Privacy Policy

This notice describes how the personal data of users of the plabpro.com website, the P-LAB PRO web platform (the "reserved area" or "LAB") and the P-LAB PRO mobile app (together, the "Service") is processed, pursuant to Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

The data controller is Roberto Salterio, VAT no. IT04252300969, Via del Cavo 16, Motta Visconti (MI), Italy.

For any privacy-related matter you can write to: info@infoquidem.it.

2. What data we process

a) Account data

Upon registration we collect: display name, email address and password (the latter stored exclusively in encrypted form, never in plain text). We also record the date and time of your acceptance of the privacy notice, of the terms of use, and of any consent to commercial communications.

b) Billing data

If you request an invoice, we collect the fiscal data you enter in your profile: name/company name, address, tax code and/or VAT number, SDI code, PEC address. At the time of each payment this data is copied immutably (a "snapshot") onto the payment record, for correct fiscal documentation.

c) Website form data

The contact form collects name, email, subject and message; the "notify me of the next offer" form collects only your email address. This data is not stored in our database: it is forwarded by email to our support team and used solely to reply to your request.

d) Technical logs

For security purposes we log failed login attempts (the email entered and the IP address); these records are deleted upon the first successful login. We also keep a log of service emails sent (recipient, message type, subject, outcome), which is necessary to ensure communications work correctly (e.g. not sending the same reminder twice).

e) Platform usage data

The matches, tagged events, lineups, players and analyses you enter into the Service are professional data of which you remain the owner: we process them exclusively to provide you with the Service (storage, statistical processing, display). We do not use them for our own purposes nor disclose them to third parties.

With respect to this data — which may also concern minors, in the case of youth teams — we act as a data processor on your behalf pursuant to art. 28 GDPR. The full terms (instructions, security, sub-processors, fate of the data, your warranties as controller) are set out in Annex A to the Terms of use.

3. Purposes and legal bases

• Performance of a contract (art. 6.1.b GDPR): creation and management of the account, provision of the platform and the app, subscription management, support.
• Legal obligation (art. 6.1.c GDPR): invoicing and retention of accounting documents within the terms established by law.
• Legitimate interest (art. 6.1.f GDPR): security of the Service, prevention of unauthorised access (failed login attempt logs).
• Consent (art. 6.1.a GDPR): sending of commercial communications and product news, only if you ticked the optional box during registration. At present we only send service emails (confirmations, expiry reminders, contractual communications); marketing consent, if given, can be withdrawn at any time. Providing marketing consent is optional and its absence does not limit your use of the Service.

4. Mobile app

The P-LAB PRO mobile app (Android and iPadOS/iOS) uses the same credentials as the web account. The data of recorded matches is saved locally on the device (SQLite database) and synchronised exclusively with our servers over an encrypted HTTPS connection (api.plabpro.com). The app contains no trackers, no advertising and no third-party SDKs that collect personal data. The only transmission to an external provider takes place from our servers, and only when you request a Coach Assistant suggestion (point 5).

5. Data recipients

Personal data may be processed, on our behalf and to the extent necessary, by the following providers:

• Aruba S.p.A. — infrastructure hosting and delivery of service emails (SMTP), with datacenters located in Italy/European Union.
• Stripe — payment processing. Card data is entered and processed exclusively on Stripe's payment page and never transits through our servers: we only receive the payment outcome and the transaction identifiers. For the processing carried out by Stripe please refer to Stripe's privacy policy.
• OpenAI — provider of the artificial intelligence model powering the Coach Assistant. The feature is triggered only when you request it: at that moment we transmit to the provider the first name and surname of the players involved, the match events (type, minute, position on the pitch), the cards, the substitutions and the score. We do not transmit email addresses, photographs, account data or billing data. Data sent through the application programming interface (API) is not used to train the models and is retained by the provider for a limited period solely for security and abuse-prevention purposes. The service involves a transfer of data to the United States, supported by the European Commission's standard contractual clauses. With respect to the data of which you remain the owner (point 2.e), OpenAI acts as our sub-processor: see Annex A to the Terms.
• Google Ireland Ltd. — Google Analytics 4 measurement service, active only upon your prior consent given through the cookie banner (see the Cookie Policy). The service may involve a transfer of data to the United States, covered by the EU-US Data Privacy Framework.

We do not sell or disclose your personal data to third parties for their own purposes.

6. Retention periods

• Account data and platform usage data: for the entire duration of the relationship and up to 24 months after the last subscription expiry; before any removal you will receive an email notice. For the data of which you remain the owner (point 2.e), retention during this period takes place on your instruction — so that it becomes fully available again upon renewal — and you may at any time request its export or its early deletion.
• Billing data and accounting documents: 10 years, in compliance with statutory fiscal obligations.
• Failed login attempt logs: until the first successful login.
• Consents: kept with a timestamp for the entire life of the account, as evidence of acceptance.

7. Your rights

Pursuant to arts. 15-22 GDPR you have the right to obtain access to your data, rectification, erasure, restriction of processing, portability, as well as to object to the processing and to withdraw any consent given at any time (without affecting the lawfulness of processing carried out before the withdrawal).

To exercise your rights, write to info@infoquidem.it. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Minors

The Service is a professional tool: it is neither aimed at nor intended for children. We do not intentionally collect personal data of persons under 14, the age at which a minor can validly give consent in relation to information society services pursuant to art. 8 GDPR and art. 2-quinquies of Italian Legislative Decree 196/2003.

For the creation of an account, the Terms of use further presuppose legal capacity to contract (being at least 18 years old, or having the authorisation of the person holding parental responsibility or guardianship). If we are notified of — or otherwise become aware of — an account held by a minor lacking the necessary capacity or authorisation, we may suspend or remove it.

9. Changes to this notice

This notice may be updated, for example following changes to the Service or to the applicable legislation. Significant changes will be communicated through the website or by email; the date of the last update is shown at the top of this page.