1.Who we are
The P.L.A.W application is operated by &Go, s.r.o., Vnútorná okružná 178/27, 945 01 Komárno, Slovak Republic, Company ID 46571388. You can write to us at support@plawsports.com.
We have not appointed a Data Protection Officer — at our current size the law does not require one. We will reassess this as the number of organisations grows.
2.The roles: your organisation is the controller, we are the processor
The training data of your players belongs to your organisation. You decide which players are entered, what is recorded about them, who has access to them and how long the records are kept. We only store and display that data on your instructions.
This means we do nothing of our own with it: no statistics outside your organisation, no model training, no benchmarking against other organisations, no sale, no advertising. Any such use would require a separate agreement with you.
We are the controller only for the accounts of your director and coaches — their email address, name and password, so that they can sign in. That part is described in section 4.
The contractual detail of this arrangement — instructions, subprocessors, audits, breach notification, return and deletion of data at the end of the service — is set out in a separate data processing agreement.
3.What we process on your behalf
| Category | What it is | |---|---| | Players | name, year of birth, active status | | Training | dates, times, status, focus areas, drills, duration, coach's notes | | Tests and measurements | results and notes, where your coaches record them | | Organisational structure | membership, roles, discipline, assignment of players to coaches, invitations, seats | | Drill codes | your organisation's standardised codes |
We do not process payment data of your members (seats are invoiced outside the application) and the application does not offer a parent or player access layer in organisation mode — that is a feature of the standalone product.
4.What we process about your director and coaches
Email address, name, password (stored only as an unreadable hash), role, discipline and the status of their membership. Additionally, on each visit, an IP address, browser type and the time of the request — for operation and abuse detection.
Legal basis: performance of our contract with your organisation, and our legitimate interest in secure operation.
5.Two things your organisation should be aware of
Your head coach sees the work of your coaches. The director's overview shows the training records of all players of the organisation, including which coach they are assigned to. That is what the oversight function is for — but it means your coaches are visible to their employer through our application, and it is your organisation, not us, that has to tell them so. We recommend covering it in the employment or cooperation documentation.
The data does not leave with a departing coach. When a coach's membership ends, the players and their history stay with the organisation and can be reassigned to another coach. It is a deliberate design decision and the strongest reason why organisation mode exists — but it also means the departing coach loses access to work they created.
6.Where the data is stored
The database is in Frankfurt, Germany — inside the European Union. The same applies to backups and to the servers the application runs on.
These providers help us, each with access only to what they need:
- Supabase — database and sign-in (Frankfurt, EU)
- Vercel — running the application (Frankfurt, EU)
- Resend — sending registration and password-reset emails
Vercel and Resend are US companies, so part of the processing may take place outside the EU; we have in place with them the standard contractual clauses designated by the European Union for that purpose. We will inform you in advance of any change to this list, as set out in the data processing agreement.
7.How long the data is kept
Your organisation decides. The retention periods for player data are agreed in the contract; our default is 2 years from the end of the player's membership unless you instruct otherwise.
The retention rules that apply to independent coaches — an individual practice for 4 years and a player's records for a year after their last practice — do not apply to organisations. Your documentation covers a whole youth base and its period is your decision, not ours.
Accounts of your coaches are kept while their membership lasts; afterwards the account remains theirs as a personal account without access to your data.
At the end of the service we will, at your choice, return the data to you or delete it.
8.Security
- Row-level security on every table; access is enforced by the database, not by the user interface.
- Separation between organisations and between coaches within an organisation: a coach sees only the players assigned to them, the director has read-only access across the organisation.
- Completed practices and archived players are read-only at database level.
- Passwords are never stored in a readable form; the application holds no administrative database key.
- HTTPS with HSTS, security headers, protection against clickjacking.
- The access model has been audited twice against the live database, with every finding verified by an actual attack attempt rather than by inspection. We are glad to walk your technical staff through the details.
9.Rights
Your director and coaches may ask us for access to their account data, its correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to support@plawsports.com; we respond within one month, free of charge.
Players and their parents exercise their rights towards your organisation, which is the controller. We will assist you in handling such requests, including where the application does not allow it directly — for example correcting an already closed practice.
Complaints can be addressed to the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava.
10.Cookies
The application uses only strictly necessary cookies: sign-in, the selected player, the time zone and the language of the public site.
We have no advertising or tracking scripts. On the public website only — not in the application after you sign in — we count visits with Vercel Web Analytics (which page was viewed, where the visitor came from, the country and the type of device), on the basis of our legitimate interest in improving the website. It uses no cookies, does not store IP addresses and keeps no profile of anyone. That is why we do not ask for cookie consent and show no cookie banner.
11.Changes to this policy
If anything material changes — a new subprocessor, a change of location, a change of retention periods — we will inform you in advance by email, in line with the data processing agreement.
This policy is effective from 1 October 2026. Last updated 7 October 2026: website visit counting added to §9.