Privacy policy

1. Data controller

The data controller is the entity identified in the Legal notice. Contact email for privacy matters: support.vemax@vemaxsport.com.

2. What data we process

• Account data: first name, last name, email, date of birth, phone number, city.
• Sports profile data: sports played, position, squad number, size, nickname, profile photo (optional, filled in by the user themselves).
• Event registration data: answers to the fields that event's organiser has enabled (e.g. emergency contact, allergies or medical notes). These fields may include special category data (health) under Article 9 GDPR — collected only with the user's explicit consent (or their guardian's, if a minor) when accepting the registration, and shared only with that specific event's organiser.
• Minor and guardian data: the guardian's name, email and phone number, and a record of their consent, when the person registering is a minor.
• Professionals directory data (only if you sign up for it, and only if you are an adult):
  • What gets published: full name, photo, city, sports, bio, experience, availability, and the federation and the date we reviewed your licence documentation.
  • What is never published: your federation licence number, the supporting document you upload, its expiry date, and your account's email and phone number. The document is stored in a private store, not accessible from the internet, and only opened by VEMAX Sport staff reviewing your application.
• Messages and applications: the content of messages an organiser sends to a professional in the directory and of applications to offers, together with the date they were sent.
• Payment data: handled directly by Stripe (payment provider). VEMAX Sport does not store card numbers.
• Technical data: strictly what is needed for the session to work (authentication cookies), with no advertising or analytics cookies. To know which pages are visited we use Vercel Web Analytics, which uses no cookies and doesn't store your IP address: it counts visits in an aggregated, anonymous way.

3. What we use your data for, and on what legal basis

• Managing your account and your event registrations — performance of a contract.
• Processing registration payments through Stripe — performance of a contract.
• Sharing with the organiser the data needed to provide the event's service (including, where applicable, health data you choose to provide) — performance of a contract / explicit consent.
• Sending you operational emails (payment confirmation, changes to your registration, refunds) — performance of a contract.
• Publishing your profile in the professionals directory if you request it — consent, which you can withdraw at any time from your own dashboard.
• Reviewing the federation licence documentation you provide before publishing your profile — legitimate interest in keeping the directory trustworthy for anyone who consults it, and in reducing the risk of publishing documentation that is clearly false or inconsistent.
• Putting organisers and professionals in touch, and keeping a record of those messages to prevent abuse — performance of a contract / legitimate interest.
• Complying with legal obligations (invoicing, fraud prevention) — legal obligation.

4. Who we share your data with

• The organiser of the event you register for, only the data needed to provide that service.
• Technology providers acting as data processors: Supabase (database and authentication), Stripe (payments), Resend (sending emails) and Vercel (hosting). Some of these providers may involve data transfers outside the European Economic Area, covered by the safeguards each provider offers (standard contractual clauses or another valid mechanism).

• Anyone, if you sign up for the professionals directory: the public part of your profile is an open page, visible without signing up and accessible to search engines. That is precisely its purpose, which is why signing up is voluntary and reversible. Data the policy itself marks as non-publishable is excluded.
• The organiser who writes to you from the directory receives your reply with your email only if you decide to answer them: their message reaches you through VEMAX Sport, without revealing your address to them beforehand.

We do not sell your data to third parties.

5. How long we keep your data

For as long as you keep your account active. After you close it, we keep billing and accounting records of your payments for 6 years (article 30 of the Spanish Commercial Code) and data relevant for tax purposes for 4 years (Spanish General Tax Act); everything else is deleted without undue delay.

Federation licence document: kept while the professional profile is published and for up to 12 months after the profile is removed or the application is rejected. After that period the document is deleted and only a record of the fact that the documentation was reviewed, and on what date, is kept — which is what backs the seal shown at the time.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to support.vemax@vemaxsport.com. You can also file a complaint with the Spanish Data Protection Agency (aepd.es) if you believe we have not properly handled your request.

7. Minors

When the person registering for an event is a minor, their data is processed with the express consent of their mother, father or legal guardian, given on the registration form itself.

8. If you're in the professionals directory

Only adults may sign up, and always on their own initiative: no one publishes another person's profile.

You can edit your profile at any time from your dashboard, and remove it yourself from there whenever you want: it stops being public immediately, and you can come back later. Your profile is also hidden solely and automatically the day your licence expires, until you upload a new one.

Players' sports profiles are not part of the directory: they cannot be searched or viewed from it. An adult player may voluntarily attach theirs when they are the one initiating contact, and never the other way round.

9. Security

We apply reasonable technical and organisational measures to protect your data: role-based access restrictions, passwords managed by a specialised authentication provider, encrypted connections, and application-level encryption (AES-256) of the fields the organiser marks as sensitive when creating their event — today, emergency contact and allergies/medical notes. We also avoid requesting or permanently storing data such as ID numbers, full home addresses or medical history beyond what is strictly necessary for a specific event.

10. Changes to this policy

We may update this policy. Significant changes will be notified by email or via a notice on the Platform.