Privacy Policy — Next Step Scout (NSS)
Effective date: 2026-09-13 Applies to: the NSS website and platform for footballers aged 10 and over and their parents/legal representatives in the countries of the European Economic Area (all 27 EU member states, plus Iceland, Liechtenstein and Norway) and in the United Kingdom.
Next Step Scout ("NSS", "we", "us") helps young footballers be seen: a player keeps a video profile and progress history, and verified clubs, academies and scouts can find players who have chosen to be visible. Because our users are children, protecting them is the first rule of this service. This policy explains, in clear terms, what personal data we process, why, on what legal basis, for how long, and what rights you have.
1. Who is responsible for your data (Controller)
The data controller is Leonardas Dauksevicius (place of establishment: Portugal). For any privacy question or to exercise your rights, contact our Data Protection contact at [email protected].
2. Who our service is for
NSS is for players aged 10 and over; there is no upper age limit. Until the age of 18, the account is created and confirmed by a parent or legal representative; from 18, a player registers and acts independently. GDPR Art. 8 lets each country set its own age of digital consent within a 13–16 range (13 in the United Kingdom). That threshold does not weaken our rules: on NSS, consent for any player under 18 is in any case given by a parent or legal representative, so the national age of digital consent does not cap us. Country-by-country thresholds are listed on the Legal Bases page. For all users under 18, publishing a profile and any contact with an adult happen only through a parent/guardian or a verified academy. See section 6.
3. What data we process
- Account & identity: name, date of birth, country, club/academy.
- Player profile: video(s) you upload, photos, and sporting details you choose to add (e.g. height, preferred foot).
- Guardian information: parent/guardian contact (email) used to obtain and record consent.
- Consents and their proof: what you consented to, when, and technical evidence of the confirmation (e.g. time, IP/user-agent of the parent's confirmation click).
- Club/scout users: contact details and verification documents of clubs, academies and their named representatives.
- Technical data: basic logs needed to run and secure the service. Cookies are covered by our separate Cookie notice; we keep tracking of children to the minimum and use no pre-ticked boxes.
We apply data minimisation: we ask only for what a stated purpose requires.
4. Why we process it and on what legal basis (GDPR Art. 6, 8, 9)
| Purpose | Legal basis |
|---|---|
| Create and run a player's account and video profile | Consent — Art. 6(1)(a); for users under 18, consent is given by a parent/legal representative (GDPR Art. 8 and NSS's own rule) |
| Show a profile to verified clubs/scouts (only if the player opts in) | Consent — Art. 6(1)(a); profile is closed by default |
| Display a player's image/video | Separate explicit image consent — GDPR Art. 6(1)(a) and, where applicable, Art. 9(2)(a); for users under 18 it is given by the parent/legal representative. National image-rights norms are listed on the Legal Bases page |
| Produce a developmental report from your video (today: a live coach) | Consent, tied to the profile purpose; see section 5 |
| Verify clubs/academies/scouts and keep contact logs | Legitimate interest in child safety and preventing abusive contact — Art. 6(1)(f); Directive 2011/93 |
| Security, fraud prevention, legal compliance | Legal obligation / legitimate interest — Art. 6(1)(c),(f) |
We process no special-category data. In particular, NSS does not use face recognition, facial tagging, or any biometric identification on players' videos or photos (see section 5).
5. How video is processed (what happens today and what is planned)
Today. The video you upload is analysed by a live coach — a person, not software. They watch the recording and write a developmental, text-based report: what happened, why, and what to work on. The report contains no verdicts, rankings, or decisions with legal effect. The video is seen only by the coach working on the report and is kept in private storage (section 11). We do not perform biometric identification and do not use face recognition.
In the future (not operational yet). We plan AI-based tools that would help prepare the developmental report. There is no such processing today. If and when it is introduced, we will update this policy in advance, name the AI providers as processors, and describe it separately; contracts will require them not to train their models on NSS data and to act only as processors under a data-processing agreement. We will not send children's video to an AI provider without updated information and, where required, consent.
This transparency meets GDPR Art. 13: we tell you the purposes and legal bases of processing at the moment data is collected, and we do not describe as operational anything that does not exist today.
6. Children and parental consent
- A profile is closed by default — invisible to everyone until the player takes an explicit action to make it visible, and (for under-18s) a parent has confirmed.
- Parental consent is obtained by an active confirmation: the parent receives a link, opens a page that shows the consent text, and confirms by pressing a button. We record who confirmed, when, and technical evidence of that confirmation.
- Consent can be withdrawn at any time (section 9). Withdrawing display consent immediately removes the profile from any listing.
- There is no private adult-to-child messaging on NSS. Contact happens only via a parent/guardian or a verified academy, and contact attempts are logged.
7. Who we share data with (processors)
We use the following service providers as processors under GDPR Art. 28 data-processing agreements:
- Cloudflare R2 — private storage of videos and files.
- Supabase / PostgreSQL — application database and authentication.
- AI providers (e.g. Anthropic, OpenAI) — planned for the future. Today the report is written by a live coach, and children's data is not shared with AI providers. If such processing is introduced, it will be added here before it goes live, under no-training terms.
- Resend — transactional email (parental-consent and early-access messages). Emails are sent from the EU (Ireland); message data and logs are stored in the US under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
We do not sell personal data. We do not add new sub-processors for children's data without appropriate safeguards.
8. International transfers
Some processors store or process data outside the EU/EEA (in the United States). Where they do, transfers are protected by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses under GDPR Art. 44–46. Details are documented in our records and available on request.
9. How long we keep data (retention)
- Website registration (email, role, interest, language): an unconfirmed registration is deleted when the confirmation link expires (7 days); a confirmed one is kept for up to 2 months and then deleted unless you renew it. You can delete a registration at any time via the link in the email.
- Account and profile data: while the account is active; deleted on account closure or on withdrawal of the underlying consent.
- Consent proof: kept as long as needed to demonstrate a valid consent existed, then deleted.
- Platform video (where an account exists): kept in private storage for up to 90 days from the date of upload, accessible only to the coach preparing the report, then deleted. It is deleted earlier on account closure or on withdrawal of consent. There is no AI processing today; when it is introduced, frames will be used only for the report and will not be retained by the AI provider for training.
- Development history (test results by date, filming conditions and coverage, focus-of-session notes, coach's written analysis, assigned exercises): kept until the player's 18th birthday, then deleted — unless before that date the player (or parent/guardian) requests deletion or withdraws consent, in which case the entire history is deleted immediately. The history contains no video or images of the child. At age 18, the player decides independently: export, continue, or delete.
- Withdrawal of consent deletes everything: withdrawing consent removes both the video and the full development history, not just the video.
- First free analysis video (request without an account): kept in private storage for up to 90 days from receipt, accessible only to the coach preparing the report, then deleted. It is deleted earlier at the parent's/guardian's request or on withdrawal of consent. The written report remains in your email.
- Transactional email logs at our email provider: kept for that provider's short retention window (e.g. ~30 days) and then deleted.
- Security logs: kept for the minimum period needed for security and legal compliance.
10. Your rights (GDPR Art. 15–22)
You (and, for a child, the parent/guardian) have the right to: access your data; rectify it; erase it; restrict or object to processing; and data portability. You can also withdraw consent at any time, and this is designed to take 1–2 steps (e.g. a delete button; withdrawing display consent immediately hides the profile).
To exercise any right, contact [email protected]. You also have the right to lodge a complaint with a supervisory authority:
- Supervisory authority of the operator's country — Portugal: CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt).
- Or the supervisory authority of the country where you habitually live or work. Country-by-country legal bases — the age of digital consent and image-rights norms — are collected on the Legal Bases page.
11. Security
We store videos in a private storage bucket with short-lived access links, enforce row-level access controls, and keep provider keys server-side. We continue to strengthen technical and organisational measures appropriate to the sensitivity of children's data (GDPR Art. 32).
12. Cookies
Our use of cookies and similar technologies, with a genuine choice and no pre-ticked boxes, is described in our separate Cookie notice.
13. Changes to this policy
We may update this policy. Material changes affecting children or parents will be communicated clearly. The effective date above shows the current version.
14. Contact
Data Protection contact — Leonardas Dauksevicius — [email protected].