1. Introduction
Team Link One ("we", "us", "our") is committed to protecting the privacy and personal data of our users. This Privacy Policy explains how personal data is collected, used, stored and protected on the platform, in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Section 2 explains which decisions belong to your club, as data controller, and which are ours, as processor acting on its instructions.
2. Who Is the Data Controller
Your club is the data controller for the personal data held about its members. That covers data the club enters itself and data you, or your parent or guardian, submit through the portal — personal details, health information, the emergency contact you nominate and a profile photograph. Team Link One is the data processor. We process that data only on your club's documented instructions, under the Data Processing Agreement every club accepts. Some notices we publish here are carried on behalf of clubs as controllers — including the information addressed to a person named as an emergency contact, who has no account with us and whom the platform is the only place we can reach. To exercise your rights over data held about you as a member of a club — access, rectification, erasure, objection — contact that club. Write to info@teamlink.one for anything concerning Team Link One as the processor, or where you cannot reach your club.
3. Data We Collect
We collect the following categories of personal data: - Account data: email address, name, password (encrypted) - Profile data: phone number, date of birth (if provided) - Club membership data: club associations, roles, group memberships - Activity data: attendance records, training sessions, competition results - Financial data: subscription plans, payment records - Technical data: IP address, browser type, device information, usage logs - Communication data: messages sent through the platform - Health data submitted by the member: allergies, chronic conditions and medications, entered voluntarily by the member or their parent or guardian so that club staff can act on them during training. This is a special category of personal data and is collected only if you choose to provide it; nothing in the platform requires it - Emergency contact data: the name and phone number of one person the member or their guardian nominates. This is personal data about a third party, given to us by the member, not by that person - Profile photograph: a photograph uploaded by the member, or by a parent or guardian for a child
4. Purpose of Processing
We process your personal data for the following purposes: - Providing and maintaining the Service - Managing your account and club memberships - Processing payments and subscriptions - Sending essential service communications - Improving the Service through analytics - Complying with legal obligations - Ensuring the security of the platform
5. Legal Basis for Processing
We process personal data based on: - Contractual necessity: to provide the Service you have requested - Consent: where you have given explicit consent (e.g., accepting Terms of Service) - Legitimate interests: for service improvement and security - Legal obligation: to comply with applicable laws and regulations Health information submitted by a member — allergies, chronic conditions, medications — is a special category of data and is processed on explicit consent under art. 9(2)(a) GDPR, given to the club before the first entry is saved. Providing it is voluntary, and a club may not make training conditional on it. The consent can be withdrawn at any time from the portal, which deletes the submitted health values; withdrawal does not affect processing carried out before it. Who gives that consent for a member under 18 is set out in section 7. The emergency contact is not covered by that consent — one person's consent cannot be a basis for processing another person's data. The club holds the name and phone number on its legitimate interest in being able to reach someone if a member is hurt at training (art. 6(1)(f)), and uses them in an actual emergency to protect the vital interests of the member (art. 6(1)(d)). Because those data do not come from the person named, clubs rely on the exception for disproportionate effort in art. 14(5)(b). The assessment behind both, and the route by which that person can object or ask for erasure, are set out in full in section 6. A profile photograph uploaded by a member, or by a parent or guardian for a child, is processed for the club's membership records under art. 6(1)(b) and art. 6(1)(f). It is not processed on consent and stands separately from the health section. You may object by contacting the club as data controller, and the photograph can be deleted at any time from the portal or by the club. When a member reaches 18 and takes over health information entered for them as a minor, the club may continue to hold that information while the member confirms or deletes it, on its legitimate interest in the safety of participants at training (art. 6(1)(f)). That is a transitional basis only: it lasts until the member first opens the form as an adult and decides.
6. Emergency Contacts — Legitimate Interest Assessment
Clubs rely on legitimate interest to keep an emergency contact on file, and this section records the assessment behind that. The interest: a club must be able to reach someone quickly if a member is injured or falls ill at training. Without a contact on file, staff have no way of notifying a family member in the minutes that matter. Proportionality: the data collected is the minimum that serves the purpose — one name and one phone number, with no free-text field and no relationship, address or other detail. It is visible only to the coaches of the member's groups, to club administration and the club owner, to any other guardian entitled to enter data for that member, and to platform support within an explicit, recorded support session. It is never disclosed to a third-party AI assistant. It is deleted together with the rest of the submitted health section, and can also be deleted on its own at the request of the person named. Impact on the person named: they are informed of the entry by the member or guardian who makes it, who must confirm that they have done so before it can be saved, and that confirmation is recorded. The processing is limited to being contacted in an emergency, which a person nominated as an emergency contact would reasonably expect. Disproportionate effort under art. 14(5)(b): the data does not come from the person named, and neither the club nor the platform holds any channel to reach them — no account, no address of their own, no agreement to be contacted for any other purpose. Notifying them through the platform is therefore not possible, and the obligation is met by the notice given by the person who enters the contact, by this published section, and by the right to object and to erasure set out below. Objection and erasure: a person named as an emergency contact may object to this processing, or ask for the entry to be erased, by contacting the club that holds it. The club can delete the emergency contact name and number on their request without affecting any other data held about the member.
7. Children's Data
Members below the age of majority we apply — currently 18 — are treated as children under this policy. For a member under that age, consent to processing the health information described above is given by a parent or guardian entitled to sign for that member, never by the child. From the member's 18th birthday the consent passes to the member: a parent or guardian who could previously see and enter the health section loses access to it, and the member confirms or deletes what was entered for them when they first open the form as an adult. A minor with their own account can read the health information held about them but cannot change or delete it. Because they cannot withdraw the consent themselves, a minor exercises that right through the parent or guardian entitled to sign who gave it, or by a request to the club as data controller. This is the one right a minor does not exercise by their own action in the application. Every other right, including access, a minor exercises in the ordinary way, and the data export in Portal > Profile > Data & Privacy returns everything held about them. This threshold is not the one in our Terms of Service, and the two serve different purposes. The Terms set the age for holding a user account — at least 16, or with parental or guardian consent. This section sets the age up to which a parent or guardian gives consent for a special category of data. Two ages, two purposes, the same person.
8. Data Sharing
We do not sell your personal data. We may share data with: - Club administrators: your membership and activity data within their club - Service providers: trusted third parties that help us operate the Service (hosting, email delivery) - Analytics provider: Google Analytics collects anonymized, aggregated usage data to help us improve the Service - Platform operators: authorized Team Link One staff have technical access to club and member data for support, abuse investigation, and legal compliance. All access is logged in our audit system and limited to what is necessary - Third-party AI assistants: if your club has enabled it and a staff member connects one, club data is disclosed to that provider on your club's decision. That provider's own terms and privacy policy apply, and we are not a party to them - Legal authorities: when required by law or to protect our rights Health information and the emergency contact submitted by a member have a narrower audience, which the list above does not widen. They are visible to the coaches of the groups the member belongs to, to club administration and the club owner, to any other parent or guardian entitled to enter data for that member, and to Team Link One support staff — the last only within an explicit, recorded platform support session, never as routine access. Every reading of the health section by club staff or by platform support is recorded, including whether it happened in a support session. This data is never disclosed to a third-party AI assistant. It is excluded at the source, so no assistant request can reach it, whether or not your club has enabled assistants. All third-party service providers we engage are bound by data processing agreements. A third-party AI assistant is not one of them — it is chosen and enabled by your club.
9. Data Retention
We retain your personal data only as long as necessary for the purposes described in this policy. When you delete your account, your personal data is removed or anonymised within 30 days, except for the records this section names as permanent and anything we are legally required to keep. Club administrators may retain member data for the duration of the membership plus any legally required retention period. Health information submitted by a member is deleted when the consent is withdrawn, when the last person entitled to enter data for that member loses that entitlement, when the member is deactivated, and when the club is deleted. Personal details a member has submitted but the club has not yet taken over into its own record remain available for the club to take over, and can be withdrawn at any time by anyone still entitled to enter data for that member. They follow the club's record of the member and are removed with it — when the member or the account is anonymised, or when the club is deleted. If portal access has ended, or the member has been deactivated or has left the club, ask the club as data controller to remove them; while you still hold an account you can also use Portal > Profile > Data & Privacy. Three kinds of record are kept permanently, with no retention period, and are not removed when the data they describe is deleted: - Consent records: which version of the consent text was shown, when it was given or withdrawn, and by whom. We keep these because a controller must be able to demonstrate the basis on which it processed data for the period it did (art. 7(1)). They contain no health values - Confirmations that the person named as an emergency contact was informed, on the same terms - Access and change records for submitted data: which field was entered, changed, withdrawn, read or taken over, when, in which role, and whether it happened in a platform support session. These are the evidence of who saw a special category of data. They contain field names and never values When a member or an account is anonymised, these records remain but stop naming anyone: the signer's and the actor's names are cleared, and health field names collapse to a single generic marker. Until the member record itself is anonymised, however, records tied to it can still be linked to a named person — including for a member who has left the club, whose record keeps their name. Only deletion of the club removes these records.
10. Your Rights (GDPR)
Under GDPR, you have the following rights: - Right of access: request a copy of your personal data - Right to rectification: correct inaccurate data - Right to erasure: request deletion of your data - Right to data portability: receive your data in a machine-readable format - Right to object: object to processing based on legitimate interests - Right to restrict processing: limit how we use your data Where the data is held about you as a member of a club, you exercise these rights against that club as data controller. What you enter in the portal is a proposal to the club, not the exercise of your right to rectification: this is not a formal correction request, and to correct your official club record you contact the club directly. Whether the club takes over what you submitted is its decision, and a decision not to appears in your data export. You can exercise these rights through the Portal > Profile > Data & Privacy section, or by contacting us at info@teamlink.one. Write to us for anything concerning Team Link One as the processor, or where you cannot reach your club.
11. Cookies & Local Storage
We use essential cookies and local storage for: - Authentication (JWT tokens) - Language preferences - Session management We also use Google Analytics (GA4) to collect anonymous usage data, including pages visited, session duration, device type, and general interaction patterns. Google Analytics uses cookies to distinguish users and sessions. No personally identifiable information (names, email addresses) is sent to Google. With your consent, Google may also use this data through Google Signals to provide aggregated demographics (age range, gender, interests) and to link your visits across devices when you are signed in to a Google account. You can disable this at any time in your Google account settings under Data & Privacy → Ad settings. You can opt in or out of analytics cookies through the consent banner shown on first visit. Your choice is stored locally and can be changed at any time by clearing your browser's local storage. We do not place advertising cookies on our site or use this data for our own marketing campaigns.
12. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including: - Encryption of data in transit (TLS/HTTPS) - Encryption of passwords using industry-standard hashing - Regular security audits and updates - Access controls and role-based permissions - Multi-tenant data isolation
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service. The updated policy will be effective upon posting. This Privacy Policy is provided in English and Croatian. In case of any discrepancy between the two versions, the English version shall prevail.
14. Contact & DPO
For privacy-related inquiries or to exercise your data rights, please contact us at info@teamlink.one. If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority.