At a glance
- LOB uses your data to run football bookings, payments, attendance, rewards and support.
- We do not sell personal data, and the apps contain no advertising, analytics or tracking SDKs.
- Approximate location is optional, used once to rank pitches by distance and never stored.
- LOB does not see or store card details; the card payment provider receives them directly.
- You can exercise your PDPL rights by using the app or contacting support.
1. Who controls your data
LOB is a mobile service for booking football training sessions and friendly matches at partner pitches in Saudi Arabia, beginning in Riyadh. The service includes the LOB player app, the LOB management app used by authorized administrators and referees, the website at lobplaysa.com, and our support service.
The controller responsible for personal data is LOB, operated by [Legal entity name], Commercial Registration number [CR number], at [National address]. You can contact us at [email protected] or through Account → Support tickets in the player app.
We process personal data in accordance with the Saudi Personal Data Protection Law, issued by Royal Decree M/19 of 1443H, as amended, and its Implementing Regulations. The Saudi Data & AI Authority (SDAIA) supervises this framework.
2. Scope
This policy applies when you register for or use the LOB player app, make or manage a booking, join a waiting list, use points, wallet funds or a package, contact support, receive notifications, or visit the LOB website. It also explains the limited access given to staff through the management app.
It does not describe a partner pitch's independent handling of information outside LOB. When staff record attendance, payment at the pitch, goals or awards in LOB, however, that processing is covered by this policy.
3. Data we collect
| Data | Why we need it | Source |
|---|---|---|
| Mobile number, display name and optional email | Create and identify your account, send sign-in codes, confirm bookings and support you | You and the SMS sign-in process |
| Position and preferred foot | Prepare staff line-ups and preserve the booking-day register | You |
| Optional profile picture | Personalize and identify your profile | Your device gallery |
| Bookings, waiting-list entries and offers | Reserve capacity, prevent clashes, issue 15-minute offers and keep service records | You and LOB's booking system |
| Attendance, goals and Man of the Match awards | Run registers, approve matches, calculate statistics and determine points | Authorized staff and referees |
| Payment and order details | Record the amount, method, status, reference, booking and time; for pay at pitch, record who collected payment and when | You, staff and the payment process |
| Points, rewards, wallet and package ledgers | Maintain balances, movements, redemptions and remaining package sessions | LOB's system and administrators |
| Violations, warnings and suspension status | Apply late-withdrawal, no-show and conduct rules | Booking times, attendance and administrators |
| Support tickets and messages | Answer questions and resolve issues | You and staff |
| Device push token | Deliver operational push notifications | Your device and Firebase Cloud Messaging |
| Authentication and security records | Limit OTP attempts, prevent abuse and audit administrative activity | Your use of LOB, including mobile number and IP address |
| Approximate coordinates, if permitted | Sort pitches by distance for one request | Your device |
Your playing position and preferred foot are copied from your profile to a booking to preserve the line-up record as it was that day. Other players see names in the public roster, not positions. Administrators can see player profiles, bookings, attendance, payments, wallet and points ledgers, violations and support messages. A referee can see the register, including name, position, attendance and pay-at-pitch status, only for an assigned training.
4. Purposes and legal bases
We use personal data only for stated and legitimate purposes. Depending on the activity and the requirements of the PDPL, our legal basis is one or more of the following:
- Contract: to register and authenticate you, show trainings, make and manage bookings, operate waiting lists, process payment records, maintain packages, points and wallet ledgers, provide support, and enforce the rules you accept.
- Consent: where required, for optional features such as using approximate location, providing a profile picture, or allowing push notifications through your device settings. You may withdraw consent without affecting processing already carried out lawfully.
- Legitimate interests: where permitted by the PDPL and balanced against your rights, to secure LOB, prevent fraud and misuse, maintain service integrity, investigate errors, enforce one account per person and keep limited operational logs.
- Legal obligation: to keep accounting and payment records, respond to lawful authority requests, protect legal rights and meet obligations under Saudi law.
We also use attendance and confirmed payment data to award one loyalty point per whole riyal actually paid after a match is approved, subject to the points rules. We use booking and attendance events to issue warnings or restrict new bookings when applicable thresholds are reached.
We do not sell personal data. The LOB apps contain no advertising and no analytics or tracking SDKs.
5. Notifications
LOB uses Firebase Cloud Messaging, provided by Google, to deliver push notifications. These can include booking confirmations, waiting-list offers and expiries, late-withdrawal and no-show warnings, suspension notices, support replies and announcements. For delivery, we store a device push token and send the notification information needed by Firebase.
You can disable push notifications in your phone settings. Essential information remains available in the app where applicable. The in-app feed shows the latest 10 notices; older delivered personal notices are deleted under the retention process described below.
6. Approximate location
If you choose to allow approximate location, the app sends your coordinates with a single request to sort pitches by distance. LOB uses them for that one distance comparison and then discards them. We do not store, cache or log those coordinates.
You can refuse or withdraw location permission in your phone settings. Pitches will still be listed, but they will not be ranked using your current distance.
7. Payment data
LOB keeps an order record for a booking, including the amount in halalas and SAR, payment method, status, reference, booking and time. For pay-at-pitch payments, the record may identify the staff member or referee who collected payment and the collection time. Wallet and package use are recorded in their respective ledgers.
LOB does not receive or store card numbers or other card data. When you pay by card, the payment provider receives the card details directly. LOB receives only the information needed to keep the related payment and order record.
9. International transfers
LOB's hosting location is [Hosting location]. Where personal data is transferred outside the Kingdom of Saudi Arabia, including through a service provider, we make the transfer only as permitted by the PDPL and its Implementing Regulations on personal data transfers. This includes applying the required safeguards, assessments or approvals where applicable.
10. How long we keep data
We keep personal data only for as long as needed for the stated purpose, legal obligations, security or dispute handling. The principal periods are:
| Record | Typical retention |
|---|---|
| Account and profile data | While the account is active; removed when the account is deleted |
| Bookings, attendance, goals, waiting-list offers and violation history | Up to 24 months |
| Support messages | Up to 12 months after the ticket closes; deleted at account deletion |
| Authentication attempt logs and routine security or audit metadata | About 90 days |
| Security events | Up to 365 days |
| Device push tokens | Until sign-out or account deletion, or about 45 days of inactivity |
| Payment and order records | As long as accounting and legal obligations require |
Deleted data may still exist in backup copies made before the deletion; these copies are kept for disaster recovery only. When account deletion requires certain records to be retained, LOB removes identifying account fields and keeps the remaining rows under an internal identifier as explained in the Account Deletion page.
11. How we protect data
LOB uses HTTPS to protect data in transit. Player sessions use random opaque tokens, and only a SHA-256 digest of each token is stored on the server. One-time codes are stored only as digests and expire. Sign-in attempts are rate-limited per day and per code.
Access is role-based and limited to authorized staff. Administrators use management access, while referees can access only the trainings assigned to them. Administrative actions have an audit trail. Uploaded JPEG, PNG and WebP images are checked by their actual content, not only the filename or declared type. Profile pictures and pitch photos are served only to signed-in users. We apply least-privilege access.
No system can be guaranteed completely secure. If you suspect unauthorized use, do not share any OTP and contact us promptly.
12. Your PDPL rights
Subject to the PDPL and its conditions, you have the right to be informed about processing, access your personal data and obtain a readable copy, request correction of inaccurate or incomplete data, request destruction when applicable, and withdraw consent for consent-based processing without affecting earlier lawful processing.
You can edit your name, position, preferred foot, email and profile picture in the app. You can control notification and location permissions in your phone settings. For other requests, email [email protected]. To help protect your data, we may verify your identity and ask for enough detail to understand the request. We aim to respond within 30 days.
If you believe your request or complaint has not been handled appropriately, you may complain to SDAIA through its available complaint channels. Your right to complain is not affected by contacting LOB first.
13. Account deletion
You can request permanent deletion in the player app using a separate SMS confirmation code. Deletion may need to wait until a future confirmed booking, pending payment or active package with sessions remaining is settled. Certain payment, booking, violation, authentication and audit records may be retained without your name for accounting, security and legal purposes.
Deletion is irreversible, and remaining points, wallet funds, rewards and unused benefits are lost. Read the full steps and consequences on the Account Deletion page before proceeding.
14. Children
You must be at least 13 years old to use LOB. If you are under 18, you must have the consent and supervision of a parent or guardian. A parent or guardian who believes a young person has used LOB without the required consent should contact us.
15. The LOB website
The LOB website is static. It uses no cookies, analytics, trackers or third-party scripts, and its fonts are served from LOB's own server. The site stores only your language and light or dark theme preferences in your browser's localStorage. These preferences remain on your device and are not sent to LOB.
The web server keeps standard access logs containing the IP address, access time, requested page and browser user-agent for security for a limited period.
16. Changes to this policy
We may update this policy when LOB's features, legal obligations or data practices change. The page will show the effective date of the current version. Where a change materially affects your rights or how we use personal data, we will provide an appropriate notice through LOB.
17. Contact us
For privacy questions, rights requests or complaints, contact LOB at [email protected] or use Account → Support tickets in the player app.
Operator: [Legal entity name].
Commercial Registration: [CR number].
National address: [National address].
If the Arabic and English versions of this policy differ, the Arabic version prevails.