Legal document
Privacy and Data Protection Policy
What we do with personal data: yours and that of the players you enter in the application. Written to be understood without a lawyer at your side.
- Last updated: 23 October 2026
- Text prepared on 23 October 2026
- About 21 min read
- 14 sections
This translation is provided for convenience. In case of any discrepancy, the Portuguese version prevails. Read the Portuguese version
Who processes your data
My Team Manager is a squad and coaching-staff management application for youth football coaches, available at https://myteammanager.pt and at https://app.myteammanager.pt.
- Name: João Carlos Neves Leonardo
- Tax number (NIF): 269514686
- Town: Odivelas
- Legal form: Sole trader (empresário em nome individual)
- Email for personal data matters: geral@myteammanager.pt
Data Protection Officer: none has been appointed. Article 37 of the GDPR does not require one at the current size of the service; we will review that decision as the number of accounts and players grows. Until then, personal data matters are handled directly by the provider, at the email above.
This policy applies to the website and to the application. It does not describe what third parties do on their own websites: if you follow a link elsewhere, that website's policy applies.
Two different roles: controller and processor
This is the most important part of the document, and it is simpler than it seems. There are two sets of data in this application and our role is different for each.
1. Your account data: here we are the controller
Your email, your name, your profile photo, the plan you subscribed to, the invoices. This data exists because you have a relationship with us. We decide what it is for and how it is processed, and so we are the data controller.
2. The players' data: here the controller is you
The squad, the player records, the photographs, the contact details of parents and guardians. This data is not ours and we did not decide to collect it: the coach did, or the club on whose behalf they work. Whoever decides what data is collected, from whom and for what purpose is the data controller. We are only the processor: we store and process that data on your behalf, according to your instructions.
In one sentence: we provide the filing cabinet and the lock; the decision to keep a six-year-old child's record in it is yours, and so is the responsibility for having a legal basis to do so.
What this means in practice, for you
- It is up to you to ensure there is a legal basis to process each player's data: usually the consent of the parent or guardian, the performance of a contract with the club, or compliance with federation obligations.
- It is up to you to inform players and their parents or guardians that the data is in this application and what it is for.
- It is up to you to obtain specific consent for the photograph. In Portugal, the right to a minor's image requires authorisation from their legal representatives.
- If a parent or guardian exercises a right (access, rectification, erasure) the request is addressed to you. If it reaches us, we forward it and let you know.
What we undertake to do, as processor
- Process the data only according to your instructions and to provide you with the service;
- Not use player data for advertising, commercial profiling or model training;
- Not sell or pass on that data to third parties;
- Maintain the security measures described in the "Security" section;
- Only use other processors if we keep them listed in this policy, giving 30 days notice when a new one is added;
- Notify you within 24 hours of becoming aware of a data breach affecting you, so that you can notify the CNPD within the 72 hours the law gives you;
- Delete or return the data at the end of the contract, as you request.
Data Processing Agreement (DPA). Article 28 of the GDPR requires the relationship between controller and processor to be set out in writing, with mandatory minimum content. That agreement is the Data Processing Agreement and is deemed entered into upon subscribing to the service. If you need a signed copy for your club, ask us by email.
What data is processed
The list below is the actual list of fields the application stores. It is not a generic enumeration.
From your account and the coaching staff
- Email and, if you choose one, a username;
- Password stored as a hash: never in plain text. If you sign in with Google, we store no password at all, only the stable identifier Google gives us;
- Full name;
- Role in the account: Club Manager, Head Coach, Assistant Coach or Team Manager;
- Descriptive position, if you fill it in (for example, "pitch delegate");
- Date of birth, if you fill it in;
- Phone number, if you fill it in;
- Where you came from when you signed up (for example, “Instagram” or “the website”) and your answer to “How did you hear about us?”, if you give one: they only tell us which channels bring people in, and are never used to track you anywhere else;
- Profile photo, if you upload one;
- Dates the record was created and last changed;
- Technical session and password recovery tokens.
From your teams
- Team name and abbreviation, age group and season;
- Club name, home ground and team colour;
- Crest, if you upload one;
- Notes you write.
From the squad: players
In the vast majority of cases, this is data about minors. See the next section.
- Full name and short name;
- Date of birth;
- Photograph, if you upload one;
- Shirt number, position and preferred foot;
- Height and weight, if you fill them in;
- Identity card or passport number, if you fill it in, and federation licence number;
- The player's phone and email, if you fill them in;
- Name, phone and email of the parent or guardian;
- Notes you write in the record.
The notes fields are free text and are not meant for health data. The application was not designed to receive clinical information, diagnoses, injuries or medication typed into a record: those are special category data. Do not write them there.
A document is a different matter, and it must be said clearly. The Documents tab accepts files linked to a player, and one of them may be a medical examination. If you upload one, you are storing health data about a minor: it is visible only to the Head Coach and the Team Manager of the team (assistant coaches cannot reach it, by any route) and it is up to you, as data controller, to have the explicit consent of whoever holds parental responsibility to store it here (article 9(2)(a) of the GDPR).
Minimise. To manage a team, in most cases it is enough to know whether the player is fit and until when: the examination itself is not needed. Keep the minimum the federation and the club require, and delete what is no longer necessary.
From the club modules
In a club account, and depending on the plan and the modules the club uses, the application also stores:
- Families' monthly fees, memberships and payments, including sibling discounts;
- Club shop orders and, in the online shop, the buyer's name, email and phone number;
- Registrations for the club's tournaments.
This data belongs to the club: the club is the controller and we are the processor, just as for the players' data.
From the subscription and invoicing
- Plan subscribed to, subscription status and end date of the free trial;
- Billing details: the name, address and tax number you provide;
- Payment history. Card details are entered and stored by Stripe: we have no access to the full card number and do not store it.
Audit log and technical data
Sensitive actions carried out within an account are logged: who did it, what, on which record, when, from which IP address and with which browser. This is for security and to be able to understand what happened in an account: never to profile the user.
The server also keeps technical operating records (logs), with minimal information about requests and errors.
Documents
The Documents tab stores files the coach uploads: regulations, notices, calendars, registration forms. For each one we keep the name, the category, any notes you write, the file type and size, who uploaded it and when, and an expiry date if you set one.
A document always belongs to a team. When it is linked to a player, it becomes visible only to the Head Coach and the Team Manager, for the reason explained above. Files are served only to signed-in users and always as a download (never opened inside the application) and are deleted from the server when the document, the player or the team is deleted.
Photographs
When you upload a photograph (yours, a player's or a crest) it is resized and converted on our server before being stored. In that process all EXIF metadata is removed, including the GPS location that many phones record in the image. Only the image remains.
What it is for and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and maintaining your account | Identification, credentials, role in the account | Performance of a contract: art. 6(1)(b) |
| Providing the service: storing squad, teams and coaching staff | Team, player and coaching staff data | Processing on behalf of the controller: art. 28. The legal basis is the one invoked by the coach or club |
| Charging the subscription | Plan, status, payment details | Performance of a contract: art. 6(1)(b) |
| Issuing invoices and meeting tax obligations | Name, address, tax number, amounts | Legal obligation: art. 6(1)(c) |
| Service emails: password recovery, billing notices | Email, name | Performance of a contract: art. 6(1)(b) |
| Security, abuse prevention and audit log | IP, browser, actions performed | Legitimate interest: art. 6(1)(f) |
| User support | What you write to us and the account context | Performance of a contract and legitimate interest |
| Marketing communications about the product | Email, name | Consent, which can be withdrawn at any time: art. 6(1)(a) |
We do not carry out automated decision-making or profiling that produces legal effects or significantly affects you. We do not sell personal data. We do not use player data for advertising or to train artificial intelligence models.
Data about minors
This application was built for youth football. The youngest age group, "Petizes" (under-7s), has children from the age of six. It makes no sense to treat this as a footnote, so it has its own section.
What data about minors is processed
- Full name and short name;
- Date of birth;
- Photograph;
- Position, shirt number, preferred foot, height and weight;
- Identity card or passport number and federation licence number;
- Phone and email, where they exist;
- Name, phone and email of the parent or guardian;
- Notes written by the coach.
This data is entered by the coach. The child does not use the application, does not create an account and has no access to anything.
Who is responsible for consent
It is the coach or the club, not My Team Manager, who must obtain and keep the consent of the parent or guardian. We are the processor: we store the data on the coach's behalf. We have no contact with families and are not in a position to ask for that consent.
That expressly includes consent for the photograph. In Portugal, using a minor's image requires authorisation from whoever holds parental responsibility, and that authorisation should be documented.
In Portugal, the age from which a minor can consent on their own to the processing of their data in online services is 13 (Portuguese Law no. 58/2019, article 16). The application, however, is not offered to children: it is used by the coach. That is why the relevant consent is that of the parent or guardian, always below the age of 13 and, above it, together with the player themselves when the club sees fit, and it is the club, or the coach, who collects and keeps it, in writing, before entering the record in the application.
How to request rectification or erasure
A parent or guardian who wants to see, correct or delete their child's data should first contact the coach or the club that entered that data. They are the ones who have the relationship with the family and they are the data controller.
If you would rather write to us directly, write to geral@myteammanager.pt. In that case:
- We confirm receipt of the request;
- We identify the account holding the data and forward the request to the controller;
- We give you whatever contact details we have available and provide technical support for carrying it out, including the permanent deletion of the record and the photograph, if that is the controller's decision;
- If the controller does not act, we inform the requester of the right to complain to the CNPD.
The coach can, at any time and without asking us anything, correct a record or delete a player from within the application.
What we never do with data about minors
- We never use player data (minors or not) for advertising, marketing or commercial profiling;
- We never sell, rent or pass on that data to third parties;
- We never use it to train artificial intelligence models;
- We never make it public, indexable by search engines, or share it with other accounts on the platform.
Each account is isolated from the others at the level of the database itself. A coach cannot see another coach's squad, even if the application had a programming error: the isolation is guaranteed by the database engine, not just by the application code.
Who we share it with
We do not sell data. We share only what is necessary, and only with those who provide services essential to the operation of the platform.
| Who | What for | What data |
|---|---|---|
| PTisp (Portugal) | Hosting of the servers and of the service email, in Portugal | All application data, at rest; emails sent and received by the @myteammanager.pt addresses |
| Stripe (Ireland / USA) | Payment processing (card, Apple Pay, Google Pay, SEPA Direct Debit, Multibanco, MB WAY and bank transfer). It only processes payments: we are the ones who sell and invoice | Email, name, tax number (NIF) if you give it, and the payment method details (entered directly with Stripe) |
| Moloni (Portugal) | Issuing the invoice-receipts, in certified invoicing software, and reporting them to the Portuguese Tax Authority | Name, email, and tax number and address if you give them; the plan and the amounts paid |
| "Continue with Google" sign-in: optional; and storage of the remote backups (Google Drive) | Email and Google account identifier, only if you use that option. Backups are encrypted on our server before they leave it: Google stores encrypted files it cannot read. | |
| Transactional email provider: to be announced | Sending service emails (call-ups, password recovery, billing notices). They currently go out through PTisp email; when we switch, this row is updated 30 days in advance | Email, name and message content |
None of these providers receives data unless a data processing contract under article 28 of the GDPR is in force: in the case of Stripe, Moloni and Google, the processing terms they themselves make available to their customers.
We may also disclose data to public authorities when the law requires it, and to lawyers or accountants for the defence of rights or compliance with legal obligations.
If we change processor or add a new one, this list is updated and users with an account are notified by email 30 days in advance, and may object, which in practice means cancelling before the change takes effect.
Where the data is stored
The application's data is hosted in Portugal, on a dedicated PTisp server. It is not in a US cloud nor spread across regions we do not control. This is a deliberate choice: for an application that keeps children's records, knowing exactly where the files are matters.
Portugal is in the European Union, so the main processing takes place entirely within the European Economic Area, under the GDPR.
Transfers outside the EU
There are exceptions, limited to the support services identified in the previous section. Stripe and Google are international groups and may transfer data outside the European Economic Area. When that happens, the transfer relies on the mechanisms provided for in Chapter V of the GDPR: usually the European Commission's standard contractual clauses and, where applicable, adequacy decisions.
Specifically: Stripe contracts with European customers through its Irish entity and transfers data to its parent company in the United States under the European Commission's standard contractual clauses. Google, when you use sign-in with your Google account, processes the data under the terms it publishes for European users, also with standard contractual clauses as a safeguard.
Player data is not transferred outside the EU. It stays in the database and file storage hosted in Portugal. Stripe receives no squad data: it only receives the coach's or the club's billing details.
How long we keep it
| Data | Period |
|---|---|
| Account and coaching staff data | For as long as the account exists |
| Teams, squad, photographs and documents | For as long as the coach keeps them in the application. They are deleted when the coach deletes them, or when the account is deleted |
| Cancelled account | 90 days after cancellation, with read and export access during that period; once it ends, everything is permanently deleted |
| Invoices and tax documents | 10 years, the period required by Portuguese tax law |
| Audit log | 24 months |
| Server technical records (logs) | 30 days |
| Website visit statistics (aggregated, no personal data) | 24 months |
| Backups | 7 days on the server; encrypted remote copies with 7 daily, 4 weekly and 6 monthly copies |
An honest note about backups: when we delete a record, it disappears from the application immediately, but it may survive in a backup until that backup is rotated out. Backups are not consulted for any purpose other than restoring the service.
There is one particular case. When a team is deleted, its players are not deleted: they are left without a team, to preserve history. If you really want to delete the player records, delete them explicitly: deleting the team is not enough.
Security
Below we describe what the platform does. We do not claim to be impregnable (no system is) nor do we invoke certifications we do not have.
- Per-account isolation at database level. Each account only sees its own rows, through PostgreSQL Row Level Security. It does not depend on the developer remembering to filter: if a filter is missing from a query, the result is zero rows, not another coach's rows. The application connects to the database with a user without special privileges, precisely so that it cannot bypass that rule.
- Encryption in transit. All traffic between your browser and our servers uses HTTPS/TLS.
- Hashed passwords. We never store passwords in plain text and cannot recover them: we can only let you set a new one.
- Metadata removed from photographs. Uploaded images are reprocessed on the server and lose their EXIF metadata, including GPS coordinates.
- Role-based permissions, checked on the server. Each person can only do what their role allows: an Assistant Coach cannot see player documents, and a Team Manager does not access the technical work (game model, tactics board, library, periodisation, fitness tests) or make call-ups.
- Audit log of sensitive actions, so that what happened in an account can be reconstructed.
- Hosting on a dedicated server in Portugal, with restricted administrative access.
Daily, encrypted backups. The database is copied every night. One copy stays on the server for 7 days; another is encrypted before it leaves the machine and stored elsewhere, with a rotation of 7 daily, 4 weekly and 6 monthly copies. Whoever hosts the remote copies never sees the data in the clear.
If we detect a personal data breach, we notify the affected data controllers within 24 hours of becoming aware of it, so that they can notify the CNPD within the 72 hours the law gives them. When the breach affects data for which we are the controller, we notify the CNPD and the data subjects under articles 33 and 34 of the GDPR.
If you find a vulnerability, please write to us at geral@myteammanager.pt before disclosing it.
Your rights
As a data subject, you have the right to:
- Access the data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data, when there are no grounds for keeping it;
- Restrict processing in certain situations;
- Portability: receive your data in a structured, machine-readable format;
- Object to processing based on legitimate interest, on grounds relating to your particular situation;
- Withdraw consent at any time, when processing is based on it. Withdrawal does not affect what was done before.
How to exercise them
Write to geral@myteammanager.pt. We reply within one month of receiving the request, extendable by two further months for complex requests: in that case we let you know within the first month. We may ask for additional information to confirm your identity, especially when the request involves deletion.
If the request concerns a player's data, the right recipient is the coach or club that entered it: they are the data controller. If you write to us, we forward the request and follow it up, as described in the section Data about minors.
Exercising these rights is free of charge. We charge nothing to reply.
Complaining to the CNPD
If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the supervisory authority. In Portugal it is the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority: www.cnpd.pt.
If you live in another Member State of the European Union, you may contact that country's supervisory authority.
We would appreciate it if you spoke to us first (it is usually resolved faster) but it is not mandatory, and the right to complain does not depend on it.
Changes to this policy
This policy may change, as the service evolves, providers change or the law changes. The version in force is always on this page, with the date of the last update at the top.
Relevant changes (new purposes, new processors with an impact, or changes in the allocation of responsibilities) are notified by email to users with an active account, before they take effect.
Contact
For any question about this policy or about the processing of personal data: geral@myteammanager.pt.
For the commercial conditions of the service, see the Terms and Conditions.