Privacy Policy

1. Controller

The controller is Concordia Sports Agency SIA (registration No. 40203574668, VAT No. LV40203574668), Krišjāņa Valdemāra iela 33A–4A, Rīga, LV-1010, Latvia (“Concordia”, “we”, “us”). Contact for privacy questions and requests: mail@concordia.football (subject “Privacy”).

2. What we collect

• Application: player’s name, date of birth, nationality and passports, country of residence, email and optional phone; for under-18s, the parent or guardian’s name, relationship, email and optional phone; football information (positions, foot, height, club, level, minutes, history, national-team experience, education/college details, contract status and end date, offers, whether the player has an agent), optional links (match footage, highlights, Transfermarkt, other profiles), goals and target countries, and your consent choices.
• Onboarding (after payment): the football profile and materials you send — CV, playing history, statistics, profile and video links, documents you upload (for example a CV or an existing representation agreement), representation status, objectives and target leagues; and, only if you choose to provide it with explicit consent, injury information relevant to the assessment.
• Assessment and service: our assessment, notes, communications with you, call scheduling, and (for European Pathway) your plan and progress.
• Payments: payer name and email, country of residence, buyer type, business name and VAT number if you buy as a business, consents given at checkout, and the payment details Stripe returns to us (payment status, amounts, billing country, card country, Stripe customer/payment identifiers, invoice references). Card numbers are entered on Stripe’s page; we never receive or store them.
• Technical: the country your request came from (derived by our hosting provider; we do not store your IP address in our records), and the storage described in our Cookie Policy.
• Attribution: campaign parameters (for example utm_source) that brought you to the site — kept across visits only if you accept optional storage.

3. Why we use it and our legal bases

• To review your application, provide the Pathway Assessment and European Pathway, and communicate with you about them — necessary to take steps at your request before entering into a contract and to perform the contract (GDPR Art. 6(1)(b)).
• To take and record payments, issue receipts/invoices, determine and document VAT treatment and keep accounting records — legal obligations under Latvian tax and accounting law (Art. 6(1)(c)).
• Injury information — only with your explicit consent (Art. 9(2)(a)), only for the assessment; you can withdraw consent at any time and we then delete it.
• For players under 18 — the parent or guardian’s consent to the application and their role as contracting party (Art. 6(1)(b) and, where relevant, Art. 8).
• Optional: sharing your application with Concordia Sports Agency (consent, Art. 6(1)(a)); marketing emails (consent); keeping campaign attribution across visits (consent).
• To keep the service secure, prevent misuse and handle disputes — our legitimate interests (Art. 6(1)(f)).

4. Who receives your data

We do not sell personal data and do not share player information with clubs. We use, or may use, these service providers (processors) under data-processing terms:

• Netlify, Inc. — website hosting, and private storage of the documents you upload (EU, Frankfurt region).
• Supabase, Inc. — our application and customer-relationship database (hosted in the data region selected for our project).
• Resend (Plus Five Five, Inc.) — sending our service emails.
• Stripe Payments Europe, Ltd. — payment processing (Stripe also acts as an independent controller for its own legal obligations, such as fraud prevention).
• Calendly LLC — booking the consultation call, if you use the booking link we send (you enter your details on Calendly’s page).
• Brevo (Sendinblue SAS, France) — marketing emails, only for people who opted in; we share only your email, first name and general segmentation details (for example country, age band, playing position and whether you are a customer) — never documents, health information, passports, assessment content or our notes.
• Our accountants and professional advisers where necessary, and authorities where the law requires.

Concordia Sports Agency (our parent business) sees your application only if you opted in.

5. International transfers

Some providers are based in the United States or may access data from there. Where personal data is transferred outside the EU/EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified providers) or the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Applications that are not accepted: 12 months after the decision (so we can recognise a re-application), then deleted.
• Customers: for as long as we provide the service, then for the periods required by Latvian accounting and tax law for payment and invoice records; other assessment data for up to 3 years after the service ends, for follow-up questions and legal claims.
• Injury information: deleted when the assessment is completed or when you withdraw consent, whichever is earlier.
• Marketing consent: until you withdraw it. After you unsubscribe we keep your email address on a suppression list, so that we never email you marketing again by mistake.

7. Players under 18

We offer assessments from age 16. For players under 18, the parent or legal guardian applies with the player, consents, is the contracting party and payer, and receives our communications. We collect only what is needed for the football assessment. See How we work with minors.

8. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests; you can withdraw consent at any time (without affecting earlier processing). Email us to exercise your rights. You may also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or the authority where you live.

8a. Marketing emails

Marketing emails are optional and separate from the emails we send to provide our services. We send them only if you ticked the optional, unticked-by-default box, and we record when you agreed, the wording you agreed to and the privacy-notice version.

For players aged 16–17, only the parent or guardian can agree to marketing, and only for their own email address; we do not send marketing to a minor’s address.

You can unsubscribe at any time with the link in every marketing email or by emailing us. Withdrawing marketing consent does not affect service emails about an application or purchase.

9. No automated decisions

Every application decision, materials-sufficiency decision and assessment is made by people. A rules-based hint may help our reviewers sort applications, but it never decides.

10. Security

Data is encrypted in transit. Only authorised team members can access our admin, with individual accounts and role-based permissions, and sensitive actions (such as opening documents, exporting or deleting data) are logged. Links to your status page are individually signed and can be revoked. Please keep your personal links private.