Privacy Notice
1. Who we are
The Talent ID service is operated by Talent ID LLC (name pending registration), established in Ukraine. Because we offer the service to people in India, we comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. This page is our notice under section 5 of the DPDP Act. You can read it in English or in Hindi (switch the language at the top of the page). Contact person for data protection questions and grievances (section 8(9) of the DPDP Act): the Talent ID Grievance Officer — privacy@talent-id.org; the name of the Grievance Officer will be published here before launch. Parents can write to the same address about their child's data; we acknowledge within 48 hours and reply within 30 days at the latest.
2. What data we collect
Adult users: name, email, mobile number, role, organisation, settings, sign-in logs; if you sign in with Google — the name and email from your Google account (we never receive your Google password); a log of account use (which sections were opened — without their content).
Children (players): name, date of birth, team group, anthropometrics (height, weight), test results, coach ratings, medical fitness and clearance dates, wellness (a daily check-in, including whether something hurts), recommendations from the coach or the academy physician (without diagnoses), psychological test results (only with separate parental consent), attendance and training load, readings from the club's sports devices (distance, speed, heart rate during practice), tags on practice and match videos (only with separate parental consent). A child's data is entered by the club or the parents; parents of a child who is not in a club may keep a short profile themselves (year and quarter of birth, city, height, weight, 30 m sprint, preferred foot).
We do not collect: medical records, diagnoses, photos of children in profiles, Aadhaar numbers, biometric data for identification or precise location.
Technical: IP address, device type, cookies (see the Cookie Policy).
3. Purposes and legal grounds
We process personal data only for the specific purposes below and only on the grounds allowed by the DPDP Act: consent (section 6) — your consent for your own account, and the verifiable consent of a parent or lawful guardian for every child's data and for each separate profile disclosure; certain legitimate uses (section 7) — where you have voluntarily given us data for a purpose and have not objected (for example, a support request), compliance with law, court orders and lawful requests from authorities, and medical emergencies. Purposes: providing the service under a contract with an academy, club or school; security and abuse prevention; accounting and legal obligations. Consent is free, specific, informed, unconditional and given by a clear action in the service; you can withdraw it as easily as you gave it. From the date Consent Managers registered with the Data Protection Board of India become available, you will also be able to give, manage and withdraw consent through one of them. As the operator is established outside India, the Law of Ukraine «On Personal Data Protection» (No. 2297-VI) also applies to our processing. We do not sell personal data.
4. Children's data
Under the DPDP Act a child is anyone under 18. Children do not have their own accounts and the service is not designed for children to use. A child's data is processed only with the verifiable consent of a parent or lawful guardian (section 9(1) of the DPDP Act and Rule 10 of the DPDP Rules, 2025): the parent gives consent in their own account, after confirming their email and mobile number and declaring that they are an adult and the child's parent or lawful guardian; the club may enter the child's data only after that. For a person with a disability who has a lawful guardian, consent is given by that guardian. We do not process a child's data in a way that is likely to harm the child's well-being, and we do not carry out tracking or behavioural monitoring of children for advertising or profiling and do not direct targeted advertising at children (section 9(2)–(3)). Training measurements, attendance and match videos are recorded only by the club for the purpose of coaching, with the parent's consent. Parents can view the child's data in their account, correct it, download a full copy at any time («My data»), ask us to erase it, or withdraw consent — without losing access to the parts of the service that do not need that data. Selection decisions are made by the coach — the service only shows calculations.
5. Who we share data with
Coaches and management of your organisation — within their role. Other clubs and academies — only with separate parental consent for each specific request. The football federation or state association — if your academy has connected the data exchange and registered the child: only full name, date of birth, academy and team group, position, city and registration number (in return, official match reports are added to the profile); tests, health, family and contacts are not shared. Your academy's own systems via the open API (Elite package) — only if the academy's management has created an access key: full name, date of birth, team group, position, measurements and attendance of that academy's players, read-only (health, wellness, family and contacts are not shared); the key can be revoked at any time, every request is logged (30 days). Anyone you yourself send a link to the child's development passport (created by parents only, valid for 7 days, can be revoked): full name, year of birth and age, position, academy and team group, medical clearance status, attendance over 90 days, matches and latest measurements — without contacts and without other children's data. A scout or club the academy sends a link to a playlist of video clips (only with the separate parental consent «Clips for scouts and clubs», up to 30 days, parents are notified, can be revoked): full name, year of birth, position and clips featuring the child; a clip plays from the match recording in the academy's video service, so the recipient can technically watch the whole recording. Advertisers — nothing except the number of parents (fewer than 20 is not shown). Data Processors under written contracts that limit their use of the data (section 8(2) of the DPDP Act): hosting and database in the EU (Ireland, Supabase); content delivery, the «human, not a bot» check and storage of match files in the EU (Cloudflare); an email service; an SMS service for the mobile verification code; Google — only if you choose to sign in with Google; a server that detects moments in match videos (Modal, USA) — it receives a match recording only for the time of the analysis and does not keep it; payment services — card and UPI data never reach us. Government authorities — only on a lawful basis (for example, a court order or a lawful demand under Indian law).
6. Retention
Account — while it is active, and 30 days after an erasure request. Player data — while the child is at the club and up to 3 years after leaving, for the development history, unless the parents ask to erase it earlier. Original match recordings — 30 days (tags and clips — while the child is at the club). Website error log — 30 days. Account usage log and visit statistics — 13 months. Security logs and processing logs — at least 12 months, as required by the DPDP Rules. Payment records — for the periods required by tax law (including GST records). When the purpose is no longer served, we erase the data and ask our Data Processors to do the same; where the Rules require it, we tell you at least 48 hours before erasing an inactive account so you can sign in and keep it.
7. Your rights
As a Data Principal you have the right (sections 11–14 of the DPDP Act) to obtain a summary of the personal data we process about you and the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with; to correct, complete and update your data; to have it erased when it is no longer needed or you withdraw consent; to withdraw consent at any time (this does not affect processing already done); to nominate another person to exercise your rights in the event of your death or incapacity; and to readily available grievance redressal. Parents and lawful guardians exercise these rights for the child. Most actions are available in your profile: «Language, theme and data»; other requests — to privacy@talent-id.org (we may ask you to confirm your identity, for example with your username or mobile number). We answer requests and grievances within 30 days and in any case within the 90 days allowed by the DPDP Rules. If you are not satisfied with our answer, after using our grievance redressal you may complain to the Data Protection Board of India (dpb.gov.in) (section 13(3)); an appeal against the Board's order lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). You can also complain to the Ukrainian Parliament Commissioner for Human Rights. Please note your own duties under section 15 of the DPDP Act: do not give false information, do not impersonate anyone and do not file frivolous complaints.
8. Security
Encryption in transit and at rest, access separation at database level, two-factor sign-in with an authenticator app (available to everyone, recommended for academy management), review of new sign-ups by an administrator, access logs, daily backups, a security review before launch — reasonable security safeguards under section 8(5) of the DPDP Act. In the event of a personal data breach we will inform each affected user (and, for a child, the parent) without delay — what happened, when, the likely consequences, what we are doing and what you can do to protect yourself, and whom to contact — and will inform the Data Protection Board of India without delay and send it a detailed report within 72 hours (section 8(6) and the DPDP Rules); cyber security incidents are also reported to CERT-In where required.
9. Transfers outside India
Talent ID's database is hosted in the European Union (Ireland), and the operator is established in Ukraine. When you use the service in India, your data and your child's data are transferred to and stored outside India. Section 16 of the DPDP Act allows such transfers except to countries restricted by a notification of the Central Government; none of the countries we use (Ireland and other EU countries, Ukraine, the USA — for video analysis and Google sign-in) is restricted at the date of this notice, and we will stop any transfer that becomes restricted. The EU's General Data Protection Regulation (GDPR) applies to the hosting, and transfers between the EU, Ukraine and the USA are made with appropriate safeguards (EU Standard Contractual Clauses).
10. Changes
We will announce material changes by email and in the service at least 14 days in advance. If a change affects how we use children's data or adds a new purpose, we will ask for fresh consent before applying it.