Privacy policy

Contents

1. About this document and about Pro Season
2. Two types of processing: controller and processor
3. Who is responsible for what
4. What data we collect and why
5. The player passport: product principle and GDPR roles
6. Sharing data with third parties (separate category)
7. Scouting: future sharing path, only with approval
8. Advertising and sponsorship: club sponsors and platform ads separated
9. Children and minors: heightened care
10. Images and video
11. Artificial intelligence on the platform
12. Retention periods
13. Processing location, sub-processors and transfers outside the EEA
14. Security
15. Your rights
16. Cookies and similar technologies
17. Changes
18. Contact and complaints

1. About this document and about Pro Season

Pro Season is a software platform for sport. Academies and associations use it to follow player development through assessments, training planning, attendance, invoicing and club news.

Responsible entity: Pro Season International B.V., P.J. Oudweg 41, 1314 CJ Almere, the Netherlands, Chamber of Commerce 42082965, RSIN 869628616, VAT NL869628616B01 (hereinafter: "Pro Season", "we" or "us").

This privacy policy explains which personal data Pro Season processes, for which purposes, on which legal basis, for how long, with whom it may be shared, and which rights you have. It is intended for administrators of academies and associations, coaches and other club staff, players, and parents or legal guardians of minor players.

This policy does not cover how a club handles membership or parent administration outside Pro Season (for example a federation system or WhatsApp). For that, refer to your club's own privacy information.

2. Two types of processing: controller and processor

Under the GDPR, the controller determines why and how personal data are processed. The processor processes data on documented instructions of the controller.

Pro Season acts in both roles, for different data and purposes:

Pro Season is controller for data we need to run our business: administrator accounts, billing and payments, operation and security of the platform, our website and marketing, and our own legal obligations (for example accounting law). For this data we determine the purposes and means ourselves.

Pro Season is processor for data that an academy or association (hereinafter: the "Club") enters about its players, teams, parents and coaches: player records, development assessments, attendance, training notes and related media. The Club is the controller. The Club decides what is entered, by whom, and for which purpose within its organisation. Pro Season processes that data only on behalf of and on instructions of the Club, under a data processing agreement (Article 28 GDPR).

Where to go? Invoice, administrator account or Pro Season website: contact Pro Season. Assessment, attendance list or photo your club entered about your child: your club is the first contact. We help the club respond to your request.

3. Who is responsible for what

Data category	Controller	Role of Pro Season
Account and contact data of club administrators	Pro Season	Controller
Billing and payment data	Pro Season	Controller
Website and marketing data (visitors, leads, newsletter)	Pro Season	Controller
Player records, assessments, attendance, training notes	The Club	Processor for the Club
Player images entered by a club for club use	The Club	Processor for the Club
Invoices and payer details from the Club to players or parents (club invoicing)	The Club	Processor for the Club; see section 4.6
Platform security and logging data	Pro Season (security purpose); Club for underlying platform content	Mixed: see section 4.5
Reference-case images in Pro Season marketing (separate consent)	Pro Season	Controller

4. What data we collect and why

4.1 Account and contact data (Pro Season = controller)

Data: name, email, phone of contact or administrator; club name and details; login credentials.

Purpose: account management, delivery of the service, service communications (updates, incidents, invoices).

Legal basis: performance of a contract (Article 6(1)(b) GDPR); where needed, legitimate interest in a working product (Article 6(1)(f) GDPR).

4.2 Billing and payment data (Pro Season = controller)

Data: billing address, payment data (via an external payment provider), payment history.

Purpose: performing the payment contract; statutory accounting and tax obligations.

Legal basis: Article 6(1)(b) and (c) GDPR.

4.3 Website and marketing data (Pro Season = controller)

Data: name, email, role at the club; technical website visit data (section 16).

Purpose: answering enquiries, newsletters on request, measuring and improving website and marketing.

Legal basis: consent for newsletters and non-essential cookies (Article 6(1)(a) GDPR); legitimate interest in answering enquiries and basic website analytics (Article 6(1)(f) GDPR).

4.4 Platform data on players, teams and clubs (Pro Season = processor)

This is the largest and most sensitive category. Pro Season is processor, not controller. It covers data the Club enters:

• identity: name, date of birth, photo, position;
• club history: teams, seasons, group assignment;
• development: assessments, scores, learning goals, coach comments;
• attendance at training and matches;
• contact details of parents or legal guardians, where the Club enters them;
• data of coaches and other club staff.

Purpose: determined by the Club (typically: tracking development, planning training, recording attendance, club communication).

Legal basis: established and owned by the Club. Pro Season processes only on the Club's documented instructions (data processing agreement).

4.5 Security and logging data

Data: technical access logs (who, when, device type, relevant actions), solely for security, troubleshooting and audit.

Purpose: securing the platform, detecting and investigating misuse or incidents, demonstrating who changed what.

Legal basis: Pro Season's legitimate interest in a secure platform (Article 6(1)(f) GDPR) for the security element; for underlying platform content, the processor role for the Club.

4.6 Club invoicing to players and parents (Pro Season = processor)

Some clubs use the platform to send and collect their own invoices to players or their parents. Here too Pro Season is a processor: the Club determines who owes what, and the Club is the party that invoices and receives the money.

Data: name and email of the payer (usually a parent or legal guardian), the relationship to the player, billing address, invoice lines and amounts, payment status and payment date, and a customer or transaction reference at the payment provider.

Purpose: determined by the Club: invoicing and collecting membership fees, tuition or other contributions.

Legal basis: established and owned by the Club (typically performance of the contract between the Club and the parent, and the Club's statutory bookkeeping obligation).

Payment provider. The payment itself is processed by an external payment provider (section 13). That party also processes payment data for its own statutory purposes, such as fraud prevention and identifying the Club as a merchant. For those own purposes the payment provider is itself a controller. Pro Season does not receive or store full card or bank account details.

4.7 Mobile app and push notifications (Pro Season = processor for the Club)

Data: a device push token, the device type and app version, and the content of the message being sent (for example a club broadcast or a notification about an assessment).

Purpose: delivering notifications that relate to the Club's use of the platform.

Legal basis: the processor role on behalf of the Club; in addition, the device itself asks permission to display notifications. If you switch notifications off in your device settings, delivery stops.

Recipients: the push service listed in section 13, and the push services of Apple and Google that deliver the message to the device.

5. The player passport: product principle and GDPR roles

As a product principle, Pro Season treats the player as owner of their own player passport or development profile.

"Owner" is a product term, not a literal GDPR role. It describes control over sharing outside the player's own club context. It does not mean the Club may not keep training administration.

In practice:

1. The Club may keep data needed for training, selection, attendance, assessment and parent communication within its relationship with the player. The Club remains controller for that processing.
2. The player (or the parent for a minor) controls sharing of passport data outside that club context: to another organisation, to a scout or professional club (section 7), or for a purpose other than the one for which the Club collected the data.
3. When the relationship ends, we enable the Club to export data and we delete data under section 12 or earlier on request of the Club or data subject, unless a legal duty requires longer retention.
4. Dual affiliation (for example association and academy): two separate processing operations may exist, each under the responsibility of the relevant club. A person-bound passport across clubs, if built later, will be described separately.

GDPR roles remain decisive: Club = controller for platform content; Pro Season = processor for that content; Pro Season = controller for its own business purposes (sections 4.1–4.3).

This principle guides product design. Not every sharing and control feature exists today; where it does not, we will build it step by step and communicate separately.

Current state of the product. A player's profile exists only within the environment of the club the player belongs to. There is no feature to carry a passport or profile to another organisation or to make it visible outside that environment. Choices about sharing outside the club context therefore run through the Club today, not through a button in the platform.

6. Sharing data with third parties (separate category)

Third-party sharing is its own category, separate from scouting (section 7) and from advertising (section 8). These three topics are not merged into one clause.

Pro Season does not share platform data about players, teams or clubs with third parties outside the Club, except:

• with sub-processors that provide infrastructure or operational services (section 13), bound by equivalent obligations;
• where the Club expressly instructs us (for example an export);
• where a player or parent has given explicit consent or approval for sharing outside the Club (see also section 7);
• where we are legally required to do so.

We do not sell personal data. We do not use player platform data for our own marketing, except the illustrative and reference-case image rules in section 10.

7. Scouting: future sharing path, only with approval

Pro Season is preparing a future capability for scouts or professional clubs, with appropriate approval, to access (part of) a player's or club's data for talent identification and follow-up.

On the date of this policy there is no feature to share data outside a club's own environment. Where a Club uses the scouting module, observations are recorded and displayed only within that Club's own environment; those records are not visible to another club, to an external scout or to a professional club. We name the sharing path now so you know this type of sharing may later occur, and under which conditions, and so we do not lock ourselves into a promise that it will never happen.

Principles when the feature is built:

• sharing with a scout or professional club is never silent. There will be an explicit, separate approval moment, distinct from ordinary platform consent;
• more than one approver may be required: player (from a certain age), parent or legal guardian, and/or the Club;
• approval is not all-or-nothing; we aim for granularity (basic profile to full file);
• approval may be withdrawn; further access then stops;
• distinction: (a) a club shares its own player data with a scout; (b) a scout records its own observations about a player who is not a Pro Season user. Situation (b) falls under a separate legal structure for the scouting module (professional club as controller of those observations) and is not the same as (a).

Before activation, we will update this policy and inform players, parents and clubs.

8. Advertising and sponsorship: club sponsors and platform ads separated

We keep room for two strictly separated future components. We do not mix them in one clause.

Club-owned sponsor content. The Club may later show sponsors or partners inside its own environment (for example a club page or club news). The Club manages that content and the sponsor relationship. Pro Season provides the technical capability.

Pro Season platform advertisements. Separately, Pro Season may later show its own ads in the platform, where Pro Season manages the advertising relationship.

On the date of this policy, neither is active. If and when either is activated:

• this policy alone does not create silent consent; we will inform expressly and clearly before visibility for affected audiences;
• we may treat youth contexts more strictly than screens used only by coaches or administrators;
• we will not use player personal data for advertising in a way not described here without updating this policy first.

9. Children and minors: heightened care

Much of the data concerns children and young people. Heightened care:

Parent as gatekeeper. For a minor, the parent or legal guardian is the appropriate person for consent and rights, to the extent the child cannot yet exercise them. The platform today has no separate parent login role; the Club manages parent contact details. Consent and rights may run via the parent, or directly via the player when capable.

Age. For young children, the parent is the practical user. For older youth, the player's own control grows, especially around scouting visibility. At majority, control moves from parent to player, including mid-season.

Coach input. Assessments, attendance and comments are usually entered by coaches or team managers. The Club remains responsible for quality and tone. Pro Season does not itself score a player.

Peer attendance. The platform is designed so a player does not by default see who was or was not present, beyond what is needed for their own use.

No unwanted one-to-one contact. Pro Season does not offer a feature that lets adults communicate privately with a minor outside the Club's sight. Communication runs through club broadcasts to a group, and through replies attached to a specific assessment or report. Those replies are stored within the Club's environment and are visible to the Club.

Images. See section 10.

10. Images and video

A recognisable image of a child is personal data, even without a name.

Club images for club use. The Club is controller (section 4.4) and responsible for appropriate parent consent within its environment.

Images in Pro Season marketing. Default: illustrative or generic imagery only (fictional names/scores, stock imagery, or adults as the main subject). Real recognisable imagery only for an approved reference case, after a separate written consent form from the parent, with concrete uses, channels and period. Club publication on its own channels is not consent for Pro Season to reuse that imagery in ads (different purpose).

Ordinary image consent does not cover AI processing or AI generation of a child's image unless separately and expressly allowed.

11. Artificial intelligence on the platform

Principle: a human scores and assesses; AI assists; AI does not take an autonomous decision about a player.

What the AI does today. Where a Club uses the AI assistance, a coach or assessor can have text suggested or rewritten within an assessment or report. For that purpose the text concerned, together with the context of that assessment, is sent to the language model provider listed in section 13. The coach decides whether to accept, edit or discard the suggestion. The model does not set a score and does not take a selection decision. There is no AI feature that autonomously assesses, ranks or selects a player.

• No silent AI consent via a general sentence. For new AI features that process player personal data in a way not yet described here, we update this policy and inform before activation.
• Images of minors are not used to train AI models or to produce AI imagery of a child, except under the separate reference-case policy with explicit AI consent.
• Input from the platform is not used to train the provider's models.
• Where Article 50 of the EU AI Act requires transparency, we make clear that an AI system is being used. The user invoking the feature sees this at the moment of use. Where a coach adopts an AI suggestion, the final text is the Club's text; the Club decides whether to mention that to the player or parent.

12. Retention periods

Canonical policy of Pro Season International B.V. (2026-08-01). Technical enforcement follows in the platform;

Data category	Retention
Account and contact data (Pro Season = controller)	While the account is active, plus 90 days after subscription end, then anonymise or delete (unless an outstanding claim or legal dispute)
Billing and payment data (Pro Season subscription → club)	7 years (Dutch statutory tax retention)
Website and marketing data	Until consent is withdrawn, or a maximum of 12 months after last contact
Platform data (player records, assessments, attendance, images)	Determined by the Club (controller). Default: club account term plus 12 months, unless the Club instructs a shorter period. Export before end is available
Images of minors	Same default as platform data; on withdrawal of consent: delete or block within 14 days
Club invoicing (Club invoices and payer details, section 4.6)	Determined by the Club. Technically Pro Season retains for a maximum of 7 years, or shorter on the Club's instruction
Security and logging data	12 to 24 months (operational); longer only in anonymised form or for a concrete incident
Backups after deletion	Residual copies in rolling backups for a maximum of 90 days, then removed with the backup cycle
Reference-case consent forms	While imagery is in use, plus a reasonable accountability period thereafter (capped at the imagery retention period)

13. Processing location, sub-processors and transfers outside the EEA

Processing takes place, in principle, within the European Economic Area (EEA). Sub-processors as of the date of this policy:

Sub-processor	Role	Location
Supabase, Inc.	Database, authentication, file storage	EU (EU-West); US parent company; EU Standard Contractual Clauses
Stripe Technology Europe, Limited	Payments: club subscription payments to Pro Season and club invoicing to players or parents (section 4.6). For its own statutory purposes Stripe is itself a controller.	Ireland / EU, with transfer to the United States (EU Standard Contractual Clauses / EU-US Data Privacy Framework where applicable)
Microsoft Corporation (Microsoft 365 / Graph)	Transactional email and notifications	EU data centres where available; transfers outside the EEA under Microsoft product terms and EU Standard Contractual Clauses
Vercel Inc.	Hosting of the web applications and website	United States / edge network; EU Standard Contractual Clauses
Firma (e-sign provider)	Electronic signing of proposals and contracts	Processing under Firma’s processor terms; transfers covered by their DPA / Standard Contractual Clauses
OpenAI Ireland Limited	Language model behind the AI assistance in reports and assessments (section 11). Active only where the Club uses AI functionality. Input is not used to train models.	Ireland / EU, with transfer to the United States under EU Standard Contractual Clauses
Expo (650 Industries, Inc.)	Sending push notifications to the mobile app (device token and message content)	United States; EU Standard Contractual Clauses
Apple Inc. and Google LLC (push services)	Delivering push notifications on iOS and Android devices	United States / worldwide; transfers under the relevant provider's terms

This list is updated when sub-processors change. For processing outside the EEA, Pro Season ensures an appropriate transfer mechanism (Chapter V GDPR), for example EU Standard Contractual Clauses.

The mobile app is distributed through Apple's App Store and Google Play. Those parties process data about installation and use of the app under their own privacy terms. Pro Season is not a processor for that and has no control over it.

14. Security

Appropriate technical and organisational measures, including: encryption in transit (TLS) and at rest; role-based access and Row Level Security; multi-factor authentication for administrative access; periodic security testing. Details are in the data processing agreement with the Club.

15. Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection.

• Data for which Pro Season is controller (sections 4.1–4.3): contact Pro Season directly (section 18).
• Platform data for which the Club is controller (section 4.4): contact your club first. If you contact Pro Season anyway, we inform the Club and provide reasonable technical assistance.

You may lodge a complaint with a competent supervisory authority. For the Netherlands: the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl).

16. Cookies and similar technologies

Our website uses cookies for operation, usage measurement, and marketing where you consent. A full cookie notice will follow as a separate document. Until then: non-essential cookies only after consent via the cookie banner.

17. Changes

We may update this policy. The date at the top shows the latest update. For a material change we inform in an appropriate way (platform or email).

18. Contact and complaints

Pro Season International B.V. P.J. Oudweg 41, 1314 CJ Almere, the Netherlands Email: info@proseason.nl (subject: privacy)

For data your club entered: contact your club first.