1. Who we are
xGI (expected Growth and Impact) is operated by to be confirmed (company number to be confirmed, registered office to be confirmed), referred to as "we" and "us". We are the controller of the personal data described here. You can reach us about anything in this policy at [email protected].
This policy covers the website at https://xgigroup.ie and the xGI platform at https://platform.xgigroup.ie/. It is written under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, and the Data Protection Commission (DPC) is our supervisory authority.
2. Who this covers
- Parents/guardians who book an assessment, sign in to the platform or write to us.
- Players, who are children between Under 9 and Under 13, whose assessments, profiles, images and recordings we hold. A parent/guardian acts for the player in everything below.
- Visitors to the website.
- Other people given access to a player's progress by us at the parent/guardian's request, such as a club or a coach.
3. Data we handle
| Category | Examples | Where it comes from |
|---|---|---|
| Enquiry data | Parent/guardian name, email, phone, the player's age group, club or school, what you tell us about the player, the date you gave consent | You, in the assessment form |
| Player profile | The player's name and age group, assessment results across the eight measured areas, the coach's estimate of the ceiling, training plans, reassessments and coach notes | Our coaches, at assessments and sessions |
| Health and emergency details | Medical conditions, allergies, medication, GP, emergency contacts, and injuries or concussions that happen in our care | The parent/guardian on the platform, and our coaches when an injury happens |
| Images and recordings | Photos and video of the player taken during assessments and sessions | Our coaches, with the parent/guardian's consent (section 5) |
| Account data | Name, email, password (stored only as a one-way hash), which players you may see | Set up by us when we grant access; there is no self-registration |
| Technical data | IP address, browser and device type, session identifiers | Your browser, in server logs and the session cookie |
| Support data | Emails you send us and our replies | You |
Please do not put medical information in the booking form. Once the player joins, the parent/guardian adds what a coach needs to know on the platform. Health details are encrypted, only the player's coaches and the xGI team can see them, and every time they are opened it is logged.
4. Why we use it and the lawful basis
- Contract (Article 6(1)(b)): arranging the assessment, measuring the player, building and updating the profile, running sessions, and showing the parent/guardian the player's progress.
- Consent (Article 6(1)(a)): taking and using photos and video of the player. You give it in the booking form and can withdraw it at any time (section 5).
- Health details (Article 9(2)(a) explicit consent, given by the parent/guardian when they enter them, and Article 9(2)(c) vital interests in an emergency): keeping the player safe and telling medical staff what they need to know. Withdrawing consent means deleting the details, which may mean a coach cannot safely include the player in some activities.
- Legitimate interests (Article 6(1)(f)): keeping the platform secure, preventing abuse, and understanding how the service is used so we can improve it. We balance these against your and the player's interests and you may object at any time.
- Legal obligation (Article 6(1)(c)): keeping accounting records and responding to lawful requests.
We do not send marketing email to people who have not enquired, and we never sell or rent personal data. No automated decision with legal or similar effect is made about a player: a coach sets every ceiling and every plan.
5. Images and recordings
Assessments and sessions are photographed and filmed because the profile is built from what we measure and see. When a parent/guardian books an assessment they confirm that they are the player's parent/guardian and consent to this.
- Images and recordings are used only to assess, coach and track the player and to show the parent/guardian the player's progress.
- They are not published on our website, social media or anywhere else without the parent/guardian's separate, written permission for each use.
- Session videos are analysed to measure each player's movement on the pitch (distance, speed, sprints, position and involvement). To tell players apart from one session to the next, the analysis compares the colour of kit and hair. It does not use facial recognition. A coach confirms every match.
- We carried out a data protection impact assessment of the filming and analysis, and review it whenever the analysis changes.
- Session videos are deleted 30 days after they are uploaded. The measured numbers are kept on the player's profile. While a video is kept, a parent/guardian can watch the sessions their own player appears in; other players in the same session may be visible.
- Assessment photos and recordings are kept only while the player trains with xGI and are deleted within 30 days of the player leaving, unless the parent/guardian asks for them sooner or asks us to keep a copy for them.
- Consent can be withdrawn at any time by email to [email protected]. We then stop recording that player and delete what we hold. The coaching can continue from the measured numbers alone.
6. Children
Every player is a child, so we apply the stricter standard the GDPR asks for. We act only through a parent/guardian: they book, they consent, they hold the account, and they can see, correct or delete everything we hold about the player. We do not contact players directly, we do not create accounts for them, and we collect no more about a player than coaching needs. Our coaches follow the FAI's child safeguarding requirements and Garda vetting rules.
7. Who we share with
We share personal data only with providers that help us run the service, each under a contract that limits what they may do with it:
- our hosting provider for servers, databases, files and backups (a location to be confirmed).
- Cloudflare for DNS and for protecting the website.
- A mail server we operate ourselves sends our emails. No artificial intelligence service processes player data.
We share a player's progress with another person, such as a club or a coach, only when the parent/guardian asks us to. We may also disclose data where the law requires it, to protect the safety of any person, or as part of a sale or reorganisation of the business, in which case the new operator takes on this policy.
8. Where data is kept
Profiles, images and recordings are stored in a location to be confirmed. If any provider processes data outside the European Economic Area we rely on an adequacy decision or the EU Standard Contractual Clauses, and copies are available on request.
9. Retention
- Enquiries that do not go ahead: deleted after 12 months.
- Player profiles: while the player trains with xGI, then deleted within 12 months of leaving, unless the parent/guardian asks for them sooner or asks us to keep them.
- Health details and emergency contacts: while the player trains with xGI, then deleted within 30 days of leaving. Injury records are kept for as long as the law on personal injury claims requires, then deleted.
- Consent records: kept with the profile, so we can show when consent was given or withdrawn.
- Session videos: 30 days from upload. The numbers measured from them stay on the player's profile.
- Other images and recordings: while the player trains with xGI, then deleted within 30 days (section 5).
- Billing records: six years after the year they relate to, as the Revenue Commissioners require.
- Server logs: 30 days.
- Support email: two years after the thread closes.
10. Security
Traffic is encrypted in transit. Everyone signs in with their email address and a password; staff accounts are separate from parent/guardian accounts and are created only on the server. Each parent/guardian sees only the players they have been given access to, and every request is checked against that. Health details and safeguarding records are encrypted, and every time they are opened it is logged. Access to the servers is limited to named people. Backups are encrypted.
11. Your rights
You, for yourself and for the player, have the right to access, correct, erase and port personal data, to restrict or object to processing, and to withdraw consent. Write to [email protected] and we will respond within one month. If you are unhappy with our answer you can complain to the Data Protection Commission at dataprotection.ie.
12. Changes
We will post changes here and update the date at the top. If a change materially affects how we use a player's data we will email parents/guardians before it takes effect.