Privacy Policy

This policy explains how personal data is handled in TP (Training Performance) in accordance with Regulation (EU) 2016/679 (GDPR).

1. Roles: controller and processor

For account data of subscribers and staff users (name, email, club, billing details), TP is the controller. For player and performance data entered by a club, the club is the controller and TP acts as processor under Article 28 GDPR.

2. Data we process

• Account data: name, email address, club name, role, authentication identifiers.
• Subscription data: plan, yearly billing period, status.
• Player data (club-controlled): identity, position, contract, training records, GPS and physical output, RPE, wellness, testing results, availability.
• Health data (special category, Article 9): injury, diagnosis, rehabilitation and return-to-play information, only where a club chooses to record it.
• Technical data: log data necessary for security and service operation.

3. Legal bases

• Performance of a contract (Art. 6(1)(b)) for providing the Service.
• Legitimate interests (Art. 6(1)(f)) for security, fraud prevention and service improvement.
• Legal obligation (Art. 6(1)(c)) for accounting and tax records.
• For health data, the club must rely on an appropriate Article 9(2) condition — typically explicit consent or occupational-health/employment obligations under national law.

4. Access control

Availability, workload, performance and clinical notes are visible to the staff users the club invites into its workspace. The club is responsible for limiting those invitations to personnel authorised to see health-related data, and for removing access when a staff member leaves.

5. Sub-processors and hosting

Data is hosted on managed cloud infrastructure within the European Union where available. Sub-processors are engaged only under written data-processing agreements with equivalent protection. Where a transfer outside the EEA is unavoidable, EU Standard Contractual Clauses are used.

6. Retention

• Account data: for the duration of the subscription plus 12 months.
• Club-controlled player data: for as long as the club maintains its account, or until the club deletes it.
• Invoicing records: as required by applicable tax law (typically 6–10 years).

7. Your rights

Data subjects have the right of access, rectification, erasure, restriction, data portability, objection, and the right not to be subject to solely automated decision-making with legal or similarly significant effects. TP does not make such automated decisions; alerts and AI observations are advisory and always reviewed by staff. Requests concerning player data should be addressed to the club as controller; TPassists the club in fulfilling them.

8. Security

Measures include encrypted transport, encrypted storage at rest, row-level access rules, authenticated access, restriction of health data to the customer workspace and least-privilege administrative access. Personal data breaches are notified to the competent supervisory authority within 72 hours where required, and to affected controllers without undue delay.

9. Cookies

TP uses only strictly necessary cookies and local storage for authentication and interface preferences. No advertising or third-party tracking cookies are used, so no consent banner is required for these.

10. Complaints and contact

Data protection contact: harisfalas@gmail.com. Data subjects may lodge a complaint with the supervisory authority of their EU member state of residence, work or the place of the alleged infringement.