1. Data Controller
Data controller: Remedios Garrido López
Tax Identification Number (NIF): 30823897X
Business address: Calle La Ladera, 10, 14007 Córdoba, Spain
Contact email: privacidad@andonestats.com
Trade name: AndOne Stats
2. When AndOne Stats Acts as Data Controller and When It Acts as Data Processor
AndOne Stats acts as the data controller for the data required to manage its own relationship with users and customers, including account creation, handling enquiries, invoicing, payments, security, communications and commercial management.
When a club, academy or other organisation enters players’, families’, coaches’ or team members’ data into the platform and determines the purposes for which that data is used, that organisation is the data controller. In such cases, AndOne Stats processes the data on behalf of the organisation as a data processor, in accordance with the corresponding agreement. Requests relating to such data should preferably be addressed to the club or organisation that entered it, without prejudice to AndOne Stats’ cooperation.
3. Data We May Process
Identification and contact details: first name, surname, email address, telephone number and account details.
Club and team relationship data: organisation, role, category, team, season and assigned permissions.
Player data: first name, surname, date of birth, photograph, team and category.
Sports data: games, minutes played, points, rebounds, assists, fouls, statistics, assessments, reports, rankings and development by season.
Subscription and billing data: subscription plan, trial period, subscription status, invoices and tax information. AndOne Stats does not store full card details when payment is processed through Stripe or Google Play.
Technical and security data: IP address, device, browser, access logs, account activity and incidents.
Communications data: enquiries, support requests, preferences and consent to receive commercial communications.
4. Purposes, Legal Bases and Retention Periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| To create and manage accounts, provide the application, offer support and maintain security. | Performance of a contract and steps taken prior to entering into a contract; legitimate interest in maintaining security. | While the account or relationship remains active and thereafter for the applicable statutory or limitation periods. |
| To manage trials, subscriptions, payments, invoicing and accounting or tax obligations. | Performance of a contract and compliance with legal obligations. | For the applicable tax, accounting and liability periods. |
| To respond to enquiries and requests. | Steps taken prior to entering into a contract, consent or legitimate interest, depending on the circumstances. | For as long as necessary to handle them and, as a general rule, for up to one year thereafter, unless they must be retained for another reason. |
| To send news, promotions and commercial communications relating to our services. | Consent; or legitimate interest where there is a prior relationship and the law permits it. | Until consent is withdrawn or the individual objects. |
| To prevent misuse, unauthorised access, fraud and technical incidents. | Legitimate interest and, where applicable, compliance with legal obligations. | For as long as necessary to investigate and manage the incident and for the applicable liability periods. |
| To host and manage sports data entered by clubs or organisations. | The legal basis is determined by the organisation acting as data controller; AndOne Stats acts as data processor. | In accordance with the organisation’s instructions and the corresponding agreement. Upon termination, the data will be returned or deleted unless retention is required by law. |
5. Children’s Data
The application is primarily intended for clubs, academies, coaches and responsible adults. Minors must not create an independent account. If, in exceptional circumstances, an account is enabled for a person under the age of 18, the prior and verifiable authorisation of their parent or legal guardian will be required in accordance with the platform’s rules.
Sports data relating to minors may be entered by clubs, academies or authorised adults. The organisation or person entering the data is responsible for properly informing the families and ensuring that there is a valid legal basis for the processing. Where processing is based on consent and the child is under 14 years of age, consent must be given by the person exercising parental responsibility or legal guardianship. AndOne Stats may request supporting evidence and apply data-minimisation measures or restrict or delete the data.
Health data, information about injuries or diagnoses, or any other specially protected information must not be entered in free-text fields, notes or assessments unless a feature has been specifically enabled for this purpose and there is a sufficient legal basis and the relevant safeguards are in place.
6. Recipients and Service Providers
Data may be processed by service providers that help us deliver the service, subject to the safeguards and agreements required by law. These may include:
- Clouding, as our infrastructure and hosting provider.
- Stripe, when payments or subscriptions are managed through its platform.
- Google, when the application is downloaded or a subscription or payment is made through Google Play, and when Google Fonts are loaded while they remain externally hosted.
- Email, support, security, maintenance and professional advisory service providers, where necessary.
Data may also be disclosed to public authorities, courts, financial institutions or other bodies where required by law or where necessary to establish, exercise or defend legal claims.
7. International Data Transfers
Some technology providers, such as Stripe or Google, may process data outside the European Economic Area. Where this occurs, the safeguards provided for under the General Data Protection Regulation will be applied, such as adequacy decisions, Standard Contractual Clauses or other valid mechanisms. Specific information is available in each provider’s privacy policy.
8. Commercial Communications
Where authorised by the user, AndOne Stats may send news, content and offers relating to its services. Subscription is voluntary and may be cancelled at any time by using the unsubscribe link included in the messages or by writing to privacidad@andonestats.com.
Communications required for account administration, security, service changes, payments or support are not advertising communications and may be sent for as long as the contractual relationship remains in force.
9. Data Protection Rights
Data subjects may request access to, rectification or erasure of their data, restriction of processing, data portability or object to processing. They may also withdraw their consent without affecting the lawfulness of processing carried out before its withdrawal.
To exercise these rights, they may write to privacidad@andonestats.com, stating which right they wish to exercise and providing the information required to verify their identity.
Where the data has been entered by a club or academy, the request may be forwarded to that organisation because it is the data controller. AndOne Stats will cooperate so that the organisation can respond to the request.
If a data subject considers that their rights have not been respected, they may lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.
10. Security
AndOne Stats will implement technical and organisational measures appropriate to the level of risk to protect data against loss, alteration, unauthorised access, disclosure or destruction. Users must use secure passwords, keep their credentials confidential, restrict permissions according to user roles and report any security incident immediately.
11. Source of the Data
Data may be obtained directly from the data subject, the account holder, an authorised family member or the club, academy or organisation using the platform. Anyone providing third-party data must be authorised to do so and must have provided the relevant information to those individuals.
12. Updates
This Privacy Policy may be updated to reflect changes in legislation, service providers or platform features. The current version and its latest revision date will be published on the website. Where a change is significant, it will be communicated through appropriate means.