Legal Notice & Privacy

1. Controller

The data controller is Iván Pico Martínez (NIF 33341312Y), based in 27003 Lugo (Spain), website pisportdesk.com. For any privacy matter, write to info@pisportdesk.com.

2. Use without an account

Data you enter in the app without an account is stored only on your own device. It never leaves it unless you export it (backup) or expressly share it with someone (link or QR code, which carry the content inside the link itself).

3. Cloud account (Pro Cloud and Club Cloud)

If you take out a Cloud plan we process: your email; your password (stored only as an irreversible hash); your display name and avatar, if you add them; your club and your role in it; the app data you sync (stored encrypted on the server); the devices you sign in from; and a security log (sign-ins, password changes, new-device verification), which includes the IP address. Purpose: providing sync and protecting the account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legitimate interest in service security (Art. 6(1)(f) GDPR). You can cancel and delete your account at any time from Settings.

4. Purchases

Payment is processed by Stripe: we never see or store your card details. We keep your email, the plan bought, Stripe customer and subscription IDs and, as proof of the purchase, an acceptance record: version and fingerprint of the text you accepted, language, date and time, age confirmation, the request for immediate activation (passes) or for the service to start immediately (Cloud), your choice about email news, an encrypted fingerprint of your IP (not the readable IP) and the payment session ID; and, if you withdraw, the record of the withdrawal (dates, amount paid and refund). Legal basis: performance of the contract and legal consumer and tax obligations (Art. 6(1)(b) and (c) GDPR) and defence against possible claims (Art. 6(1)(f) GDPR).

5. Email news

We only send you news if you expressly tick the box (it is never pre-ticked). Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI). You can withdraw it at any time via the unsubscribe link in every email or by writing to info@pisportdesk.com.

6. Player, minor and club data

As a coach you may enter player data, including minors. The app applies data minimisation by design (short names or nicknames, illustrated avatars instead of photos, no player contact fields). You or your club decide on that data: without an account it stays on your device; with Club Cloud, the club is the controller of that data and PiSportDesk acts as processor, only hosting it encrypted and syncing it between club members, under the data processing agreement. Make sure you have the club's or families' authorisation under the applicable child-protection rules.

Injuries and other health data. If you record a player's injury (dates and a short note), their condition or load in session tracking, physical assessments or Wellness data, you are processing health-related data (Art. 9 GDPR), a special category. As controller, the coach or club needs a legal basis that allows it —normally the player's explicit consent or, for children under 14, that of whoever holds parental authority or guardianship (Art. 7 LOPDGDD)— and must limit it to what the sporting activity needs: do not record medical diagnoses, reports or treatments. Without an account this data stays on your device; with Cloud it is stored encrypted and only those who have that team in their account or club can access it. Delete it when the player leaves the team or asks you to.

7. Tournaments

If you organise a tournament and publish its registration page, you will receive the data other clubs send (club and team name, contact details and, if they add them, players and staff). The organiser is the controller of that data; PiSportDesk only hosts it to deliver it, and the organiser decides whether to approve each registration.

8. Images you upload

When you upload an image (crest, tournament logo, social-media background or an exercise image), you confirm you have the right to use it. It is stored on your device and, if you use Cloud, also encrypted in your account.

9. AI assistant

The AI assistant prepares a text for you to copy and paste into the AI platform of your choice, using your own account. The app never sends anything to those platforms automatically; what you paste there is subject to their own privacy terms.

10. Recipients and processors

We never sell your data or share it for commercial purposes. The following act as processors: the server and email hosting provider; Stripe (payments), which may involve international transfers to the US covered by the EU-US Data Privacy Framework or standard contractual clauses; Google (reCAPTCHA on sign-in and purchase forms, to prevent abuse; and Analytics and, if enabled, AdSense on the website); and FormSubmit (website contact form). The up-to-date list of sub-processors that may touch club data is in the data processing agreement.

11. Retention

We keep each item only as long as needed. When the period ends, the server deletes (or anonymises) it automatically:

• Cloud account and synced data: while the account exists; deleting it removes them from the server.
• Security log (sign-ins, codes, password changes, with the IP): 12 months.
• Devices you sign in from: 12 months without use (30 days if they were never verified).
• Club invitations: 90 days after they are sent, unless still pending and valid.
• Password reset codes: deleted the day after they expire.
• Public tournament registrations: rejected ones, 12 months after the reply; ones nobody reviews, 24 months after submission. Accepted ones are kept by the organiser, who is their controller.
• Purchases, acceptance record and withdrawals: 6 years (Art. 30 of the Spanish Commercial Code) and, in any case, while your subscription lasts; then they are anonymised.
• Email news: until you unsubscribe; your email is then removed from the list.
• Wellness: see section 14.

12. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to info@pisportdesk.com. From the app itself you can edit or delete your data, download a backup (portability) and delete your Cloud account. If you think your request was not handled properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

13. Security

Communications with the server are encrypted (HTTPS); synced data is stored encrypted; passwords are protected with a strong hashing algorithm (Argon2id); and signing in from a new device requires a code sent to your email.

14. Wellness (load and wellbeing monitoring)

Who is who: the club or coach using Wellness is the controller; PiSportDesk is their processor (see the processing agreement). The person answering (the player) is the data subject. Minimum age: 18 (age of majority); they are asked to confirm it and no links are issued for anyone younger.

What data: only answers on 1–5 scales (sleep, stress, energy, muscle soreness) and a 1–10 scale (perceived exertion), the activity and date they refer to, and the record of their consent (date, version and fingerprint of the text accepted, language and age confirmation). We do not ask for or store names, phone numbers, emails, diagnoses, conditions or free text on the server. The person is identified on the server only by a pseudonymised identifier; the link to their name exists only on the coach's device and in the encrypted backup of their account. The IP address is not stored in clear.

Legal basis: explicit consent (Arts. 6(1)(a) and 9(2)(a) GDPR), because this data may relate to physical condition and is handled with the safeguards for special categories. It is requested on the response page before anything is stored, is independent of any other consent and can be withdrawn at any time, as easily, from the same link: withdrawing it immediately deletes their pending answers on the server.

Purpose: so the coaching staff can adjust training load. No automated decisions with legal effects are taken; the indices are indicative and not a medical diagnosis. Retention: on the server, answers are deleted 7 days after the coach downloads them and, at most, 30 days if nobody downloads them; the consent record is kept while the controller's account exists, as proof (Art. 7(1) GDPR), and if the person withdraws it, it is deleted 3 years after the withdrawal. In the coach's app and in the encrypted backup of their Cloud account, the controller decides how long to keep them and must delete them when the person leaves the team or asks. Who sees them: individual answers are not shared through the club channel: club management and other coaches only receive an aggregated team summary (how many players are green, amber or red), without names or individual answers and, in groups of fewer than 5 people, without a breakdown. Rights: access, rectification, erasure, restriction, objection and portability, exercised with the controller club, plus the right to complain to the Spanish data protection authority (AEPD).

15. This website: analytics and cookies

The pisportdesk.com website uses Google Analytics to measure visits in aggregate, only with your consent in the cookie banner. The app itself uses no tracking cookies of its own; if it shows ads, Google AdSense may use its own. You can manage them from the cookie banner or your browser settings.

Last updated: 7 October 2026 (version 2026-10-07.1). Draft pending professional review before final publication.

1. Acceptance

By using PiSportDesk (the website or the app) you accept these Terms of Use. If you disagree, please don't use the service.

2. Plans

PiSportDesk offers: a free, local version with usage limits; the Pro and Club passes, local, activated on the device with a code; and the Pro Cloud and Club Cloud subscriptions, with an account and sync across devices. Club Cloud includes the sporting director and two coaches, expandable with extra coaches. Each plan's description and limits are shown before purchase.

3. Price and payment

Each plan's price is shown before payment, in euros and including applicable taxes. Payment is processed by Stripe under its own terms. You will receive the purchase confirmation by email.

4. Term, renewal and cancellation

Pro and Club (season pass): 365 days of access from activation, paid once; they don't renew automatically. When the pass ends, the app returns to the free version without losing your data. Pro Cloud and Club Cloud (annual subscription): they renew automatically at the end of each year until you cancel. You can cancel at any time from Settings → Cloud → Cancel subscription; cancellation takes effect at the end of the period already paid, and you keep access until then. If the renewal price changed, we would notify you in advance and you could cancel.

5. Cloud accounts

To create an account you must be over 16 and provide accurate details. Accounts are personal: each coach uses their own and must keep their password safe. We may suspend an account for fraudulent use, for sharing credentials to get around plan limits, or for non-payment, notifying you where possible.

6. Right of withdrawal

If you contract as a consumer (an individual acting outside your professional activity), you generally have 14 calendar days from purchase to withdraw without giving a reason (Art. 102 ff. of Spanish Royal Legislative Decree 1/2007, TRLGDCU, and Directive 2011/83/EU).

Pro and Club passes (digital content): as access is activated on payment, the purchase process asks for your express consent to that immediate activation and for you to acknowledge that you thereby lose the right of withdrawal (Art. 103(m) TRLGDCU).

Pro Cloud and Club Cloud subscriptions (a service): you do not lose the right of withdrawal. When subscribing you ask us to start the service immediately; if you withdraw within those 14 days, we will refund what you paid minus the part proportional to the days already used (Arts. 106(4) and 108(3) TRLGDCU). For example, on an annual subscription, if you withdraw on the fifth day we refund what you paid minus 5/365.

How to withdraw: from the app, in Settings → Cloud → "Withdraw from the contract (14 days)", which shows you the amount before you confirm; or by sending an unequivocal statement to info@pisportdesk.com. You can use this model (Annex B of the TRLGDCU): "To Iván Pico Martínez, 27003 Lugo, info@pisportdesk.com: I hereby give notice that I withdraw from my contract for the provision of the service [Pro Cloud / Club Cloud], subscribed on [date]. Name: [...]. Account email: [...]. Date: [...]". We will send you an acknowledgement by email without delay. The subscription is cancelled at that moment and the refund is made within 14 days, using the same payment method. Extra coach seats bought separately are withdrawn by email.

If you contract as a club, organisation, company or professional, the right of withdrawal does not apply.

7. Content and intellectual property

The code, design, documents, exercises, content structures and other material of the service belong to its owner; all rights reserved. They may not be reproduced, redistributed or sold without express authorisation. Data and documents you enter remain yours.

8. Informational content

Library documents, regulations, exercises and texts —including AI-assisted content— are guidance only. For official regulations, always check the current federation source; the service does not replace professional advice where appropriate.

9. Prohibited uses

You may not: reverse-engineer the service for copying or resale; extract and redistribute the library content as your own; share credentials to get around plan limits; or use the service for purposes contrary to law or third-party rights.

10. Availability and liability

We take reasonable steps to keep the service running without interruption, but cannot guarantee it at all times. We are not liable for the loss of data stored only on your device; we recommend backups or Cloud. Nothing here limits your statutory consumer rights.

11. Changes to these terms

We may update these terms. Significant changes will be announced in the app or by email with reasonable notice; if you disagree with a change to your subscription, you may cancel it.

12. Data processor (clubs, coaches and Cloud services)

If you use PiSportDesk to process personal data of third parties — players, families, coaches or other clubs — through Pro Cloud, Club Cloud, Tournaments or Wellness, you or your club are the controller and the owner of PiSportDesk acts as processor. The agreement required by Article 28 GDPR is in the «Data Processing Agreement» tab, forms part of these Terms and is deemed signed electronically (Art. 28(9) GDPR) when you subscribe to or activate the service. If you act in a private capacity and only process your own data, it does not apply.

13. Wellness (load and wellbeing monitoring)

Wellness is available only in Pro Cloud and Club Cloud and is intended exclusively for people aged 18 or over. Whoever uses it (the controller) undertakes not to issue response links to anyone under 18, to inform each person before use and to respect their decision to withdraw consent, which PiSportDesk collects and records on the response page itself. Wellness records only subjective perception scales (whole numbers from 1 to 5 and 1 to 10): it is not a medical device, does not diagnose and does not replace the judgement of a medical professional, and the indices it shows (Hooper, perceived exertion, acute:chronic workload ratio and others) are purely indicative. The controller alone decides how to use them in their sporting activity.

14. Governing law and complaints

These terms are governed by Spanish law. For any question or complaint, write to info@pisportdesk.com. If you are a consumer, you may go to the courts of your place of residence and to consumer dispute-resolution systems.

Last updated: 7 October 2026 (version 2026-10-07.1). Draft pending professional review before final publication.

1. Who enters the data, and about whom

Whoever uses the app (coach, sporting director, teacher) decides what data to enter about the people they coach — very often, minors: names, dates of birth, photographs, parents' or guardians' contact details, and in some cases personal notes. PiSportDesk is the tool where that data is stored; whoever enters it is responsible for having obtained it lawfully and for handling it appropriately.

2. Responsibility for appropriate use

Whoever uses the app is responsible for having the appropriate consent from parents or legal guardians before entering data about minors, for keeping that data accurate and up to date, for not sharing screenshots, exports or backups with anyone who shouldn't have access to them, and for complying with the data protection and child protection regulations that apply to them in their country, club or educational institution.

PiSportDesk doesn't review, validate or supervise the content each person enters — there's no technical way to do so, since in local mode the data never leaves the device itself. Legal responsibility for the lawfulness of that data rests with whoever enters it, not with the app.

3. Especially sensitive fields

Some fields (personal notes, contact details, photographs) are marked within the app itself with an additional reminder of this custody responsibility — especially when the person on record is a minor. We recommend entering only the information strictly necessary for the sporting or educational activity in these fields.

4. Photographs and images of minors

Before adding any photograph of a minor (for example, to identify a player on a roster), whoever uses the app must have the corresponding image authorization from their parents or legal guardians, in line with the data protection and child image regulations in force in their country.

5. Cloud: where this data lives

If cloud sync is activated (Pro Cloud, Club Cloud), the data entered — including data about minors — is also stored, encrypted, on the server. The same responsibilities on this page apply; additionally, whoever administers a Club Cloud account is responsible for revoking a coach's access when appropriate, and for ensuring only authorized club staff can see the data of the minors in their care.

6. Wellness: only from age 18

The Wellness function (wellbeing and training-load monitoring) must not be used with anyone under 18: response links must not be issued to younger players, even with their families' authorisation. Whoever uses it is responsible for checking each person's age and for each person giving their own consent on the response page.

7. Contact

For any question about this policy, or to exercise rights related to a minor in your care, write to info@pisportdesk.com.

Last updated: 2026. This is a guidance draft; professional review by someone specialized in child protection and data protection is recommended before final publication.

1. Parties

Controller: the individual or organisation (club, entity, coach or teacher) that subscribes to or activates the service, identified by their account and purchase details. Processor: Iván Pico Martínez, tax ID 33341312Y, address 27003 Lugo (Spain), email info@pisportdesk.com, owner of PiSportDesk.

2. Purpose, duration and services covered

The Processor will process personal data on behalf of the Controller only to provide the services subscribed to: encrypted hosting and synchronisation of app data across devices and club members (Pro Cloud and Club Cloud), publication of tournament pages and registrations, and collection of wellbeing and load answers (Wellness). It lasts while the service is active and ends on cancellation or deletion of the account, without prejudice to section 4.8.

3. Description of the processing

Nature, purpose, types of data and data subjects are detailed in Annex I. Security measures are in Annex II and authorised sub-processors in Annex III.

4. Obligations of the Processor

4.1 Instructions. It will process data only on the Controller's documented instructions, which are this agreement, the Terms of Use and the actions the Controller performs in the app (entering, syncing, publishing, deleting, issuing a Wellness link). If it considers that an instruction infringes data protection law, it will tell the Controller immediately.

4.2 Confidentiality. It ensures that persons with access to the data have committed to confidentiality or are under a statutory duty of confidentiality.

4.3 Security. It will apply the technical and organisational measures in Annex II, appropriate to the risk (Art. 32 GDPR), and review them when the service changes.

4.4 Sub-processors. The Controller gives general authorisation for the sub-processors in Annex III. The Processor will give at least 30 days' notice of any addition or replacement, by email or in the app; the Controller may object on reasonable grounds and, if the objection cannot be accommodated, cancel the service with a refund of the unused proportion. It will impose on each sub-processor the same data protection obligations as this agreement and remains liable to the Controller for their performance.

4.5 Data subject rights. It will give the Controller the tools to handle rights of access, rectification, erasure, objection, restriction and portability (editing and deletion within the app, backup export, account deletion and, in Wellness, withdrawal of consent by the person themselves). If a person contacts the Processor directly, it will forward the request to the Controller within 5 working days and will not respond itself unless instructed.

4.6 Personal data breaches. It will notify the Controller without undue delay and within 48 hours at most of becoming aware of a breach affecting its data, with the information available (nature, data and persons affected, likely consequences and measures taken). Notifying the supervisory authority and the affected persons is the Controller's responsibility.

4.7 Assistance. It will help the Controller, taking into account the nature of the processing and the information available to it, to comply with the obligations on security, breach notification, impact assessment and prior consultation (Arts. 32 to 36 GDPR).

4.8 Deletion and return. When the service ends, the Controller can export its data from the app (backup) and the Processor will delete it from the server when the account is deleted, keeping no copy unless required by law. Where the hosting provider keeps technical backup copies, they will be removed under its ordinary rotation cycle. Wellness answers that are not downloaded are deleted after 30 days, and downloaded ones after 7. While the service is active, and as a documented instruction of the Controller, the Processor also applies these automatic periods: coach or collaborator invitations, 90 days after they are sent (except pending ones still valid); rejected tournament registrations, 12 months after the reply, and ones nobody reviews, 24 months after submission; withdrawn Wellness consent records, 3 years after withdrawal. Accepted registrations and synced data are not deleted by time limit: the Controller manages them.

4.9 Audit. It will make available to the Controller the information necessary to demonstrate compliance with this agreement and allow reasonable audits, with 30 days' notice, during business hours, without compromising security or other customers' data and at the requester's expense.

4.10 International transfers. It will not transfer data outside the European Economic Area unless there is an adequacy decision or appropriate safeguards (standard contractual clauses or another Chapter V GDPR mechanism) or applicable law requires it, in which case it will inform the Controller beforehand.

4.11 Records. It will keep the record of processing activities carried out on behalf of controllers required by Art. 30(2) GDPR.

5. Obligations of the Controller

• Have a valid legal basis for every piece of data it enters and have informed the data subjects (Arts. 13 and 14 GDPR).
• Obtain the necessary authorisations from parents or guardians for minors' data, and not enter more data than strictly necessary for the sporting activity.
• In Wellness: use it only with people aged 18 or over, not issue links to anyone younger, and not request or keep outside the app any diagnoses or other health data. It is responsible for what it decides to do with the indices.
• Manage the access of its club members and withdraw it when appropriate, and safeguard its credentials.
• Handle data subjects' rights and, where applicable, notify breaches to the supervisory authority and to the persons affected.
• Carry out, where required, the impact assessment and keep its own record of processing activities.

6. Service-specific rules

Pro Cloud and Club Cloud. Synced data is stored encrypted. In Club Cloud the club is the controller and coaches act under its authority; the director decides who accesses what.

Tournaments. The organiser is the controller of the registration data it receives (clubs, teams and, if requested, shirt number, sporting nickname and avatar); the Processor only hosts it and passes it on. Real names, dates of birth and identity documents are not accepted.

Wellness. On the response page, on the Controller's behalf, the Processor collects each person's information, age confirmation and explicit consent, and keeps their record as evidence. The person can withdraw consent at any time from their link (their pending answers are deleted). The Processor keeps on the server only a pseudonymised identifier and numeric scales, for the periods in section 4.8. Answers already downloaded live in the coach's app and in the encrypted backup of their Cloud account, which the Processor hosts; they are not shared through the club channel (only an aggregated team summary, without names). How long data is kept inside the app is up to the Controller.

7. Liability

Each party is liable for the damage it causes by breaching this agreement or data protection law, in accordance with Art. 82 GDPR. This does not limit data subjects' rights against either party.

8. Term, changes and governing law

This agreement lasts as long as the service. If the law or the service changes, the Processor may update it with reasonable notice (and 30 days for new sub-processors). It is governed by Spanish law; for any dispute, the courts of the Controller's place of residence if a consumer and, otherwise, those of Lugo.

Annex I — Description of the processing

• Nature: encrypted hosting, synchronisation, publication and collection of answers through individual links.
• Purpose: to provide the Controller with the app functions it has subscribed to; in Wellness, so the coaching staff can adjust training load.
• Data subjects: coaches, directors and other club members; players (including minors, except in Wellness) and, where applicable, their families or guardians; contacts of clubs registering for a tournament.
• Data: email, display name, avatar, role and club of accounts; the data the Controller enters in the app (squads with names or nicknames, observations, assessments, attendance, sessions, matches, tournaments), stored encrypted; tournament registration data; in Wellness, 1–5 and 1–10 scales, activity and date, pseudonymised identifier and consent record. No diagnoses or free-text health information is requested.
• Special categories: Wellness data may relate to physical condition; it is processed on explicit consent (Art. 9(2)(a) GDPR). If the Controller records injuries (dates and a short note) or physical condition in session tracking, that is health data too: it must have a valid legal basis, normally the explicit consent of the player or their guardians, and must not enter diagnoses, medical reports, treatments or other special categories.

Annex II — Security measures

• Communications encrypted with HTTPS.
• Synced data encrypted on the server with AES-256-GCM.
• Passwords stored only as an Argon2id hash.
• Access from a new device requires an emailed code; revocable sessions; attempt limits and anti-abuse checks (reCAPTCHA) on sign-in, purchases and public tournament registrations.
• Data separated by account and, in Club Cloud, control over which members see which teams and modules.
• Wellness: signed individual links with an expiry, pseudonymised identifiers using a server-only key, IP address not stored in clear (only a fingerprint to limit abuse), automatic deletion of answers and immediate deletion on withdrawal of consent.
• Log of security actions (sign-ins, password changes, new devices) and of legal acceptances.
• Minimisation by design: short names or nicknames, illustrated avatars instead of photographs and no player contact data.

Annex III — Authorised sub-processors

• Hostinger — hosting of the server and database and sending of account email (device verification, password reset, invitations). Server location: as stated in the current hosting contract; if outside the EEA, standard contractual clauses will apply.
• Google (reCAPTCHA) — anti-abuse check on sign-in, purchases and public tournament registrations; receives technical browser data and the IP address. It receives no sports data.
• Stripe — payments for subscriptions and passes. It receives no player or team data; it processes payment data as its own controller.

Last updated: 7 October 2026 (version 2026-10-07.1). Draft pending professional review before final publication.

1. What is a cookie

A cookie is a small file that a website stores in your browser, usually to remember information between visits (language, whether you're logged in, or to measure how the site is used).

2. What we use on this site

This website (pisportdesk.com) uses Google Analytics to know, in aggregate, how many people visit the site and which pages get the most interest — never to identify you personally. These cookies only activate if you give explicit consent via the notice shown on your first visit; until then, they aren't loaded.

Cookie	Purpose	Duration
_ga	Distinguishes unique users (Google Analytics)	2 years
_ga_*	Maintains analytics session state	2 years

This site also stores in your browser's local storage (not a cookie, and exempt from consent as it's strictly necessary) which choice you made in this notice, so it doesn't ask again on every visit.

3. How to withdraw your consent

You can change your decision at any time by clicking here to manage your cookies, or by deleting this site's cookies directly from your browser settings.

4. Legal basis

Under EU Directive 2002/58/EC (ePrivacy Directive) and the General Data Protection Regulation (GDPR), non-essential cookies require your prior, explicit consent — which is exactly what this notice requests before activating them. If you are located outside the EU/EEA, your local data protection and e-privacy regulations may apply instead or in addition.

Last updated: 2026. Guidance draft; professional review before final publication is recommended.