PRIVACYPrivacy Notice
CEO SUPER LEAGUE — PDPA NOTICE
“This notice says what personal data CEO Super League collects about you, what it is used for, who can see it, how long it is kept, and what you can ask us to do with it. It describes only what the system actually does today — not what it is meant to do one day.”
01What we collect
Your account
Collected when you create an account, before any application form.
First · last nameNames your account and ties it to your application.
EmailSigns you in, and receives status emails about your application — we keep a record of which emails were sent to you and when.
PhoneUsed to reach you about your application and about matches.
PasswordStored and checked by Google Firebase Authentication — the league never sees or stores your password.
Application — personal details
Collected when you apply to the league, whether as a team, as an individual, or by joining an existing team. Some fields apply only to some routes.
NameTitle · first name · nickname · last name · gender
Date of birthNot published automatically — see section 05.
WorkBusiness · company · business type · industry · job title
PlayingPositions · shirt size · shirt number · whether you play yourself · the team you belong to
Player identifierYour Thai national ID number, or passport number for a foreign player — encrypted and stored separately from your profile, solely for player identity and eligibility checks. This is self-declared information, not proof that the document is genuine or belongs to you.
ContactPhone · LINE ID (join-a-team applications only)
SocialFacebook · Instagram · LinkedIn · TikTok · any other platform you name — used to introduce players in league content.
Gate 1 photoA mandatory identity photo, used to verify who you are while your application is reviewed — and, once you are a member, a COPY of it becomes the public display photo shown in the player directory and on your team squad list. See section 04.
Team nameTeam applications only.
Payment
Transfer slipsUp to 5 images per payment — written once and never overwritten.
Tax invoiceOnly if you ask for one: entity name · 13-digit tax ID · address — for an individual applicant that 13-digit number is their Thai national ID number, which is the most sensitive item the league holds.
System records
Email logA record of the emails the system sent you, kept to prevent duplicates and to check back on later.
Admin logA record of which admin did what to your application or data, and when — deliberately not editable and not deletable.
02What we use it for
AdmissionReviewing and deciding applications, verifying who an applicant is, and telling you the outcome.
Player eligibilityUsing the player identifier you provide solely for player identity and eligibility checks. It is not used to merge accounts or treated as government verification.
Running the leagueBuilding teams, squad lists, shirt numbers and sizes, fixtures, and per-match statistics.
MoneyChecking entry and membership payments, and issuing a tax invoice when you ask for one.
ContactNews, scheduling, and anything else to do with playing.
PublicityPublishing results, statistics, and league content — see section 04.
NeverThe league does not sell, rent, or trade your personal data to anyone for marketing.
03Who sees what
This is the most important section in this notice. Read it in full before you tick a consent box.
PublicFor every player registered in a season, one set of fields is readable by anyone — on the website and in the CSL app, without signing in: team · squad role · shirt number · position · gender · nickname · full name · profile photo (if you uploaded one) · goals · assists · appearances · yellow cards · red cards · ban status, plus date of birth only if you consented under section 05.
Real namesStated plainly: your real full name is part of that public set, even though the website and the member portal choose to display nicknames. Showing nicknames is a naming convention, not a privacy control.
Player profilesBy owner ruling (11 September 2026), the player profile page on the website shows your full name and the social links you entered in your application (Instagram · Facebook · TikTok · LinkedIn) to anyone, without signing in, so those social links are part of the public set above as well. A free-text “other platform” entry is not published. Your phone number, LINE ID, email, national ID number and address are still not published, and your date of birth still appears only with your consent under section 05.
MembersInside the member portal the league calls everyone by their nickname, except for someone who has none, and your real name appears in full only on your own membership card.
AdminsRegistration admins see everything on an application, including real names, dates of birth, Gate 1 photos, and payment slips — deciding whether to admit a stranger is the one job that needs a legal name.
Full document numberThe full national ID or passport number is absent from profiles, rosters and public data. Only a super_admin can reveal it through a separate audited action; the audit log never contains the full number.
ClosedThe original Gate 1 photo file and payment slips are readable only by the person they belong to and by registration admins. There is no public link, and content admins cannot open them either — but read section 04 as well: a COPY of the Gate 1 photo is published as a member’s public display photo.
ProcessorsThe product runs on Google Firebase (Authentication · Firestore · Cloud Storage · App Hosting), so your data is stored and processed on Google infrastructure as a processor acting for the league.
04Photos and publicity
When you fill in a join-a-team application you tick a box allowing the league to “use your information and images to run and promote the league”. This section separates the photos, because the league keeps different ones in different places.
Gate 1 photoThe mandatory identity photo, used for two things: (1) verifying who you are while your application is reviewed, and (2) once your application succeeds and you are a member, the league COPIES it to a second location and uses that copy as your public display photo in the player directory and on team squad lists (owner ruling, 11 August 2026). Rejected and cancelled applicants are never copied from. The original verification file stays closed exactly as before — its owner and registration admins only. The published copy is also resized and stripped of ALL embedded file metadata first, including the GPS coordinates phone cameras routinely record; none of that is published.
Consent comes firstFrom 12 August 2026 the league copies your Gate 1 photo into your public display photo ONLY when it holds a recorded image-use consent (owner ruling, 12 August 2026). That record arrives one of two ways: the box you ticked when you submitted your application, or — if you agreed some other way, for example over LINE — an admin recording it for you. The second kind is marked as admin-recorded, with the name of the admin and a note of where and when you agreed; it is never counted as a form tick. Without a record your card simply has no picture, and no picture appears later either, however many approvals or payments follow. This is a condition enforced in the code, not a promise in a document.
Members published before thatPlainly: the rule above governs the NEXT publication only. The photos the league copied and published on 11 August 2026 happened before the system recorded image-use consent as its own separate fact, so no such record exists for them, and the league has not taken them down automatically. If you are in that group and would rather not be shown, you can remove the photo yourself at any time — see “Taking it down” below — or ask us via section 10.
Profile photoThe photo shown publicly. If you upload one yourself it is always the one used, and a copy of your Gate 1 photo will never overwrite it. If you upload none, the league uses the copy of your Gate 1 photo instead — still only where the consent record above exists.
Taking it downYou can remove your display photo yourself from the member portal at any time, or ask an admin to remove it. Removal deletes both the displayed photo and the COPY the league made, and your card goes back to having no picture — the original verification file is a different file and stays where it was.
Match imageryPhotographs and video the league records on matchdays and at league events may be published as league content.
SocialThe social accounts you give us are used to introduce players in league content.
05Date of birth — a separate consent
The date of birth on your application is not published automatically. The league treats it as its own consent, separate from the PDPA box you tick when applying.
DefaultNot published. If you have never answered, the system treats that as no, and your birthday is nowhere in the public data.
GrantingYou turn it on yourself from your member profile on the website or in the CSL mobile app. Once on, your birthday appears on your public player profile.
WithdrawingYou can withdraw at any time from your member profile on the website or in the CSL mobile app, and withdrawal deletes the birthday from the public data in the very same write — no queue, no next sync, no waiting.
ChannelsThe website and app use the same consent state. A change updates the public projection immediately; refresh or reopen the profile to see the latest state in the other channel.
RecordsWe record when you granted or withdrew consent, but we do not put the birthday itself in that record.
06How long we keep it
Written to match the system as it is today, not as it ought to be: there is currently no automatic deletion and no expiry period — nothing is removed on a schedule. What exists is deletion ON REQUEST. In the CSL app you can close your account and erase your personal data yourself, immediately; the website has no such button yet, so from here you ask by email under section 10. Both routes, and the full list of what goes and what stays, are set out on the “Delete your account and data” page.
ApplicationsApplication data, profiles, and match statistics are kept continuously so they can be referenced across seasons. There is no deletion schedule — they go only when you close your account yourself or ask the league to delete them, and even then the match statistics stay in the league’s records, unnamed.
Player identifierWhile your account is open, the league keeps the national ID or passport number in a separate encrypted live record. That live record is deleted with account closure and is not retained by the application after closure. A copy already present in a daily Firestore backup may remain until that backup expires, for no more than 7 days, and is restricted to recovery. Identity records are excluded from recovery copies; if a full-database restore is unavoidable, they are purged before traffic is restored and open-account users must complete identity collection again.
Financial evidencePayment slips and payment records are written once and never deleted, because they are the evidence that money actually arrived. A reversed payment is kept too, as evidence.
Tax invoicesIf you ever asked for a tax invoice, the league keeps that invoice and the data used to issue it — entity name · 13-digit tax ID · address — even after you close your account or ask us to delete the rest of your personal data. This retention does not rest on your consent: it is a legal obligation under Thai accounting and tax law, so the league keeps these records for as long as the law requires — at least 5 years under the Revenue Code and the accounting legislation. For that reason the right to erasure in section 07 cannot reach these documents until that period has passed.
Admin logCreate-only. Not editable, not deletable.
You can deleteOn the website, two things are in your hands immediately: deleting your public profile photo, and withdrawing birthday consent under section 05. Closing the account and erasing the whole set of personal data in one action is something you do yourself in the CSL app.
Everything elseIf you have no app or cannot sign in, and for any other deletion or correction request, contact us under section 10. A request made that way is carried out by a person rather than an automated process, and the league replies within 30 days.
07Your rights
Under the Personal Data Protection Act B.E. 2562 (PDPA) you have the following rights. To exercise any of them, contact us via section 10.
AccessAsk to see, and to receive a copy of, the personal data the league holds about you.
RectifyAsk us to correct data that is wrong or out of date — some of it you can edit yourself in the member portal.
WithdrawWithdraw a consent you gave — you can withdraw birthday consent from your member profile on the website or in the CSL mobile app; for anything else, contact us.
EraseAsk us to delete or suspend use of your data. Two routes actually work: close your account yourself in the CSL app, which erases your personal data in a single request, or contact us under section 10 if you have no app. The exceptions are the ones the league has already declared: match statistics stay in the league’s records, unnamed; tax invoices and payment evidence are kept as a legal obligation; and consent records are kept as accountability evidence — see the honest limits in section 06.
ObjectObject to the collection, use, or disclosure of your data.
PortabilityAsk for your data in a machine-readable form, or ask us to send it to another data controller.
ComplainComplain to the Personal Data Protection Committee if you believe the league has handled your data wrongly.
NoteWithdrawing consent does not make earlier use of your data unlawful, and withdrawing some consents may mean the league can no longer let you play.
08Cookies and browser storage
__sessionA strictly necessary cookie that remembers you are signed in. It cannot be read by page scripts (httpOnly) and is not sent cross-site (SameSite=Lax) — 5 days on the member side, 14 days on the admin side, and deleted the moment you sign out.
NEXT_LOCALERemembers which language you are reading (Thai or English).
reCAPTCHAThe league uses Google reCAPTCHA v3, through Firebase App Check, to check that requests reaching the league’s systems come from a real browser rather than an automated script standing in for a person. It is there for abuse protection only, not for advertising or marketing. Where it is switched on it loads as the page opens, on every page — not only on pages with a form, and not only when you press submit. You can see for yourself whether it is running on the page you are reading: it shows a small reCAPTCHA badge in the bottom corner.
On Google’s sideThe reCAPTCHA script is fetched from Google’s own domains (google.com and gstatic.com), so the check itself happens on Google’s side, and Google may set cookies or store data in your browser under those domains — Google’s storage, not the league’s. The league cannot read that part and keeps no copy of it. Google acts as a processor for the league for this check, the same as the other Firebase services in section 03.
Not usedThis site does not use Google Analytics, and carries no advertising or marketing tracking scripts of any kind.
VideoReplays are embedded from youtube-nocookie.com and only start loading when you press play — if you never press play, YouTube is never contacted.
On your deviceYour browser holds your Firebase sign-in token locally, and keeps a half-filled form draft until you close the tab. Neither is sent anywhere else.
09Other people’s data that you fill in
A team application asks the applicant to enter other people’s details. Those people do not tick a consent box themselves — the applicant confirms on their behalf. This section is for both sides to read.
Other CEOsTitle · first name · last name · date of birth · business · business type · job title
InfluencersTitle · first name · last name · date of birth · social platforms and handles
Contact personFull name · phone · email
If you fill it inPlease tell the person first that you are sending their details to the league, and enter only what is needed.
If you were enteredIf someone listed you and you want that corrected or removed, contact us directly via section 10 — you do not need to go through the applicant.
10Contact us about your data
To exercise a right under section 07, or to ask anything about your data:
Data controllerCEO Super League
Emailleague@ceosuperleague.com
LINE@superleague — the channel the league actually uses to reach members today.
Response timeWithin 30 days of receiving the request
Last updated14 August 2026