Privacy Policy

This is the most important distinction in the document, and everything else depends on it — including who is responsible for answering a data subject's request. Cantera acts in two different roles, depending on the data concerned:

• Data controller, for the data collected directly by us and whose purposes and means we determine: the account and authentication, subscription billing, customer support communications, and technical and security logs.
• Data processor, under Article 28 GDPR, for all information that the club enters into the platform — athletes, guardians, members, staff, clinical data, school data, financial information, training sessions, matches and observations. In those cases the data controller is the club: it falls to the club to establish the lawful basis, obtain any necessary consents, inform the data subjects and respond to their requests. We process that data solely on the instructions of the club and to the extent necessary to provide the service to it.

In other words: Cantera builds and operates the tool; it is the club that decides what information is recorded in it and for how long. The terms of this processing form part of the contract entered into with the club.

Each processing operation rests on a lawful basis under Article 6 GDPR. The two roles described in the previous section are kept apart:

For every processing operation in the second column, the lawful basis is determined by the club, not by us — typically the performance of the registration contract entered into with the athlete or with their legal representative.

Most of the data subjects whose data passes through this platform are children and young people, and part of the information is sensitive. It deserves to be said plainly:

• Minors. The registration of a minor athlete is carried out by the club, with the involvement of the guardian, who is linked to the athlete's record. In Portugal, Portuguese Law 58/2019 sets 13 years as the minimum age at which a data subject may consent directly; below that age consent falls to the holders of parental responsibility. It falls to the club to ensure that this framework is respected.
• Health. If the club enables the clinical module, injuries, treatments, medical examinations and the sporting availability of the athlete are recorded. These are special categories of data (Article 9 GDPR) and may be processed only under Article 9(2)(h) — sports medicine and health care by a professional bound by professional secrecy — or on explicit consent (Article 9(2)(a)). The applicable basis is determined by the club. Within the platform, access to this information is limited to those to whom the club has expressly granted the corresponding permission; that control applies to the record held in the platform and may not extend to the direct address of an uploaded file.
• School. If the club enables the school module, the educational establishment and the school reports of the athlete may be recorded. The detailed information is locked behind a consent recorded on the athlete's file: while that consent does not exist, the platform does not even query it. The club may also permanently delete all detailed school data of an athlete, at any time.
• Photographs. The file of an athlete, of a member or of a member of staff may include a photograph, uploaded by the club. It falls to the club to obtain the necessary authorisations, with the added care that the image of a minor demands.

A guardian wishing to know what information exists about their child, or to have it removed, should approach the club — the club is the data controller. See section 10.

Not everything happens within the screen of a signed-in user. These are the principal situations in which information leaves the platform, and they are worth knowing:

• Links accessible without a password. So that a guardian may confirm a call-up, or a family pay a notice, without having to create an account, links are generated with a long, unpredictable code specific to that call-up, that document or that membership card. They give access to nothing else — but whoever holds the link can open it. Such a link should therefore be treated as an access code, and not forwarded to anyone who should not see that information.
• Emails sent by the club. Call-ups, payment notices, payment reminders, thank-you messages and birthday greetings leave the platform on behalf of the club, to the contact details recorded by the club.
• Device notifications. Where these are authorised in the browser, delivery passes through the notification service of the maker of that browser (for example Google, Mozilla or Apple). That service receives what is needed to deliver the notification; it is neither engaged nor controlled by us. The authorisation may be revoked at any time in the browser settings.
• Federation documents. The platform generates official forms pre-filled with the data of the athlete — namely Modelo 1 and Modelo 2 of the federation and Modelo 9 of the IPDJ, the Portuguese institute for sport and youth — intended to be submitted to those bodies. Submission is carried out by the club and at its own decision.

In every case, the information of a club is not visible to another club: every query is filtered by the club of the user.

In order to provide the service we rely on the suppliers below, all contractually bound by obligations of confidentiality and of compliance with the GDPR:

• Supabase — database, file storage and real-time synchronisation. Infrastructure in the European Union (Frankfurt).
• Vercel — application hosting and execution of the automated tasks. Infrastructure in the European Union (Frankfurt).
• Stripe Payments Europe (Ireland) — club subscription and payments by families. We do not store card numbers.
• EasyPay (Portugal) — payments by families through MB WAY and Multibanco.
• Resend (United States) — delivery of transactional emails.
• Google (United States) — solely the optional «Continue with Google» authentication. Where that option is not used, no data is communicated to it.

We never sell, transfer or share personal data for advertising or marketing, whether ours or that of third parties. Nor do we use third-party analytics: there is no Google Analytics or any other audience-measurement tool in this application. Data may be disclosed where the law or a competent authority so requires, and any material change to this list is communicated in advance.

Mandatory statutory periods — in particular tax and accounting obligations — prevail over those indicated above.

Technical and organisational measures appropriate to the risk are applied:

• Encryption in transit (TLS) and at rest.
• Isolation between clubs: every database query is filtered by the club of the user making it, so that the information of one club cannot be reached from another.
• Access control by group and permission: within the club, each user sees only the areas and the teams assigned to them by the club, with the sensitive areas — such as clinical and school information — requiring their own permission.
• Logging of sensitive operations and continuous monitoring of the platform.

Personal data breach. Should a breach occur affecting data processed on behalf of a club, that club — as the data controller — is notified without undue delay and within 72 hours at the latest of us becoming aware of it, in accordance with Article 33(2) GDPR.

The data subject has the rights provided for in Articles 15 to 22 GDPR:

• Access — to know what data exists and to obtain a copy.
• Rectification — to correct inaccurate or outdated data.
• Erasure — the «right to be forgotten», where applicable.
• Restriction of processing.
• Objection to processing.
• Portability — to receive the data in a structured, machine-readable format.
• Withdrawal of consent at any time, where consent is the basis of the processing, without affecting the lawfulness of what was processed beforehand.

The addressee of the request depends on the role involved (section 2). As regards account, billing and customer support data, the contact point is geral@canterasports.com. As regards data that a club has entered into the platform — concerning athletes, guardians, members or staff — the request should be addressed first to that club, which is the data controller and the only party able to decide upon it; any such request reaching us is forwarded to the club concerned, in accordance with Article 28(3)(e) GDPR. No automated individual decisions producing legal effects on data subjects are taken (Article 22). There is also the right to lodge a complaint with the supervisory authority: the CNPD in Portugal, the AEPD in Spain, or — under the UK GDPR — the ICO in the United Kingdom.