Privacy policy — CC Athletics

CC Athletics ApS makes measuring equipment for sport (PlateMate, GroinMate, CableMate and more), the ForceMate measurement app and ForceMate Cloud. This policy explains what personal data we process, why, on what legal basis, and what rights you have.

Who is responsible for your data

CC Athletics ApS CVR no. 40545867 Grønløkkevej 6H, 5000 Odense C, Denmark Email: [email protected]

Write to us at the address above about anything in this policy, including requests to use your rights. We have not appointed a data protection officer.

Two roles: our own data, and data we process for organisations

We have two different roles, depending on whose data it is.

We are the data controller for data about our website visitors, customers, newsletter subscribers and people who create their own ForceMate account (owners) — for example account details, enquiries, orders and support conversations. We are also the controller for our record of which version of our Terms of Service an adult user has accepted, and for enforcing those terms. This policy describes that processing.
We are a data processor for the data that an organisation stores in ForceMate Cloud: athlete profiles and measurements, patients it imports from Cliniko, the accounts of the coaches and athletes it invites, bug reports sent from the apps, and automatic error monitoring and security logs in the apps. An organisation is the workspace an owner creates in ForceMate Cloud — typically a club, academy, university, clinic or municipality, but it can also be a single coach or a parent. The organisation decides which athletes are registered and what is stored about them, and it is the controller of that data. We only process it on the organisation’s behalf and on its instructions, under a data processing agreement. We do not use it for our own purposes.

If you are an athlete or coach in an organisation and want to see, correct or delete your data, contact that organisation (for example your club). If you contact us, we pass your request on to the organisation.

How ForceMate stores data

Locally. Measurements taken in the ForceMate measurement app can be saved on your own computer, and exported as Excel or CSV files. We do not receive data you only store locally.
In ForceMate Cloud. If you log in to your ForceMate Cloud account in the measurement app, you can upload measurements to an organisation you belong to. They are then stored in our cloud service in the EU, and the organisation’s members can see them according to their role.

Importing patients from Cliniko

Organisations that use Cliniko for practice management can connect their Cliniko account to ForceMate Cloud and import patients as athletes, so they don’t have to type them in again.

Only the patients the organisation picks. An owner or coach searches the organisation’s Cliniko patients by name and chooses who to import. The search results show name and sex, and are not stored.
Only name, sex and Cliniko patient ID. For each imported patient we store these, plus who imported the patient and when. The Cliniko patient ID stops the same patient being imported twice, and lets Cliniko’s “Open in ForceMate” button find the right athlete. Dates of birth, contact details, notes, appointments and everything else in Cliniko stay in Cliniko.
Read-only. ForceMate Cloud never sends data to Cliniko or changes anything there.
The Cliniko API key. To connect, an owner enters an API key from their own Cliniko login. We check it with Cliniko, then store it encrypted, together with the name of the Cliniko user it belongs to. It is never shown again, and it is deleted when the organisation disconnects Cliniko. ForceMate’s requests to Cliniko go to the Cliniko servers that host the organisation’s Cliniko account.
Roles. The organisation is the controller of the imported data, as for all its data in ForceMate Cloud, and we process it on its behalf under our data processing agreement. Cliniko, run by Red Guava Pty Ltd, is the organisation’s own provider, chosen and contracted by the organisation. It is not one of our sub-processors.

ForceMate Cloud has three roles: owner, coach and athlete. Accounts are for adults only. Anyone aged 18 or older can create an account and become the owner of their own organisation. Coaches and athletes can only join an organisation when an owner invites them.

What we process, why, and our legal basis

Purpose	Personal data	Legal basis (GDPR)
Your ForceMate account, if you created it yourself (owner, 18 or older)	Name, email address, password (stored only as a hash by our hosting provider), role, organisation memberships, language and display settings, which version of the terms you accepted and when	Art. 6(1)(b) — performing our contract with you
Running ForceMate Cloud for organisations	Athlete profiles and measurements, and the accounts of coaches and athletes the organisation has invited. If the organisation connects Cliniko: name, sex and Cliniko patient ID of the patients it imports, and the name of the Cliniko user whose API key it entered, see Importing patients from Cliniko	We act as processor for the organisation, see above
Enquiries, quotes and demo bookings	Name, email, phone, company, country, your message, the products you are interested in, and the time you booked	Art. 6(1)(b) — steps at your request before a contract; Art. 6(1)(f) — our legitimate interest in answering and following up on enquiries
Orders, delivery, invoicing and warranty	Name, company, addresses, contact details, order and payment details	Art. 6(1)(b) — contract; Art. 6(1)(c) — bookkeeping obligations
Customer support	What you tell us, and technical details needed to solve the problem	Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interest in helping users
Bug reports you send from the ForceMate apps	Your description, name and email, and a screenshot of the screen (which may show athlete data visible at the time)	We act as processor for the organisation, to fix the fault you report
Accepting our Terms of Service, if you were invited by an organisation	Which version of the terms you accepted and when	Art. 6(1)(b) — performing our contract with you; Art. 6(1)(f) — enforcing the terms
Automatic error monitoring and security logs in the ForceMate apps	Error messages, stack traces, technical device information and a technical user ID. No session recordings or screenshots, and no IP address	We act as processor for the organisation, to operate, secure and fix the platform
Usage statistics	Aggregated technical figures such as the number of tests, device types, app versions and operating systems. No names or measurement values	We act as processor for the organisations, to operate and support the service
Protecting stolen devices	If a device we have marked as stolen is used: the user’s ID, name, email, organisation, IP address and approximate location	Art. 6(1)(f) — legitimate interest in recovering stolen property. We contact the organisation before marking its device as stolen
Newsletter	Name and email address	Art. 6(1)(a) — consent, which you can withdraw at any time via the link in every newsletter
Website analytics and advertising	See Cookies	Art. 6(1)(a) — consent via the cookie banner
Legal claims and compliance	The data relevant to the case	Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — establishing or defending legal claims

Where we rely on legitimate interest, you can object at any time, see Your rights.

We do not sell personal data, and we do not use automated decision-making, including profiling, that has legal or similarly significant effects for you.

Children and young athletes

ForceMate’s measuring devices can be used by athletes from the age of 8, under the supervision of a trained professional. Young athletes are normally registered by their club or another organisation, or by a parent.

Creating your own account. You must be at least 18 to create a ForceMate Cloud account yourself, because creating an account makes you the owner of an organisation and means accepting agreements on its behalf. You confirm your age when you sign up.
Athletes registered by an organisation. An organisation can register athletes of any age as athlete profiles. A child does not need an account or an email address for this. The organisation is the controller of that data. It decides what is registered and is responsible for having a legal basis, including consent from the holder of parental responsibility where the law requires it, and for informing children and parents in a way they understand.
No logins for under-18s. Organisations may only invite people aged 18 or older to log in. Athletes under 18 are registered as athlete profiles without a login, so no email address or password is created for them. The organisation can share their results with them and their parents, for example as a PDF report.
Parents. If you want to know what is registered about your child, or want it corrected or deleted, contact the organisation that registered your child. You are also welcome to contact us and we will help you reach the right organisation.

If we learn that someone under 18 has an account, we will suspend it. If they were invited by an organisation, we tell the organisation, which can turn them into an athlete profile without a login. If they created their own organisation, we contact them, and if an adult, for example a parent or coach, does not take over ownership within 30 days, we delete the organisation and its data. Apart from this, we do not delete athlete data that an organisation has registered — only the organisation can decide that.

If you are a young athlete

Your club or team uses ForceMate to save your test results, so your coaches can follow how you develop. Your club decides what is saved about you. We store it safely for them in Europe, and we do not use it for anything else, sell it, or show it to anyone outside your club. You don’t have your own login, but your coach can show you your results. If you want to see what is saved, or want something changed or deleted, ask your coach or your parents to talk to the club. You can also write to us at [email protected], and we will help.

We use service providers (processors) that only process personal data on our instructions and under a data processing agreement.

The ForceMate platform, which holds account and athlete data, runs on these providers:

Provider	What for	Where the data is stored
Google Cloud EMEA Ltd (Google Cloud / Firebase)	Hosting ForceMate Cloud: login, database, file storage, server functions, and encryption keys for stored Cliniko API keys (Cloud Key Management Service)	EU — Belgium (europe-west1) and Google’s EU multi-region. Login data (name, email address and password hash): Google’s global infrastructure, including the USA
Google Ireland Ltd (Google Workspace)	Email, including invitations and system emails sent by ForceMate	Google’s global infrastructure
Functional Software, Inc. (Sentry)	Error monitoring and bug reports from the ForceMate apps	EU — Germany (Frankfurt). Sentry is a US company, see Transfers

For the rest of our business we use providers in these categories: customer relationship management and newsletter, meeting booking, accounting and invoicing, payment, cookie consent, and shipping. They receive contact, enquiry and order details as needed for their task, but no athlete or performance data from ForceMate.

We also share data with:

Google and Meta, if you accept advertising cookies, see Cookies.
Public authorities, when the law requires it.
A buyer or successor, if all or part of our business is sold or transferred. We will tell you first.

Transfers outside the EU/EEA

We store ForceMate Cloud data in the EU, with one exception: login data (name, email address and password hash) is handled by Google’s login service, which may process it outside the EU, including in the USA. Sentry, which stores error and bug reports in Germany, is a US company. Some of our other providers belong to groups with companies outside the EU/EEA, mainly in the USA, so data may also be accessed from or transferred there for support and security, and by Google and Meta for advertising when you have consented.

Transfers to the USA are based on the EU-US Data Privacy Framework where the recipient is certified, as Google and Sentry are, with the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) in the provider’s data processing terms as fallback. Transfers to other countries outside the EU/EEA are based on the standard contractual clauses. Transfers to the UK are covered by the Commission’s adequacy decision for the UK. Write to us for a copy of the relevant safeguards.

How long we keep data

ForceMate account data is kept until you delete your account. Coaches and athletes can delete their account themselves in the app’s settings. An owner must first delete their organisation or hand ownership to someone else. Measurements and athlete profiles belong to the organisation and stay there when a member’s account is deleted.
Organisation data (athletes and measurements) is kept until the organisation deletes it, or until the organisation’s use of ForceMate ends. We then delete it as agreed in our data processing agreement with the organisation.
Backups and file versions. We back up ForceMate Cloud in the EU every day (database) and every week (files). Deleted or changed data stays in backups and previous file versions for up to 90 days, so it can be restored after an accident, and is then permanently deleted.
Enquiries and customer records are kept while they are relevant to our relationship with you, for example a customer relationship, an open quote or a conversation we may pick up again. You can ask us to delete them at any time, and we will, unless we must keep them (for example invoices, see below).
Accounting records (orders and invoices) are kept for 5 years from the end of the financial year, as required by the Danish Bookkeeping Act.
Error reports and bug reports (including screenshots) are kept by Sentry for 90 days and then deleted automatically.
Cliniko API keys are deleted when the organisation disconnects Cliniko. Imported athletes, and the record of which Cliniko patient each came from, are organisation data, see above.
Newsletter data is kept until you unsubscribe.

Security

ForceMate Cloud data is encrypted in transit (TLS) and at rest. Each organisation’s data is kept separate, and access is checked on our servers, so a user can only see data in the organisations they belong to, according to their role. Cliniko API keys are encrypted with a separate key held in Google Cloud Key Management Service in the EU (Belgium), and only our server functions can decrypt them; no user of the app can read a stored key. Only employees who need access for their work have it, and they are bound by confidentiality.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict our processing;
data portability — receive your data in a machine-readable format;
object to processing based on our legitimate interest, and always to direct marketing;
withdraw your consent at any time, without affecting processing that took place before.

Write to us at [email protected] to use your rights. We answer within one month. For athlete data that an organisation has registered, see Two roles.

Complaints. You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk, or to the data protection authority in the EU/EEA country where you live or work. We would appreciate the chance to sort things out with you first.

Cookies

We use cookies and similar technologies for functionality, analytics, and marketing. Analytics and advertising cookies are only set if you accept them in the cookie banner. You can review and change your choices at any time through the cookie settings on this site, or control cookies through your browser settings.

Analytics: Google Analytics, to understand how the site is used.
Advertising: Google Ads and the Meta Pixel, to measure and improve our ads. If you accept advertising cookies and arrived via an ad, the ad’s click identifier is saved with any enquiry you send us, so we can see which ads lead to enquiries. Meta and we are jointly responsible for collecting this data through the Meta Pixel.
Embedded videos use YouTube’s privacy-enhanced mode and only load when you choose to play them.

The table below lists the cookies this site uses, grouped by purpose. It is generated and kept up to date automatically by our consent tool (CookieYes).

Changes to this policy

We update this policy when our processing changes. The date at the top shows when it was last changed. We will tell account holders about significant changes by email or in the app.