Privacy Policy

1. Data controller

The data controller responsible for the processing of your personal data is Elite Football Mentoring, operated from Spain.

For any questions regarding this Privacy Policy, the processing of your personal data, or to exercise your data protection rights, please contact us at:

• Email:info@elitefootballmentoring.com

This contact point also serves as our point of contact for data protection enquiries in accordance with Article 13 of the GDPR and Article 11 of the LOPDGDD.

2. Data we collect

We collect the following categories of personal information:

• Enquiry and registration data: name, year of birth, email address, phone number, current club, playing position, last competition played, and any additional information you choose to provide.
• Account activation data: dominant foot, as provided when you set up your player account.
• Guardian data (minors only): parent or legal guardian's name, email address, and phone number.
• Match footage: video files or links submitted for analysis.
• Session notes: tactical feedback and coaching observations produced during or after a session.
• Communication data: emails or messages exchanged with our team.
• Teams & Academies enquiry data:organisation name, contact person name, email, phone number, location, number of players, competition level(s), preferred contact method, and any additional information provided in the enquiry form.
• Subscription and billing data:plan selected, billing cycle, and payment history. We do not collect payment card data directly; payment processing is handled by a compliant third-party provider.

3. How we use your data & legal bases

We use your personal data exclusively for the following purposes, relying on the legal bases indicated:

• Contractual necessity (GDPR Art. 6(1)(b)):To process your registration, onboard you into the programme, deliver and personalise your mentoring sessions using submitted footage, produce analytical feedback, and manage your subscription.
• Explicit consent (GDPR Art. 6(1)(a)):To collect and process match footage and video recordings. Where applicable, to send marketing communications about new plans, features, or promotions. You may withdraw consent at any time (see Section 8).
• Legitimate interest (GDPR Art. 6(1)(f)):For administrative purposes (scheduling, internal quality assurance), fraud prevention, and improving our services. We ensure a balance between our legitimate interests and your rights and freedoms.
• Legal obligation (GDPR Art. 6(1)(c)):To comply with applicable tax, accounting, and regulatory obligations under Spanish and EU law.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal. This processing complies with both the GDPR and Spain's LOPDGDD.

4. Who has access to your data

Access to your personal data and footage is strictly limited to:

• Your assigned EFM mentor, for the purpose of preparing and delivering your sessions.
• EFM staff involved in administration, communication, or quality assurance.
• Video editors (EFM staff or contracted external editors), where footage requires preparation before analysis. External editors are given access only to the specific footage needed for their editing task.
• Third-party service providers:payment processors, cloud hosting providers (for data storage), and communication tools.

Your data and footage are never shared with, sold to, or disclosed to any unauthorised third party. We do not use your footage for marketing or promotional content without your explicit separate written consent. We do not sell personal information to any party for monetary or other valuable consideration.

5. International data transfers

EFM is based in Spain and primarily stores personal data within the European Economic Area (EEA) using EU-region infrastructure provided by our cloud and hosting partners.

In limited circumstances, personal data may be transferred outside the EEA — for example, when external video editors located outside the EU are engaged to prepare footage. In such cases, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)approved by the European Commission (Decision 2021/914).
• Adequacy decisions where the European Commission has determined that the recipient country ensures an adequate level of data protection.

For users located in the United States: your data may be stored and processed in the EU, which affords a level of data protection generally recognised as comprehensive. Transfers of data to the US (if any) are conducted in compliance with applicable frameworks, including the EU-US Data Privacy Framework where applicable.

6. Data retention

We retain your personal data for as long as you are an active participant in the programme, plus a reasonable administrative period thereafter. Specifically:

• Match footage is retained for a maximum of 90 days after the session date, then permanently deleted unless you request otherwise.
• Registration data and session notes are retained for up to 2 years after the end of the programme, for legal and quality-assurance purposes.
• Teams & Academies enquiry data is retained for up to 2 years after the enquiry date, or for the duration of the active service agreement plus 2 years, whichever is longer.
• You may request deletion of your data at any time (see Section 8 below).

7. Security

We take the security of your data seriously. All videos and personal data are stored on access-controlled, encrypted infrastructure. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration, or disclosure.

While we strive to protect your information, no internet transmission or digital storage can be guaranteed 100% secure. We will notify you and the competent supervisory authority promptly in the event of a data breach that affects your rights, in accordance with GDPR Articles 33 and 34.

8. Your Rights

Depending on your location and applicable law, you have the following rights regarding your personal data:

8.1 Rights under EU/EEA law (GDPR & LOPDGDD)

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Erasure (Art. 17): Request deletion of your data ("right to be forgotten").
• Restriction (Art. 18): Request that we temporarily stop processing your data.
• Portability (Art. 20): Request your data in a structured, machine-readable format.
• Withdrawal of consent (Art. 7(3)): Withdraw your consent at any time, without affecting the lawfulness of prior processing.
• Objection (Art. 21): Object to processing of your data for certain purposes, including profiling.

8.2 Rights under US state law (CCPA/CPRA & others)

If you are a resident of California or another US state with applicable privacy legislation (including Virginia, Colorado, Connecticut, and others), you may have additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to Delete: Request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: EFM doesnot sell your personal information and doesnot share it for cross-context behavioural advertising. Therefore, there is no need to opt out. Should this practice ever change, we will provide a clear opt-out mechanism.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

8.3 How to exercise your rights

To exercise any of these rights, please email us at info@elitefootballmentoring.com. We will verify your identity and respond within:

• EU/EEA requests: within 30 days(extendable by up to 60 days for complex requests, with notice).
• US state requests (CCPA/CPRA): within45 days (extendable by up to 45 additional days, with notice).

9. Teams & academies — data processing

When EFM provides services to a team, club, or academy, the following data processing arrangements apply:

• The organisation (team/club/academy) is the data controller for the personal data of its players. The organisation is responsible for ensuring that it has a valid lawful basis (e.g., consent, contractual necessity, or legitimate interest) for sharing each player's personal data and match footage with EFM.
• EFM acts as a data processor on behalf of the organisation, processing player data exclusively for the purposes agreed between EFM and the organisation.
• EFM will not use player data obtained through a Teams & Academies engagement for any purpose outside the scope of the agreed services, and will not share it with third parties except as necessary to deliver those services (e.g., assigned mentors, video editors).
• Where minor players are involved, the organisation is responsible for obtaining verifiable parental or guardian consent before sharing the minor's data with EFM.

The enquiry data submitted through the Teams & Academies enquiry form (contact person details, organisation information) is processed by EFM as data controller, under the legal basis of legitimate interest (responding to the business enquiry) and, where consent is given, for follow-up communications.

10. Children's privacy

For players under the age of 18, all registration, consent, and data processing is conducted through a parent or legal guardian. We do not knowingly collect personal data from minors without verifiable parental consent. If you believe we have inadvertently collected such data, please contact us immediately.

In compliance with GDPR Article 8 and the LOPDGDD (which sets the age of digital consent in Spain at14 years), and US legislation such as COPPA (Children's Online Privacy Protection Act), we require parental consent for all users under 18 to ensure comprehensive protection regardless of jurisdiction.

11. Cookies & analytics

Our website may use essential cookies to ensure basic functionality. We do not currently use third-party advertising cookies or behavioural tracking cookies. Any analytics tools used process data in an anonymised or aggregated form only.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact & complaints

If you have any questions, concerns, or complaints about how we handle your data, please contact us at info@elitefootballmentoring.com.

You also have the right to lodge a complaint with the relevant data protection supervisory authority:

• Spain (lead authority):Agencia Española de Protección de Datos (AEPD)— www.aepd.es.
• Other EU/EEA countries: You may also contact your local Data Protection Authority (DPA) in your country of residence.
• United States: You may contact theFederal Trade Commission (FTC) or your state's Attorney General office, as applicable.