GDPR Compliance

This page outlines how Squadora complies with the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), United Kingdom, and Switzerland. Squadora acts as both a data controller (for data we collect directly) and a data processor (for data managed on behalf of sports clubs). We are committed to protecting the rights and freedoms of data subjects as defined by the GDPR. For GDPR-related inquiries, contact our Data Protection team at support@squadora.com.

We process personal data under the following lawful bases as defined by Article 6 of the GDPR: Consent (Article 6(1)(a)): Where you have given clear consent for us to process your personal data for a specific purpose, such as optional marketing communications and usage analytics (collected only after you accept the cookie banner). Contract Performance (Article 6(1)(b)): Processing necessary for the performance of a contract with you, including account creation, service delivery, and payment processing. Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests, including security and fraud prevention, provided these interests do not override your fundamental rights. Legal Obligation (Article 6(1)(c)): Processing necessary to comply with legal obligations, such as financial record keeping and responding to law enforcement requests. The main categories of data we process and their lawful bases are summarized in the Data Processing Activities section below.

Under the GDPR, you have the following rights: Right of Access (Article 15): You can request a copy of all personal data we hold about you. We will provide this in a commonly used electronic format within 30 days. Right to Rectification (Article 16): You can request correction of inaccurate personal data. Most data can be updated directly through your account settings. Right to Erasure (Article 17): You can request deletion of your personal data ("right to be forgotten"). We will comply unless we have a legal obligation to retain the data. Right to Restrict Processing (Article 18): You can request that we limit how we process your data while a complaint or dispute is being resolved. Right to Data Portability (Article 20): You can download your personal data as structured, machine-readable JSON at any time from your profile settings in the app, or request a copy from us, and transfer it to another service. Right to Object (Article 21): You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds. Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of prior processing. Rights Related to Automated Decision-Making (Article 22): We do not currently use automated decision-making that produces legal effects. If this changes, we will update this policy. To exercise any of these rights, email support@squadora.com with the subject line "GDPR Request". We will verify your identity and respond within 30 days.

Our key processing activities are: Account Management - Data: Name, email, phone, date of birth, profile photo, mailing address, emergency contact - Purpose: User authentication and profile management - Lawful basis: Contract performance - Retention: Deleted when you delete your account Club Operations - Data: Team rosters, participant profiles, match results, player statistics, schedules, availability, and any medical information the club records for participant safety - Purpose: Core service delivery for sports club management - Lawful basis: Contract performance - Retention: Duration of the club's account; the club manages its own records. Uploaded photos and media are automatically deleted 3 years after upload or when the club's account closes, whichever comes first, unless the club enables media retention Payment Processing - Data: Transaction amounts, payment method identifiers (tokenized) - Purpose: Processing club membership fees and event payments - Lawful basis: Contract performance - Retention: 7 years (financial regulations) Communications - Data: Messages, notifications, chat history - Purpose: Facilitating club communications - Lawful basis: Contract performance / Legitimate interest - Retention: Messages you send remain part of the club's chat history, which the club manages AI Features - Data: Content you submit to AI features (prompts and, for photo analysis, the photo) - Purpose: Generating the response you requested (processed via Google's Gemini API) - Lawful basis: Contract performance - Retention: Prompts are not retained on our servers, except short excerpts kept for review when automated safety screening flags a concern; generated content you save (such as training programs) is stored with your account Analytics - Data: Usage events (such as page views and sign-ups), associated with your user ID when signed in - Purpose: Service improvement - Lawful basis: Consent (collected only after you accept the cookie banner; change your choice any time on our Cookie Policy page) - Retention: Aggregated reporting may be retained indefinitely

Squadora's infrastructure is hosted on Google Cloud Platform with primary data centers in the United States. For users in the EEA, UK, and Switzerland, this constitutes an international data transfer. We ensure adequate protection for international transfers through: Standard Contractual Clauses (SCCs): The data processing terms of our processors, which we accept as a condition of using their services, incorporate EU-approved Standard Contractual Clauses. This includes Google (Firebase) and Stripe. Data Processing Agreements: Our sub-processors provide GDPR data processing terms that govern their handling of personal data on our behalf. Supplementary Measures: In addition to SCCs, we implement supplementary technical measures including: - Encryption in transit and at rest - Role-based access controls enforced by database security rules - Logging of administrative and support access - Data minimization practices Sub-processors who access personal data from EEA users: - Google LLC (Firebase / Google Cloud) - United States - cloud infrastructure, authentication, database, file storage, analytics - Google LLC (Gemini API) - United States - processing of content submitted to AI features - Stripe Inc - United States - payment processing - Microsoft Corporation (Microsoft 365) - United States - email delivery - Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) - United States - push notification delivery We will notify users of any changes to our sub-processor list and provide an opportunity to object.

For all GDPR-related inquiries, data subject requests, or complaints: Data Protection Contact Email: support@squadora.com Subject line: "GDPR Inquiry" Response times: - Data subject access requests: Within 30 days - Data deletion requests: Within 30 days - General inquiries: Within 5 business days If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at the European Data Protection Board website.

In accordance with Articles 33 and 34 of the GDPR, we have procedures in place to handle personal data breaches: Supervisory Authority Notification: We will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Data Subject Notification: If a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected data subjects without undue delay. Our breach response procedures include: - Immediate containment and assessment - Documentation of the breach and its effects - Notification to relevant authorities and affected individuals - Implementation of remedial measures - Post-incident review and process improvement We document security incidents and our responses.

Sports clubs frequently include minor participants. We take additional care when processing data of children under 16 (or the applicable age in your member state): - Profiles for children are created and managed by a parent, guardian, or authorized club administrator - never by the child - Clubs that enter a child's information are responsible for having the parent's or guardian's consent to do so, typically as part of the club's own registration process - Club administrators act as authorized agents for the limited purpose of managing sports activities - We collect only the minimum data necessary for participation - Children's data is subject to the same security measures as all personal data - Parents and guardians can exercise data subject rights on behalf of their children at any time For clubs operating in jurisdictions with different age thresholds (e.g., UK uses 13), we respect the local requirement.

We review this GDPR compliance page regularly and update it to reflect changes in our practices, technology, or applicable law. Material changes will be communicated through the Service and via email to affected users at least 30 days before they take effect. Last review date: July 13, 2026 Next scheduled review: October 1, 2026 For questions about this policy, contact support@squadora.com.