Privacy Notice

This notice explains how VectorPitch collects, uses, stores and shares your personal data, what rights you have under GDPR, and how to contact us. For data protection enquiries or to exercise your rights, email privacy@vectorpitch.com.

Last updated: 2026-10-18 · v1.0

Version: 1.0
Effective Date: 2026-10-18
Controller: Vector Sport Solutions Limited
Privacy Contact: privacy@vectorpitch.com
Security Contact: security@vectorpitch.com
Legal Documents: /legal
Sub-processor List: /legal/subprocessors

Clause

Provision

Section 1 — Status and Scope of this Privacy Notice

What this notice covers. Where we handle data on behalf of a club or academy — match footage, player records — that organisation is responsible for telling people how their data is used, not us. The Data Processing Agreement covers those arrangements in full.

1.1

This Privacy Notice explains how VectorPitch collects, uses, discloses, transfers, retains and otherwise processes personal data.

1.2

This Privacy Notice applies to personal data processed by VectorPitch as controller or independent controller.

1.3

Where VectorPitch processes Customer Personal Data as processor on behalf of a customer, that processing is governed by the Data Processing Agreement. In that context, the customer is normally the controller and is responsible for providing privacy information to relevant data subjects.

1.4

This Privacy Notice should be read together with the Terms of Service Agreement, Data Processing Agreement, AI and Model Improvement Notice, Acceptable Use and Customer Content Policy, Cookie Policy, Sub-processor List and any applicable Subscription Plan. These documents are available at /legal.

1.5

This Privacy Notice is provided in accordance with Articles 13 and 14 GDPR and equivalent requirements under applicable data protection laws. It does not create contractual rights or obligations beyond those set out in the Terms of Service Agreement, Data Processing Agreement or any separate written agreement with VectorPitch.

Section 2 — Controller, Privacy Contact and Data Protection Officer

Who we are and how to reach us about privacy.

2.1

VectorPitch is operated by Vector Sport Solutions Limited.

2.2

Unless otherwise stated, references to "VectorPitch", "we", "us" or "our" mean Vector Sport Solutions Limited.

2.3

For privacy matters, contact: Vector Sport Solutions Limited, Email: privacy@vectorpitch.com.

2.4

For security matters, contact: security@vectorpitch.com.

2.5

VectorPitch has not designated a Data Protection Officer under Article 37 GDPR on the basis that its current processing activities do not require mandatory DPO appointment. Privacy and data protection queries should be directed to privacy@vectorpitch.com.

2.6

VectorPitch will keep its DPO position under review as its processing activities develop. If VectorPitch appoints a Data Protection Officer, this Privacy Notice will be updated to include the relevant contact details.

2.7

VectorPitch's lead supervisory authority is expected to be the Irish Data Protection Commission, unless another supervisory authority is competent in a particular case.

Section 3 — Definitions

Terms used throughout this notice. The GDPR definitions of controller, processor and personal data apply as written in the legislation.

3.1

In this Privacy Notice:

Account Data means personal data relating to an individual user account, including name, email address, authentication information, account identifiers, role, permissions, organisation, profile information and account settings.

AI Features has the meaning given in the Terms.

Applicable AI Laws has the meaning given in the Terms.

Applicable Data Protection Laws means all data protection, privacy, electronic communications and similar laws applicable to VectorPitch's processing of personal data, including, where applicable, the GDPR, the UK GDPR, the Data Protection Act 2018 of Ireland, the UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations, the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Australian Privacy Act 1988, the New Zealand Privacy Act 2020 and equivalent laws.

Customer Content has the meaning given in the Terms.

Customer Personal Data has the meaning given in the Data Processing Agreement.

De-identified Training Material means frames, crops, derived tracking data, tags, corrections, annotations or related outputs prepared for model evaluation or improvement in a manner designed to remove direct identity linkage, including by masking faces, removing audio and severing match, date and roster metadata using commercially reasonable technical and organisational measures.

GDPR means Regulation (EU) 2016/679.

High-Risk Use has the meaning given in the Terms.

Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Service means VectorPitch and all related products, features, applications, websites, APIs, software, hosted services and support services made available by VectorPitch.

Special Category Data means personal data that is subject to additional protection under Applicable Data Protection Laws, including where applicable personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a person, health data, sex life or sexual orientation data, and equivalent categories under applicable law.

Subscription Plan has the meaning given in the Terms.

3.2

The terms "controller", "processor", "personal data", "processing", "data subject" and "supervisory authority" have the meanings given in Applicable Data Protection Laws.

Section 4 — VectorPitch's Processing Roles

We wear three hats. Running our own business — accounts, billing, security, support — we're the controller, and this notice covers it. Handling footage a club uploads, we're the processor acting on that club's instructions. Improving our AI models from de-identified material, we're an independent controller.

4.1

VectorPitch processes personal data in different roles depending on the processing context.

4.2

VectorPitch acts as controller for personal data processed for its own business, operational, legal, security and service administration purposes, including Account Data, billing administration, support, website operation, service security, product analytics and business administration.

4.3

VectorPitch acts as processor where it processes Customer Personal Data on behalf of a customer in the customer's workspace, including uploaded videos, player data, squad data, tags, clips, annotations, comments, reports, exports and customer-configured sharing activity.

4.4

VectorPitch acts as independent controller for model evaluation and improvement processing carried out by VectorPitch for its own purposes, as described in this Privacy Notice and the AI and Model Improvement Notice.

4.5

If you are a player, parent, guardian, coach, referee, opposition player, spectator or other individual whose personal data appears in Customer Content uploaded by a customer, the relevant customer will normally be the controller of that Customer Content. You should normally contact that customer first in relation to data protection rights concerning that Customer Content.

Section 5 — Categories of Data Subjects

Whose data may be involved: account users, players including under-18s, coaches, analysts, referees, opposition players and others who appear in uploaded footage.

5.1

VectorPitch may process personal data relating to the following categories of data subjects:

(a) account users;
(b) organisation administrators;
(c) customer representatives;
(d) invited users;
(e) trial users;
(f) beta users;
(g) support contacts;
(h) website visitors;
(i) business contacts;
(j) players appearing in Customer Content;
(k) under-18 players appearing in Customer Content;
(l) coaches, analysts, referees, staff and opposition personnel appearing in Customer Content;
(m) parents, guardians, spectators and other incidental individuals appearing in Customer Content;
(n) people included in video-derived outputs, where applicable;
(o) individuals whose personal data is included in support, billing, security, legal or business records.

Section 6 — Categories of Personal Data

What we may hold: names, email addresses, account and usage data, uploaded footage and the analysis derived from it. We don't collect card details directly — a payment provider handles those if paid plans are enabled.

6.1

VectorPitch may process the following categories of personal data:

(a) names;
(b) email addresses;
(c) phone numbers;
(d) job titles;
(e) organisation names;
(f) account identifiers;
(g) user roles and permissions;
(h) profile photos, where provided;
(i) password and authentication information;
(j) session, browser, device and IP address data;
(k) subscription, plan and billing administration data;
(l) support messages and correspondence metadata;
(m) security logs, audit records and usage records;
(n) website and product analytics data;
(o) organisation, team and squad configuration data;
(p) player names;
(q) squad numbers;
(r) player positions;
(s) team or squad membership;
(t) video footage;
(u) images, thumbnails, frames and crops;
(v) tags, annotations, corrections and comments;
(w) clips, playlists, presentations, reports and exports;
(x) movement, tracking, speed, distance, acceleration, positioning and other sports analysis metrics, subject to the position described in section 11;
(y) model evaluation and improvement data, where applicable;
(z) technical metadata.

6.2

VectorPitch does not intend to collect payment card details directly. Where payment processing is enabled, payment information is expected to be processed by Stripe or another payment provider.

Section 7 — Sources of Personal Data

Where the data comes from: what you give us directly, what your organisation uploads, and what the service generates as you use it.

7.1

VectorPitch may collect personal data from:

(a) individuals who create an account, accept an invitation, complete a form, contact us or use the Service;
(b) customers who create organisations, invite users, upload footage, add player data, configure teams or manage workspaces;
(c) authorised users who tag, annotate, correct, comment, export, share or otherwise use Customer Content;
(d) uploaded footage and related analysis outputs;
(e) support, security, hosting, analytics, payment and infrastructure providers;
(f) business, legal, regulatory, public or professional sources where reasonably necessary for business administration, legal compliance, dispute handling, fraud prevention or security.

Section 8 — Purposes and Legal Bases of Processing

Why we process data and the legal basis for each. Legitimate interests is the basis we rely on where there's a genuine business reason that's proportionate and doesn't override your rights. Where a club instructs us to process footage, having a lawful basis for that is the club's responsibility.

8.1

VectorPitch processes personal data for the purposes and on the legal bases set out in Schedule A.

8.2

Where GDPR or UK GDPR applies, VectorPitch relies on one or more of the following legal bases:

(a) performance of a contract or steps taken before entering into a contract;
(b) compliance with legal obligations;
(c) legitimate interests pursued by VectorPitch, a customer or a third party, except where overridden by the interests, rights or freedoms of the data subject;
(d) consent, where required or appropriate;
(e) establishment, exercise or defence of legal claims, where applicable;
(f) other legal bases permitted under Applicable Data Protection Laws.

8.3

Where VectorPitch relies on legitimate interests, the relevant legitimate interests may include:

(a) providing, operating and improving the Service;
(b) managing customer and user accounts;
(c) securing the Service;
(d) preventing fraud, misuse, unauthorised access and abuse;
(e) supporting customers and users;
(f) improving sports analysis accuracy and reliability;
(g) evaluating and improving AI Features;
(h) developing, testing and improving product functionality;
(i) maintaining business, legal, tax, accounting and audit records;
(j) enforcing legal rights;
(k) protecting the rights, property and safety of VectorPitch, customers, users, data subjects and third parties.

8.4

Where VectorPitch relies on consent, the data subject may withdraw consent at any time, without affecting processing carried out before withdrawal.

8.5

Where VectorPitch processes Customer Personal Data as processor, the customer is normally responsible for determining the lawful basis for that processing.

8.6

Where an individual applies to become a Founding Analyst through the application form on the VectorPitch website:

(a) VectorPitch uses the application to assess it and to contact the applicant about the beta;
(b) the personal data collected is the name, role and email address entered in the form, together with anything else the applicant chooses to send, and the IP address and submission metadata recorded when the form is submitted;
(c) the legal bases are steps taken at the request of the data subject before entering into a contract, and VectorPitch's legitimate interests in running the Founding Analyst programme;
(d) submissions are received and stored on VectorPitch's behalf by Formspree, Inc. in the United States, as processor, under the transfer safeguards described in Schedule C;
(e) applications are held until the Founding Analyst programme closes, and unsuccessful applications are deleted at that point.

Section 9 — Customer Content and Customer-Controlled Processing

Footage and data uploaded by a customer sits under that customer's control. They're responsible for the rights, permissions, notices, consents and safeguarding measures behind it.

9.1

Customers may upload, create, store, analyse, export and share Customer Content through the Service.

9.2

Customer Content may include personal data relating to players, under-18 players, coaches, analysts, referees, opposition players, parents, guardians, spectators, staff and incidental individuals appearing in footage.

9.3

Customers are responsible for ensuring that they have all rights, permissions, notices, consents, lawful bases, safeguarding approvals, competition approvals, league permissions, broadcast rights and other authorisations required to upload, analyse, store, export and share Customer Content through the Service.

9.4

VectorPitch does not verify the customer's lawful basis, permissions, notices, consents, safeguarding approvals, broadcast rights or third-party rights in Customer Content.

9.5

Where VectorPitch processes Customer Personal Data as processor, VectorPitch processes that data on the customer's documented instructions and in accordance with the Data Processing Agreement.

Section 10 — Children and Young Players

Youth footage is common on VectorPitch. The club or academy uploading it is responsible for the lawful basis and safeguarding — parental consent or another basis, age-appropriate notices, and proper access controls before they start.

10.1

No person under the age of 18 may create a VectorPitch account.

10.2

The Service is not directed to children and VectorPitch does not knowingly permit children to create accounts.

10.3

Customer Content may include children or young players where customers use the Service for academies, schools, youth teams or similar programmes.

10.4

Where Customer Content includes children or young players, the customer is responsible for ensuring that the use of that content is lawful, fair, transparent, appropriate and properly safeguarded.

10.5

Customer responsibilities include, where applicable:

(a) parent or guardian notices, consents or authorisations;
(b) player notices;
(c) safeguarding controls;
(d) age-appropriate transparency measures;
(e) club, academy, school, university, league and competition requirements;
(f) access restrictions;
(g) external sharing restrictions;
(h) appropriate legal bases under Applicable Data Protection Laws.

10.6

VectorPitch does not provide accounts for players, parents or guardians at launch.

Section 11 — Special Category Data, Biometric Data and Health Data

Player tracking metrics are for sports analysis only. We don't build identity profiles or biometric templates, and our tracking outputs aren't biometric data under GDPR because we don't use them to uniquely identify anyone.

11.1

The Service is not designed or configured for health, injury, medical, wellness, biometric identification, biometric categorisation, emotion recognition or similar Special Category Data processing.

11.2

The Service may generate sports analysis outputs such as movement, speed, distance, acceleration, positioning and tracking metrics. These outputs are intended for sports analysis.

11.3

VectorPitch does not use movement, tracking, speed, distance, acceleration or positioning metrics to identify named individuals or create biometric templates for the purpose of uniquely identifying a person.

11.4

The Service is not designed or configured for biometric identification or biometric categorisation within the meaning of Article 4 GDPR. VectorPitch applies technical and organisational measures designed to reduce re-identification risk from these metrics.

11.5

If a customer uses the Service or outputs, alone or with other information, to identify or verify individuals, create biometric templates, infer health or injury information, conduct biometric categorisation or otherwise process Special Category Data, the customer is responsible for ensuring that it has a lawful basis and, where required, an Article 9 GDPR condition or equivalent legal basis.

11.6

Incidental appearance of characteristics that may be sensitive, such as a visible health condition, ethnic or racial origin, religious symbol or disability, in video footage does not mean VectorPitch processes that data as Special Category Data under Article 9 GDPR, where VectorPitch does not extract, analyse, store separately or act upon those characteristics.

11.7

If customer-configured use of the Service or downstream customer use of outputs reveals or acts upon a sensitive characteristic, the customer is responsible for ensuring that appropriate legal bases and safeguards apply to that downstream use.

Section 12 — AI Features and Automated Analysis

AI outputs are tools for coaches and analysts. They don't decide employment, contracts or eligibility on their own — there's no automated decision-making with legal effect — and human review is required before any high-stakes decision.

12.1

The Service may include AI Features that generate tags, tracking, events, confidence scores, analysis, reports or other outputs.

12.2

AI-generated or AI-assisted outputs may be incomplete, inaccurate, delayed, unsuitable for a particular purpose or affected by the quality and nature of input footage.

12.3

AI Features are provided for coaching, tactical analysis, video review and decision-support.

12.4

VectorPitch does not use AI Features to make decisions that produce legal effects or similarly significant effects concerning individuals.

12.5

Customers and users are responsible for reviewing, correcting and validating AI-generated outputs before relying on them.

12.6

Customers must not use AI-generated outputs as the sole basis for any High-Risk Use, including decisions relating to player health, injury, medical treatment, safeguarding, employment, discipline, player selection, contracts, scholarships, eligibility, player welfare or access to opportunities.

12.7

Where a customer uses the Service or outputs in a manner subject to Applicable AI Laws, the customer is responsible for compliance with its obligations as deployer, user, employer, education provider, club, academy, school, controller or other regulated person, as applicable.

Section 13 — Model Evaluation and Improvement

Whether your content is used to improve our models depends on your plan. Where it is, we use de-identified material rather than raw identifiable footage. We never train models to recognise people by name, and third-party AI providers can't use your content for their own models.

13.1

The base Service runs on pre-trained models. Customer-derived model improvement is used to improve accuracy on real-world sports footage, including amateur, academy and youth footage, varied camera angles, lower production quality video, different kits and different playing environments.

13.2

Customer-derived model improvement is not required for the base Service to function.

13.3

Depending on the applicable Subscription Plan and available controls, VectorPitch may use Customer Content and related outputs to evaluate, train, fine-tune and improve the Service, including automated tagging, tracking and sports analysis models.

13.4

Information about which Subscription Plans include model evaluation or improvement is set out in Schedule E of the AI and Model Improvement Notice. Where a customer's Subscription Plan includes this processing, VectorPitch will process De-identified Training Material as described in this section, subject to any controls exercised by the customer or applicable objection rights exercised under section 15.

13.5

Where Customer Content is used for model evaluation or improvement, VectorPitch does not retain raw identifiable video in the training corpus.

13.6

Model evaluation and improvement uses, or is intended to use, De-identified Training Material, including face-masked frames or crops, derived tracking data, tags, corrections, annotations and related outputs. Audio is removed and match, date and roster metadata is severed using commercially reasonable technical and organisational measures.

13.7

VectorPitch does not use Customer Content to train models to identify named individuals.

13.8

VectorPitch does not permit third-party AI providers to use Customer Content to train their own models.

13.9

Customer Content is not sent to OpenAI, Anthropic or similar third-party AI providers for model training.

13.10

Where third-party AI providers are used to provide inference, enrichment or other Service functionality, VectorPitch uses commercially reasonable measures to configure those services so that Customer Content is not used to train the provider's models.

13.11

VectorPitch does not use Customer Content in public demos, public marketing materials, case studies or public customer stories without the customer's prior agreement.

Section 14 — Lawful Basis for Model Evaluation and Improvement

We rely on legitimate interests for using de-identified training material to improve our models, not consent. You can object — see the next section.

14.1

Where GDPR applies and model evaluation or improvement involves personal data processed by VectorPitch as independent controller, VectorPitch's anticipated lawful basis is legitimate interests under Article 6(1)(f) GDPR.

14.2

VectorPitch's legitimate interests include:

(a) improving sports analysis accuracy;
(b) improving model performance on real-world non-professional and youth sports footage;
(c) reducing tagging, detection and tracking errors;
(d) improving reliability across varied cameras, kits, lighting conditions, pitch conditions and match environments;
(e) improving the safety, consistency and usefulness of AI Features;
(f) reducing customer correction burden;
(g) developing and maintaining a competitive, reliable and affordable sports analysis service.

14.3

VectorPitch considers this processing to be necessary for those legitimate interests because public or professional broadcast datasets do not adequately represent many customer environments, including amateur, academy, school, youth, semi-professional and varied camera environments.

14.4

VectorPitch applies safeguards designed to reduce the impact of this processing on individuals, including:

(a) face masking;
(b) audio removal;
(c) severance of match, date and roster metadata using commercially reasonable measures;
(d) use of De-identified Training Material rather than retained raw identifiable video in the training corpus;
(e) no model training to identify named individuals;
(f) no third-party provider model training on Customer Content;
(g) restricted access to model evaluation and improvement datasets;
(h) periodic review of de-identification measures;
(i) objection handling as described in this Privacy Notice;
(j) data protection impact assessment for model evaluation and improvement involving personal data.

14.5

VectorPitch has conducted or will conduct a legitimate interests assessment before relying on legitimate interests for model evaluation or improvement involving personal data.

14.6

VectorPitch has conducted or will conduct a data protection impact assessment under Article 35 GDPR in respect of model evaluation and improvement processing involving personal data. The outcome of that assessment informs the safeguards described in this section.

14.7

VectorPitch will not rely on legitimate interests where Applicable Data Protection Laws require consent or another lawful basis for the relevant processing.

14.8

Where the relevant material has been effectively anonymised so that individuals are not identified or identifiable by means reasonably likely to be used, data protection law may no longer apply to that anonymised material.

Section 15 — Model Improvement Exclusions and Objections

How to opt out: pick a plan that excludes model improvement, use the in-product setting where available, or contact us before your content is processed. Opting out stops future use; it doesn't require us to delete de-identified material already in the training set or retrain existing models.

15.1

Some Subscription Plans may include use of customer-derived material for model evaluation and improvement. Other Subscription Plans may provide a model improvement exclusion.

15.2

Where a customer requires exclusion from model evaluation or improvement involving Customer Content, the customer must:

(a) select a Subscription Plan that includes a model improvement exclusion;
(b) enable the applicable product control, if available; or
(c) notify VectorPitch at privacy@vectorpitch.com or support@vectorpitch.com, identifying the Customer Content to be excluded, before that Customer Content is processed by VectorPitch for model evaluation or improvement purposes.

15.3

Unless otherwise agreed, a model improvement exclusion applies prospectively only and does not require deletion of De-identified Training Material already created or retraining of models already developed, unless required by Applicable Data Protection Laws or the applicable Subscription Plan.

15.4

Where VectorPitch relies on legitimate interests, data subjects may have the right to object to processing of their personal data.

15.5

If an objection relates to Customer Content controlled by a customer, VectorPitch may need to involve the relevant customer to identify the relevant content and assess the request.

15.6

If the relevant material has been effectively anonymised so that individuals are not identified or identifiable by means reasonably likely to be used, rights such as erasure and objection may no longer apply to that anonymised material.

15.7

If a customer or data subject reasonably challenges whether specific De-identified Training Material has been effectively anonymised, VectorPitch will review the challenge in good faith.

15.8

While a challenge is being reviewed, VectorPitch will apply appropriate protective measures to the disputed material where reasonably practicable. These may include restricting further use, restricting access, reprocessing the material or applying additional de-identification measures.

15.9

VectorPitch will attempt to resolve any such challenge within 30 calendar days of receiving sufficient information to identify and assess the disputed material.

15.10

If VectorPitch determines, or is required by a competent supervisory authority or court to treat, specific De-identified Training Material as personal data, VectorPitch will take appropriate remedial steps in accordance with Applicable Data Protection Laws. Such steps may include deletion, further de-identification, restriction of processing, exclusion from future training datasets or other measures reasonably appropriate to the risk and legal requirement.

15.11

Nothing in this Privacy Notice requires VectorPitch to retrain models already developed using De-identified Training Material unless required by Applicable Data Protection Laws, a competent supervisory authority, a court or the applicable Subscription Plan.

Section 16 — Recipients and Categories of Recipients

Who else may see the data, and why. We don't sell it and we don't share it for advertising.

16.1

VectorPitch may disclose personal data to the following recipients or categories of recipients:

(a) customers and authorised users, according to customer configuration, user roles and permissions;
(b) cloud hosting, storage, compute, database, CDN, logging, security and transactional email providers;
(c) support, communication and business email providers;
(d) payment providers, where payment processing is enabled;
(e) analytics providers, where enabled;
(f) bot protection providers, where enabled;
(g) AI inference or enrichment providers, where enabled;
(h) professional advisers, auditors, insurers, investors, acquirers and business partners, where reasonably necessary;
(i) regulators, courts, law enforcement or public authorities, where required or permitted by law;
(j) third parties involved in corporate transactions, including merger, acquisition, financing, restructuring or sale of assets.

16.2

VectorPitch's current sub-processors and service providers are identified in the Sub-processor List at vectorpitch.com/legal/subprocessors.

16.3

VectorPitch does not sell personal data.

16.4

VectorPitch does not share personal data for targeted advertising.

16.5

VectorPitch does not use Customer Content in public demos, public marketing materials, case studies or public customer stories without the customer's prior agreement.

Section 17 — International Transfers

We're established in Ireland, and data may be processed outside Ireland, the EEA or the UK — production hosting is expected to include AWS infrastructure in the United States. Recognised safeguards apply to every such transfer.

17.1

VectorPitch is established in Ireland. Personal data may be processed outside Ireland, the EEA or the United Kingdom, including in the United States.

17.2

Current production hosting is expected to include Amazon Web Services infrastructure in the United States, including AWS US East, unless the Sub-processor List states otherwise.

17.3

VectorPitch implements appropriate safeguards for all transfers of personal data outside the European Economic Area, the United Kingdom or another country that benefits from an adequacy decision, in accordance with Chapter V GDPR and applicable data protection laws.

17.4

Such safeguards may include:

(a) adequacy decisions;
(b) the EU-US Data Privacy Framework, where the recipient is certified and the transfer is within the scope of that certification;
(c) the European Commission's Standard Contractual Clauses;
(d) the UK International Data Transfer Agreement or UK Addendum;
(e) transfer impact assessments;
(f) supplementary technical, contractual and organisational measures where required.

17.5

Further details are set out in the Data Processing Agreement and Sub-processor List.

Section 18 — Security

The technical and organisational measures we use to protect personal data. No system is completely secure, and managing your own users, roles, permissions and sharing settings stays with you.

18.1

VectorPitch implements technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

18.2

Such measures may include:

(a) role-based access controls;
(b) organisation, team and squad permissions;
(c) multi-factor authentication;
(d) logical tenant separation;
(e) private cloud storage;
(f) encryption in transit;
(g) encryption at rest where technically supported;
(h) web application firewall controls;
(i) logging and monitoring;
(j) threat detection and alerting;
(k) vulnerability management;
(l) security testing;
(m) backup and recovery measures;
(n) incident response procedures;
(o) restricted internal access;
(p) youth and academy access controls;
(q) de-identification measures for model evaluation and improvement datasets.

18.3

No system is completely secure. Customers are responsible for managing their own users, roles, permissions, sharing settings and credentials.

18.4

Security reports may be sent to security@vectorpitch.com.

Section 19 — Retention

How long we keep things. Deleted data may sit in encrypted backups for up to 90 days before it's permanently overwritten.

19.1

VectorPitch retains personal data for as long as necessary for the purposes described in this Privacy Notice, unless a longer period is required or permitted by law.

19.2

The applicable retention period depends on the nature of the data, the processing context, customer configuration, legal requirements, security requirements, business requirements and whether VectorPitch acts as controller or processor.

19.3

Typical retention periods are set out in Schedule B.

19.4

Deleted data remains in backup systems and is overwritten or deleted within 90 days.

19.5

Where VectorPitch retains data for legal, tax, accounting, dispute, security, fraud prevention or compliance purposes, access to that data will be limited to the relevant purpose.

19.6

Deletion of Customer Content from a customer workspace does not necessarily require deletion or retraining of models previously developed using De-identified Training Material, unless required by Applicable Data Protection Laws, a competent supervisory authority, a court or the applicable Subscription Plan. See also section 15.

Section 20 — Cookies and Similar Technologies

Cookies and local storage used by the website and service, including PostHog analytics on the marketing site. The Cookie Policy has the detail, including the specific keys set.

20.1

VectorPitch uses cookies and similar technologies to operate the website and Service.

20.2

These may include:

(a) strictly necessary cookies for login, security, session management and Service operation;
(b) cookies or similar technologies used for bot protection, where enabled;
(c) analytics technologies, where enabled;
(d) preference or functionality technologies, where enabled.

20.3

VectorPitch uses PostHog for product and web analytics on its marketing website, including event tracking, autocapture of clicks and page views, and session recording of on-page interactions with form inputs masked, together with capture of browser console logs and network request timings during recorded sessions. Data is hosted in the EU. This technology only runs after a visitor accepts the cookie consent banner, and consent can be withdrawn at any time.

20.4

VectorPitch does not use targeted advertising cookies.

20.5

Where consent is required for cookies or similar technologies, VectorPitch will seek consent in accordance with applicable cookie and electronic communications laws.

20.6

Further details are set out in the Cookie Policy.

Section 21 — Data Subject Rights

Your GDPR rights: access, correction, deletion, restriction, portability, objection, and complaint to a supervisory authority. Which apply depends on the legal basis and on whether we're acting as controller or processor.

21.1

Depending on the applicable law and the processing context, individuals may have rights to:

(a) access personal data;
(b) receive a copy of personal data;
(c) correct inaccurate personal data;
(d) request deletion of personal data;
(e) restrict processing;
(f) object to processing based on legitimate interests;
(g) object to direct marketing;
(h) withdraw consent where processing is based on consent;
(i) request portability of personal data;
(j) lodge a complaint with a supervisory authority;
(k) avoid certain solely automated decisions that produce legal or similarly significant effects, where applicable.

21.2

These rights may be limited where permitted by law, including where VectorPitch processes data as processor on behalf of a customer, where identity cannot be verified, where data has been anonymised, where legal retention applies, where a request affects the rights of others, or where another exemption applies.

Section 22 — Exercising Rights

Email privacy@vectorpitch.com to exercise your rights over your account or our own processing. We aim to respond within one month of having everything needed to act.

22.1

Requests relating to a VectorPitch account or VectorPitch controller processing should be sent to privacy@vectorpitch.com.

22.2

Requests relating to Customer Content uploaded by a club, academy, school, university, analyst, company or other customer should normally be directed to that customer first, because the customer is usually the controller for Customer Content.

22.3

Where VectorPitch receives a request relating to Customer Content and can reasonably identify the relevant customer, VectorPitch may notify the customer or direct the requester to the customer.

22.4

Where VectorPitch cannot reasonably identify the relevant customer, VectorPitch may request further information or provide a neutral response explaining that VectorPitch cannot identify or act on customer-controlled content without further details.

22.5

VectorPitch may need to verify the identity and authority of the person making the request before acting on it.

22.6

VectorPitch will respond to requests relating to VectorPitch controller processing without undue delay and in any event within one month of receiving the request and any information required to verify the requester's identity.

22.7

Where a request is complex or VectorPitch receives a number of requests, VectorPitch may extend the response period by a further two months. In that case, VectorPitch will inform the requester within one month of receipt of the request and explain the reason for the extension.

22.8

Where VectorPitch does not take action on a request, VectorPitch will inform the requester without undue delay and, where GDPR applies, within one month of receipt of the request, including the reasons for not taking action and information about complaint rights where required by law.

Section 23 — Complaints and Supervisory Authorities

You can raise a concern with us directly, or complain to a data protection authority. For Ireland and the EEA, our lead authority is expected to be the Irish Data Protection Commission.

23.1

Individuals may contact VectorPitch at privacy@vectorpitch.com with privacy concerns.

23.2

Individuals may also have the right to complain to a data protection supervisory authority.

23.3

For individuals in Ireland or the EEA, VectorPitch's lead supervisory authority is expected to be the Irish Data Protection Commission, unless another supervisory authority is competent in a particular case.

23.4

For individuals in the United Kingdom, the relevant supervisory authority may be the UK Information Commissioner's Office.

23.5

Individuals are not required to contact VectorPitch before contacting a supervisory authority.

Section 24 — United States Privacy Disclosures

For US residents: we don't sell personal information, don't share it for targeted advertising, and don't use sensitive information to infer characteristics for advertising.

24.1

VectorPitch does not sell personal information.

24.2

VectorPitch does not share personal information for targeted advertising.

24.3

VectorPitch does not use sensitive personal information to infer characteristics for targeted advertising.

24.4

VectorPitch does not knowingly allow children to create accounts.

24.5

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, or another US state privacy law applies, individuals may have rights to access, delete, correct or receive a copy of personal information, and to opt out of certain processing. The availability and scope of those rights depends on the applicable law, the nature of the data and whether VectorPitch acts as controller, business, processor or service provider in the relevant context.

24.6

Where VectorPitch processes Customer Content on behalf of a customer, VectorPitch normally acts as processor or service provider and will refer requests about that content to the relevant customer where appropriate.

24.7

Additional United States state privacy information is set out in Schedule E of this Notice.

Section 25 — Australia, New Zealand and Other Jurisdictions

Where local privacy law applies instead of or alongside GDPR, we comply with it. Requests about customer-uploaded content are referred to the customer.

25.1

VectorPitch may provide the Service to customers and users in Australia, New Zealand and other jurisdictions.

25.2

Where the Australian Privacy Act 1988, New Zealand Privacy Act 2020 or other local privacy laws apply, VectorPitch will process personal data in accordance with applicable legal requirements.

25.3

Where VectorPitch processes Customer Content on behalf of a customer, VectorPitch may need to refer privacy requests to that customer.

25.4

Additional jurisdiction-specific privacy information is set out in Schedule F of this Notice.

Section 26 — Changes to this Privacy Notice

We may update this notice. Material changes come with at least 30 days' advance notice, and continued use after the effective date counts as acknowledgement.

26.1

VectorPitch may update this Privacy Notice from time to time.

26.2

Where changes are material, VectorPitch will provide at least 30 days' advance notice through the Service, by email to registered account contacts, or by posting a notice on the VectorPitch website, unless a shorter period is required for legal, security, fraud prevention or urgent operational reasons.

26.3

Continued use of the Service following the effective date of a material change will constitute acknowledgement of the updated Privacy Notice, subject to any mandatory rights or requirements under Applicable Data Protection Laws.

26.4

If a change affects processing that requires consent, a new lawful basis, updated contractual terms or other affirmative action under Applicable Data Protection Laws, VectorPitch will take the steps required by law before the relevant processing begins.

Section 27 — Contact Details

How to reach us about privacy and security matters.

27.1

For privacy questions or requests: Vector Sport Solutions Limited, Email: privacy@vectorpitch.com.

27.2

For security matters: security@vectorpitch.com.

27.3

If VectorPitch appoints a Data Protection Officer, this section will be updated to include the relevant DPO contact details.

Schedule A — Controller Processing Purposes and Legal Bases

A clause-by-clause table of what we process as controller, why, and under which legal basis.

Purpose	Categories of personal data	Legal basis where GDPR applies
Account creation, authentication and access management	Account Data, authentication data, organisation data, role and permission data, technical metadata	Contract performance; legitimate interests in operating and securing the Service
Organisation setup and administration	Organisation data, admin contact data, roles, permissions, settings and audit logs	Contract performance; legitimate interests in administering customer organisations
Invitations and authorised user management	Names, email addresses, organisation identifiers, role and permission data	Contract performance; legitimate interests in enabling customer collaboration
Service provision and customer workspace operation	Customer Content, user activity, technical metadata, usage records	Where VectorPitch acts as processor, customer determines the legal basis; for VectorPitch controller administration, contract performance and legitimate interests
Support and troubleshooting	Contact details, support messages, account data, service metadata, logs and relevant Customer Content where needed	Contract performance; legitimate interests in supporting users and maintaining the Service
Security, abuse prevention and incident response	Account Data, IP addresses, device data, logs, audit records, security events and relevant Customer Content where needed	Legitimate interests; legal obligations where applicable
Upload and sharing confirmation audit trail	Upload and sharing confirmations, acceptance evidence, timestamps, user and organisation details, IP address, user agent, Subscription Plan and Model Improvement status	Legitimate interests in keeping a record of confirmations and acceptance evidence; establishment, exercise or defence of legal claims and compliance where applicable
Billing and subscription administration	Customer contact details, billing details, plan data, payment status, invoice data and tax records	Contract performance; legal obligations; legitimate interests in payment administration
Legal, tax, accounting and corporate compliance	Account data, billing records, correspondence, legal notices and audit records	Legal obligations; legitimate interests in governance, compliance and dispute management
Website operation	IP address, device data, browser data, cookie data, website usage data	Legitimate interests; consent where required by cookie or electronic communications laws
Website analytics	Website analytics data, usage data, device or browser data, where applicable	Legitimate interests; consent where required
Product analytics and service improvement	Usage data, feature usage, performance data, logs, metadata and aggregated or de-identified data	Legitimate interests in improving the Service
Communications	Names, email addresses, account status, organisation data and communication records	Contract performance; legitimate interests; consent where required for marketing
Founding Analyst applications made through the website (see section 8.6)	Name, role, email address, anything else the applicant chooses to send, IP address and submission metadata	Steps taken at the request of the data subject before entering into a contract; legitimate interests in running the Founding Analyst programme
Model evaluation and improvement	De-identified Training Material, selected frames or crops, derived tracking data, tags, corrections, annotations and related outputs	Legitimate interests in improving sports analysis model accuracy and reliability. VectorPitch has conducted or will conduct a legitimate interests assessment. You may object to this processing as described in section 15. A data protection impact assessment has been or will be conducted for model evaluation and improvement involving personal data.
Corporate transactions	Customer contact data, account data, contracts, billing data and business records	Legitimate interests in corporate transactions; legal obligations where applicable
Establishment, exercise or defence of legal claims	Relevant account data, Customer Content, correspondence, logs and records	Legitimate interests; legal claims basis where applicable

Schedule B — Retention Periods

How long each category of data is kept.

Data Category	Typical Retention Period
Account Data while active	While the account is active
Account Data after closure	Up to 7 years for legal, tax, accounting and compliance records; up to 12 months for operational records, unless a longer period is required for legal, dispute, security or fraud prevention purposes
Organisation and workspace records while active	While the organisation or workspace is active
Organisation and workspace records after closure	Up to 7 years for legal, tax, accounting and compliance records; up to 12 months for operational records, unless a longer period is required for legal, dispute, security or fraud prevention purposes
Customer Content	While the relevant account, organisation or Subscription Plan remains active, subject to deletion, export and retention rules
Post-cancellation export data	Normally available for 30 days after cancellation or expiry
Deleted production content	Removed from active use and scheduled for deletion from live production systems in accordance with the Terms and DPA
Backups	Overwritten or deleted within 90 days
Support emails	Up to 24 months
Founding Analyst applications	Until the Founding Analyst programme closes; unsuccessful applications are deleted at that point
Security logs	Up to 12 months, unless longer retention is required for security, fraud prevention, investigation, legal or compliance reasons
Product analytics and usage metadata	Up to 24 months or anonymised earlier where practical
Failed uploads	Normally deleted after 7 days
Failed processing job logs	Normally retained for 30 days
Billing, tax and accounting records	For applicable legal, accounting and tax retention periods
Legal and dispute records	For the period reasonably required for legal, limitation, dispute, insurance, compliance or enforcement purposes
Model improvement datasets	Retained while reasonably needed for model evaluation, training, testing, auditability and improvement, subject to review at least annually

Schedule C — International Transfers and Transfer Safeguards

Data may be handled outside your country, including in the US. Where it leaves the EU or UK, the law requires a recognised safeguard — these are the standard GDPR-approved routes we rely on.

C.1

Transfer locations. Personal data may be processed in Ireland, the EEA, the United Kingdom, the United States and other countries where VectorPitch or its service providers operate.

C.2

Current hosting position. Current production hosting is expected to include Amazon Web Services infrastructure in the United States, including AWS US East, unless the Sub-processor List states otherwise.

C.3

Transfer mechanisms. VectorPitch may rely on:

(a) adequacy decisions;
(b) the EU-US Data Privacy Framework, where the recipient is certified and the transfer is within the scope of that certification;
(c) the European Commission's Standard Contractual Clauses;
(d) the UK International Data Transfer Agreement or UK Addendum;
(e) transfer impact assessments;
(f) supplementary measures where required.

C.4

Transfer safeguards. Transfer safeguards may include:

(a) encryption in transit;
(b) encryption at rest where technically supported;
(c) access controls;
(d) role-based permissions;
(e) logical tenant separation;
(f) private cloud storage;
(g) web application firewall controls;
(h) logging and monitoring;
(i) contractual service provider and sub-processor controls;
(j) restrictions on third-party AI model training;
(k) de-identification measures for model evaluation and improvement datasets.

Schedule D — Recipients and Service Providers

The outside companies that help us run the service, with the live list linked. We never sell your data, never use it for ad targeting, and never hand footage to OpenAI or Anthropic for their model training.

D.1

Sub-processor List. An up-to-date list of sub-processors is maintained at vectorpitch.com/legal/subprocessors.

D.2

Current expected service provider categories. The Sub-processor List should identify live providers actually processing personal data for the Service. Expected provider categories include:

(a) cloud hosting, storage, compute, database, CDN, logging and security providers;
(b) business email and support communication providers;
(c) bot protection providers, where enabled;
(d) analytics providers, where enabled;
(e) AI inference or enrichment providers, where enabled;
(f) payment providers, once payment processing is enabled.

D.3

No targeted advertising sale or sharing. VectorPitch does not sell personal data or share personal data for targeted advertising.

D.4

Third-party AI model training. VectorPitch does not permit OpenAI, Anthropic or similar third-party AI providers to use Customer Content to train their own models.

Schedule E — United States State Privacy Information

Extra information required by individual US state privacy laws. Nothing applies beyond Section 24 at the moment.

E.1

Current position. No additional United States state privacy information currently applies beyond Section 24. VectorPitch will update this Schedule where a specific US state privacy law requires additional information.

Schedule F — Jurisdiction-Specific Privacy Information

Extra information required by the privacy laws of other countries. Nothing applies beyond Section 25 at the moment.

F.1

Current position. No additional jurisdiction-specific privacy information currently applies beyond Section 25. VectorPitch will update this Schedule where a specific law requires additional information.