1What we collect, and nothing else
If you fill in the contact form we collect what you type, plus three things the request carries with it. That is the whole table below, and there is nothing more.
The form holds no identifier for you and no IP address. The site only counts, anonymously, how many people visit it (visits, page views, country, device type, referring page) with Vercel Web Analytics: no cookies, no reconstruction of your journey, and no link between those numbers and the form. It uses no advertising tools, builds no profiles and does not follow you across other sites.
| Data | What it is for | Legal basis |
|---|
| Full name | Knowing who we are talking to | Art. 6(1)(b) — pre-contractual steps |
|---|
| E-mail address | Replying to you | Art. 6(1)(b) |
|---|
| Club or organisation (optional) | Understanding which squad we are talking about | Art. 6(1)(b) |
|---|
| Role | Preparing an answer that fits your job | Art. 6(1)(b) |
|---|
| Mobile number (optional) | Calling you back, if you leave it | Art. 6(1)(b) |
|---|
| Reason for the request (demo or contact) | Understanding what you need | Art. 6(1)(b) |
|---|
| Message | Answering the question you actually asked | Art. 6(1)(b) |
|---|
| Language of the site you wrote from | Replying in your language | Art. 6(1)(b) |
|---|
| Page you wrote from | Knowing which part of the site raises questions | Art. 6(1)(f) — legitimate interest |
|---|
| Date and time | Answering in order and applying the retention limits | Art. 6(1)(b) |
|---|
| Consent to updates (optional) | Remembering whether you allowed us to send you MarkerDrift updates, and since when | Art. 6(1)(a) — consent |
|---|
2If you open an account
Whoever opens an account for their own organisation, and whoever receives one from their administrator, gives us further data. For this data we are the controller: it is the data of the RELATIONSHIP with the customer, not the athletes’ data — for those the club is the controller, as the section “Athlete data does not pass through here” says.
Billing details — address, VAT number, payment method — are collected by Paddle, which resells the service on our behalf and issues the invoice: they do not pass through us and we do not keep them. To Paddle we pass only what is needed to link the payment to the organisation: the buyer’s name and e-mail and the organisation’s identifier. What stays with us about the subscription is the plan, the period, the status and the identifiers we use to ask Paddle what happened.
None of this serves to profile anyone: we build no profiles of staff users and we do not measure their productivity. The activity log exists to reconstruct who accessed what, or how an error happened, not to assess the people who work.
| Data | What it is for | Legal basis |
|---|
| Full name | Knowing who is using the software, and signing their actions in the log | Art. 6(1)(b) — performance of the contract |
|---|
| E-mail address | Sign-in, password recovery, communications about the contract | Art. 6(1)(b) |
|---|
| Password | Protecting access. It is stored only as a hash and is readable by no one, ourselves included | Art. 6(1)(b), and Art. 32 for the measure |
|---|
| Role and access level | Deciding what each person sees, health data included | Art. 6(1)(b) |
|---|
| Organisation and team | Keeping different customers’ data apart | Art. 6(1)(b) |
|---|
| Screen preferences (language, theme, palette, tiles) | Finding the software as you left it | Art. 6(1)(b) |
|---|
| Documents accepted and optional consent to updates: which document, which version, its hash, with which e-mail, in which language and when | Proving what was accepted and what you consented to | Art. 6(1)(b), and Art. 6(1)(c) for the proof of consent |
|---|
| Activity log: who entered or changed an item of data, and who opened health data, consents or exports | Reconstructing who accessed what, or how an error happened | Art. 6(1)(c) — obligations under Arts. 5(2) and 32 |
|---|
| Technical sign-in data: date of the last sign-in and, while the session stays open, IP address and browser | Keeping the session open and protecting the account | Art. 6(1)(b), and Art. 32 for the measure |
|---|
| Subscription: plan, period, status and the identifiers held at Paddle | Running the subscription and the invoices | Art. 6(1)(b) |
|---|
3Why we process it
To answer your request and, if you ask for one, to show you a demo of the software: these are pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
If you open an account, the data serves to perform the contract (Art. 6(1)(b)) and to meet the security and record-keeping obligations (Art. 6(1)(c)): the purpose and legal basis of each item are in the table above.
Only if you tick the dedicated box do we occasionally send you MarkerDrift updates (news and new features): the legal basis is your consent (Art. 6(1)(a)), separate from the request and freely given — the request is sent whether you give it or not. You can withdraw it at any time, using the unsubscribe link in every message or by writing to us: withdrawal does not affect the lawfulness of earlier messages. If you do not tick the box, you receive no marketing at all.
Providing the data is your choice, but without the items the form and the sign-up ask for as required we cannot answer your request or open the account. No decision about you is taken by automated means (Art. 22 GDPR).
4How long we keep it
We delete your request twenty-four months after it arrives, and with it the copy received by e-mail. If you gave us consent to updates, we keep it until you withdraw that consent: when you do, we delete it.
A staff account stays active until the end of the relationship and for the 60 read-only days that follow, which are there for the handover and for exporting the data. Then it is deactivated automatically, and 90 days later its data is deleted together with the organisation’s, on the date that clause 11 of the Data processing agreement sets for the club’s data, with notice given by e-mail at least 14 days before. An operator who leaves the team before then is removed by the customer’s administrator, from the software, whenever they want. If a sign-up never reaches payment, the account and the organisation delete themselves after seven days, with a reminder first. The activity log is kept for twenty-four months at most, and the club may choose fewer: beyond that, a log no longer helps reconstruct an incident and becomes an archive of personal data in its own right. The register of acceptances is kept for as long as the agreement it certifies can be relied on. Invoices are issued and kept by Paddle, for as long as tax law requires; the subscription data that stays with us is deleted together with the organisation.
5Who we share it with
The data passes through suppliers acting as processors, on our instructions and under an agreement required by Art. 28 GDPR.
Paddle is the exception, and it has to be said: it resells the service on our behalf and issues the invoice, so for the sale it is an independent controller and applies its own privacy notice. We do not receive payment details.
We do not sell your data and we do not pass it to third parties for marketing.
| Supplier | What it does | Where the data sits |
|---|
| Supabase Pte. Ltd. (Singapore) | Stores requests and account data (database and authentication) | Database in Ireland; technical staff may access it from third countries, under the standard contractual clauses |
|---|
| Vercel Inc. (United States) | Runs the site and the software, receives the form and counts visits anonymously | Application in Dublin (Ireland); the company also processes data in the United States, under the EU-U.S. Data Privacy Framework and the standard contractual clauses |
|---|
| Resend — Plus Five Five, Inc. (United States) | Tells us by e-mail that a request has arrived, and sends account e-mails | United States, under the EU-U.S. Data Privacy Framework and the standard contractual clauses |
|---|
| Paddle.com Market Limited (United Kingdom) | Collects the payment and issues the invoice: for the sale it is an independent controller | United Kingdom, which the European Commission recognises as adequate; for onward transfers outside the United Kingdom and the European Economic Area, the standard contractual clauses |
|---|
| IONOS SE (Germany) | Hosts the support mailboxes: the e-mails you write to us, our replies and the alerts of requests sent through the form | European Union |
|---|
6Where it is kept
Your request is stored in a database on servers located in the European Union (Ireland). A copy reaches us by e-mail: it goes through Resend, which keeps it in the United States, and ends up in the support mailboxes, hosted by IONOS in the European Union, where the messages you write to us directly also stay.
The application that receives the form runs in the Dublin (Ireland) region. The public pages of the site, which contain nothing of yours, are delivered from the node closest to whoever opens them, and that node may sit outside the Union.
As on any website, whoever delivers the pages sees the IP address the visit comes from: without it, they could not deliver them. We do not record it and we do not attach it to your request. When you sign in to the software, the authentication service keeps it with the session for as long as the session stays open (see “If you open an account”).
Some data does leave the European Union, and we say so supplier by supplier. Paddle collects the payment details, which we do not receive, and processes them in the United Kingdom, which the European Commission recognises as adequate. Resend keeps in the United States the e-mails that tell us about requests and those we send to accounts. Supabase keeps the data in Ireland and Vercel runs the application there, but they are companies based outside the Union (Singapore and the United States): their technical staff may access the data from third countries, and Vercel also processes some data in the United States. Every transfer is covered by the safeguards of Chapter V of the GDPR: the adequacy decision for the United Kingdom; the European Commission’s standard contractual clauses for the other suppliers and for Paddle’s onward transfers; plus the EU-U.S. Data Privacy Framework for Vercel and Resend, which are certified under it.
7Your rights
You can ask to access your data, correct it, erase it, restrict its processing, object to processing, and receive it in a machine-readable format (Arts. 15–22 GDPR).
To exercise them write to support@markerdrift.com: we reply within one month.
If you believe the processing breaches the regulation you may lodge a complaint with the supervisory authority of the country where you live, work or where the alleged infringement took place. In Italy that is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it, protocollo@gpdp.it.
8Athlete data does not pass through here
Inside MarkerDrift a club processes data about its own athletes, including health data. In that processing the club is the controller: it decides what to collect, on which legal basis, and for how long.
We process that data as a processor, on the club’s instructions and within the limits of the data processing agreement required by Art. 28 GDPR. That document is separate from this notice and is accepted by the customer before any data is uploaded.
9Who processes your data
Controller: Lorenzo Vitale (CPSS, CSCS), Italian VAT number 01344880867.
For any question about this notice, or to exercise your rights, write to support@markerdrift.com.