Privacy Policy

2.1. Identification and contact data

• Full name
• Email address
• Phone number
• Residential address
• National ID / Passport (when required for federation procedures)
• Date of birth
• Profile photo

2.2. Data relating to minors

• Minor's full name
• Date of birth
• Sports data (team, position, squad number)
• Photos
• Sports health data (medical check-ups, injuries, allergies)
• Sports performance data (statistics, assessments, attendance)
• Legal guardian data (name, contact, relationship with minor)

2.3. Health data

• Medical certificates and fitness reports
• Injury records and progress
• Allergies and intolerances
• Medically relevant information for sports practice

2.4. Biometric data

• Fingerprint and/or facial recognition data used exclusively for unlocking the mobile app on the user's device
• This data is processed and stored locally on the device (iOS Keychain / Android Keystore) and is never transmitted to our servers

2.5. Financial and payment data

• Payment history for fees
• Bank card data (processed directly by Stripe; Sphaira Tech does not store full card numbers)
• Billing data (name, tax address, tax ID)
• Subscription status and plan

2.6. Sports and performance data

• Individual and team statistics
• Coach assessments and evaluations
• Training and match attendance
• Squad calls and confirmations
• GPS training data (coordinates, distance, speed) when the user voluntarily enables this feature

2.7. Audiovisual data

• Match and training videos
• Live broadcasts (YouTube Live, Twitch)
• Photos of players, teams and events

2.8. Technical and browsing data

• IP address
• Device type, operating system and browser
• Push notification tokens
• App and web usage data
• Cookies (detailed in our Cookie Policy)

4.1. Mandatory parental consent

• Under-18s may not register on Sphaira Tech. Parents or legal guardians always register and enter minors' data into the platform.
• The sports club must obtain and retain explicit consent from the parent or legal guardian before entering the minor's data into the platform.
• Sphaira Tech provides mechanisms for clubs to document and record such consent within the platform.

4.2. Data minimisation principle

• Only data strictly necessary for the minor's sports management is collected.
• The minor's health data is only processed with the legal guardian's explicit consent.
• The minor's photos are only used for identification within the platform, unless additional specific consent is given.

4.3. Legal guardians' rights

• Parents or legal guardians may exercise the rights in section 8 on behalf of the minor at any time.
• They may request access, rectification, erasure or portability of their child's data.
• They may withdraw consent at any time, which will result in deletion of the minor's data from the platform within a maximum of 30 days.

4.4. Additional protection measures

• Minors' data is subject to enhanced access controls within the platform.
• Only authorised club staff have access to minors' data within their teams.
• Videos and photos of minors are stored on EU-based servers with encryption at rest.
• No automated decision-making or profiling is performed on minors' data without human oversight.

5.1. Sports club obligations

The sports club, as data controller, undertakes to:

• Obtain informed consent from those concerned (or their legal guardians) before entering their data into Sphaira Tech.
• Inform data subjects about the processing of their data in accordance with the GDPR and LOPDGDD.
• Ensure that only authorised personnel can access data on the platform.
• Not use data stored in Sphaira Tech for purposes other than the club's sports management.

6.1. Data processors (technology providers)

6.2. Third-party services voluntarily activated by the user

The following services only process data when the user expressly enables them from the app:

• YouTube Live / Twitch: for live streaming. Requires an OAuth connection voluntarily initiated by the user.
• Google Drive: for video import. Requires explicit OAuth authorisation.
• GPS: for individual tracking sessions. Requires express activation for each session.
• Voice recognition: processed locally by the device's operating system. No audio is sent to Sphaira Tech servers.
• Biometric authentication: processed and stored locally on the device. Sphaira Tech has no access to biometric data.

6.3. Data sharing under legal obligation

We may share your data with:

• Public authorities and official bodies where a legal obligation exists.
• Sports federations where necessary to meet the club's federation obligations.
• Law enforcement agencies upon judicial order.

10.1. Technical measures

• Encryption in transit: all communications use HTTPS/TLS.
• Encryption at rest: data stored uses AES-256 encryption.
• Secure authentication: passwords stored with bcrypt hashing. Biometric authentication supported as a second factor.
• JWT tokens: sessions managed via JWT tokens with configurable expiry and secure signing.
• Role-based access control (RBAC): each user only accesses data corresponding to their role.
• Payment data tokenisation: card data processed exclusively by Stripe via PCI-DSS Level 1 tokenisation.
• Local biometric storage: biometric data stored exclusively on the user's device.

10.2. Organisational measures

• Minimum access policy: staff access only data strictly necessary for their role.
• Regular team training on data protection.
• Security breach management procedures in accordance with Article 33 GDPR.
• Data Protection Impact Assessments (DPIAs) for high-risk processing (minors' or health data).
• Confidentiality agreements with all staff and data processors.

14.1. United Kingdom (UK GDPR)

UK residents are protected by the UK GDPR and the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO).

14.2. California, USA (CCPA / CPRA)

California residents have additional rights under the CCPA and CPRA. Sphaira Tech does not sell personal data. To exercise your CCPA rights, contact info@sphairatech.com (subject: “CCPA Rights Request”).

14.3. Brazil (LGPD)

Brazilian residents are protected by the Lei Geral de Proteção de Dados (LGPD). The supervisory authority is the Autoridade Nacional de Proteção de Dados (ANPD).

14.4. Canada (PIPEDA)

Canadian residents are protected by the Personal Information Protection and Electronic Documents Act (PIPEDA). The supervisory authority is the Office of the Privacy Commissioner of Canada (OPC).

14.5. Australia (Privacy Act 1988)

Australian residents are protected by the Privacy Act 1988 and the Australian Privacy Principles (APPs). The supervisory authority is the Office of the Australian Information Commissioner (OAIC).