save changes to your predictions.
• Stage release when a new tournament stage opens.
• Deadline reminders when you have unfilled predictions before a kickoff.
• Results and scoring when a stage concludes.

Every transactional email includes a one-click List-Unsubscribe header (RFC 8058) and an in-body unsubscribe link. If you unsubscribe from transactional emails you may miss critical service messages such as password resets or results.

Marketing emails.If you ticked the optional mailing-list checkbox when you signed up, your email address is added to Marcrist’s mailing list and you may receive occasional marketing communications about Marcrist products, future competitions, and news. Every marketing email includes an unsubscribe link, and you can opt out at any time using that link or by contacting us at info@marcrist.com. Unsubscribing from marketing will not stop you receiving service-critical transactional emails such as password resets.

• Right of access. Ask us for a copy of the personal data we hold about you.
• Right of rectification. Ask us to correct inaccurate or incomplete data. You can update your own name and team name in your account settings.
• Right of erasure. Ask us to delete your data. We will comply unless a legal obligation requires us to keep it. If you ask during an active competition, we may anonymise rather than delete your entry to preserve leaderboard integrity.
• Right to restrict processing. Ask us to limit how we use your data (e.g. while a dispute is resolved).
• Right to data portability. Ask us to provide your data in a portable format (CSV or JSON).
• Right to object. Object to processing based on legitimate interest.
• Right to withdraw consent. Where we rely on consent (such as future marketing), you can withdraw it at any time.
• Right to complain.Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, email info@marcrist.com. We’ll respond within 30 days (up to 90 days for complex or repeated requests).

Marcrist Match Picks 2026 is intended for adults. We do not knowingly collect personal data from anyone under 18. If we discover that we have, we will delete it immediately.

Your personal data is stored in the United Kingdom and the European Economic Area (EEA). Where a processor (such as Brevo) processes data outside the UK, the transfer is protected by Standard Contractual Clauses approved by the UK Information Commissioner’s Office.

We use cookies in two categories:

Strictly necessary

• NextAuth session cookie. Keeps you signed in. HTTP-only, Secure, SameSite=Lax. Expires when you log out or your session ends. This cookie is essential for the service to function and does not require consent.

Advertising and measurement

• Meta (Facebook) Pixel. On our public marketing pages (for example the landing page, sign-up, and leaderboard) we run the Meta Pixel, which sets cookies such as _fbp and sends Meta information about your visit: the page you viewed, your IP address, and your browser and device details. Marcrist uses this to measure its Facebook and Instagram advertising, to show ads to people who have visited the site, and to reach similar audiences. The pixel is not used on the staff site or in the signed-in admin area.

Who receives this data: Meta Platforms Ireland Limited, and Meta Platforms, Inc. in the United States. Meta processes pixel data as a controller under its own terms; transfers to the United States are covered by the UK Extension to the EU-US Data Privacy Framework.

Lawful basis and your choice: advertising cookies are not strictly necessary, so we rely on your consent under the Privacy and Electronic Communications Regulations (PECR). You can control or refuse them through your browser cookie settings, your Facebook and Instagram ad preferences (Settings, then Ads), and industry opt-out tools such as youronlinechoices.com. Refusing these cookies does not affect your ability to enter or use the competition.

We may update this policy from time to time to reflect changes in law, best practice, or our service. If we make changes that materially affect your rights, we will notify you by email at least 30 days before the change takes effect. Your continued use of the service after a change means you accept the updated policy.

If you have questions about this policy or wish to exercise your rights:

• Email: info@marcrist.com
• Post: Marcrist International Limited, Marcrist House, Kirk Sandall Industrial Estate, Doncaster, DN3 1QR, United Kingdom.

We will respond within 30 days.

You can also contact the Information Commissioner’s Office (ICO) directly:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post:Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 8QG.