Privacy Policy

1. Who we are

Tactico Limited ("tactico", "tactico sport", "we", "us", "our") provides:

• the tactico platform (sports team management and intelligence), and
• the tactico.ai marketing website

(together, the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you interact with our website and when you use our platform. We are committed to protecting your privacy, keeping your data secure, and ensuring compliance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and other applicable laws.

We are established in the UK and act as:

• Data Controller for website usage, accounts, billing, support and our own marketing; and
• Data Processor for player/club data you input into the platform (the club/coach is the Data Controller for that data).

We're registered with the ICO in the UK, under ICO registration number: ZB997673.

2. Information we collect

Personal Information

• Coach and Club Staff Information: name, email, phone number, role, login credentials, and club association.
• Contact Details: name, email address, phone number — when you register for marketing purposes, join our waitlist or newsletter, request a demo, or create an account.
• Player Information (entered by coaches/clubs): name, date of birth, playing position, kit sizes, other preferences, emergency contacts, medical information (special category), performance data.
• Club & Team Data: fixtures, match results, training sessions, attendance, performance statistics, and related records.

Automatically collected information

• Usage data: how you interact with our Services (pages/screens visited, features used, timestamps).
• Device information: IP address, browser type, operating system, device identifiers.
• Cookies & tracking technologies: used on our website and platform to enhance functionality, analyse usage and support marketing activities. You can manage cookies via your browser settings and our cookie controls.

Important note on children's data

• We do not collect personal data directly from children.
• Player information, including data relating to children, is entered and controlled by coaches and clubs.
• Clubs and coaches are responsible for ensuring they have obtained appropriate parental or guardian consent before submitting youth player data.

3. How we use your information (and lawful bases)

We use information to:

• Provide, operate and improve the Services (contract; legitimate interests).
• Manage teams, rosters, schedules and player information (contract; legitimate interests).
• Track matches, training and performance (contract; legitimate interests).
• Communicate important team or account updates (contract; legal obligation).
• Respond to demo requests, enquiries and marketing opt-ins (consent; legitimate interests).
• Personalise and improve the website and platform experience (legitimate interests).
• Detect, prevent and address technical issues, misuse or fraud (legitimate interests; legal obligation).
• Comply with legal and regulatory obligations (legal obligation).

Special category data (medical): processed only where the club/coach (as Controller) has a valid condition under UK GDPR Article 9 (typically explicit consent or relevant safeguarding/health grounds). We act as Processor for this player data and follow the Controller's documented instructions.

4. Marketing communications (PECR)

If you opt in (e.g., waitlist/newsletter) or request information, we may send you marketing emails about tactico products, updates and offers.

You can unsubscribe anytime via the link in our emails or by emailing privacy@tactico.ai.

We do not share your marketing data with third parties for their own use.

5. Information sharing

We do not sell, trade or rent personal information. We may share information only:

• With your explicit consent or at your direction.
• With trusted service providers (e.g., hosting, analytics, email delivery, error logging, support) under GDPR-compliant data processing agreements.
• To comply with legal obligations or enforce our terms.
• To protect our rights, safety, or the safety of others.
• In the event of a merger, acquisition, or corporate restructuring (you will be notified).

6. Data security

We implement appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure or destruction, including encryption in transit, access controls, least-privilege, secure hosting, monitoring and regular backups. No method is 100% secure, but we work to reduce risk and will notify relevant Controllers and regulators/individuals as required by law in the event of a personal data breach.

7. Data retention

We retain personal data only as long as necessary for the purposes set out in this policy or as required by law. Typical periods include:

• Account & billing: life of account + 6 years (tax/audit).
• Support tickets: up to 24 months after closure.
• Team/player data (as Processor): per the club/coach's instructions; usually for the duration of team membership plus two years, unless earlier deletion is requested.
• Marketing and waitlist sign-ups: until you withdraw consent or we detect prolonged inactivity.

8. Children's privacy (platform use)

• The platform is administered by adult coaches, club staff and clubs.
• We process children's personal data on behalf of clubs/coaches and do not use it for our own marketing or profiling.
• Clubs/coaches must ensure valid consent/authority for youth data and keep it accurate and up to date.
• Clubs/coaches are solely responsible for ensuring compliance with applicable child data protection laws, including obtaining valid parental/guardian consent.

9. International data transfers

Where data is transferred outside the UK or EEA, we use adequacy decisions or Standard Contractual Clauses (plus the UK Addendum where applicable) and implement additional safeguards where needed. We disclose regions in our sub-processor list.

10. Automated decision-making and AI

We use analytics and AI-powered features to generate insights and recommendations. These features do not produce solely automated decisions with legal or similarly significant effects on individuals. Coaches and clubs remain in control of decisions. If this changes, we'll update this notice and explain your rights.

You can find out more about our AI use in our AI Transparency Policy.

11. Your rights (UK GDPR)

You have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data.
• Portability — request transfer of your data to another provider.
• Objection — object to certain processing, including direct marketing.
• Restriction — request restriction of processing in certain circumstances.

To exercise these rights, please contact privacy@tactico.ai. We may need to verify your identity before fulfilling requests and aim to respond within one month.

You can also contact the ICO: ico.org.uk.

12. Cookies

We use necessary, functional, analytics and marketing cookies/SDKs. You can manage preferences via our cookie controls and your browser settings.

See our Cookie Policy for details.

13. Controller–Processor details

• For website, accounts, billing, support and our marketing, Tactico Limited is the Controller.
• For club/player data entered into the platform, the club/coach is the Controller and Tactico Limited is the Processor.

We offer a Data Processing Addendum (DPA) detailing our security measures and sub-processor transparency.

14. Changes to this policy

We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated "Last Updated" date. Where appropriate, we will notify you directly (e.g., by email or in-app notification).