Privacy Policy
Last updated: [DATE] · Version 1.0
1. Data Controller
The Data Controller is DM Creative Studio (referred to below as "NextGen Coach", "we", "the platform"), with registered office at [full address, city, postal code, country], VAT number [VAT / Tax ID].
For any request regarding the processing of your personal data, you can contact us at: [privacy email, e.g. privacy@nextgencoach.ai].
2. Scope
This policy applies to nextgencoach.ai, to the web applications (Coach WebApp, Player WebApp), to the Telegram bot and to all related services (collectively, "the Platform"), used by coaches, technical staff, sports clubs and players (or their parents/legal guardians, where the player is a minor).
3. Categories of data collected
Depending on which module is used, the Platform processes the following categories of data:
3.1 Coach / staff data (registered user)
- Name, surname, login credentials, role within the club
- Phone number (for WhatsApp / Telegram access)
- Billing data, if the club subscribes to a paid plan
3.2 Player data (entered by the coach or the club)
- Name, surname, date of birth, shirt number, playing position
- Anthropometric data: height, weight, skinfolds, BMI, biological age, arm span
- Attendance and participation data: training sessions, matches, minutes played, match stats (goals, assists, ratings)
- Physical test data (speed, endurance, strength, jump tests)
- Player photo (optional, uploaded by the coach for the player card)
3.3 Health-related data (special category, Art. 9 GDPR)
The Platform processes the following special categories of data, with a reinforced level of protection:
- Injury registry: injury type, body area, severity, date, and return-to-play protocol/timeline
- Daily wellness / Hooper Index: a daily self-assessment of sleep, stress, perceived fatigue and muscle soreness, filled in directly by the player
- Psychological data: pre-competition anxiety questionnaires (CSAI-2), team cohesion (GEQ) and notes related to psychological support during return from injury, where enabled by the club
This data is processed exclusively to monitor the athlete's psycho-physical wellbeing and to support the club's technical/medical staff, and is never used for commercial purposes or advertising profiling.
3.4 Location and GPS performance data
If the club connects a compatible GPS device (K-Sport partnership), the Platform imports player performance data via API during training and matches: distance covered, top speed, accelerations, on-field trace. This data is transmitted by the GPS device provider and processed for the purposes described above.
3.5 Communication data
- Telegram identifier (chat_id), used to send notifications, attendance requests, call-ups and surveys via the bot
- WhatsApp number, if you contact our support through that channel
3.6 Technical and browsing data
- IP address, device/browser type, pages visited (via Google Analytics)
- Technical and analytics cookies (see section 9)
4. Purposes and legal basis of processing
| Purpose | Legal basis |
|---|---|
| Delivering the service (team management, attendance, statistics) | Performance of a contract with the club (Art. 6(1)(b) GDPR) |
| Monitoring injuries, wellness and psychological data of the player | Explicit consent of the parent/legal guardian, where the player is a minor (Art. 9(2)(a) GDPR) |
| AI-generated training sessions and team analysis | Performance of a contract / legitimate interest of the club (Art. 6(1)(b), 6(1)(f) GDPR) |
| Website usage statistics (Google Analytics) | Consent via cookie banner (Art. 6(1)(a) GDPR) |
| Invoicing and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
5. Minors
The Platform is used to manage youth teams (U12–U19 categories), and therefore processes data belonging to minors. Player data for minors is entered on the Platform by the club/coach, who acts as the party responsible for obtaining informed consent from the parent or legal guardian before entering the minor's data on the Platform — in particular for the health and psychological data categories described in section 3.3.
6. Recipients of the data and sub-processors
Within the limits of the purposes described above, your data may be shared with the following third parties acting as processors:
| Provider | Service | Data involved |
|---|---|---|
| Google LLC (Google Analytics) | Website traffic analytics | Browsing data, anonymised IP |
| Telegram FZ-LLC | Notification bot, attendance, surveys | Telegram identifier, bot messages |
| Meta Platforms Ireland Ltd (WhatsApp Business) | Customer support | Phone number, message content |
| OpenAI, L.L.C. | AI generation of training sessions and team analysis | Aggregated team-profile data (normally without directly identifying a minor, unless entered by the coach in free-text prompts) |
| K-Sport | GPS wearable device data import | Physical performance and location data during sports activity |
| Hetzner Online GmbH | Server and database hosting | All Platform data (infrastructure located in Germany, European Union) |
Some of these providers (e.g. OpenAI, L.L.C.) are based in the United States. Any transfer of data outside the EU relies on the Standard Contractual Clauses approved by the European Commission or another adequate transfer mechanism under the GDPR. [To be confirmed/updated by the legal team based on the actual DPAs signed with each provider.]
7. Data retention
Data is retained for the duration of the contractual relationship with the club, and for [period, e.g. 12 months] after the subscription ends, unless a different period is required by law (e.g. tax obligations) or an earlier deletion request is made by the data subject.
8. Data security
We adopt appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including: encrypted HTTPS connections, credential-protected server access, periodic database backups, and per-club data segregation (each club has its own dedicated database, not shared with other clubs).
9. Cookies
The site uses the following categories of cookies:
- Technical cookies (always active): necessary for the site to function (e.g. language preference)
- Analytics cookies (Google Analytics, subject to consent): collect aggregated, anonymised data on how the site is used, to understand which content visitors find most useful
You can manage or withdraw consent to analytics cookies at any time via the banner on the site or through your browser settings.
10. Your rights
As a data subject, you have the right to:
- Access your personal data and obtain a copy of it
- Request rectification of inaccurate or incomplete data
- Request erasure of your data ("right to be forgotten"), within the limits provided by law
- Request restriction of processing
- Object to processing based on legitimate interest
- Request data portability in a structured format
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
- Lodge a complaint with your national data protection authority (in Italy, the Garante per la Protezione dei Dati Personali)
How to exercise your rights
To exercise any of these rights, write to [privacy email] indicating your club/team name and your specific request. We will respond within 30 days of receiving your request.
11. Changes to this policy
This policy may be updated periodically, for example following regulatory changes or new Platform features. The date of the last update is shown at the top of this document. In case of material changes, we will notify clubs by email or via a notice on the Platform.
12. Contact
DM Creative Studio · [address] · [email] · [phone, optional]