Privacy policy

1. Data controller

• Controller: Mario Fernández Osorio (NeoTactIQ), Tax ID 49392036L
• Address: Calle Pablo de Olavide 19, 28830 San Fernando de Henares (Madrid), España
• Privacy contact: [email protected]

We do not have a data protection officer; for any privacy question, write to that address.

2. Two different roles: controller and processor

NeoTactIQ processes data in two different roles:

• As controller: data of website visitors, account holders (coaches, club administrators and their staff), course buyers and anyone who writes to us. This policy explains that processing.
• As processor on behalf of the club: data that each club enters about its players, families and staff (including minors and health data). The club is the controller: it decides what data it keeps and why, and must inform those people and obtain their authorisation or that of their parents or guardians. NeoTactIQ only processes that data to provide the service to the club, following its instructions and the Terms and conditions, which include the data processing agreement.

3. What data we process

• Website visitors: contact form data (name, email, club, message) and, only if you accept, analytics cookies (see the Cookie policy).
• User account: name, email, username, language, profile photo, club and roles; if you sign in with Google, the basic data Google provides to identify you.
• Security and usage: access logs (date, IP address, device), two-step verification, and the activity needed for features such as levels and goals.
• Community: alias, photo and content you choose to share (drills, sessions, set plays, Debates replies) and its moderation.
• Billing: billing details of the club or user and payment history. Card data is handled by Stripe; NeoTactIQ never sees or stores it.
• Courses: purchases, progress, test results and certificate. The certificate shows your name, the course, the score and the date, and anyone with its code can check it is genuine.
• Job offers: if you apply, your name, email, alias, level, message and attached CV are shared with the club that posted the offer.
• Player self-assessment: the answers a player sends through the link given by their coach; they are attached to the club’s report.

4. Purposes and legal basis

• Providing the contracted service (account, app features, courses, support): performance of the contract.
• Charging and invoicing, and meeting tax and accounting obligations: legal obligation.
• Security, fraud and abuse prevention, and community moderation: legitimate interest.
• Service notices (changes, incidents, invoices): performance of the contract.
• Website analytics: your consent, which you can withdraw at any time from the cookie banner.
• Replying to contact form messages: your consent.

We do not make automated decisions that produce legal effects on you.

5. How long we keep it

• Account and club data: while the account is active. After closure it is deleted or blocked, except what the law requires us to keep.
• Invoices and payment data: the periods required by tax and commercial law (up to 6 years).
• In-app notifications: 90 days.
• Job application CVs: deleted 180 days after the offer closes, or as soon as you withdraw the application.
• Contact form messages: as long as needed to reply and, at most, 2 years.
• Security logs: as long as needed to detect and investigate incidents.

6. Who we share it with

We do not sell data. To provide the service we use providers that process data on our behalf, under contract and with safeguards:

• Stripe (payments and invoices)
• Cloudflare (storage of files, images and videos; network and domain)
• Hostinger (servers and email)
• Google (Sign in with Google and, only with your consent, Google Tag Manager and Google Analytics on the website)
• Microsoft Clarity (website analytics, only with your consent)
• Umami (application usage statistics, without cookies and without identifying you)
• Sentry (application error logging)

Some of these providers may process data outside the European Economic Area (for example, in the United States). In those cases the transfer relies on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

We also disclose data to public authorities when required by law, and to the relevant club what the feature itself implies (for example, an application to its offer).

7. Minors

NeoTactIQ accounts are for people aged 14 or over; clubs and plans are contracted by adults.

Data of minor players is entered by their club, which is responsible for obtaining their parents’ or guardians’ authorisation. Self-assessment is only requested from players aged 13 or over and is done through a personal link, without creating an account.

8. Your rights

You can request access to, rectification or erasure of your data, restriction of processing, object to it or request portability by writing to [email protected] and stating which right you are exercising. For data your club has entered (for example, as a player), contact your club; if the request reaches us, we will pass it on.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply appropriate technical and organisational measures: encrypted communications, role- and club-based access, two-step verification, backups, access logs and provider reviews.

10. Changes to this policy

If we change this policy, we will publish the new version with its date and, if the change is significant, notify you in the app or by email.