This Privacy Policy ("Policy") describes how Mate Academy Oy (Business ID: 3591146-1), a company registered in Finland ("Company", "we", "us", or "our"), collects, uses, stores, and protects your personal data when you use the MateFootball platform at matefootball.fi ("Service").
We are committed to protecting your privacy and processing your personal data in compliance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the Finnish Data Protection Act (tietosuojalaki, 1050/2018), and other applicable data protection legislation.
1. Data Controller
The data controller responsible for your personal data is:
- Company: Mate Academy Oy
- Business ID: 3591146-1
- Country: Finland
- Email: [email protected]
- Website: https://matefootball.fi
2. Personal Data We Collect
2.1. Data You Provide Directly
- Account information: Name, email address, password (managed by Clerk), profile picture
- Profile details: Country, sex, football club, preferred playing position, date of birth
- Coach-specific data: Professional qualifications, coaching experience, bio, availability schedule, bank/payment details (for payouts)
- Payment information: Payment card details (processed and stored exclusively by Stripe — we do not store card numbers)
- Communications: Messages sent through the Platform, support inquiries, feedback, and reviews
- Booking information: Session dates, times, Coach selection, participant details
2.2. Data Collected Automatically
- Usage data: Pages visited, features used, videos watched (including watch progress and completion status), time spent on the Platform
- Device and technical data: IP address, browser type and version, operating system, device type, screen resolution
- Cookies and similar technologies: Session cookies, authentication tokens, and analytics identifiers (see Section 8)
- Performance data: Training progress, gamification points (XP), challenge completions, leaderboard rankings
2.3. Data from Third Parties
- Clerk: Authentication data, social login profile information (if you sign in via Google or Facebook)
- Stripe: Payment confirmation, subscription status, invoice data
3. Legal Bases for Processing
We process your personal data based on the following legal grounds under Article 6 of the GDPR:
| Legal Basis | Purpose |
|---|
| Contract performance (Art. 6(1)(b)) | Providing the Service, managing your account, processing subscriptions and payments, facilitating bookings |
| Legitimate interest (Art. 6(1)(f)) | Improving the Service, analytics, fraud prevention, security monitoring, direct marketing to existing customers |
| Consent (Art. 6(1)(a)) | Marketing communications, optional analytics cookies, social login integration |
| Legal obligation (Art. 6(1)(c)) | Tax and accounting records, compliance with Finnish law, responding to lawful requests from authorities |
4. How We Use Your Data
We use your personal data for the following purposes:
- Service delivery: Creating and managing your account, providing access to Content based on your subscription tier, facilitating Coach-Player bookings
- Payment processing: Processing subscription payments, booking payments, Coach payouts, refunds, and invoicing
- Personalization: Tracking your training progress, maintaining gamification scores and leaderboard rankings, recommending relevant content
- Communication: Sending transactional emails (booking confirmations, payment receipts, subscription updates), responding to support requests
- Marketing: Sending promotional communications (with your consent), notifying you of new features, camps, and offers
- Analytics and improvement: Understanding how the Service is used, identifying popular content, improving user experience, debugging technical issues
- Security: Preventing fraud, detecting unauthorized access, protecting the integrity of the Platform
- Legal compliance: Maintaining records required by Finnish tax and accounting laws, responding to lawful requests
5. Data Sharing and Recipients
We share your personal data with the following categories of recipients:
5.1. Service Providers (Data Processors)
- Stripe, Inc. (USA) — Payment processing and subscription management. Stripe is certified under the EU-US Data Privacy Framework.
- Clerk / Clerk, Inc. (USA) — Authentication and identity management. Clerk processes data under Standard Contractual Clauses (SCCs).
- DigitalOcean, LLC (USA/EU) — Hosting, database, and file storage. Data is hosted in the EU (Frankfurt, Germany).
- Resend, Inc. (USA) — Transactional email delivery.
5.2. Other Users
- Your public profile information (name, profile picture, position, club) may be visible to other users on the Platform
- Leaderboard rankings and gamification achievements are visible to other registered users
- When you book a session, your name and contact details are shared with the Coach
- Reviews you post are publicly visible on the Platform
5.3. Legal and Regulatory
We may disclose your personal data if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
5.4. Business Transfers
In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.
6. International Data Transfers
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States, where some of our service providers are located. Such transfers are protected by:
- EU-US Data Privacy Framework (for certified US companies)
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Other appropriate safeguards as required by Article 46 of the GDPR
Our primary database and hosting infrastructure is located within the EU (DigitalOcean Frankfurt region).
7. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes described in this Policy:
- Account data: Retained for the duration of your account, plus up to 30 days after account deletion for technical processing
- Payment and transaction records: Retained for 6 years after the transaction as required by Finnish accounting legislation (kirjanpitolaki, 1336/1997)
- Usage and analytics data: Retained for up to 2 years, then anonymized or deleted
- Communication records: Retained for up to 2 years after the last interaction
- Marketing consent records: Retained for as long as consent is valid, plus 1 year after withdrawal
- Coach invoicing data: Retained for 6 years as required by Finnish tax law
After the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be associated with you.
8. Cookies and Tracking Technologies
8.1. Essential Cookies
We use strictly necessary cookies for authentication (session cookies) and security. These cookies are required for the Service to function and cannot be disabled.
8.2. Functional Cookies
We use functional cookies to remember your preferences, such as language selection and display settings.
8.3. Analytics
We may use analytics tools to understand how the Service is used. Any analytics cookies that are not strictly necessary will only be placed with your consent.
8.4. Managing Cookies
You can manage cookie preferences through your browser settings. Note that disabling essential cookies may prevent you from using certain features of the Service.
9. Your Rights Under GDPR
As a data subject, you have the following rights under the GDPR. To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days.
- Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.
- Right to rectification (Art. 16): You have the right to request correction of inaccurate personal data and completion of incomplete data.
- Right to erasure (Art. 17): You have the right to request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations.
- Right to restriction (Art. 18): You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.
- Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
- Right to object (Art. 21): You have the right to object to processing based on legitimate interests, including profiling. You also have the right to object to direct marketing at any time.
- Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to lodge a complaint: You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu): Office of the Data Protection Ombudsman, P.O. Box 800, 00531 Helsinki, Finland, [email protected], www.tietosuoja.fi
10. Children's Privacy
The Service is available to users aged 13 and above. We do not knowingly collect personal data from children under 13. For users between 13 and 16, we process personal data based on consent provided or authorized by the holder of parental responsibility, in accordance with Article 8 of the GDPR and Finnish implementation thereof.
If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will take steps to delete that data promptly. If you believe we have inadvertently collected data from a child under 13, please contact us at [email protected].
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Secure authentication through Clerk with support for multi-factor authentication
- Regular security assessments and monitoring
- Access controls limiting data access to authorized personnel only
- Secure payment processing through PCI DSS-compliant Stripe infrastructure
- Database hosting within the EU with encrypted connections
- Regular backups with secure storage
Despite these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
12. Automated Decision-Making
The Service uses automated processing for the following purposes: (a) subscription tier access control (determining which content you can access based on your plan); (b) gamification scoring (calculating XP points and leaderboard positions); (c) payment failure handling (automatic downgrade upon failed payments). None of these automated processes produce legal effects or similarly significantly affect you within the meaning of Article 22 of the GDPR.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Material changes will be communicated to you by email or through a prominent notice on the Platform at least 14 days before they take effect. We encourage you to review this Policy periodically.
The "Last updated" date at the top of this Policy indicates when it was last revised.
14. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:
You also have the right to contact the Finnish Data Protection Ombudsman if you are not satisfied with our response:
- Office of the Data Protection Ombudsman
- P.O. Box 800, 00531 Helsinki, Finland
- Email: [email protected]
- Website: www.tietosuoja.fi