Privacy Policy
Version 1.1 • Last updated 21 September 2026
1. Who is responsible for the service
The person responsible for HIA – Handball in Analysis is Willian Ferrari, Portugal. Privacy enquiries and data protection requests may be sent to handballinanalysis@gmail.com.
2. Scope of this Policy
This Policy explains how HIA processes personal information in connection with account creation, authentication, invitations, team management, player information, match analysis, reports, security, support, billing, research and service administration. It does not replace the responsibilities of coaches, clubs or other organisations that independently decide why and how they process player or staff information.
3. Data protection roles
For account administration, service security, billing, legal compliance, support and HIA’s own operational purposes, HIA generally acts as controller. Where a coach, club or organisation determines why and how player, staff or other third-party information is entered into HIA, that user or organisation may act as controller and HIA may act as processor. Where Article 28 of the GDPR applies, this processing is also governed by the HIA Data Processing Agreement.
4. Information processed
HIA may process account information such as name, email address, user identifier, account status, invitation details and authentication information. It may also process team, player and match information entered by users, including names, numbers, positions, events, timestamps, statistics, goalkeeper data, charts, timelines and generated reports. For subscriptions, HIA may process plan, subscription status, billing identifiers and transaction metadata; payment card details are handled by the payment provider rather than intentionally stored by HIA. Technical, device, log, diagnostic, security and support information may also be processed.
5. Information HIA asks users not to enter
Users should not enter information unnecessary for handball analysis, including medical records, health conditions, biometric identifiers, government identification numbers, precise home addresses, financial information or other special-category or highly sensitive data unless HIA expressly supports that processing and appropriate legal grounds and safeguards exist.
6. Sources of information
Information may be provided by account holders, coaches or authorised organisations, generated through use of the service, received through invitations or support communications, received as subscription or transaction status from payment providers, or produced automatically by authentication, hosting, database and security systems.
7. Purposes of processing
Information may be processed to create and authenticate accounts, manage invitations and permissions, provide team and match functionality, save and restore matches, generate statistics and reports, administer subscriptions, maintain security, prevent misuse, diagnose faults, respond to support requests, communicate service information, comply with legal obligations, establish or defend legal claims, improve reliability and develop the service.
8. Legal bases
Depending on the context, processing may be necessary to perform a contract or requested pre-contractual steps, comply with legal obligations, protect vital interests, perform a task in the public interest where applicable, or pursue legitimate interests such as service operation, security, fraud prevention, support, research, service improvement and protection of legal rights. Where consent is legally required, it will be requested separately and may be withdrawn without affecting earlier lawful processing.
9. Player and third-party information
Coaches and other users who enter information about players, staff or third parties are responsible for ensuring that they are authorised to do so, that the information is accurate and limited to what is necessary, and that affected individuals receive privacy information required by law. When HIA acts as processor, it processes that information on behalf of the relevant controller in accordance with the Data Processing Agreement and applicable documented instructions.
10. Children and young players
Children merit specific protection. HIA may contain information about young players only when entered by an authorised coach or organisation for a lawful purpose. The user or organisation entering the information must ensure that applicable parental, guardian, club, federation, safeguarding and legal requirements are satisfied.
11. Research, scientific and educational use
HIA may use information for scientific research, academic publications, educational activities, statistical analysis and methodological development. Whenever reasonably possible, such work will use effectively anonymised or aggregated data. Where personal data must be processed for research, HIA will identify an appropriate legal basis and apply suitable safeguards. Pseudonymised data remains personal data.
12. Aggregated statistics and benchmarking
HIA may create and publish aggregated statistics, trends, benchmarks and performance analyses derived from multiple users or matches, provided that results do not identify or reasonably permit identification of individual players, coaches, teams, clubs or organisations.
13. Artificial intelligence and automated analysis
HIA may research, test and improve automated analysis or artificial intelligence features using effectively anonymised or appropriately aggregated information. Personal data, including pseudonymised data, will only be used for AI development where a valid legal basis, transparency and appropriate safeguards are in place.
14. Service providers and recipients
Depending on the feature used, HIA may rely on Google/Firebase and Google Cloud for authentication, database, hosting and infrastructure; Stripe for subscription and payment processing; and Resend for transactional or service communications. HIA may also use professional advisers, security, support or infrastructure providers where necessary. Providers processing personal data on HIA’s behalf are subject to appropriate contractual, confidentiality and security arrangements where required.
15. Subprocessors
Where HIA acts as processor, HIA may use subprocessors to provide the service. The controller gives HIA general authorisation to engage subprocessors subject to the Data Processing Agreement. HIA will impose applicable data-protection obligations on subprocessors and provide information about material additions or replacements in accordance with the DPA.
16. International transfers
Some service providers may process information outside Portugal or the European Economic Area. Where required, HIA will rely on an adequacy decision, approved contractual clauses or another lawful transfer mechanism and consider supplementary safeguards appropriate to the risk.
17. Retention
Personal information is kept only for as long as reasonably necessary for the purposes described in this Policy, account administration, security, dispute resolution and legal compliance. Account deletion requests are intended to be completed from active HIA systems within a maximum of 30 days, except where lawful retention or restricted backup cycles apply. Further information is available in the Data Retention notice.
18. Security
HIA applies technical and organisational measures appropriate to the nature and risk of the information, which may include authenticated access, access controls, encrypted transmission, provider security controls, logging, backups and restricted administrative access. No online system can guarantee absolute security.
19. Data breaches
HIA will assess suspected personal data breaches and take appropriate containment, investigation and remediation measures. Where HIA acts as controller, it will make legally required notifications. Where HIA acts as processor, it will inform the relevant controller without undue delay after becoming aware of a breach affecting data processed on that controller’s behalf and provide reasonable assistance.
20. Your rights
Subject to applicable law and the role of the relevant controller, individuals may request access, correction, deletion, restriction or portability, object to certain processing and withdraw consent where applicable. Requests relating to data controlled by a club or other HIA customer may need to be handled by that controller, with HIA providing reasonable assistance where applicable. Requests concerning HIA’s own controller activities may be sent to handballinanalysis@gmail.com.
21. Complaints
Individuals may contact HIA first so concerns can be investigated. They also have the right to lodge a complaint with the competent supervisory authority, including the Portuguese Comissão Nacional de Proteção de Dados (CNPD) where applicable.
22. Cookies and local storage
HIA may use technically necessary cookies, browser storage or similar technologies for core functionality. Non-essential analytics, advertising or tracking technologies will only be used where legally permitted and, where required, after obtaining valid consent and providing appropriate controls.
23. Changes to this Policy
This Policy may be updated when the service, providers, legal requirements or processing activities change. Material changes will be communicated where required.
24. Contact
Privacy questions, rights requests and complaints may be sent to handballinanalysis@gmail.com. Please do not send passwords or unnecessary sensitive information by email.