Privacy statement
This statement explains how transferlink (“we”, “us”) handles personal data. It covers two different groups of people, and the rules differ for each: people who contact us or use our service, and the football decision-makers recorded in our database.
Object or request removal at any time: email privacy@transferlink.io. We respond within 30 days. If you are listed in our database and do not wish to be, we remove your record — no explanation required.
1. Who is responsible
| Controller | transferlink, operated from the Netherlands |
| Privacy contact | privacy@transferlink.io |
| Registration details | Provided on request, and in full to clients under contract |
2. If you contact us or use our service
What we collect
Name, agency, email address, phone number if you provide it, the markets you are interested in, and the content of your message. If you become a client we also process contract and billing details.
Why, and on what basis
- To answer your request and provide the service — necessary for performance of a contract, or for steps taken at your request before entering into one (Art. 6(1)(b) GDPR).
- To keep records for tax and accounting — legal obligation (Art. 6(1)(c) GDPR).
How long
Enquiries that do not lead to a relationship: 12 months. Client records: for the duration of the contract and 7 years afterwards, which is the retention period Dutch tax law requires for administration.
3. If you are listed in our database
Our service is a directory of the people responsible for squad building and transfers at professional football clubs — sporting directors, technical directors, directors of football and heads of recruitment. If you hold such a role, your record may appear in it. You are reading the notice required under Art. 14 GDPR.
What we record
- Name, job title, club, league and country
- The date the role started, where publicly stated
- Publicly listed professional contact details for the club or the role
- The source of each entry, the date it was verified, and a confidence rating
- Short factual notes about the role, such as contract length where publicly reported
We do not record private home addresses, private telephone numbers, dates of birth, financial data, or any special category data such as health, religion or political opinion.
Where it comes from
Records are built from publicly accessible professional sources: club websites, league and federation websites, official club announcements and press releases, publicly reported news, and public professional profiles. Every record carries the source it came from and the date it was checked.
Why we may process it
Our basis is legitimate interest (Art. 6(1)(f) GDPR). Football is a market in which clubs and intermediaries are expected to reach one another, and the data concerns people acting in a professional capacity, in a role whose entire purpose is to receive proposals about players. We limit ourselves to professional information, keep the dataset accurate and dated, and do not publish it openly. We have weighed this against your interests and consider the impact limited. You can ask us for our assessment.
Why you may not have heard from us directly
Art. 14(5)(b) GDPR allows notification through a public statement where informing each individual would require disproportionate effort. Contacting several thousand people individually across 201 countries, in dozens of languages, would be exactly that. This page is therefore our notice, kept permanently available and linked from every page of our website.
Who sees it
Access is licensed to a limited number of agencies under contract. They are contractually forbidden to resell, publish or redistribute records. We do not sell the database, we do not make it publicly searchable, and we do not transfer it to advertising networks or data brokers.
How long we keep it
For as long as the role is professionally current. When someone leaves a role we either update the record or remove it. If you object, we remove your record and add your details to a suppression list for the sole purpose of making sure the record is not re-added later — which is the only way to make a removal permanent.
4. Your rights
- Access — ask what we hold about you, including the source of each entry
- Rectification — have anything incorrect corrected
- Erasure — have your record deleted
- Restriction — have processing paused while a dispute is resolved
- Objection — object to processing based on legitimate interest. Where we process for direct marketing purposes, an objection is absolute and we stop immediately
- Portability — receive data you provided to us in a machine-readable form
Write to privacy@transferlink.io. We answer within 30 days and do not charge for a first request. If you are not satisfied you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the supervisory authority in your own country.
5. Cookies and website statistics
This website sets no cookies. It runs no advertising, no remarketing and no cross-site tracking, and it stores nothing on your device. Fonts and images are served from the page itself rather than from third parties, so simply visiting does not disclose your visit to anyone else.
We do measure how the site is used, with Cloudflare Web Analytics. It is a privacy-first service that works without cookies and without any client-side identifier, so it cannot follow you between sessions or between websites. It reports only aggregated statistics:
- Number of page views and visits
- Country of origin
- The referring website, where there is one
- Which pages were opened
- Device type, browser and operating system
No individual profiles are built, no data is sold, and nothing is shared with advertising networks. Our basis is legitimate interest (Art. 6(1)(f) GDPR) in understanding whether our own website works. Because no cookies or similar techniques are placed on your device, no consent banner is required for this.
6. Processors and hosting
Our website is hosted by Netlify, Inc. (United States), which processes server logs including IP addresses in order to deliver the site. Website statistics are processed by Cloudflare, Inc. (United States) as described above. Transfers outside the European Economic Area are covered by the European Commission's Standard Contractual Clauses. Email and administration are handled by our email provider. We use processors only under a data processing agreement.
7. Security
The database is not publicly accessible. Access is granted to named users at licensed agencies, and is withdrawn when a contract ends. Website traffic is encrypted with TLS.
8. Changes
We may update this statement. The date at the top shows when it last changed. Material changes affecting people in the database will be reflected here before they take effect.