EnskAI Privacy Notice
Last updated: 29 October 2026
This notice explains how EnskAI processes personal data: on our website, in the EnskAI platform, and in the football data the platform provides. It replaces our earlier website and platform privacy policies.
1. Who we are
EnskAI Ltd, a company registered in Bulgaria under company number 205816543, with its registered office at 71 Struga Street, Sofia 1233, Bulgaria.
For any question or request about your personal data, write to support@enskai.com. Our data protection lead will answer.
2. Who this notice covers
| You are | What we hold | Our role |
|---|---|---|
| A visitor to ensk.ai, or someone who contacts us or books a demo | what you send us, and how you use the site | controller (section 3) |
| A user of the EnskAI platform | your account, how you use the platform, billing | controller (section 4) |
| A footballer, coach, member of club staff or agent | professional football information about you | controller (section 5) |
| Someone at a football agency or club we may work with | your business contact details | controller (section 6) |
| Someone whose data an agency puts into the platform | whatever the agency enters | the agency is the controller and we are its processor (section 7) |
3. Visitors to our website and people who contact us
What we hold
- What you send us: your name, organisation, email address, phone number and your message, for example when you book a demo or write to us by email or WhatsApp.
- Log data our hosting provider records for every visit: IP address, browser, pages visited, date and time, and the page you came from.
- Analytics data, through cookies (see Cookies below).
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to you and arranging a demo | steps you ask for before a contract (Article 6(1)(b) GDPR), or our legitimate interest in answering enquiries (Article 6(1)(f)) |
| Running and securing the site, and preventing misuse | legitimate interests (Article 6(1)(f)) |
| Measuring how the site and our campaigns perform | legitimate interests (Article 6(1)(f)) |
| Sending you news about EnskAI | legitimate interests, or your consent where the law requires it; you can opt out at any time |
Cookies. The site uses cookies that keep it working, and Google Analytics and Google Ads cookies that measure how the site and our campaigns perform. Google Analytics cookies last up to two years. You can block or delete cookies in your browser settings at any time.
4. Users of the EnskAI platform
What we hold: your name, email address, phone number (optional), role and organisation; login details (passwords are stored only as secure hashes by our authentication provider); records of what you do in the platform (activity, security and audit logs); your messages to our support; and your organisation's billing details. We need your name and email address to give you an account.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing your account and the platform under your organisation's agreement | contract (Article 6(1)(b)) |
| Keeping the platform secure, keeping audit logs and answering support requests | legitimate interests (Article 6(1)(f)) |
| Understanding how the platform is used, through product analytics that record activity such as pages visited and clicks | legitimate interests (Article 6(1)(f)) |
| Invoicing and keeping accounting records | legal obligation (Article 6(1)(c)) |
AI assistants you connect yourself. If you connect the platform to an external AI assistant, the data you ask it for is sent to that provider at your request and handled under that provider's own terms.
5. Footballers, coaches, club staff and agents
The EnskAI platform includes professional football information about players, coaches, club staff and agents, which we provide to the football agencies that use EnskAI. We decide what this information contains and where it comes from, so we are its controller. This section is for you if you work in professional football.
What we hold
- Identity: name, photo where a licensed data provider supplies one, date of birth, nationality and citizenships.
- Playing profile: positions, preferred foot, height and weight.
- Career: current and past clubs; transfers and loans with their dates and reported fees; contract end dates as published; market value estimates; the agency publicly recorded as representing a player.
- Performance: appearances, minutes, goals, and match and season statistics and ratings.
- For coaches and club staff: role, club, career history and job changes.
- Published news and transfer reports about your professional situation.
- Injury status, where it has been publicly reported (see Injuries below).
What we do not hold: contact details, home addresses, salaries, bank details, or anything about your private life.
Where it comes from
- Licensed football data providers: Hudl Wyscout and Sportmonks.
- Publicly available football websites, such as those of governing bodies and competitions, clubs, agent registers published by national associations, football agencies' own websites, football news outlets, and local and club news.
- Public social media posts by clubs, players, agencies and football journalists.
- Open-licence reference data: Wikidata and Wikipedia.
- EnskAI's own calculations: ratings, estimates and scores built from the information above.
We never use the records that agencies keep in the platform as a source of this information.
Why, and on what legal basis. Football agents need accurate, current professional information to represent players, find suitable clubs and meet their regulatory duties, for example checking a player's age, club and contract position before acting under the FIFA Football Agent Regulations. Providing that information is our legitimate interest (Article 6(1)(f) GDPR). We have weighed it against your interests in a written assessment. Clubs, competitions and the press already publish this information, and we keep it to your professional football life.
Injuries. Injury status is health data. We hold only injury information that has already been made public, for example by the player, the player's club or the competition: the type of injury and the dates out. We rely on Article 9(2)(e) GDPR. It is shown only inside the platform.
Who sees it. The football agencies that use EnskAI and their authorised users, inside the platform; people an agency chooses to share a player list with, such as a club; and the service providers in section 8. We do not publish it on the open web or use it for advertising.
Scores and suggestions. The platform calculates scores and suggestions, for example how closely a player's level matches a club's. They support an agent's own judgement. We make no decision about you with legal or similarly significant effects.
Players under 18. For players under 18 we hold the same professional information as for adults and nothing more, never contact details. Their date of birth is shown on their record, so our customers can see their age. A parent or guardian can make any request on a child's behalf.
How long we keep it. We keep professional information while it is relevant to your football career. Past clubs, transfers and appearances form your career history and are kept as part of it. We remove information that is no longer relevant.
Why we have not written to you. We hold no contact details for the people in our football data, so we cannot tell each person individually. This notice is how we inform you (Article 14(5)(b) GDPR).
Corrections and objections. If something about you is wrong, tell us at support@enskai.com and send evidence, such as an announcement by your club, league or federation, or confirmation from you or your agency. We will correct the record. You can also object to our use of your information (Article 21 GDPR). We will then stop, unless we have compelling legitimate grounds to continue; for a player under 18 we do not expect to have such grounds.
6. People at agencies and clubs we may work with
We hold the business contact details of people at football agencies and clubs we may work with: name, role, organisation, business email address and phone number. They come from the organisation's own website, from business data providers, or from you. We use them to tell you about EnskAI, which is our legitimate interest (Article 6(1)(f)). You can ask us to stop at any time, and we will.
7. Data that agencies put into the platform
Agencies that use EnskAI enter their own information, for example about their players, contacts, contracts and deals. For that data the agency is the controller. EnskAI processes it only on the agency's instructions, under a data processing agreement. If your data is in an agency's records, please contact that agency; if you contact us instead, we will pass your request on and help the agency respond. Each agency's data is kept separate, is never shared with other customers, and is not used to train AI models unless the agency explicitly agrees.
8. Service providers and transfers outside the EU
We use service providers who process personal data for us under data protection terms:
- cloud hosting and storage: Google Cloud, in the EU (Belgium);
- AI features in the platform: Google Cloud Vertex AI;
- user sign-in: Google Firebase Authentication;
- email delivery: Brevo and SendGrid;
- optional WhatsApp messaging: Twilio and the WhatsApp Business API;
- product analytics in the platform: PostHog (EU), Heap and Hotjar (both Contentsquare);
- website hosting: Netlify;
- website analytics: Google Analytics;
- customer relationship management: HubSpot;
- payments: Stripe.
Platform data is stored in the EU. Some of these providers may process data outside the EU, including in the United States, for example sign-in details, analytics, AI processing or our own sales records. Where they do, we rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
9. How long we keep data
| Data | How long |
|---|---|
| Enquiries and demo requests | while we are in contact, and up to 24 months after our last contact |
| Business contact details (section 6) | while we are in contact, and up to 24 months after our last contact, or until you ask us to stop |
| Platform accounts | while your organisation's agreement runs; deleted within 90 days after it ends, unless the law requires us to keep something longer |
| Security and audit logs | for the period our security procedures set, then deleted |
| Billing and accounting records | as long as accounting and tax law requires |
| Football data (section 5) | as described in section 5 |
| Analytics cookies | up to two years |
10. Your rights
You have the right to:
- see the personal data we hold about you;
- have it corrected;
- have it erased;
- restrict how we use it;
- object to our use of it, and always to its use for marketing;
- receive it in a portable form, where we use it on the basis of your consent or a contract;
- withdraw your consent at any time, where we rely on consent.
Write to support@enskai.com. We reply within one month. If a request is complex or we receive many, we may take up to two more months, and we will tell you within the first month. We may ask you to confirm your identity first.
You can also complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg), or to the data protection authority where you live or work.
California residents have the right to know what personal information we collect, to have it deleted, and to opt out of its sale. We do not sell personal information.
11. Children
Our website and platform are for football professionals. They are not meant for anyone under 16, and we do not knowingly collect information from children through them. Players under 18 in our football data are covered in section 5.
12. Security
We protect personal data under an information security management system certified to ISO/IEC 27001, with encryption in transit and at rest, role-based access control, and monitoring and audit logging.
13. Changes to this notice
When we change this notice we update the date at the top. We announce significant changes on our website and in the platform.
This notice explains how we process personal data. It is not a contract. Our obligations to our customers are set out in our agreements with them, and where this notice and such an agreement differ about a customer's data, the agreement applies.