Privacy Policy

The controller of the data collected through RootCoach is Fernando René Gomes Futuro, NIF Y5680905B, address Calle María Tudor, 8, Madrid, and contact email fernando.gomes@rootcoach.app.

RootCoach has a dual position regarding data, depending on whose it is:

• Controller: with respect to the data of its own clients and direct users (coaches and club administrators who register), RootCoach decides on the processing and is the controller.
• Processor: with respect to the data of the students that a club or coach manages through the platform, the controller is the club or coach itself, and RootCoach acts as the data processor, processing that data on their behalf and according to their instructions.

RootCoach collects only the data necessary to provide the service. Specifically:

• From coaches and club administrators: name, email and professional activity data (certifications, rates, club, etc.) that they choose to provide. Purpose: to create and manage their account and provide the service.
• From students: name and the data that the club/coach or the student themselves choose to provide for managing the classes. Most fields are optional. The student's phone number and payment data are not requested.
• Optional sports data: level, dominant hand, position, progress and, optionally, active injuries. These fields are voluntary.
• Technical usage data: IP address and technical data about the device or browser, for operational and security purposes.
• Contact form (web): club name, person's name, email and, optionally, phone number and message. Purpose: to handle the information request.

The "injuries" field is health-related data and therefore a special category of data. Providing it is entirely voluntary: it is only processed if the person (or the responsible club/coach) decides to include it, for the purpose of adapting the sporting activity. It can be deleted at any time.

RootCoach is a management tool aimed at clubs and coaches, not a service aimed directly at minors nor a network that puts users in contact with one another. Students (who may be minors) do not contract, make payments or interact with people outside their club through the platform: they are solely managed by their club or coach in the context of their classes. For this reason, the processing of their data is limited and low-risk.

RootCoach may optionally collect the student's date of birth, for the sole purpose of allowing the club to organize students by age. When the student is below the applicable age of consent (in Spain, 14 years old), it is the responsibility of the club or coach —as the controller of the student's data— to obtain and keep the consent of the parents or guardians. RootCoach, as processor, does not directly collect data from minors outside of that club or coach.

• Performance of a contract / provision of the service (Art. 6.1.b GDPR): to manage accounts and provide the service.
• Consent (Art. 6.1.a GDPR): for optional data, health data (injuries), the contact form and the analytics and advertising cookies (Google Analytics, Google Ads, Meta Pixel), which are only activated if the user accepts them in the cookie notice.
• Legitimate interest (Art. 6.1.f GDPR): for the technical operation and security of the platform.

To provide the service, RootCoach relies on providers that may process data on its behalf, under the contracts and safeguards required by the GDPR:

• Supabase — database, authentication and storage. Data hosted in the European Union (Frankfurt, Germany).
• Google (Gemini) — artificial intelligence assistant. Processes the data sent to the assistant. May involve an international transfer (USA).
• Google — Analytics and Ads — site usage analytics and advertising conversion measurement. Only if the user accepts the corresponding cookies. May involve an international transfer (USA).
• Meta (Meta Pixel) — conversion measurement and advertising optimization. Only if the user accepts the corresponding cookies. May involve an international transfer (USA).
• Sentry — technical error monitoring. Data in the European Union (Germany).
• Netlify — hosting of the website and the application, and management of the contact form. US company (international transfer).
• Google Fonts — site typography. May transmit the visitor's IP address to Google (USA).
• Browser push notification service — for sending alerts.

Some of the above providers (Google/Gemini, Google Analytics and Ads, Meta, Netlify and Google Fonts) may process data outside the European Economic Area, in particular in the United States. Such transfers are carried out with the safeguards provided by the GDPR (for example, standard contractual clauses or recognized adequacy frameworks). Most of the data (main database) is hosted in the European Union.

Data is kept while the account is active and for the time necessary to comply with legal obligations. The user may request deletion at any time.

Any person may exercise their rights of access, rectification, deletion, objection, restriction of processing and portability by writing to fernando.gomes@rootcoach.app. Likewise, if they believe their rights have been infringed, they may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

When it concerns student data managed by a club or coach, RootCoach will forward the request to the responsible club or coach, or handle it following their instructions.