HandIQ Privacy Policy

Version 1.0, in force from 6 October 2026.

This is a translation provided for information. The French version of this policy is the binding one; in the event of any discrepancy, the French text prevails, subject to any mandatory provision to the contrary applicable to you.

This policy explains what personal data HandIQ processes, why, on what legal basis, for how long, with whom it is shared and how to exercise your rights. It applies to the HandIQ application (iOS, Android and web), to the handiq.eu website and to the emails sent from them.

In short

• HandIQ shows no advertising, sells no data and uses no advertising tracker. Website traffic is measured without cookies, using a tool we host ourselves (point 3.11); the application itself contains no audience measurement.
• The data is hosted in the European Union (Ireland).
• Player data belongs to the club. HandIQ processes it solely on the club's behalf, and player photographs never leave your phone.
• You can delete your account at any time from the application: Settings › My profile › Delete my account.

1. Who is responsible for your data?

The publisher of HandIQ: Kamel Boudif, sole trader (entrepreneur individuel), micro-enterprise, SIREN 828 640 052, resident at 15 boulevard de Verdun, B61, 59000 Lille, France. Referred to below as "HandIQ" or "we".

Contact for any question about your data: support@handiq.eu, by post to the address above, or by telephone on +33 (0)7 62 47 92 43.

Data protection officer: HandIQ has not appointed an officer, as that appointment is not mandatory given its activity. Requests are handled personally by Kamel Boudif.

2. Two different roles depending on the data

For player data, the controller is therefore the club. A player, or a parent, who wishes to exercise their rights should first contact their club. HandIQ helps the club to respond and passes on to the club any request received directly. HandIQ's commitments to clubs are set out in the Data Processing Agreement (Annex 1 of the Terms).

3. Data processed, purposes, legal bases and retention periods

3.1. Creating and managing your account

• Data: first name and surname, email address, telephone number and country dialling code, application language, password, club(s) and role (administrator or coach), assigned team, creation and update dates. The password is stored in hashed form by the authentication service: no one at HandIQ can read it.
• Purpose: to allow you to create and use your account, join a club and collaborate with other coaches.
• Legal basis: performance of the contract, that is, the Terms (Article 6(1)(b) of the GDPR).
• Mandatory nature: name, email address, telephone number and password are necessary to create the account. The telephone number allows support to reach you in the event of a request concerning a club.
• Retention: for as long as your account exists. You may delete it at any time; deletion is immediate and permanent. An account with no activity for two years is deleted, after a warning sent by email at least 30 days beforehand. Opening the application or logging in is enough to keep it. By way of exception, the account of the administrator of a club still used by other coaches is retained, so as not to delete a club in service.

3.2. Security of the account and of the service

• Data: one-time verification code sent by email, session tokens, technical connection logs (IP address, date and time, device type).
• Purposes: to verify your email address, secure access, prevent abuse and fraud, diagnose incidents.
• Legal basis: HandIQ's legitimate interest in ensuring the security of the service (Article 6(1)(f) of the GDPR) and performance of the contract.
• Retention: the verification code expires after 15 minutes and can be used only once; technical logs are kept for 7 days at the host, then deleted.

3.3. Club, invitations and access requests

• Data:
  • club: name, country, any link to the federation catalogue;
  • invitations: first name, surname, email address, optional telephone number and team of the invited person, entered by the club administrator;
  • requests for access to a club already present on HandIQ: type of request ("administrator" or "coach"), telephone number, optional message, date and outcome.
• Purposes: to operate the club and its roles, to allow the administrator to invite coaches, and to verify the legitimacy of a request for access to or a claim over a club.
• Specific recipients:
  • an "administrator" request is passed to HandIQ support, with the contact details of the club's current administrator in order to verify the situation;
  • a "coach" request is passed to the club administrator, with your name, your email address and your telephone number. Their contact details are never disclosed to you.
• Legal basis: performance of the contract, and the legitimate interest of HandIQ and of clubs in ensuring that a club is administered only by an authorised person.
• Retention:
  • an invitation that is not accepted expires after 14 days and is then deleted; an invitation that is accepted or withdrawn is deleted 30 days later;
  • an access request is deleted 12 months after it is handled or cancelled, or 12 months after it is created if it has never been handled.
• Invited person: if someone invited you or asked to join your club, your contact details were provided by that person. The invitation email informs you of this and refers to this policy (Article 14 of the GDPR).

3.4. Club data (HandIQ as processor)

• Data:
  • players: first name, surname, shirt number, position, goalkeeper status, teams, optional date of birth;
  • matches: opponent, date, competition, score, actions tracked live and linked to the shirt number, match sheet;
  • teams, set plays and defensive systems.
• Player photographs and club logo: these remain solely on the device where they were taken or chosen. They are never sent to the HandIQ servers.
• Purpose: to provide the club with the tracking, analysis and sharing of its matches among its coaches.
• Legal basis: determined by the club, as controller; in principle its legitimate interest in organising its sporting activity.
• Minors: many players are minors. The data is entered by the club's staff, never by the players themselves. It is for the club to inform families, and HandIQ provides it with a template notice. HandIQ does not use this data for any other purpose, draws no commercial profile from it and discloses it to no other club.
• Retention: for as long as the club exists. After the club is deleted by its administrator, the data is destroyed 30 days later. After a transfer of the club not followed by a takeover, it is destroyed 6 months later.

3.5. Service emails

• Data: email address, first name, language, club name and information specific to the message.
• Messages concerned: verification code, forgotten password, invitation, removal from a club, transfer of a club, reminders before a club is deleted, confirmation of the deletion of a club or of an account.
• Purpose: to inform you of events concerning your account and your club.
• Legal basis: performance of the contract. These messages are not promotional and cannot be switched off for as long as the account exists.
• Retention: the sending queue is cleared 30 days after dispatch.

3.6. Fair-play report sent to the opposing team

• Recipient's data: email address entered by a coach, name of their team, date and score of the match. The report contains no player name and no individual statistic.
• Purpose: to send the fair-play report at the request of the sending club. The message also briefly introduces HandIQ.
• Legal basis: the sending club's legitimate interest in sharing this sporting report, and HandIQ's legitimate interest in making its service known. The message states the identity of the sending club and offers a simple means of refusing any further message. The address is never reused for another message without the consent of its holder.
• Retention: the address is kept for 30 days, then deleted. All that remains is a fingerprint encrypted with a secret key (HMAC), which does not allow the address to be recovered and serves solely to prevent the same report from being sent twice. A person who has refused further messages is entered in an objection list in the same fingerprint form, so that their refusal is respected.

3.7. Feedback, ratings and support

• Data:
  • message, type of feedback (problem, display, idea, etc.) and any rating;
  • screen concerned;
  • technical information: application version, update identifier, channel, platform, system version, screen size, language, role in the club;
  • up to three screenshots;
  • if you choose, the log of the match in progress;
  • your name and your email address, so that we can reply to you.
• Screenshots: they may show player names. They are rebuilt on our servers, which removes their metadata, including any GPS location. They are used only for support.
• Purposes: to answer your requests, correct faults and improve the application.
• Legal basis: HandIQ's legitimate interest in providing support and improving the service. Sending feedback is optional.
• Retention: 12 months after the feedback is received, and at the latest when your account is deleted. Screenshots are deleted at the same time as the feedback.
• Rating request: the application may offer you the chance to rate HandIQ after a match, at most once every 30 days. The date of the last request is recorded solely on your device.

3.8. Application updates

• Data: the device's operating system, the HandIQ project identifier and a random installation identifier, transmitted to the update service. No device identifier and no data from your account is transmitted.
• Purpose: to download fixes and new versions of the application.
• Legal basis: HandIQ's legitimate interest in keeping the application up to date and secure.

3.9. Federation catalogue

The catalogue of clubs, teams, fixtures, results and logos comes from public federation sources. It concerns clubs and teams, not individuals.

3.10. Pilot club request (handiq.eu website)

• Data: club name, country, your name, your email address, your telephone number (optional), the devices your club will use (iPhone, Android or both), an optional message and the language of the site at the time of the request. To this is added a fingerprint of your IP address: the address itself is never recorded, only a fingerprint computed with a secret key, and it does not allow you to be traced back.
• Purposes: to handle your request, get back to you and send you the installation links matching your devices. The IP address fingerprint serves only to limit the number of requests submitted from the same device and to filter out automated submissions.
• Legal bases: pre-contractual steps taken at your request (Article 6(1)(b) of the GDPR); for the IP address fingerprint, HandIQ's legitimate interest in protecting its form from automated submissions (Article 6(1)(f)).
• Mandatory nature: the club name, the country, your name, your email address and the choice of devices are necessary to handle the request. The telephone number and the message are optional.
• Recipients: HandIQ support. The notification message is delivered by Sendinblue (Brevo).
• Retention: 12 months after the request is handled, or 12 months after it is submitted if it is never handled.
• No acknowledgement is sent to the address you enter: the confirmation appears on the page. We write to that address only to answer your request.

3.11. Audience measurement on the handiq.eu website

• Data: pages viewed, date and time, the page or search engine you came from, device type, browser and language, country derived from a truncated IP address. The IP address is never recorded in full.
• Purpose: to know how many people visit the site, where they come from and which pages are useful to them.
• Tool: Matomo, which we host ourselves. No data is passed to a third party, no cookie is set, no tracking across sites takes place, and your browser's "do not track" signal is respected.
• Legal basis: HandIQ's legitimate interest in measuring traffic to its site. This measurement meets the conditions set by the CNIL for exemption from consent; you may nevertheless opt out at the bottom of this page.
• Retention: 13 months.
• The mobile application contains no audience measurement.

3.12. Legal obligations and defence of rights

HandIQ may retain certain data beyond the periods indicated, in restricted-access archiving. This is the case where a legal obligation requires it, in order to respond to a request from an authority, or in order to establish, exercise or defend its rights in court, within the limits of the applicable limitation periods.

4. Data stored on your device

The application stores locally on your device:

• a copy of your club's data, so that it works without a connection;
• your session;
• your preferences.

The handiq.eu website, for its part, remembers in your browser the language you chose and the fact that you dismissed the suggestion to change it. Nothing else.

These records are strictly necessary for the operation of the service, or correspond to a preference you expressed: they do not require consent (Article 82 of the French Data Protection Act). HandIQ uses no cookie or tracker for advertising or social networks, neither in the application nor on the website. Protect your device with a lock code. Deleting your account also erases the application's local data.

5. Recipients and providers

Your data is accessible only to those who need it:

• to the members of your club, according to their role;
• to authorised persons at HandIQ, for support and maintenance;
• to the providers below, who act on HandIQ's instructions and are bound by a data processing agreement;
• where applicable, to authorities that request it within the framework of the law.

Apple (App Store) and Google (Google Play) distribute the application and process the data linked to your account on their platform as separate controllers, in accordance with their own policies. HandIQ receives from them no data that allows you to be identified.

HandIQ does not sell, rent or exchange any personal data.

6. Transfers outside the European Union

Your data is hosted in the European Union. Limited transfers may nevertheless take place:

• Supabase Pte. Ltd., a company incorporated in Singapore, may access the data from Singapore or other countries in order to provide the service. That transfer is governed by the standard contractual clauses adopted by the European Commission;
• 650 Industries, Inc. (Expo), in the United States, receives the technical update information described in point 3.8. It states that it complies with the EU–US Data Privacy Framework, which benefits from an adequacy decision of the European Commission of 10 July 2023.

You may obtain a copy of these safeguards by writing to support@handiq.eu.

7. Security

HandIQ implements technical and organisational measures appropriate to the risks:

• encryption of exchanges (TLS) and encryption of data stored at the host;
• separation of data by club: each user accesses only the clubs of which they are a member;
• hashed passwords;
• verification of the email address by code;
• administration keys server-side only;
• cleaning of images received by support;
• restricted internal access.

In the event of a data breach presenting a risk to your rights, HandIQ notifies the CNIL within 72 hours. Where the risk is high, the persons concerned are also informed.

8. Your rights

In accordance with the GDPR and the French Data Protection Act, you have the following rights over your data:

How to exercise your rights. Write to support@handiq.eu from your account's address, or by post to the address given in point 1. HandIQ replies within one month. That period may be extended by two months for a complex request; you are then informed. If there is reasonable doubt about your identity, proportionate proof may be requested.

Players and parents. For data entered by a club, contact the club. HandIQ passes on to the club any request received directly and helps it to respond.

Complaint. If you consider that your rights are not being respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

9. Minors

The HandIQ account is reserved for persons aged at least 16. A user aged 16 or 17 must have the consent of a holder of parental authority. Minor players have no account: their data is entered by their club's staff (point 3.4).

10. Automated analysis

Statistics, indicators and analysis messages are calculated automatically from the matches tracked. They are training aids. No decision producing legal effects or significantly affecting you is taken solely on the basis of automated processing, within the meaning of Article 22 of the GDPR.

11. Changes to this policy

HandIQ may amend this policy to take account of changes in the service or in regulations. Any significant change is announced to you by email and in the application before it takes effect. The date of the version in force appears at the head of the document.