CoachDesk

Privacy Policy

Last updated: 2026/11/09

1. LEGAL RESPONSIBILITY

This Privacy Policy governs the relationship between the User and CoachDesk. By creating an account, accessing the platform, or using any CoachDesk service, the User accepts this Privacy Policy and the associated Terms of Service.

2. INFORMATION AND PERSONAL DATA

All personal information provided to CoachDesk is processed in accordance with this Privacy Policy and applicable data protection laws including GDPR. By using CoachDesk, the User confirms that the submitted data is true and authorizes its collection and processing. CoachDesk is intended only for users aged 18 or older. CoachDesk does not knowingly collect personal data directly from individuals under 18.

3. CATEGORIES OF DATA WE COLLECT

CoachDesk may collect and process the following categories of personal data:

  • Identity Data (name and email)
  • Coaching Data (teams, seasons, competitions, training sessions and plans, exercises, diagrams, animations and documents)
  • Player Data entered by coaches (names, dates of birth, contact and emergency contact details, squad numbers and positions, attendance and physical metrics)
  • Health Data entered by coaches (injuries and medical cases, allergies, medications, surgeries, restrictions, clearances and fitness tests). See Section 14.
  • Device and Usage Data (IP address, browser type, operating system, logs and error reports)
  • Billing Data (plan, subscription status, renewal dates and the email used at checkout; card and payment details are handled by Paddle and never reach CoachDesk)
  • Communications Data (support messages)
  • Sign-in Data (Google account profile details needed for authentication, such as name and email)

4. PURPOSE OF DATA PROCESSING

CoachDesk processes personal data for the following purposes:

  • Platform functionality (tactical board, sessions, cloud synchronization)
  • Account management and authentication
  • Subscription billing and plan limits
  • Security, fraud and abuse prevention
  • Performance improvement and bug detection
  • Service-related communications
  • Advertising measurement and remarketing campaigns (only when enabled and permitted by law)
  • Compliance with legal and regulatory obligations

5. LEGAL BASIS FOR PROCESSING

CoachDesk processes data under the following GDPR legal bases:

  • Performance of a contract
  • Legitimate interests
  • Legal obligations
  • Consent (for non-essential cookies)
  • Explicit consent, obtained by the coach, for health data (Art. 9(2)(a) GDPR) — see Section 14

6. DATA RETENTION PERIOD

Personal data is kept only as long as needed for the purposes in this policy:

  • Account, coaching, player and health data: while your account is active, and deleted after an account deletion request is processed (within 30 days)
  • Analytics data (only with consent): up to 2 months
  • Server and error logs: up to 30 days
  • Crash reports from the mobile app: up to 90 days
  • Security data from reCAPTCHA: up to 6 months
  • Billing and invoice records: for the period required by tax and accounting law; Paddle, as Merchant of Record, keeps its own records under its privacy policy

7. DATA SHARING AND TRANSMISSIONS

CoachDesk does not sell or disclose data for commercial gain. Data may be shared only with:

  • Google Firebase and Google Cloud (Google LLC, USA) — data processor for authentication, database storage, hosting, server functions, security checks (App Check and reCAPTCHA), analytics (when consented) and crash and error reporting. Processing is governed by Google’s Data Processing Agreement and Standard Contractual Clauses for international transfers. See https://cloud.google.com/terms/data-processing-addendum.
  • Paddle.com Market Limited (United Kingdom) — our reseller and Merchant of Record for Pro subscriptions. Paddle processes payment, billing and tax data as an independent controller under its own privacy policy (https://www.paddle.com/legal/privacy). We share your email and an account reference so your purchase can be linked to your account.
  • Cloudflare, Inc. (USA) — domain, network and security provider. It processes connection data such as IP addresses to deliver the website and protect it from attacks.
  • Advertising and measurement partners (such as Google, Meta, Reddit, and other social/advertising platforms), when enabled by your consent choices.
  • Legal or governmental authorities when required by law.

8. INTERNATIONAL DATA TRANSFERS

CoachDesk ensures that any international data transfers comply with GDPR requirements. Transfers to the USA (Google, Cloudflare) are protected by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and, where the provider is certified, the EU-U.S. Data Privacy Framework. Transfers to Paddle in the United Kingdom rely on the European Commission’s adequacy decision for the UK. Google’s DPA and SCCs are available at https://cloud.google.com/terms/data-processing-addendum.

9. USER RIGHTS

Under GDPR, Users may exercise the following rights at any time by emailing support@coach-desk.net. In the mobile app you can also request account deletion from the privacy settings. CoachDesk will respond within one month, as required by law.

  • Right of access — request a copy of your personal data
  • Right to rectification — correct inaccurate data
  • Right to erasure ('right to be forgotten') — delete your account and associated data
  • Right to restrict processing — limit how your data is used
  • Right to data portability — receive your data in a machine-readable format
  • Right to object — object to specific processing activities
  • Right to withdraw consent — remove previously granted consent for analytics or marketing at any time

10. COOKIES AND CONSENT

CoachDesk uses cookies and similar technologies (localStorage, IndexedDB) for essential platform functionality (authentication, security, preferences) as well as optional purposes such as analytics. Non-essential categories are loaded only after you explicitly accept them via the cookie consent banner. You can change or withdraw your choice at any time using the "Manage cookie settings" link in the website footer, the Profile page, or the Cookie Policy. For the full list of cookies, see the Cookie Policy.

11. COMMUNICATIONS

By registering, the User authorizes service-related communications. Marketing emails require explicit consent and may be unsubscribed at any time.

12. THIRD-PARTY LINKS

CoachDesk may include external links. CoachDesk is not responsible for the privacy practices or content of third-party websites.

13. CHANGES TO THIS POLICY

CoachDesk may update this Privacy Policy to reflect regulatory or operational changes. The latest version is always available on the website.

14. PLAYER AND HEALTH DATA ENTERED BY COACHES

Coaches can record data about their players, including health data. For this data:

  • The coach (or their club) is the data controller and decides what is recorded; CoachDesk processes it only on the coach's behalf, to provide the service, and never for its own purposes.
  • The coach must have a lawful basis to record it, tell players how their data is used and, for players under 18, have the consent of a parent or legal guardian.
  • Health data is a special category of data (Art. 9 GDPR). It may only be recorded with the explicit consent of the player, or of a parent or legal guardian for minors, or under another condition of Art. 9(2) GDPR.
  • CoachDesk does not share this data with anyone except the processors listed in Section 7, and does not use it for analytics or advertising.
  • Players who want to access, correct or delete their data should contact their coach or club.

15. DATA CONTROLLER AND CONTACT

CoachDesk is operated from Portugal. The data controller for personal data processed through CoachDesk is its operator, reachable for any privacy-related question, data subject request or complaint at support@coach-desk.net. For player and health data entered by coaches, the coach is the controller and CoachDesk processes it on their behalf (see Section 14). You also have the right to lodge a complaint with a data protection supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (https://www.cnpd.pt); elsewhere in the EU, see https://edpb.europa.eu/about-edpb/about-edpb/members_en.