Privacy Policy
1. Who we are
Football Coaching Institute OÜ ("FCI", "we", "us", "our") is the data controller responsible for the personal data described in this policy. This means we decide why and how your personal data is processed.
| Legal entity | Football Coaching Institute OÜ |
| Registry code | [REGISTRY CODE] |
| Registered address | [OFFICE1 FULL STREET ADDRESS], Tallinn, Estonia |
| info@footballcoachinginstitute.com | |
| Website | www.footballcoachinginstitute.com |
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. Privacy enquiries should be sent to the email address above.
2. What this policy covers
This policy explains what personal data we collect when you visit our website, create an account, purchase a course or contact us; why we collect it; what we do with it; and what rights you have.
It should be read together with our Cookie Policy and our Terms and Conditions.
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).
3. Personal data we collect
3.1 Data you give us
- Account data: your name, email address and password (stored in encrypted form).
- Purchase data: the courses you buy, purchase date, amount paid, invoice details and, where relevant, your VAT number and company name.
- Billing data: billing name, billing address and country. We never receive or store your full card number — card details are entered directly with our payment provider (see Section 5).
- Correspondence: the content of emails or messages you send us, including support requests and complaints.
- Optional profile information: anything you voluntarily add to your profile, such as your club, role or coaching level.
3.2 Data we collect automatically
- Course progress data: which lessons you have opened or completed, and your position within a course.
- Technical data: IP address, browser type, device type, operating system and referring page.
- Log data: access times, error logs and security-related events generated by our hosting environment.
3.3 What we do not collect
We do not knowingly collect special categories of personal data (such as health data, racial or ethnic origin, or religious beliefs), and we do not ask you to provide it. Please do not send us such information unless we have specifically asked for it.
In particular, do not send us personal data about players you coach, including names, photographs, medical information or assessments. Our courses are designed to be applied in your own environment without transferring player data to us.
4. How we use your data and why
Under the GDPR we must have a lawful basis for each processing purpose. The table below sets ours out.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and manage your account | Account data | Contract (Art. 6(1)(b)) — necessary to provide the service you signed up for |
| Process your purchase and give you access to courses | Purchase data, billing data, account data | Contract (Art. 6(1)(b)) |
| Track your progress and issue certificates of completion | Course progress data | Contract (Art. 6(1)(b)) |
| Send service emails (purchase confirmation, access details, password resets, important service notices) | Account data, purchase data | Contract (Art. 6(1)(b)) |
| Respond to your questions and support requests | Correspondence, account data | Contract or legitimate interests (Art. 6(1)(f)) — to assist our users |
| Send marketing emails about new courses and offers | Name, email address | Consent (Art. 6(1)(a)), which you may withdraw at any time |
| Comply with accounting, tax and VAT obligations | Purchase data, billing data, invoices | Legal obligation (Art. 6(1)(c)) |
| Keep the platform secure, prevent fraud and abuse, and enforce our Terms | Technical data, log data, account data | Legitimate interests (Art. 6(1)(f)) — protecting our platform, our users and our content |
| Improve our courses and platform | Aggregated course progress data | Legitimate interests (Art. 6(1)(f)) — improving the service we provide |
| Establish, exercise or defend legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)) / legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and concluded that they are not. You may object to this processing at any time (see Section 8).
5. Who we share data with
We do not sell your personal data. We share it only with the service providers we need to operate, and only to the extent necessary. These providers act as our processors and may only use the data on our instructions.
| Provider | Purpose | Data shared |
|---|---|---|
| Stripe (Stripe Payments Europe, Ltd.) | Payment processing and fraud prevention | Name, email, billing address, country, transaction amount. Card details are collected by Stripe directly and are never received by us. |
| [EMAIL MARKETING PROVIDER] | Sending service and marketing emails | Name, email address, engagement data (opens, clicks) |
| [HOSTING PROVIDER] | Website and platform hosting, backups | All data stored on the platform, including account and progress data |
| [ACCOUNTANT / BOOKKEEPING PROVIDER] | Accounting, VAT filing and statutory reporting | Invoice and transaction data |
Stripe acts as an independent controller in respect of certain fraud-prevention and regulatory processing. Their handling of your data is described in the Stripe Privacy Policy.
We may also disclose personal data:
- where required by law, court order or a competent authority;
- to our professional advisers (lawyers, accountants) where necessary;
- to a buyer or successor in the event of a merger, acquisition or sale of assets, subject to this policy continuing to apply.
6. International transfers
Our providers are primarily located within the European Economic Area (EEA). Where a provider processes data outside the EEA, we ensure an appropriate safeguard is in place under Chapter V of the GDPR, which will usually be:
- an adequacy decision by the European Commission for the destination country; or
- Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional technical and organisational measures.
You may request a copy of the relevant safeguard by contacting us at info@footballcoachinginstitute.com.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account and profile data | For as long as your account is active, and for 24 months after your last login, after which the account is deleted or anonymised |
| Course progress data and certificates | For the duration of your access period plus 24 months, so that we can reissue a certificate on request |
| Invoices, purchase and VAT records | 7 years, as required by Estonian accounting and tax law |
| Marketing data | Until you withdraw consent or unsubscribe, plus a suppression record kept indefinitely so that we do not contact you again |
| Correspondence and support tickets | 24 months from the date the matter is closed |
| Server and security logs | 12 months |
Where a legal claim is pending or reasonably anticipated, we may retain relevant data until the matter is resolved and any limitation period has expired.
8. Your rights
Under the GDPR you have the following rights in respect of your personal data:
- Access — to receive a copy of the personal data we hold about you.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to have your data deleted, where there is no overriding reason for us to keep it (for example, statutory retention of invoices).
- Restriction — to have processing limited in certain circumstances.
- Portability — to receive data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
- Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, email info@footballcoachinginstitute.com. We will respond within one month. If your request is complex we may extend this by up to two further months, and will tell you if we do.
We may ask you to verify your identity before acting on a request. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
9. Marketing communications
We will only send you marketing emails where you have given consent, or where permitted by applicable law in respect of existing customers for similar products.
Every marketing email contains an unsubscribe link. You can also email us to opt out. Unsubscribing from marketing does not stop service emails relating to a purchase you have made, such as access details, receipts or important notices about your account.
10. Cookies
We use cookies and similar technologies. Full details of which cookies we set, what they do and how to manage them are in our Cookie Policy.
11. Data security
We take appropriate technical and organisational measures to protect personal data, including:
- encryption in transit (HTTPS/TLS) across the platform;
- hashed and salted password storage;
- access controls limiting who within our organisation can access personal data;
- regular backups;
- use of established providers who maintain their own recognised security standards.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours where required, and will inform you without undue delay where the breach is likely to result in a high risk to you.
12. Children's data
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children.
Our courses concern the coaching of young players. However, we do not collect or process personal data about the players you coach, and you must not send such data to us. If you believe you have inadvertently sent us personal data about a child, contact us immediately at info@footballcoachinginstitute.com and we will delete it.
13. Automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 of the GDPR.
14. Changes to this policy
We may update this policy from time to time. The version number and date at the top of this page will always show when it was last changed.
Where a change materially affects how we use your personal data, we will notify you by email or through a prominent notice on the platform before it takes effect.
15. Contact and complaints
15.1 Contact us
For any question about this policy or about how we handle your data, contact us at info@footballcoachinginstitute.com. We aim to acknowledge privacy enquiries within 5 working days.
15.2 Right to lodge a complaint
If you are not satisfied with how we have handled your data or your request, you have the right to lodge a complaint with a supervisory authority.
Our lead supervisory authority is:
| Authority | Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) |
| Website | www.aki.ee |
| Address | Tatari 39, 10134 Tallinn, Estonia |
You may also lodge a complaint with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place.