Privacy Policy
1. Who we are
The Talent ID service is operated by Talent ID LLC (name pending registration), Ukraine. Data protection contact: privacy@talent-id.org. In EU countries — the operator's representative (to be appointed before launch). In the United Kingdom — the operator's representative under Art. 27 of the UK GDPR, because the operator is established outside the UK, in Ukraine (to be appointed before launch).
2. What data we process
Adult users: name, email, mobile phone, role, organisation, settings, sign-in logs; if you sign in with Google — the name and email from your Google account (we never receive your Google password); a log of cabinet use (which sections were opened — without their content).
Children (players): name, date of birth, group, anthropometry (height, weight), test results, coach ratings, clearance and medical check-up dates, wellbeing (a daily check-in, including whether something hurts), recommendations from the coach or the academy doctor (without diagnoses), psychological test results (only with separate parental consent), attendance and training load, readings from the club's sports devices (distance, speed, heart rate during training), tags on training and match videos (only with separate parental consent). A child's data is entered by the club or the parents; parents of a child without a club may keep a short profile themselves (year and quarter of birth, city, height, weight, 30 m sprint, preferred foot).
We do not process: medical documents, diagnoses, photos of children in profiles, biometrics for identification.
Technical: IP address, device type, cookies (see the Cookie Policy).
3. Purposes and legal bases
Providing the service under a contract with an academy or school; parental consent — for children's data and for each separate profile disclosure; legitimate interest — security and abuse prevention; legal obligations — accounting and requests from authorities. Legal bases — the Law of Ukraine «On Personal Data Protection» (No. 2297-VI) for EU countries — the GDPR (Art. 6, 8, 9), and for users in Wales and the rest of the United Kingdom — the UK GDPR (Art. 6, 8, 9) and the Data Protection Act 2018.
4. Children's data
Children do not have their own accounts. A child's data is processed only with the consent of a parent (legal guardian). In the United Kingdom (Data Protection Act 2018, s. 9) a child can consent to information society services on their own only from the age of 13; for children under 13, consent is given by a person with parental responsibility. Talent ID applies a stricter rule: all consents for a child's data are given by the parent, whatever the child's age. We design the service in line with the ICO's Age Appropriate Design Code (Children's Code). Parents see the child's data in the cabinet and can correct it, download a full copy at any time («My data») or withdraw consent. In Ukrainian academies, test results are shown to parents in the cabinet once the academy's management has opened them; height and weight are always visible. We do not use children's data for advertising and do not build advertising profiles. Selection decisions are made by the coach — the service only shows calculations.
5. Who we share data with
Coaches and management of your organisation — within their role. Other clubs and academies — only with separate parental consent for each specific request. The football federation — if your academy has connected the data exchange and registered the child: only full name, date of birth, academy and group, position, city and register number (in return, official match reports are added to the profile); tests, health, family and contacts are not shared. Your academy's own systems via the open API (Elite package) — only if the academy's management has created an access key: full name, date of birth, group, position, measurements and attendance of that academy's players, read-only (health, wellbeing, family and contacts are not shared); the key can be revoked at any time, every request is logged (30 days). Anyone you yourself send a link to the child's development passport (created by parents only, valid for 7 days, can be revoked): full name, year of birth and age, position, academy and group, medical clearance status, attendance over 90 days, games and latest measurements — without contacts and without other children's data. A scout or club the academy sends a link to a playlist of video clips (only with the separate parental consent «Clips for scouts and clubs», up to 30 days, parents are notified, can be revoked): full name, year of birth, position and clips featuring the child; a clip plays from the match recording in the academy's video service, so the recipient can technically watch the whole recording. Advertisers — nothing except the number of parents (fewer than 20 is not shown). Processors under contract: hosting and database in the EU (Ireland, Supabase); content delivery, the «human, not a bot» check and storage of match files in the EU (Cloudflare); an email service; an SMS service for the phone verification code; Google — only if you choose to sign in with Google; a server that detects moments in match videos (Modal, USA) — it receives a match recording only for the time of the analysis and does not keep it; payment services (WayForPay in Ukraine) — card data never reaches us. Authorities — only on a lawful basis.
6. Retention
Account — while it is active, and 30 days after a deletion request. Player data — while the child is at the club and up to 3 years after leaving, for the development history, unless the parents ask to delete it earlier. Original match recordings — 30 days (tags and clips — while the child is at the club). Website error log — 30 days. Cabinet usage log and visit statistics — 13 months. Security logs — 12 months. Payment documents — for the periods required by tax law.
7. Your rights
Access to the data and a copy in a machine-readable format, rectification, erasure, restriction of processing, objection, withdrawal of consent at any time, a complaint to the Ukrainian Parliament Commissioner for Human Rights or to the supervisory authority in your EU country; in the United Kingdom — to the Information Commissioner's Office (ICO, ico.org.uk; ICO Wales office in Cardiff). We reply to requests within 30 days. Most actions are available in your profile: «Language, theme and data».
8. Security
Encryption in transit and at rest, access separation at database level, two-factor sign-in with an authenticator app (available to everyone, recommended for academy management), review of new sign-ups by an administrator, access logs, daily backups, a security review before launch.
9. International transfers
Data is stored in the EU. Transfers outside the EU and Ukraine (including to the video analysis server in the USA and during Google sign-in) — only with appropriate safeguards (EU Standard Contractual Clauses; for UK users — together with the UK International Data Transfer Addendum). For UK users, storage in the EU/EEA is covered by the UK adequacy regulations for the EEA.
10. Changes
We will announce material changes by email and in the service at least 14 days in advance.