Global Data Protection & Privacy Policy

1. Data Controller Identification and Scope

Scope of Policy: This Global Privacy Policy ('Policy') describes how Passione90 ('we', 'us', 'our', or 'Data Controller') collects, uses, discloses, and protects your personal data when you use the Passione90 mobile application on iOS and Android devices across the European Union (EU/EEA) and the United States (US).

Regulatory Alignment: We strictly adhere to applicable data privacy legislation, including the EU General Data Protection Regulation (GDPR - Regulation EU 2016/679), the ePrivacy Directive, the US Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and applicable US state privacy statutes (including VCDPA, CPA, CTDPA, and UCPA).

2. Categories of Personal Data Collected Across the 4 Roles

Data Categorization: Depending on your active role (Fan, Player, Coach, Club) and app interactions, we collect the following categories of personal information:

Data Category	Specific Data Fields Collected	Primary Collection Source & Purpose
Identity & Account Data	Full name, email address, phone number, profile avatar, role persona (Fan, Player, Coach, Club), 2FA credentials.	Direct user input via Supabase Auth. Necessary for account setup and security.
Athletic & Training Data	Workout logs, training frequency, drill performance metrics, AI workout scores, and position preferences.	Player and Coach inputs. Used to generate Grok AI fitness insights and player tracking.
User-Generated Media	Scout Reporter video uploads, match goal clips, profile images, comments, and tactical scheme votes.	User uploads. Shared within community feeds and scout discovery modules.
Geolocation Data	Precise GPS coordinates, local venue search preferences, and regional stadium proximity.	Mobile device location services. Powers Match Organizer pickup game finder.
Financial & Commercial Data	Transaction logs, subscription tiers, ticket exchange history (card details handled by Stripe/PayPal).	Direct user transactions. Managed via PCI-DSS compliant Stripe and PayPal SDKs.

3. Legal Bases for Data Processing Under EU GDPR

EEA Processing Principles: For users located in the European Economic Area (EEA), our processing of personal data is grounded in legal bases defined under GDPR Article 6(1):

Performance of Contract (Art. 6(1)(b)): Processing is necessary to perform our contractual obligations under the Terms of Service, including delivering core app functionality across the 4 roles, account management, and match organization.

Explicit User Consent (Art. 6(1)(a)): Obtained for precise GPS geolocation processing, push notification delivery via Firebase FCM, direct marketing, and Scout Reporter public video publishing.

Legitimate Interests (Art. 6(1)(f)): Necessary to protect platform security, prevent ticket exchange fraud, improve app algorithms, and maintain network integrity.

4. US State Privacy Disclosures (CCPA/CPRA & Multi-State)

United States Privacy Rights: This section provides mandatory disclosures for residents of California and US states with comprehensive privacy laws:

Notice at Collection & Sale Disclosures: In the preceding 12 months, Passione90 has collected the categories of personal information listed in Section 2. We do NOT sell personal information for monetary consideration. We share personal data solely with service providers under strict data processing agreements.

Your US Privacy Rights: US residents possess the Right to Know/Access, Right to Delete, Right to Correct inaccurate data, and the Right to Limit the Use of Sensitive Personal Information (including precise geolocation).

5. Children's Data Protection & Youth Football Academies

Child Privacy Rules: Passione90 enforces strict youth privacy protections for youth players and junior academy participants:

COPPA Compliance (US): We do not knowingly collect personal information from children under 13 in the US without prior verifiable parental consent in compliance with COPPA. Parents may review, delete, or revoke consent at any time by contacting privacy@passione90.app.

GDPR Article 8 (EU): For EU residents, processing data of children under 16 (or lower national thresholds) requires verifiable consent from holders of parental responsibility in accordance with GDPR Article 8.

6. Video Data Processing & US VPPA Disclosures

Video Media Rights: The Scout Reporter module enables players to publish athletic highlight clips. In compliance with the US Video Privacy Protection Act (VPPA), users consent to the sharing of their user-uploaded sports video highlights within the Passione90 community feeds and scout discovery platforms upon uploading.

7. Geolocation Processing for Match Organizer

GPS Location Services: Passione90 collects precise mobile device GPS coordinates solely when users activate the Match Organizer feature to locate nearby pickup games or local football pitches. Users can disable location permissions at any time within OS device settings.

8. Third-Party Service Processors & Data Sharing Matrix

Data Processor Engagement: We transmit personal data to verified third-party data processors bound by written Data Processing Agreements (DPAs):

Third-Party Processor	Service Function	Data Transferred & Safeguards
Supabase Inc.	Cloud Database & Authentication Hosting	Account credentials, user profiles, 2FA logs. Encrypted at rest (AES-256).
Google Firebase (FCM)	Push Notification Delivery	Device push tokens, score alert triggers, system messages.
xAI (Grok Engine)	AI Coaching & Analytics Processing	Anonymized prompt inputs, training logs, post-match stats.
API-Football	Live Football Match Data API	Read-only score queries. No user personal data transmitted.
GNews API	Sports News Article Integration	Read-only news queries. No user personal data transmitted.
Stripe & PayPal	Payment Gateway & Subscriptions	Payment card info handled directly via PCI-DSS Compliant SDKs.

9. International Data Transfers & EU-US Safeguards

Cross-Border Data Flows: Personal data collected within the EEA may be transferred to and processed in the United States. Such transfers are safeguarded using EU Standard Contractual Clauses (SCCs) and adherence to the EU-U.S. Data Privacy Framework (DPF) adequacy decisions.

10. Data Retention Schedules and Deletion Standards

Data Lifespan: We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy. Active account data is retained for the duration of account life. Upon account deletion requests, personal profile data is purged within 30 days, except where retention is mandated by tax or financial auditing statutes.

11. Data Subject Rights & How to Exercise Them

Rights Execution: EU and US users can exercise data subject rights (Access, Erasure, Rectification, Restriction, Data Portability, and Opt-Out) by submitting a request to privacy@passione90.app or utilizing self-service deletion controls within the Passione90 app settings.

12. Data Security Standards & Encryption

Security Infrastructure: Passione90 employs technical and organizational security measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, Supabase 2FA, strict access controls, and periodic vulnerability testing to safeguard personal information.

13. Policy Updates and Contact Information / DPO

Policy Revisions: We may update this Privacy Policy to reflect app enhancements or legal changes. Material revisions will be communicated via push notifications and in-app alerts. For privacy inquiries or to reach our Data Protection Officer (DPO), contact privacy@passione90.app.