1. Data Controller

OneClub is the data controller for personal data collected through this platform.

2. Data We Collect

We collect the data you provide when registering: name, email, phone and club information. We also collect usage and browsing data.

3. Purpose

We use your data to:

Provide the contracted service

Send service-related communications

Improve the platform

Comply with legal obligations

4. Legal Basis

Processing is based on contract performance, your consent and our legitimate interest.

5. Your Rights

You can exercise your rights of access, rectification, erasure, portability, restriction and objection by writing to privacy@oneclubapp.com.

6. Security

We implement technical and organizational security measures to protect your data, including 256-bit SSL/TLS encryption and secure storage on European servers.

7. Retention

We will retain your data while your account is active and for the legally required period.

8. Third Parties

We share data with providers necessary to deliver the service: Stripe (payments), AWS and MongoDB Atlas (hosting and infrastructure), Brevo (email delivery), Meta Platforms (advertising and campaign measurement), Google Analytics and Microsoft Clarity (site usage analytics) and Calendly (meeting scheduling). All act as processors or joint controllers under the GDPR.

9. Prospects: lead forms and marketing video

Beyond our customers' data, we process data about people who express interest in OneClub through our ads. This section explains that processing in detail.

9.1. What we collect, and from where

When you complete a form in a Meta ad (Facebook or Instagram), Meta passes us the details you provided: name, email, phone number, club name, number of players and your role at the club. We obtain nothing about you beyond what you typed into that form.

If you then open the page hosting our introductory video, we also record how you watch it: whether you press play, how many seconds you watch, where you pause or drop off, whether you return another day, whether you click to request a demo, plus your device type, browser and IP address.

9.2. This information is linked to you — it is not anonymous

To be explicit: the link you receive is personal, so **your video viewing is tied to the details you submitted in the form**. It is not aggregate analytics. It lets us know that a specific person, from a specific club, watched up to a given point.

We do this to prepare a more relevant sales conversation, and to avoid pressing people who clearly are not interested.

9.3. Identifiers stored on your device

To recognise your return visits we store two of our own identifiers in your browser (`oneclub_vsl_session` and `oneclub_vsl_attribution`) and, if you accept marketing cookies, those set by Meta (`_fbp` and `_fbc`). See our Cookie Policy for details.

9.4. Legal basis

**Sending the video and contacting you**: your consent, given when you submitted the ad form requesting that information.

**Measuring video engagement and sharing it with Meta**: your consent, collected through the cookie notice on the page. If you decline, we do not carry out that advertising measurement and share nothing with Meta.

**Subsequent sales follow-up**: our legitimate interest in approaching organisations that have requested information about our product, balanced against your right to object at any time.

9.5. What we share with Meta

If you accept marketing cookies, we send Meta your video engagement milestones through its Conversions API, including your email and phone number **irreversibly hashed** (SHA-256): Meta can check whether they match one of its users, but cannot recover your address or number from them. The purpose is to measure campaign performance and improve ad targeting. If you decline cookies, we send nothing.

9.6. How long we keep it

Detailed video engagement events are **deleted automatically after 180 days**.

Contact details and the interest summary are kept for a maximum of **24 months** from the last contact, unless you object or request erasure sooner, or the relationship becomes a contract (in which case section 7 applies).

9.7. How to stop it

Email privacidad@oneclubapp.com and we will erase your data and stop contacting you. You can also withdraw cookie consent at any time from the notice on the page, with immediate effect.

10. International transfers

Some of our providers are established outside the European Economic Area or may access data from third countries, in particular Meta Platforms, Google and Microsoft. These transfers rely on the EU-US Data Privacy Framework and, failing that, on the Standard Contractual Clauses approved by the European Commission.

Privacy Policy