Privacy Policy

This Privacy Policy explains what personal data we collect when you visit futland.net, place an order or contact us, and how we use, store and protect it. If you are based in the European Union or the European Economic Area, it also explains your rights under the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is FUTLand, owned by Hussein bin Ali bin Mal Allah Al-Lawati, Muscat / Seeb, 112, Oman. Email: [email protected]

2. What data we collect and why

When you visit our website, our server records technical information such as your IP address, browser type, operating system, referring URL, pages visited and the time of your visit. We process this data on the basis of our legitimate interest in a stable and secure website (Art. 6(1)(f) GDPR) and delete it after 7 days, unless a longer retention is needed to investigate a security incident.

When you place an order, we collect:

• your email address and, if you provide it, your name
• payment information, processed by the payment provider you choose (we do not store full card details)
• the details needed for delivery: platform, the EA account email and password you enter for the transfer, and verification codes
• order history and transaction records

We process this data to perform the contract with you (Art. 6(1)(b) GDPR) and to meet legal obligations such as tax and bookkeeping rules (Art. 6(1)(c) GDPR).

When you contact us by email or live chat, we store your contact details and your message to answer you (Art. 6(1)(f) GDPR).

3. EA account details for delivery

Coins are delivered to your Ultimate Team club through your EA account (Comfort Trade). The login details and verification codes you enter are used only for your transfer and are passed to the delivery partner who carries it out. Please change your EA password after the delivery if you like. Never share these details anywhere else, including in the live chat.

4. Cookies

We use technically necessary cookies, for example for your session, your cart, your language, currency and display settings. Optional cookies (for example analytics) are only set with your consent, which you can withdraw at any time by deleting your browser cookies.

5. Analytics

If we use Google Analytics (Google Ireland Ltd. / Google LLC), it runs only with your consent (Art. 6(1)(a) GDPR) and with IP anonymisation. Google may transfer data to the USA under the EU-U.S. Data Privacy Framework. More information: https://policies.google.com/privacy

6. Live chat

Our live chat runs on our own chat server (Chatwoot). Chat messages are stored to answer you and for quality assurance (Art. 6(1)(f) GDPR) and deleted when they are no longer needed. Please do not share passwords or payment details in the chat.

7. Sharing with third parties

We do not sell your personal data. We share it only where necessary:

• payment providers, to process your payment (each provider is responsible for its payment data under its own privacy policy, shown at checkout)
• delivery partners, to carry out your coin transfer
• hosting and infrastructure providers, to run the website and store data
• authorities, if the law requires it or to protect our legal rights

All service providers are bound by contract to handle your data in line with data protection law.

8. International transfers

Our business is based in Oman, outside the EEA. Some service providers are also located outside the EEA. Where we process data of EU/EEA residents, transfers take place to perform the contract with you (Art. 49(1)(b) GDPR) or with suitable safeguards such as Standard Contractual Clauses. Contact us if you have questions about a specific transfer.

9. How long we keep your data

• order and transaction data: 7 years (commercial and tax law)
• support and chat messages: up to 3 years after the last contact
• server log data: 7 days
• data processed on the basis of consent: until you withdraw consent

We delete or anonymise data as soon as there is no legal reason to keep it.

10. Your rights

If you are in the EU or EEA, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR), and you can withdraw consent at any time with effect for the future. Write to [email protected]; we answer within 30 days. You can also lodge a complaint with your local data protection authority (list: https://edpb.europa.eu).

11. Security

We protect your data with appropriate technical and organisational measures, including encrypted transmission (TLS) and restricted access. No transmission over the internet is completely secure; if you think your data has been compromised, contact us immediately.

12. Children

Our services are not directed at children under 16. We do not knowingly collect data from minors; if you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version.