Privacy Policy

Preamble

With the following privacy policy we would like to inform you which types of your personal data (hereinafter also abbreviated as "data") we process for which purposes and in which scope. The privacy statement applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Controller

Overview of Processing Operations

The following table summarises the types of data processed, the purposes for which they are processed and the concerned data subjects.

Legal Bases for the Processing

In the following, you will find an overview of the legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may apply.

Security Precautions

We take appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.

The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, transmission, securing and separation of the data.

Transmission of Personal Data

In the context of our processing of personal data, it may happen that the data is transferred to other places, companies or persons or that it is disclosed to them. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content that are embedded in a website.

In such a case, the legal requirements will be respected and in particular corresponding contracts or agreements, which serve the protection of your data, will be concluded with the recipients of your data.

Recipients include OpenAI, L.L.C. (AI Coach processing, see the dedicated section), Google LLC (Firebase hosting, authentication, analytics and Cloud Functions; AdMob rewarded advertising), Microsoft Corporation (Clarity analytics), RevenueCat, Inc. (in-app purchase processing) and the Apple App Store / Google Play (in-app purchases).

Data Processing in Third Countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or the processing takes place in the context of the use of third party services or disclosure or transfer of data to other persons, bodies or companies, this will only take place in accordance with the legal requirements and with appropriate safeguards such as standard contractual clauses or adequacy decisions.

Transfers to OpenAI, L.L.C. (United States) are covered by OpenAI's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Advertising data is processed by Google LLC (United States) under Google's Data Processing Terms, which incorporate the EU Standard Contractual Clauses; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Erasure of Data

The data processed by us will be erased in accordance with the statutory provisions as soon as their processing is revoked or other permissions no longer apply (e.g. if the purpose of processing this data no longer applies or they are not required for the purpose).

If the data is not deleted because they are required for other and legally permissible purposes, their processing is limited to these purposes. This means that the data will be restricted and not processed for other purposes.

Use of Cookies

Cookies are small text files or other data records that store information on end devices and read information from the end devices. For example, to store the login status in a user account, the contents of a shopping cart in an e-shop, the contents accessed or the functions used.

Mobile App Data Collection and Consent

Our mobile application ("SSOT App") collects and processes certain personal data to provide AI-powered football training features. By using the App, you acknowledge and consent to the collection and processing of the following data:

AI Coach and Third-Party AI Processing (OpenAI)

When you use the AI Coach (chat, drill attachments, or AI training reports), we transmit the information needed to generate a response to OpenAI, L.L.C., San Francisco, United States, which processes it on our behalf as a processor through its API. The information may include:

• your first name, age, skill level, playing position and preferred foot;
• your skill ratings and best drill results;
• your recent training sessions and achievements;
• the messages you type to the AI Coach; and
• the drill statistics you choose to attach.

We do not transmit your last name, email address, photos, precise location or drill videos.

Legal basis. Your consent (Art. 6(1)(a) GDPR), given in the app before the first transmission. For users under 13, consent is given by a parent or guardian in the app. You can withdraw consent at any time in Settings → Privacy → AI Coach data sharing; this stops all further transmission and does not affect processing carried out before withdrawal.

Purpose. Solely to generate the AI Coach's answers and training reports for you. Under OpenAI's API data usage policy, OpenAI does not use data submitted through its API to train its models and retains it only for a limited period for abuse monitoring before deletion. OpenAI is bound by a data processing agreement to protect your data to a standard at least equivalent to this policy. See https://openai.com/policies/api-data-usage-policies.

Advertising

The app shows rewarded video ads only — short ads you choose to watch to earn free coins or to unlock a drill for one session. Ads are served by Google AdMob (Google LLC).

We do not track you. We never access your device's advertising identifier, never combine data collected in the app with data from other companies' apps or websites for advertising, and never share your data with data brokers. Consequently the app does not show the iOS "Allow tracking" (App Tracking Transparency) request.

Ads on iOS are always non-personalized. They are selected from the context of the app, not from a profile of you.

Ads on Android are non-personalized by default. If you are 16 or older, the app may ask — from your second session — whether you consent to personalized ads through Google's consent form; you can decline and continue with non-personalized ads, and change your choice later from the same form.

Children and teenagers. For users under 13 ad requests are tagged as child-directed; for users under 16 they are tagged as under the age of consent. In both cases ads are non-personalized and limited to general-audience content, and no consent request is shown.

To serve an ad, Google receives technical data from your device (such as the app identifier, device type, operating system version, coarse location derived from your IP address, and whether the ad was displayed or completed). This data is processed under Google's privacy policy (https://policies.google.com/privacy) and Google's advertising policies for non-personalized ads. Legal basis: our legitimate interest in funding the free tier of the app (Art. 6(1)(f) GDPR); for personalized ads on Android, your consent (Art. 6(1)(a) GDPR).

Leaderboard and Performance Data

The SSOT App features a global leaderboard system that displays user training performance scores and rankings. By using the App and participating in training drills, your performance data may be uploaded to our servers and displayed on leaderboards visible to other users.

Business Services

We process data of our contractual and business partners, e.g. customers and interested parties (collectively referred to as "contractual partners") within the context of contractual and comparable legal relationships as well as associated actions and communication.

Provision of Online Services and Web Hosting

In order to provide our online services securely and efficiently, we use the services of web hosting providers from whose servers the online services can be accessed. For these purposes, we may use infrastructure and platform services, computing capacity, storage space and database services.

Contact and Inquiry Management

When contacting us (e.g. via contact form, e-mail, telephone or via social media) as well as in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact requests and any requested measures.

Profiles in Social Networks (Social Media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us.

Changes and Updates to the Privacy Policy

We kindly ask you to inform yourself regularly about the contents of our data protection declaration. We will adjust the privacy policy as changes in our data processing practices make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

Rights of Data Subjects

As data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

Terminology and Definitions

This section provides an overview of the terms used in this privacy policy. Many of the terms are drawn from the law and defined mainly in Article 4 GDPR.