Controller
This is the notice to data subjects (Articles 13 and 14 GDPR) and also explains how Nicoelsoft applies Regulation (EU) 2016/679 and Legislative Decree 196/2003 as amended. The controller is Nicoelsoft di Vito Nicola Scarciolla, Via Sandro Pertini 32, 35010 Vigonza (PD), Italy, VAT 05779090280.
To exercise your rights and for any question: privacy@nicoelsoft.com. We reply within one month, with any extension under Article 12 GDPR.
No data protection officer is appointed: the cases in Article 37 GDPR do not apply.
Data, purposes and legal bases
We do not sell personal data and we do not use it for third-party advertising or profiling. We may use your contact details (in particular the account email) to send you updates about new versions of the products and new applications of the Nicoelsoft brand. We do not take decisions based solely on automated processing that produce legal or similarly significant effects (Article 22 GDPR).
| Purpose | Data | Legal basis | Retention |
|---|
| Account, contract and support | First name, last name, email, password in protected form, preferred language | Contract (Article 6(1)(b)) | For the life of the account. After closure, for as long as the data are needed for a legal obligation or to establish, exercise or defend a claim. |
| Updates on versions and new Nicoelsoft applications | Email and, where useful, name and preferred language | Legitimate interest (point (f)): inform brand customers about new versions and new Nicoelsoft applications. You may object at any time (unsubscribe or email privacy@). | For the life of the account or until you object; then removal from mailing lists, unless other obligations apply. |
| Phone number | Phone, only if you provide it | Contract. The field is optional. | Same as account data. |
| Payment and billing | Email and billing details, sent to Stripe only if you start a payment. Nicoelsoft does not store the full card number. | Contract and legal obligation (point (c)) | Tax records are generally kept for ten years in Italy. |
| Security of the site and the service | IP address, user agent, date and time, technical logs | Legitimate interest (point (f)): protect systems and accounts and prevent abuse. We do not use these data to analyse browsing for statistics or marketing. | As a rule up to 12 months, then deletion, unless needed to document abuse or an incident. |
| Emails you send us | Address and message content | Contract, if the message concerns the service; otherwise legitimate interest in replying. | For as long as needed to handle the request and record the outcome. |
| Email verification, password reset and MFA code | Email and code, only while the code is valid | Contract and account security | For the validity of the code, then deletion. During MFA the password is not stored in the browser. |
| Proof of acceptance of terms, privacy notice and Article 28 appointment | Document versions, acceptance flags, authority declaration, IP, user agent, server timestamp | Contract and legitimate interest in proving the agreement and the processor appointment | For the duration of the contract and, afterwards, up to ten years to establish, exercise or defend a claim. |
| Sync of player photos and team logos | Images synced from the product (athlete/staff photos and logos) and related metadata needed for sync | Contract; Nicoelsoft acts as processor on behalf of the customer | For the duration of the service/account that uses sync, then deletion unless a legal obligation applies. Videos are not synced. |
| Site language | Language preference in the browser’s local storage | Technical tool necessary for the service you request | Until you change language or clear site data. |
| Interface after sign-in | Local copy of the profile (name, email, roles) in browser storage | Contract: personalise the reserved area | Deleted on logout or when the session is no longer active. |
Data you must provide
First name, last name, email and password are required to create the account and provide the service. Without them the account cannot be opened. Phone is not required. Billing details are required only if you buy a subscription. You can read the public pages without an account: the server still receives technical connection data, processed for security.
Recipients
Account, website and log data are processed on our behalf and on our instructions by these processors (Article 28 GDPR):
- Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, for hosting of the website, the API and backups. Hostinger privacy notice.
- Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, for service email (account verification, password reset, sign-in codes, replies). Microsoft privacy statement.
We do not disclose them for marketing. We may disclose data to authorities only where the law requires it.
Payments with Stripe
Subscriptions and purchases on the site are paid through Stripe (in the European Union mainly Stripe Payments Europe, Limited, Ireland). Data are disclosed to Stripe only if you start a payment (checkout): if there is no payment we do not send your data to Stripe or to other third parties for commercial purposes.
Stripe is:
- a processor (Article 28 GDPR) when it processes payment data on our behalf and on our instructions, to run checkout, charging and subscription management;
- an independent controller when it determines purposes and means itself, in particular for fraud prevention, anti-money-laundering and KYC obligations, legal compliance and platform security.
Card data are entered on Stripe’s infrastructure. For processing for which Stripe is an independent controller, Stripe’s privacy notice and data processing agreement apply.
App Store and Google Play
Video Analyst Live is distributed through the Apple App Store and Google Play. Apple and Google are independent controllers of the data they process as store operators (Apple or Google account, download, updates, store pages). That is not a disclosure of your Nicoelsoft account. Notices: Apple and Google.
Local videos and synced data
Analysis videos stay exclusively on the user’s computer (or device). They are not sent to the Nicoelsoft cloud, they are not stored on our servers, and Nicoelsoft does not take knowledge of them. On those videos there is no processing by Nicoelsoft: processing, if any, is by the customer on their own device.
With the server, if you use those features, player photos and team logos may be synced (and any related profile data linked to those images in the product). Of that data you (or the club you act for) are the controller; Nicoelsoft processes it as a processor under the Article 28 appointment accepted at registration and the documented instructions (sync, deletion, requests to privacy@nicoelsoft.com, end of the service).
The account is not directed at children and must be opened by someone who can enter the contract. If you sync photos of minor athletes, the legal basis is yours. At registration we ask for a declaration to that effect: Nicoelsoft does not perform age verification or biometric recognition of people in the photos; it does not process videos because it does not receive them.
The service is not designed for medical records or biometric identification.
Acceptance of terms, privacy notice and Article 28 appointment
At registration we collect separate acceptances of the terms, of this notice and of the processor appointment (for synced photos and logos), plus a declaration of authority (to act for yourself or for the controller/club) and a declaration on the legal basis for any minors in synced photos.
We keep: the version of each accepted document, acceptance flags, the authority declaration, IP address, user agent and server timestamp. The proof is kept for the duration of the contract and, afterwards, up to ten years for any rights or disputes. On account deletion there remain, where due, the acceptance log and an immutable timestamp of deletion of the operational data.
Your rights
You may request access, rectification, erasure, restriction, portability and objection to processing based on legitimate interest, including updates about versions and new Nicoelsoft applications (also via an unsubscribe link in the emails, if present). Write to privacy@nicoelsoft.com.
You may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the Member State where you live or work.
Cookies and browser storage
Nicoelsoft uses only technical cookies for access to the reserved area. We do not collect data to analyse browsing and we do not use profiling, advertising or marketing cookies. We do not ask for cookie consent and we do not offer a “management” panel because there are no choices to switch on: the technical tools remain necessary. The list is published here; we do not record a “read confirmation” of the cookie notice.
| Name | Type | Purpose | Duration |
|---|
__Host-auth_token | HttpOnly cookie | Session for access to the reserved area. | 14 days |
|---|
__Host-auth_present | Cookie | Only indicates that sign-in is active. | 14 days |
|---|
__Host-mfa_pending | HttpOnly cookie | Links the MFA code to the check in progress, without storing the password in the browser. | 10 minutes |
|---|
nicoelsoft_lang | Local storage | Remembers the selected language. | Until you change language or clear site data |
|---|
nicoelsoft_user | Local storage | Copy of the profile for the interface after sign-in. | Until logout or the end of the session |
|---|
If you start a payment, Stripe may set cookies on its own domain: they are not Nicoelsoft cookies and Stripe’s notice applies.
International transfers
Stripe, Apple, Google and Microsoft may transfer data outside the European Economic Area under an adequacy decision (Article 45 GDPR), including under the EU-US Data Privacy Framework where applicable, or under standard contractual clauses (Article 46). Hostinger is established in the European Union (Cyprus). Its notice indicates that data may also be processed in Lithuania, the Netherlands, the United Kingdom and, where necessary, in other countries with GDPR safeguards. We do not transfer data abroad for marketing.
Retention, deletion and anonymisation
Processing for which Nicoelsoft is controller (account, billing, security logs, acceptance proof, technical browser storage): purposes, means and periods are those in this notice and in the table above. They are not “according to the user’s instructions”, except for the rights in Articles 15–22.
Processing for which Nicoelsoft is processor (player photos and team logos synced with the server): retention and deletion follow the documented instructions in the Article 28 appointment and in the product features (sync, removal, account/service closure, requests to privacy@). As a rule that data is deleted at the end of the service, unless a legal obligation applies. Videos stay only on the user’s device and are not retained by Nicoelsoft.
Deletion means removal of personal data from operational systems and, within ordinary cycles, from backups.
Anonymisation is not the same as deletion. We use it only in these cases, after a legitimate-interest assessment and with a dedicated entry in the record of processing activities (and a DPIA if the risk so requires):
- aggregate service metrics (for example subscription or usage counts over time) after account closure, when identifiers and data that allow identification of the person are removed irreversibly;
- any technical platform statistics with no reference to an identifiable data subject.
Tax records are not anonymised: they are kept for the statutory period and then deleted. Security logs, once the period ends, are deleted, not anonymised, unless needed to document an incident already under way.
Security and breaches
We adopt technical and organisational measures appropriate to the risk (Article 32 GDPR), including:
- HTTPS/TLS transport on the site and the API;
__Host-* session cookies with HttpOnly, Secure and SameSite flags where applicable;- multi-factor authentication (email code) when required;
- passwords stored in protected form (hash), not in clear text;
- account separation and access control to the reserved area;
- hosting and backups with the processor Hostinger;
- technical logging to detect and document abuse;
- staff and persons authorised to process data bound by confidentiality as far as their role requires.
In the event of a personal data breach, where the conditions are met we notify the Garante within 72 hours of becoming aware of it (Article 33) and, if the risk to data subjects is high, we inform them (Article 34). If the breach concerns content of which you are controller, we communicate it to you without undue delay as provided in the Article 28 appointment.
Impact assessment
We have assessed the processing in light of Article 35 GDPR. A data protection impact assessment (DPIA) was found necessary, and is updated when risks or means change, for:
- processing, as processor, of player photos synced with the server (images that may concern athletes, including minors) in the context of the service.
Analysis videos are not subject to a DPIA by Nicoelsoft because they are neither transmitted nor stored on our systems. For team logos (as a rule data relating to legal persons or distinctive signs) and for security logs and anonymisation of aggregate metrics only, we have documented assessments in the record of processing activities (LIA where applicable). If prior consultation of the Garante is required (Article 36), we carry it out.
Changes
We may update this notice. The date and version at the top of the page show the latest revision. Material changes are communicated on the site or by email if we have a valid contact. A new acceptance at registration or a renewal requested in the product may update the proof of accepted versions.
Contact
Privacy: privacy@nicoelsoft.com
Legal: legal@nicoelsoft.com
Processor appointment for synced photos and logos: dpa.html
