Privacy policy

Last updated: 16 October 2026

At Spooru we take seriously the privacy and protection of the personal data of the people who use our platform.

This Privacy Policy explains what personal data we process, what we use it for, the legal basis for each processing activity, who we may share it with, and the rights of the people whose data we process.

Spooru is designed primarily to facilitate the management of sports clubs and their teams, players, families and sports staff.

Where this Policy uses the term “Spooru”, it refers to Marc Piera Secall, with registered address at Froschau, 24, 74925 Epfenbach, Germany.

1. Who is the data controller?

The data controller will depend on the relationship with the user and the specific processing activity.

1.1. Processing carried out by Spooru

For processing that Spooru carries out for its own purposes, the data controller is:

• Marc Piera Secall
• Address: Froschau, 24, 74925 Epfenbach, Germany
• Email: info@spooru.com

In these cases, Spooru determines the purposes and means of processing and assumes the obligations that apply to it under applicable regulations.

1.2. Data managed by clubs

Clubs that use Spooru may add and manage personal data of their players, families, coaches and other members.

For processing in which the club determines the purposes and essential elements of the processing, the club will be the data controller and Spooru will provide the corresponding technology service on behalf of the club, under the terms set out in the Data Processing Agreement that applies.

A club's use of Spooru does not automatically make Spooru the controller of all processing carried out through the platform.

Whether a party acts as controller, processor or, where applicable, joint controller will be determined based on the functions and decisions actually carried out by each party for each processing activity.

2. What personal data do we process?

Depending on the relationship with Spooru and the features used, we may process the following categories of data.

2.1. Account and contact data

We may process:

• First and last name.
• Email address.
• Information necessary to create and manage the account.
• Data the user chooses to voluntarily add to their profile.

2.2. Player data

Where a club uses Spooru to manage its teams and players, data such as the following may be processed:

• First and last name.
• Date of birth.
• Photograph, where added by the club.
• Team and category.
• Shirt number.
• Position.
• Participation and sports statistics.
• Information related to call-ups, matches and sports activities.

The club is responsible for determining which data it needs for sports management and for having an appropriate legal basis for processing it.

2.3. Medical check-up / fitness-to-play information

The platform may allow the club to record the date of the last medical check-up and the date until which fitness to play is valid, where this feature is used.

Spooru is designed for this field to be used purely for administrative validity-tracking purposes.

This field is not intended, and is not used, to collect information about a player's diagnosis, illness, injury, treatment, specific medical result, or other clinical circumstances.

However, certain information related to fitness to play could, depending on the specific circumstances and context, be linked to a person's health.

For this reason, clubs must avoid entering medical or health information into the platform that is not necessary for the management purpose permitted by the service.

Where, in a specific case, such data must be regarded as health data within the meaning of Art. 9 GDPR, the club, as controller, needs, in addition to a legal basis under Art. 6 GDPR, an exception under Art. 9(2) GDPR (for example, explicit consent). Spooru deliberately does not offer free-text fields in which diagnoses or medical results could be recorded; access is role-based.

2.4. Communications and messages

Spooru may process messages and communications sent through the platform's internal channels.

This data is used to provide the service's communication feature and to maintain the security, integrity and operation of the platform.

Messages are subject to the retention rules set out in this Policy and to the conditions applicable to the service.

2.5. Payment-related data

Where a club uses payment-collection features through Spooru, we may process the data necessary to manage those payments and their reconciliation.

Depending on the payment method used, this may include:

• Identifying information about the payer.
• The amount and description of the payment.
• The status and date of the transaction.
• Banking information necessary for a direct debit.
• References relating to SEPA mandates.
• Transaction identifiers.

Where payment is made by card through Stripe, full card data is processed directly by Stripe under its own terms and privacy policies. Spooru does not store the full card number.

2.6. Push notifications

Where the user enables push notifications, Spooru may process the technical identifier needed to link the browser or device with the notification service.

This identifier is used solely to send the requested notifications and manage their technical operation.

The user can disable notifications from the relevant settings on their device or browser.

2.7. Technical and security data

We may process certain technical data necessary to provide and protect the service, such as:

• IP address.
• Browser and device information.
• Technical logs.
• Date and time of access.
• Information related to errors, incidents and security events.

This data will be used, among other purposes, to ensure security, prevent fraudulent use and maintain the availability and integrity of the platform.

2.8. Advertising

Families using the platform without the corresponding ad-free subscription may see advertisements provided by third parties, including Google AdSense.

The use of cookies, identifiers and similar technologies for advertising purposes is explained in more detail in our Cookie Policy.

When the platform is opened, Google's consent management is loaded (except for users logged in with an active ad-free subscription) before any advertising is shown. Minors with their own access are shown only non-personalised ads. The choice can be changed or withdrawn at any time via “Cookie preferences” in the page footer.

2.9. Contact form

If you write to us through the contact form, we process the name, email address, subject and message you provide in order to handle your enquiry and reply to you. The message reaches our mailbox (info@spooru.com); we do not store it on the platform.

The legal basis is the taking of pre-contractual steps or the performance of a contract if you are already a user (Art. 6(1)(b) GDPR), or our legitimate interest in handling the enquiries we receive (Art. 6(1)(f) GDPR). We keep the message and our reply only as long as needed to handle the enquiry and, afterwards, for the applicable statutory periods if legal obligations arise from it.

To prevent abuse of the form we store, for a maximum of two days, a non-reversible fingerprint (keyed hash) of your IP address together with the time of submission, solely to limit the number of messages; the IP address itself is not stored. The email is sent through our provider Resend, which acts as a processor.

2.10. Source of the data and obligation to provide it

We receive personal data from different sources:

• directly from the data subject, for example when registering, accepting an invitation or using the contact form;
• from clubs, which enter data on players, families, coaches and members; in that case the data do not come from the data subject but from the club, which is responsible for informing the individuals concerned (Arts. 13 and 14 GDPR) and is supported by Spooru in doing so;
• from families, who respond to events (for example, confirming or declining attendance);
• automatically through the use of the platform (technical data, see section 2.7).

An email address and a password are required to create an account; without them the account cannot be created and the service cannot be used. Push notifications, photos and optional profile details are voluntary. In the contact form, the fields marked with * are required. Which data a club asks players and families for, and whether providing them is mandatory, is determined by the club; the consequences of not providing them depend on its relationship with the individuals concerned (for example, not being included in a team or not having access to the platform).

3. Minors' data

Spooru may process personal data of minors, since sports clubs using the platform may manage teams made up of minor players.

The creation and management of player profiles is the club's responsibility, in line with its relationship with the players and their families. Families (parents or guardians) access their children's data through their own accounts; players can only be invited to have their own access from the age of 16.

The fact that a player is a minor does not mean that every processing of their data is necessarily based on their parents' consent. The legal basis depends on the specific purpose of the processing and on the legal relationship between the club, the player and their family.

Consent under Art. 8 GDPR. Art. 8 GDPR relates only to a child's consent in relation to information society services offered directly to them, such as creating their own user account. It must be distinguished from other legal bases and from consents for other purposes, in particular for the use of photographs.

The minimum age for valid consent to information society services is 16 under Art. 8(1) GDPR, unless national law sets a lower age (not below 13). Spanish law sets 14 (Art. 7 LOPDGDD); Germany has not set a lower age, so the limit of 16 applies. Which national law applies in a given case depends on the circumstances.

Photographs. Player photos are uploaded by the club. The club is responsible for having an appropriate legal basis (normally the consent of the parents or guardians or, depending on age and maturity, of the minor) and for being able to demonstrate it. Photos are not publicly accessible on the internet; they are only shown to authorised users through time-limited links. The club can remove a photo at any time.

Information addressed to minors will be provided, where applicable, in a clear, simple and age-appropriate way.

4. What do we use the data for?

Depending on the specific processing activity, we may use personal data for the following purposes:

Account management

• Create and manage accounts.
• Identify users.
• Allow access to the platform.
• Manage permissions and roles.

Sports management

When acting on behalf of a club:

• Manage teams and players.
• Organise seasons and categories.
• Manage calendars.
• Manage call-ups.
• Record statistics.
• Facilitate communication between authorised members.

Communications

• Send invitations.
• Send notices relating to matches and call-ups.
• Send communications necessary for the service to function.
• Send push notifications where enabled.

Payment management

• Process and record payments.
• Manage direct debits.
• Manage payments made through external providers.
• Facilitate payment reconciliation.
• Comply with applicable legal obligations.

Security

• Detect and prevent unauthorised access.
• Prevent fraud and abusive use.
• Investigate security incidents.
• Maintain the integrity of the platform.

Advertising

Where applicable, show advertising in certain areas of the platform and manage users' advertising preferences.

5. Legal bases

The legal basis will depend on the specific purpose of the processing.

The legal bases that may apply include:

Performance of a contract

Where processing is necessary to provide the contracted or requested services.

Compliance with legal obligations

Where it is necessary to process certain data to comply with legal obligations, particularly tax, accounting, commercial or other applicable obligations.

Consent

Where processing requires consent and it has been validly given.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

Legitimate interest

Where Spooru or a third party has a legitimate interest and that interest does not override the rights and freedoms of the affected individual.

Where this legal basis is used, Spooru will carry out the corresponding balancing test where necessary.

Allocation to purposes

The table below allocates data, role, legal basis and recipients to the main purposes. Retention is described in section 8. A contract with Spooru is not automatically attributed to relatives or coaches: what matters is whether a direct contractual relationship exists.

6. Who do we share data with?

Spooru does not sell personal data.

Data may be disclosed or made available to third parties where necessary to provide the service, comply with a legal obligation, ensure security or carry out any of the purposes described in this Policy.

The technology providers that may be involved include:

Supabase

Provider used for certain infrastructure services, database hosting and information and file storage.

Resend

Provider used to send certain electronic communications from the platform.

Stripe

Provider used for certain services related to payments and transaction processing.

Depending on the specific service, Stripe may act as a payment service provider or as controller for certain processing carried out for its own purposes.

Google

Certain advertising services may be provided through Google AdSense.

Processing carried out by Google for its own purposes will be governed by its own policies and terms.

The use of advertising services and tracking technologies will be subject, where applicable, to the preferences and consents established through Spooru's cookie management system.

Vercel

Provider of hosting and delivery of the web application. For technical reasons, IP addresses and access logs are processed.

Anthropic

When a player photo or club crest is uploaded, the image may be sent to Anthropic for an automated content check. The check only verifies that the image is suitable for its intended use; nobody is identified, no age is estimated and no facial recognition is performed.

OpenAI

The texts of a club's own exercises (for example the title, description and equipment) may be sent to OpenAI to translate them automatically into the other languages and to generate illustrations with artificial intelligence. These texts describe the exercise and must not include personal data.

OpenStreetMap

For address search (Nominatim) and map display, the search terms entered and, for technical reasons, the IP address are transmitted to OpenStreetMap's services.

Push services of browser and device providers

Push notifications are delivered through the services of each browser or device provider (for example Google, Apple, Mozilla).

An up-to-date list of providers and, where applicable, sub-processors may be kept in the relevant contractual and privacy documentation.

7. International transfers

Some technology providers used by Spooru may be established outside the European Economic Area or use infrastructure located outside that area.

Where an international data transfer takes place, Spooru will adopt the measures and safeguards required by applicable regulations, including, where applicable:

• an adequacy decision of the European Commission;
• standard contractual clauses;
• supplementary measures;
• or other legally recognised mechanisms.

The use of a provider located outside the European Economic Area does not by itself mean that all data is transferred internationally; this will depend on the specific infrastructure and configuration of the service.

We use providers that may be established, or have infrastructure, in third countries, for example Google, Stripe, Resend, Vercel, Anthropic and OpenAI. Where data are transferred to third countries, we rely on adequacy decisions (Art. 45 GDPR, such as the EU-US Data Privacy Framework for certified providers) or on standard contractual clauses (Art. 46 GDPR) and, where necessary, supplementary measures. A copy of the safeguards can be requested at info@spooru.com.

8. Data retention

Personal data will be retained for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the periods necessary to comply with legal obligations or for the establishment, exercise or defence of claims.

Season data

The data of a season (teams, calendar, call-ups, statistics, messages, training sessions, line-ups, tournaments and standings) is deleted automatically two years after the season ends. Club administrators are notified at least 30 days beforehand. Player profiles (including photos) of players who no longer belong to any team after that deletion are deleted together with the season. Payment and billing data (receipts, direct-debit runs, payments, SEPA mandates) is not affected and is handled under the statutory retention periods. Longer retention remains possible where a legal obligation or the defence of legal claims requires it. A season that is still in use (with events in the last two years) is not deleted.

Payment-related data

Mandate data (SEPA mandate and IBAN) is masked, or deleted if no receipts are linked to it, 14 months after the last collection made with it. Billing data (direct-debit runs, receipts, orders, and card or subscription payments) is deleted eight years after the end of the calendar year in which it arose, which is the retention period for accounting records. Longer retention remains possible where a legal obligation or the defence of legal claims requires it.

Account data

Account data will be retained for as long as the account remains active and, subsequently, for as long as necessary to comply with legal obligations or address any liability.

Where certain data is necessary to comply with a legal obligation, it may be retained in a blocked state, separate from ordinary use of the service, for the applicable period.

9. Security

Spooru applies reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration, unauthorised disclosure and other risks associated with processing.

These measures include, where applicable, access controls, permission management, authentication mechanisms, infrastructure security measures and incident detection and management procedures.

No system connected to the Internet can guarantee absolute security. Spooru will therefore review and update its security measures in line with technological developments and the risks associated with the processing carried out.

10. Rights of individuals

Individuals whose data are processed may exercise, where applicable, the following rights:

• Access to their personal data.
• Rectification of inaccurate data.
• Erasure of their data.
• Restriction of processing.
• Objection to processing.
• Data portability where applicable.
• Withdrawal of consent where processing is based on consent.

To exercise these rights, a request can be sent to:

info@spooru.com

We generally respond to requests within one month of receipt. Under the conditions of Art. 12(3) GDPR, this period may be extended by a further two months; we will inform you of any extension within the first month.

The request should state which right is to be exercised. We only ask for additional information to verify identity where there are reasonable doubts about it, and only to the extent necessary.

Requests relating to data for which a club is responsible can also be addressed directly to that club. Where the data were entered and are processed on behalf of a club, Spooru may forward the request to the relevant club or cooperate with it to handle it properly, in line with the roles and responsibilities of each party.

11. Exercising rights relating to underage players

Where a request relates to the data of an underage player, the rights must be exercised by whoever is legally entitled to do so under applicable law.

Depending on the minor's age, the right being exercised and the legal basis for the processing, it may be appropriate for the minor themselves to take part in exercising the right.

Where the club is the controller for the processing, the request may be forwarded to the club so that it can handle the exercise of the right with the data subject.

12. Right to lodge a complaint

If a person considers that the processing of their personal data infringes applicable law, they may contact Spooru to try to resolve the matter.

Under Art. 77 GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the place of their habitual residence, place of work or place of the alleged infringement. For Spooru's establishment in Baden-Württemberg, the competent authority is, in particular, the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW).

For persons habitually resident in Spain, the competent supervisory authority is the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain.

Information and procedures are available on the official website of the relevant authority.

13. Automated decisions and profiling

Spooru does not make decisions based solely on automated processing that produce legal effects or similarly significant effects on users.

Where third-party advertising technologies are used, any processing carried out by those third parties for their own purposes will be governed by their own policies and consent-configuration mechanisms.

14. Privacy by design and data minimisation

Spooru seeks to limit the collection of personal data to that which is adequate, relevant and necessary for the purposes for which it is processed.

In particular, the platform is not designed to request detailed medical information about players, and clubs must avoid entering particularly sensitive information that is not necessary for managing the service.

15. Changes to this Policy

Spooru may update this Privacy Policy where necessary to reflect changes in legislation, in the services provided, in the providers used or in data-processing practices.

The version in force will be the one published on this page.

Where changes are significant and legally required, Spooru will take appropriate steps to inform users.

16. Contact

For any matter relating to this Privacy Policy or the processing of personal data, you can contact:

• Marc Piera Secall
• Address: Froschau, 24, 74925 Epfenbach, Germany
• Email: info@spooru.com

Last updated: 16 October 2026