Privacy Policy

Last Updated: September 2026

1. Data Roles & Hierarchy

Under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, your sports club or organization (the "Club") acts as the Data Controller. They determine the purposes and legal basis for which member data is processed.

MyAthlete acts as the Data Processor. We process personal data strictly on documented instructions from the Club to facilitate club administration, financial operations, communication channels, and athletic development records.

2. Information We Process

Beyond standard user account details, our platform processes the following categories of information:

A. Sensitive & Special Category Data

• Medical & Emergency Health Data: Information regarding allergies, dietary requirements, chronic conditions (e.g., Asthma, Diabetes), and emergency medical consents to ensure athlete safety during training, fixtures, matches, and travel.
• Safeguarding & Vetting: For coaches, volunteers, and officials, we host vetting metadata (e.g., Garda Vetting/AccessNI status), safeguarding credentials, and qualification expiry dates.

B. Financial & Transactional Data

• Payment Mandates: Direct Debit authorizations and transaction tokens required for our Financial OS.
• Family Virtual Wallet & Ledger: An immutable, double-entry record of all charges, credits, discounts, and consolidated batch payments related to squad fees, term subscriptions, kit orders, and event entries.

C. Performance & Attendance Data

• Heuristic Identity Data: Name, DOB, Gender, National Governing Body ID, and Club History utilized by our "Self-Healing Engine" to maintain the integrity of each member's "Golden Record."
• Performance Analytics: Match statistics, race splits, workout loads, bioenergetic metrics, and AI-assisted progression projections.
• Engagement & Consistency: Training attendance rates, attendance streaks, and team leaderboards.

D. Communication & Engagement

• Interactive Forms: Information submitted via conditional forms (e.g., trial sign-ups, event availability, kit orders, or camp registrations).
• Broadcast Governance: Read receipts and acknowledgments for administrative safety broadcasts and channel announcements.

3. How We Use Information

• Self-Healing Integrity: Employing probabilistic reconciliation to eliminate duplicate member accounts and maintain complete historical athletic records.
• Financial Automation: Calculating pro-rated subscriptions, applying automated family/sibling discounts, and executing consolidated Direct Debit batch sweeps.
• Operational Conflict Detection: Detecting scheduling collisions (e.g., coach double-bookings or venue capacity conflicts).
• Athletic Intelligence: Analyzing training volume, consistency, and bioenergetic stress to support coach planning.

4. Data Sharing & Access Governance

MyAthlete utilizes a Polymorphic Identity Model, enabling a single authenticated login to navigate multiple authorized roles (e.g., a Coach who is also a Club Parent). Access to data is strictly governed by Granular Scoped Permissions adhering to the Principle of Least Privilege.

A. Scoped Administrative Access

Club Administrative access is strictly compartmentalized by functional responsibility:

• Financial Controllers: Access to the club ledger, payment sweeps, and Virtual Wallet records. Other staff cannot view family financial histories unless explicitly granted this scope.
• Compliance & Safeguarding Officers: Access to safeguarding documents, vetting records, and compliance audit packs.
• Coaching & Operations Staff: Access scoped strictly to assigned squads, attendance registers, training sets, and event rosters.

B. Third-Party Payment Processing (Mollie)

To facilitate secure payments, MyAthlete integrates with Mollie B.V., a regulated European payment service provider.

• When setting up payment mandates or making card payments, sensitive financial information (such as IBAN or card numbers) is processed directly by Mollie.
• MyAthlete stores transactional metadata (amounts, timestamps, payment statuses, and mandate references) to maintain the club ledger, but does not store raw credit card numbers or banking credentials.
• Review Mollie’s privacy policy at mollie.com/privacy.

C. Competition & Event Exports

MyAthlete does not transmit athlete data directly to third-party event organizers or National Governing Bodies without club initiation.

When the platform generates standardized entry or roster files (such as SD3 exports for swimming or tournament team sheets), these files are generated at the explicit request of an authorized Club Admin. The Club remains solely responsible for the manual review, download, and secure submission of files to event hosts.

D. Cloud Infrastructure & Object Storage (EEA Data Residency)

All primary database records and encrypted file storage (documents, qualification certificates, and assets) are hosted within the European Economic Area (EEA) via Akamai / Linode Cloud (Frankfurt and Dublin data centers) and Google Cloud Platform (GCP). All data is encrypted at rest using AES-256 and in transit via TLS 1.3.

5. Data Security & "The Golden Record"

We employ Atomic Transactions to ensure data integrity. Our infrastructure incorporates AES-256 encryption, TLS data in transit, and Multi-Factor Authentication (MFA). Because MyAthlete maintains historical sporting records, performance history is retained as part of the athlete’s developmental trajectory unless a formal erasure request is instructed by the Data Controller.

6. Your Rights Under GDPR

Under GDPR, data subjects have rights of access, rectification, objection, restriction, and erasure. Because MyAthlete serves as a Data Processor on behalf of your club, requests to exercise data privacy rights should be directed to your Club Secretary or Data Protection Officer.

7. Contact Us

For inquiries regarding our data privacy practices: privacy@myathlete.ie | General support: support@myathlete.ie