Your data, and the club's.
What this website collects, why, who sees it and how long we keep it; how the club's records are handled in Scova Athlete, Squad Lab and Partners; and how to ask for a copy, a correction or deletion.
Who is responsible
Scova Labs is being registered as a limited company in Malta (Scova Labs Ltd). Its company number, registered office and VAT number will appear here once issued. Contact: contact page.
For this website and for our own sales and customer records, Scova Labs is the controller: we decide why and how the data is used. Inside a club's Scova account the club is the controller and we act for it (see section 05).
For anything about your data, use the Your data page. We are a small company and have not appointed a data protection officer, because the law does not require one for what we do; the founding team answers privacy requests directly.
What we collect, why, and for how long
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Contact form: name, club or organisation, work email, message; role and products if you add them | To reply, prepare a quote or walkthrough, and keep a record of the conversation | Steps you ask for before a contract (GDPR art. 6(1)(b)); our legitimate interest in answering business enquiries (art. 6(1)(f)) | 24 months after our last contact, unless your club becomes a customer and the contract says otherwise |
| NDA signing: the club or company, its registration number and address if given, your name, position, work email and typed signature, the time and IP address of acceptance and of confirmation | To make and prove the non-disclosure agreement before a walkthrough; the signed record is emailed to you and to us | Entering into and performing the agreement (art. 6(1)(b)); our legitimate interest in being able to prove it (art. 6(1)(f)) | Six years after the agreement's obligations end. If you never press the confirm link, nothing is kept: the details live only inside that link |
| Your data form: name, email, club if you add it, your request | To answer a privacy request or unsubscribe you | Legal obligation (art. 6(1)(c)) | 24 months after we close the request, to show we handled it |
| Server logs kept by our host: IP address, browser, time, page requested | To keep the site running and secure | Legitimate interest (art. 6(1)(f)) | A short period set by the host, usually days |
| Settings saved in your own browser | Theme, currency, demo counters | Not sent to us; see Cookies | Until you clear them |
We ask only for what we need to answer you. Please do not send health information, information about children, or anything confidential through the forms.
This site sets no cookies and runs no analytics, advertising, social media or tracking scripts. Fonts are served from our own domain, so your browser never contacts a font service.
If we contact you first
We sell to football clubs, so we sometimes write to people in club roles such as recruitment, medical or commercial. We use only work contact details that are published or offered for business use: club websites, league and federation directories, professional networking profiles and business contact databases (such as Apollo.io).
The legal basis is our legitimate interest in offering our products to clubs (art. 6(1)(f)). We keep your name, role, club, work email and our notes for up to 24 months after the last contact.
Every email we send carries an unsubscribe link. Once you use it, or tell us in any way, we stop within two working days and keep only your email address on a do-not-contact list so it stays that way. You can always object: see Your data.
How the club's records are handled
- Controller
- The club
- Processor
- Scova Labs, under contract
- Medical records
- Medical roles only
- Under-18 records
- Extra safeguards
- Staff devices
- No health data stored
- Scoring and models
- Run on our servers
When a club uses Scova Athlete, Squad Lab or Partners, the club decides what goes in and is the controller. Scova Labs processes those records only to run the club's account, under a data processing agreement (GDPR art. 28). The club's own privacy notice explains its legal basis to its players and staff.
Roles decide what each person sees
Every seat has a role. Coaches see availability and return dates; diagnoses and injury notes stay with the head of medical and physios. The club can narrow access further, and access is logged.
Web app, not a desktop copy
The products run in the browser. Medical, wellness and under-18 data is never saved to laptops or phones, so a lost device does not mean lost records.
If you are a player or member of staff
Ask your club first: it is the controller. If you write to us instead, we pass your request to the club within five working days and help it answer.
Children's data
This website and its forms are for adults (18 and over) who work in or with football clubs. We do not knowingly collect data from children through the site; if we learn we have, we delete it.
Academy players' records reach the products only when a club enters them, as part of the club's own duties. Scova never relies on a child's consent, or a parent's consent given online, as the legal basis for those records; the club relies on its own basis and safeguards, and under-18 records get extra access limits. Malta sets 13 as the age at which a child can consent to online services (GDPR art. 8), but our products are never offered to children directly.
Ask, correct, delete or object
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you (access and portability);
- correct it if it is wrong, or complete it;
- delete it, or limit how we use it;
- stop using it for our legitimate interests, and always stop marketing to you (objection).
Use the Your data page. It is free. We reply within one month; if a request is complex we may take up to two more months and will tell you why. We may ask you to confirm the request from the email address we hold, so we only ever give your data to you.
We make no decisions about you by automated means alone.
If you are unhappy with how we handled your data, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or the data protection authority where you live or work.
How we protect it
Every page and product is served only over HTTPS, and browsers are told never to fall back to an unencrypted connection. This site runs under a strict content security policy that blocks scripts from any other domain. Demos use fictional data only and run entirely in your browser.
If you find a security problem, please tell us through the contact page before sharing it anywhere else. We will reply and keep you informed while we fix it.
When this policy changes
We update this page when what we collect or who handles it changes, and change the date at the top. If a change matters for people we already hold data about, we tell them directly.