B42 CoachZone Privacy Policy

This privacy policy applies to B42 CoachZone at teams.b-42.com and the Teams section within the B42 App. Both access routes use the same platform and are subject to the same privacy provisions. The B42 App Privacy Policy applies to all other B42 App features, and the B42 Websites Privacy Policy applies to our other websites.

1. General Information

B42 CoachZone is a web-based platform that enables coaches and clubs to manage teams, create training plans, and support their athletes’ performance development. This involves processing personal data of coaches and club administrators as well as the athletes they support.

CoachZone’s data protection arrangements differ from a conventional B2C application: coaches and clubs are themselves responsible for their athletes’ data. SFY GmbH provides the technical platform and processes athlete data as a processor in this context. This division of roles is explained in detail in section 2.

2. Responsibilities and Roles

2.1. SFY GmbH as controller for coach and account data

SFY GmbH is the controller within the meaning of Article 4(7) GDPR for processing the personal data of coaches, club administrators, and other account holders (e.g. registration, account management, and payment processing). This privacy policy informs you about that processing.

2.2. Coaches and clubs as controllers for athlete data

Coaches and clubs that use CoachZone to collect, manage, and evaluate athlete data are themselves controllers for that processing within the meaning of the GDPR. They decide which athlete data is collected in CoachZone and are accountable to their athletes and responsible for providing information to them.

In this context, SFY GmbH processes athlete data exclusively as a processor under Article 28 GDPR, on the instructions of the respective coaches and clubs and solely to provide the platform’s features. A data processing agreement exists between SFY GmbH and the coaches/clubs.

Athletes who wish to obtain access to their data or request its deletion should first contact their coach or club. SFY GmbH assists in fulfilling data subject rights at the controller’s request.

2.3. Contact

SFY GmbH
Industriestraße 15
84149 Velden
Germany
Email: info@b-42.com

Represented by Managing Director Andreas Gschaider.

3. Mandatory Information

3.1. Withdrawal of your consent to data processing

Where processing is based on your consent, you can withdraw it at any time with effect for the future by emailing info@b-42.com. The lawfulness of processing carried out before withdrawal remains unaffected.

3.2. Right to lodge a complaint with the competent supervisory authority

In the event of data protection violations, you have the right to lodge a complaint with the competent supervisory authority. The competent authority is the state data protection commissioner of the federal state in which our company is based. A list of supervisory authorities is available at: www.bfdi.bund.de.

3.3. SSL/TLS encryption

CoachZone uses SSL/TLS encryption for security. You can recognize an encrypted connection by “https://” in your browser’s address bar and the padlock symbol.

3.4. Transfers to third countries

Where we transfer data to the USA, this is based on the EU-US Data Privacy Framework (DPF) of July 10, 2023, provided the relevant provider is DPF-certified. The applicable legal bases are stated for each service. No third-country transfer takes place for PostHog and Sentry because we use the EU region.

4. Data Processed

4.1. Account and coach data

An account is required to use CoachZone. During registration and use, we process the following data as controller:

• Coach’s / club administrator’s name and email address
• Club name and information
• Login data (email address, encrypted password)
• Platform usage behavior (with consent, via PostHog)

The legal basis is Article 6(1)(b) GDPR (performance of a contract). Account data is stored for the duration of the contractual relationship and for 3 years after it ends.

4.2. Athlete data (processing on behalf of a controller)

As part of team management, coaches and clubs process their athletes’ data through CoachZone. SFY GmbH processes this data exclusively as a processor (see section 2.2). This may include:

• Athletes’ names, dates of birth, and playing positions
• Training results, performance data, and test results
• Attendance and training history
• Communication within the platform (e.g. announcements and lineups)

The respective coaches and clubs are the controllers for this data. Retention periods and deletion deadlines follow their instructions; SFY GmbH deletes athlete data no later than 30 days after the contractual relationship with the respective coach/club ends.

4.3. Technical data

When you visit CoachZone, technical data is automatically stored in server log files (IP address, browser type, operating system, time, and pages accessed). The legal basis is Article 6(1)(f) GDPR. This data is automatically deleted after 3 days (Vercel default).

5. Hosting

5.1. Vercel

CoachZone (teams.b-42.com) is hosted by Vercel. The provider is Vercel Inc., 340 Pine Street, Suite 603, San Francisco, CA 94104, USA.

Vercel automatically processes technical data when operating the platform (server log files as described in section 4.3). Data is processed on Vercel servers in the USA. Transfers to the USA are based on the EU-US Data Privacy Framework; Vercel is DPF-certified. Server log files are automatically deleted after 3 days.

The legal basis is Article 6(1)(f) GDPR. We have concluded a data processing agreement with Vercel. Further information: vercel.com/legal/privacy-policy.

6. Analytics and Troubleshooting

6.1. PostHog

We use PostHog to analyze platform usage and improve CoachZone. The provider is PostHog Inc. We use PostHog’s EU cloud version; all data is processed and stored exclusively on servers within the European Union (Frankfurt, Germany). No personal data is transferred to third countries.

PostHog collects pseudonymized data about platform usage (e.g. areas accessed, click paths, and session duration). This data helps us develop CoachZone in a targeted way.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in improving our platform). Usage data is automatically deleted after 12 months. You can object to processing at any time by emailing info@b-42.com.

We have concluded a data processing agreement with PostHog. Further information: posthog.com/privacy.

6.2. Sentry

We use Sentry to detect and resolve errors and performance problems in CoachZone. The provider is Sentry, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. We use Sentry in the EU region; all data is processed and stored exclusively on servers within the European Union. No personal data is transferred to third countries.

When errors occur, Sentry automatically transmits:

• Anonymized user ID
• Browser type and version, operating system
• Time and type of error
• Error log and stack trace
• Performance metrics

The legal basis is Article 6(1)(f) GDPR (legitimate interest in stable platform operation). Error data is automatically deleted after 90 days.

We have concluded a data processing agreement with Sentry. Further information: sentry.io/privacy.

7. Payment

7.1. Stripe

We use Stripe to process team subscriptions and license payments. The provider is Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

Stripe processes the data required for payment, including name, email address, billing address, and payment data (e.g. credit card details). Payment data is encrypted and transmitted directly to Stripe and is not stored on our servers.

The legal basis is Article 6(1)(b) GDPR (performance of a contract). Transfers to the USA are based on the EU-US Data Privacy Framework; Stripe is DPF-certified. Payment data is subject to statutory retention requirements and is stored for 10 years (sections 146 and 147 of the German Fiscal Code, AO).

We have concluded a data processing agreement with Stripe. Further information: stripe.com/de/privacy.

8. User Rights

8.1. Rights of coaches and club administrators

As a CoachZone user (coach or club administrator), you have the following rights against SFY GmbH as controller:

• Right of access (Article 15 GDPR): Information about the data processed about you.
• Right to rectification (Article 16 GDPR): Correction of inaccurate data.
• Right to erasure (Article 17 GDPR): Deletion of your data under certain conditions.
• Right to restriction of processing (Article 18 GDPR): Restriction of processing of your data.
• Right to data portability (Article 20 GDPR): Receipt of your data in a machine-readable format.
• Right to object (Article 21 GDPR): Objection to processing of your data.

8.2. Athletes’ rights

Athletes whose data is managed by coaches or clubs through CoachZone can exercise their data subject rights (access, rectification, erasure, etc.) against the respective coach or club, which is the controller for that data under the GDPR.

SFY GmbH supports fulfillment of these rights at the controller’s request. Athletes may alternatively contact info@b-42.com directly; we will then forward the request to the responsible controller.

8.3. Right to lodge a complaint

You have the right to complain to the competent data protection supervisory authority about processing of your personal data.

8.4. Withdrawal of consent

You can withdraw consent at any time with effect for the future. To do so, email info@b-42.com.

8.5. Changes to this privacy policy

We reserve the right to amend this privacy policy at any time in compliance with applicable data protection regulations. The current version is available on this page.

8.6. Contact

If you have questions about data processing in CoachZone, please contact:

SFY GmbH
Industriestraße 15
84149 Velden
Germany
Email: info@b-42.com