Privacy Policy

1. General provisions

1.1. We respect privacy and take reasonable organisational and technical measures to protect personal data within the nature of the Service, available infrastructure and applicable legal requirements.

1.2. Access to Platform functionality is provided to clubs on a subscription basis after acceptance of the public offer and payment. Users within a club are created, invited or otherwise administered by that club.

1.3. The Site https://www.uteam.club is used to publish product information, communicate with interested parties and, where applicable functionality exists, to receive enquiries.

1.4. Use of the Platform on club subdomains takes place in the context of the relationship between the Operator and the relevant club. The club may determine the set of users, role structure, volume of uploaded data and internal workflows within its Platform instance.

1.5. By using the Site and/or contacting us, you confirm that you have read this Policy. If you do not agree with its terms, please refrain from using the Site and from sending us personal data.

2. Operator and contacts

2.1. The owner of the Site and the party providing the UTeam Platform is:

Artem Aravi Oganyan
Status: self-employed taxpayer (NPD), Russian Federation
TIN (INN): 230412571946

2.2. For any matters relating to personal data processing and this Policy, you may contact us:

Email: info@uteam.club
Phone (Russia): +79189966000
Phone (Armenia): +374055126753
Legal details: https://www.uteam.club/requisites

3. Categories of data that may be collected and processed

Depending on how the Site and Platform are used, the following categories of data may be processed.

3.1. Platform user account data, including account identifiers, name, email address, information about the user's role and status within a club, and data required for authentication, authorisation, sessions and secure operation of the service.

3.2. Contact details voluntarily provided when contacting us via the Site, email or other designated channels, including name, email, phone number and the content of the message, where such details are provided.

3.3. Club profile data, including club name, subdomain, logo, organisational settings and other information the club enters into the Platform.

3.4. Data on club staff, Platform users and other persons added by the club, including name, contact details, work-related information, role, access rights and other information the club considers necessary for work in the Platform.

3.5. Player data, including name, date of birth, sports and organisational information, team membership, statuses, documents and other information the club enters or uploads to the Platform.

3.6. Sports, organisational and administrative information, including schedules, training and match data, calendar events, attendance, internal activity, tasks and other information related to the club's activities.

3.7. Wellness / readiness / condition survey data, including sleep, recovery, subjective load, wellbeing, pain, readiness and other indicators, where the club uses the relevant functionality.

3.8. Medical and health-related data, where the club uses the relevant sections and modules of the Platform, including information on injuries, recovery, restrictions, medical cases, complaints, history, examinations, recommendations, prescriptions, medical documents, wellbeing and other health-related data.

3.9. Documents, files, photos and other media uploaded to the Platform by the club or its authorised users.

3.10. Technical data, including cookies, tokens, technical logs, IP addresses, browser and device information, local UI settings, session data and other information objectively generated when using the Site and Platform and necessary for their operation, security and support.

3.11. UTEAM Coach user materials, including exercises, tactical schemes, notes, files and other materials saved by the user in the product. Users must not include third-party personal data without an appropriate legal basis, or health data or minors' personal data.

4. Sources of data

4.1. Directly from users when they provide data via forms on the Site, by email or in the Platform interface.

4.2. From the club, which adds, uploads, modifies, organises or otherwise enters data into the Platform, including in relation to staff, players, minors, documents and medical information.

4.3. Automatically when using the Site and Platform, including technical and service data, event logs, system timestamps, activity metrics and other data arising in connection with operation of the service.

5. Purposes of processing

5.1. Providing access to the UTeam Platform and ensuring its operation.

5.2. Creating and maintaining accounts, managing sessions, authorisation, security and access control.

5.3. Handling enquiries, requests, demo requests, feedback and other communications related to use of the Site and Service.

5.4. Performing contractual and related obligations towards clubs.

5.5. Enabling Platform modules related to club, team and player management, documents, training process, matches, attendance, condition surveys, wellness / readiness, recovery and medical processes.

5.6. Support, diagnostics, abuse prevention, incident investigation, technical logging and improving service stability.

5.7. Fulfilling duties under applicable law and responding to lawful requests from competent authorities where provided by law.

6. Legal bases for processing

6.1. Personal data are processed on bases provided by applicable law, which may include, depending on the situation:

• performance of a contract or steps related to its conclusion and performance;
• exercise of the Operator's or third parties' rights and legitimate interests under Article 6(1)(7) of Federal Law No. 152-FZ, provided that the data subject's rights and freedoms are not infringed;
• data subject consent, where required and obtained in a specific case;
• other legal bases provided by applicable law.

6.2. For data uploaded, entered or used by a club inside the Platform, the legal bases for such processing are largely determined by the club as the party deciding the purposes, scope and content of the relevant data.

6.3. For special categories of data, including medical and other health-related data, the club ensures necessary legal bases, separate written consents, Roskomnadzor notices and verification of a minor's legal representative. UTEAM processes these data only under documented club instructions and remains responsible for its own processor duties.

6.4. Processing operations and methods

Depending on the purpose, operations include collection, receipt, recording, organisation, accumulation, storage, updating, retrieval, use, controlled access, transfer to listed processors, pseudonymisation, blocking, deletion and destruction. Processing is primarily automated and may be mixed for support, documents and legal compliance, using the internal network and the Internet.

7. Medical and health-related data

7.1. Clubs may use the Platform to enter, store, organise and use medical and health-related data to the extent necessary for the relevant Service functionality.

7.2. Such data may include information on injuries, illnesses, complaints, recovery, restrictions, medical cases, history, wellbeing, examinations, prescriptions, recommendations, wellness / readiness indicators and related documents.

7.3. The club is solely responsible for the lawfulness of processing such data, including having required consents, notices, permissions and other legal bases, and for the lawfulness of upload, accuracy and content of specific records, documents and files.

7.4. The Operator processes medical and health-related data only to the extent necessary to provide the digital infrastructure and Platform functionality to the relevant club.

7.5. The Operator does not perform legal review of each individual medical document, record, consent, processing basis or other material uploaded by the club to the Platform, unless expressly agreed otherwise in a separate agreement.

7.6. Access to such data within the Platform is granted only to authorised club users in accordance with roles, access settings and internal rules established by the club itself.

8. Minors

8.1. The Platform may be used by clubs in relation to minor athletes, as sports clubs and academies may involve children and adolescents.

8.2. UTeam is not a public children's service and is not intended for independent use by children outside the structure of a specific club.

8.3. Minors' access to Platform functionality is possible only within a specific club and under rules set by that club.

8.4. The club is solely responsible for compliance with legal requirements when processing minors' data, including obtaining consents, engaging with parents or other legal representatives, providing required notices and having other legal bases.

8.5. The Operator does not assume the club's functions of preparing consents, notifying parents or legal representatives, or verifying the sufficiency of such bases, unless expressly agreed otherwise in a separate agreement.

9. Role of the club and its responsibility

9.1. The club is a key participant in processing where it uses the Platform for its internal operations and independently uploads, enters, organises, modifies and uses data through the available Service functionality.

9.2. It is the club that determines what data, concerning which persons, in what volume and for what purposes are entered, stored and used through the Platform.

9.3. It is the club that bears responsibility for the lawfulness of uploading and using such data, including having required consents, notices, permissions and other legal bases.

9.4. This applies in particular to:

• minors' data;
• medical and health-related data;
• player documents;
• information entered by club staff;
• photos, videos, documents and other materials uploaded to the Platform.

9.5. The Operator provides the club with digital infrastructure and Service functionality but does not replace the club regarding lawfulness of data content, lawfulness of initial collection, completeness of notices to data subjects or the club's internal duties towards such subjects.

9.6. The club independently manages roles, access settings and the circle of authorised users within the Platform's capabilities. Therefore, access to data within a specific club is determined not only by the user's general role but also by settings configured by the club.

10. Disclosure to processors and other recipients

10.1. Cloud, technical, communications and other infrastructure processors may be used to operate the Service, providing hosting, storage, notification delivery, messaging, security, backups and other technical functions.

10.2. The application, server, database and related infrastructure are hosted using Yandex Cloud.

10.3. For specific Platform functions the following processors may also be used (only to the extent needed for the relevant function):

• YooKassa — subscription payments and fiscal receipts;
• email delivery (SMTP / Yandex Mail) — transactional and service emails, including contact-form messages;
• Expo Push / Apple Push Notification service / Firebase Cloud Messaging — mobile push notifications.

10.4. Personal data may be disclosed to such processors only to the extent necessary to operate the Site and Platform, provide technical support, ensure security and perform related service functions.

10.5. The Operator does not provide personal data to third parties for their independent marketing purposes, unless expressly required by law or by separate consent of the data subject.

10.6. Data may also be disclosed:

• where required by law;
• in response to a mandatory request from a competent authority;
• in connection with protecting rights, legitimate interests and safety of the Operator, club, users or others, where permitted by applicable law.

11. Localisation and cross-border processing

11.1. The primary application, database and object storage are hosted in Yandex Cloud in the Russian Federation. Initial recording, organisation, accumulation, storage, updating and retrieval of Russian citizens' data collected online use databases in Russia.

11.2. When mobile push is enabled, device tokens, routing identifiers and notification text are sent through Expo Push and then Apple Push Notification service or Firebase Cloud Messaging. This may be cross-border processing. Medical records and survey answers are not included in notification text, and payloads are minimised.

11.3. The Operator may perform restricted administrative access to Russian infrastructure from Armenia. Where the same individual Operator accesses the systems without disclosing data to a foreign authority, individual or legal entity, the place of connection alone does not create a separate foreign recipient under Article 3(11) of Federal Law No. 152-FZ. Access is protected, least-privileged and logged; local storage of club personal data on devices in Armenia is prohibited.

12. Cookies and technical data

12.1. The Site and Platform may use cookies and similar technologies necessary for authentication, session management, remembering basic user preferences, security and correct operation of the interface.

12.2. Browser local storage and other technical mechanisms may also be used to store language, visual preferences and other service information needed for convenient use of the Site and Platform.

12.3. A more detailed description of cookies and similar technologies is set out in the Cookie Policy. The Site shows an informational notice about necessary cookies.

12.4. If additional analytics or other non-strictly-necessary technologies are introduced on the Site in the future, this Policy and the Cookie Policy may be updated accordingly.

13. Retention periods

13.1. Club data and related data are retained for the period the relevant club uses the Platform.

13.2. When a club voluntarily stops using the Platform (contract termination, deletion request and similar cases), club working data is deleted no later than 3 (three) calendar days after contract termination. Any export must be requested before access ends; no separate extended retention period is provided solely for a possible export.

13.3. When access ends due to unpaid subscription, the following applies (see also the public offer): for 5 (five) calendar days after the paid period ends (grace period) full plan access remains; access is then suspended; club working data enters a short technical archive and is deleted no later than 3 (three) calendar days after suspension unless deletion is prohibited by law.

13.4. Payment, invoice, subscription and related accounting/tax records may be retained longer than under §13.2–13.3, to the extent and for the period required by applicable law.

13.5. Where otherwise required by law, contract or dispute resolution, specific data may be retained longer, to the extent and for the period necessary for those purposes.

13.6. Unsuccessful signup requests and contact-form submissions are retained for no more than 30 (thirty) calendar days; duplicate personal data in a successful signup request is erased no later than 7 days after the account is created. Transactional-email metadata and raw payment provider event bodies are erased after 30 days. Application, access and security logs that may contain technical identifiers are rotated no later than 14 days. Expired verification tokens are deleted when their validity ends.

14. Deletion and backups

14.1. Deletion is carried out in accordance with available Platform functionality, the Operator's internal procedures and contractual relations with the club.

14.2. Deletion in the Platform interface does not always mean immediate and final destruction of all related technical copies.

14.3. Backups may be retained for up to 14 (fourteen) calendar days after deletion of primary data, after which they are deleted, overwritten or rotated out of the regular backup cycle in line with applied technical procedures.

14.4. If a deletion request concerns data entered by the club, the Operator may take into account the club's role as the party determining the content and lawfulness of the relevant data.

15. Security measures

15.1. The Operator applies necessary legal, organisational and technical measures under Articles 18.1 and 19 of Federal Law No. 152-FZ, taking account of processing risks.

15.2. Measures include role-based least-privilege access, authentication and session protection, TLS in transit, private object storage and authorised routes for sensitive files, security logging, backup and restore checks, secret and vulnerability management, and incident and destruction procedures.

15.3. Only the Platform owner has access to production and data from the Platform side, except where limited access by infrastructure processors is objectively necessary to provide the relevant services.

15.4. Despite these measures, no method of transmission or storage can guarantee absolute security; the Operator cannot eliminate all risks entirely.

16. Rights of data subjects

16.1. To the extent provided by applicable law, a data subject may have the right to:

• request access to their data;
• request correction of inaccurate data;
• request erasure or restriction of processing where provided by law;
• withdraw consent, where processing is based on consent;
• object to processing where permitted by law;
• exercise other rights provided by applicable law.

16.2. If a request concerns data entered, uploaded or used by the club in its activities, in many cases the primary addressee of such a request is the club itself, as the club determines the purposes, scope and content of that data.

16.3. The Operator may consider such requests within its role as Platform provider and, where necessary, coordinate with the club to handle them, where permitted by law, contract and technically feasible.

17. How to submit requests

17.1. Requests, communications and notices regarding personal data in connection with the Site and Platform should be sent to: info@uteam.club.

17.2. Where possible, please include in your request:

• subject matter of the request;
• category of data or action concerned;
• contact for replies;
• information reasonably sufficient to identify the requester.

17.3. We may request additional information if needed to verify the requester's identity, protect third-party rights, prevent abuse or properly fulfil the request.

18. Changes to the Policy

18.1. The Operator may amend this Policy.

18.2. The current version is published at: https://www.uteam.club/privacy.

18.3. Updates may be communicated by email and/or through the Site, where such notice is appropriate for the relevant category of users.