Privacy policy
This policy explains how personal data is processed in InsightsLab, the player performance platform published by DataMatchLab at insightslab.datamatchlab.com. It is intended for players, their parents or legal guardians, club staff members, and anyone who contacts us to request a demo.
Last updated: 5 October 2026.
1. Who we are and what our role is
InsightsLab is published by ObiMi Developments SRL (trading as DataMatchLab), a Belgian private limited company with its registered office at Clos des Coquinettes 7, 1440 Wauthier-Braine, Belgium, registered with the Crossroads Bank for Enterprises under number 0743.984.753 (RLE Walloon Brabant). Contact: contact@datamatchlab.com.
The GDPR distinguishes between two roles, and DataMatchLab plays a different one depending on the data involved.
The club is the controller for its players’ and staff’s data
Each club using InsightsLab decides which data it records about its players and staff, for what purpose and for how long. The club is therefore the controller. DataMatchLab acts as a processor within the meaning of Article 28 GDPR: we host and process this data solely on the club’s behalf, following its instructions and under a data processing agreement signed with it.
If you are a player, a parent or a staff member, your first point of contact for any question about your data is your club.
DataMatchLab is the controller for its own purposes
DataMatchLab is the controller only for:
- demo and meeting requests sent through our public booking form (prospects);
- the security logs that protect the platform;
- audience measurement with Google Analytics, only if you have accepted it;
- product usage events, analysed to improve the application;
- managing our relationship with client clubs (contracts, invoicing, support).
Anonymised data, only on the club’s instruction
Where a club has given an express instruction to that effect in its data processing agreement with DataMatchLab, DataMatchLab may produce, from certain sporting and performance data (GPS and sensor measurements, excluding heart rate and calories; playing time; session type; position; level and age band; numerical results of virtual reality exercises), anonymised data. Where the anonymisation process results in data that no longer allow a person to be identified, directly or indirectly, by means reasonably likely to be used, those data no longer constitute personal data within the meaning of the GDPR. DataMatchLab may then retain them, including after the end of the club’s contract, to improve InsightsLab’s indicators, references and algorithms. Identification data, photos, videos, comments and health data are never concerned. Without the club’s instruction, no anonymisation is carried out for this purpose.
DataMatchLab has not designated a data protection officer. For any question about your data, write to contact@datamatchlab.com.
2. What data is processed?
Players (including minors)
Clubs use InsightsLab for all their age groups, including youth teams (U12 to U21). Depending on what the club chooses to record, the data may include:
- Identity: first name, last name, email address, phone number, date of birth, nationality, profile photo;
- Physical data: height, weight, strong foot, shoe size, clothing size;
- Sporting data: club, team, position, level, ranking, goals, technical and tactical comments, objectives;
- Performance: match statistics, video highlights, loads measured by GPS or sensors (distance, sprints, speed);
- Health data (special category, Article 9 GDPR): injury descriptions, wellness questionnaires (hours of sleep, muscle soreness, mood, rating of perceived exertion or RPE), average and maximum heart rate, calories burned, staff notes that may relate to medical follow-up;
- Cognitive data from virtual reality exercises: scan rate, decision quality, game awareness. These are sports performance measures, not health data;
- Derived indicators: load or fatigue alerts, performance scores.
Staff members (coaches, analysts, administrators)
Identity, email address, role, club, date of last login.
Technical data (all users)
- session cookie, IP address and browser (user agent) at login;
- security logs (IP address, email entered, browser, requested page);
- notification subscriptions, if you turn them on (technical delivery address, device, browser);
- product usage events (pages and features used), to improve the application.
Prospects (demo request form)
Contact name, email address, phone number, club name and address.
Source of the data
The data processed in InsightsLab may be provided directly by the user, entered by authorised people at their club, generated through use of the platform, or imported from the sports tools and providers used by the club. For processing carried out on a club’s behalf, the club determines which data sources are used.
3. Why is this data processed and on what legal basis?
| Processing | Purpose | Controller | Legal basis |
|---|---|---|---|
| Player monitoring | Tracking players’ performance, training load, development and availability; preparing sessions and matches | The club | Determined by the club — usually performance of the player’s contract or licence, or the club’s legitimate interest |
| Health and wellness data | Preventing injuries, adjusting load, managing return to play | The club | A condition under Article 9(2) GDPR determined by the club according to the context, including, where appropriate, the explicit consent of the data subject |
| Photos and videos | Video analysis of match actions, player identification | The club | Determined by the club — consent or legitimate interest depending on the use |
| Staff accounts | Giving each person access to the platform according to their role | The club | Determined by the club — generally its legitimate interest in organising and securing access to its professional tools, or any other applicable basis determined by the club |
| Platform security | Detecting intrusion attempts, preventing abuse, investigating incidents | DataMatchLab | Legitimate interest (securing the service) and security obligation (Article 32) |
| Product improvement | Analysing which pages and features are used in order to develop the application | DataMatchLab | Legitimate interest (improving the service) |
| Audience measurement | Understanding how the site is used in order to improve it (Google Analytics 4) | DataMatchLab | Consent, collected through the cookie banner |
| Demo requests | Answering your request, arranging the meeting, commercial follow-up | DataMatchLab | Pre-contractual steps taken at your request; legitimate interest for follow-up |
| Client club management | Contracts, invoicing, support, service emails | DataMatchLab | Performance of the contract; legal obligations (accounting) |
InsightsLab does not make any automated decision producing legal effects on players. Calculated alerts and scores are decision aids for staff, who remain in charge of every sporting decision.
4. Who has access to the data?
Within a club, data is only accessible to people authorised by the club, according to their role. One club’s data is never visible to another club. DataMatchLab staff only access it when necessary to operate the service or provide support at the club’s request.
We use the following sub-processors:
| Provider | Service | Data location | Safeguards |
|---|---|---|---|
| Amazon Web Services (AWS EMEA SARL) | Hosting of the application, database, files (photos, videos, logos, analyses) and security logs | European Union — Paris region (eu-west-3) | AWS data processing addendum (DPA) |
| Microsoft (Microsoft 365) | Sending service emails: account activation, password reset, booking confirmation, security alerts | European Union (EU Data Boundary) | Microsoft data protection addendum (DPA), EU Data Boundary |
| Google Ireland Ltd / Google LLC | Audience measurement (Google Analytics 4), only after your consent | European Union and United States | EU-US Data Privacy Framework; standard contractual clauses |
| Browser push services (Google FCM, Mozilla, Apple) | Delivering notifications, only if you turn them on | Depends on your browser | Browser vendor’s terms |
| GPS and sensor providers connected by the club (including Catapult and STATSports) | Retrieving load data, on the club’s initiative and with its own credentials | Region chosen by the club with its provider | Direct contract between the club and its provider |
Files exported from other GPS or sensor systems may also be imported manually by the club, without any direct connection. InsightsLab does not send any data to artificial intelligence or language model services, and does not sell any data.
5. Transfers outside the European Union
Club data is hosted in the European Union (Paris). A transfer to the United States may only occur in two cases: Google Analytics audience measurement, if you have accepted it, covered by the EU-US Data Privacy Framework and standard contractual clauses; and notification delivery by your browser’s push service, if you have turned notifications on.
6. How long is data kept?
| Data | Retention period |
|---|---|
| Player and staff accounts and data | For the duration of the club’s contract. When the contract ends, the data is returned or deleted as the club chooses, in accordance with the data processing agreement; failing instructions from the club within the contractually agreed period, the active data is deleted. Residual copies may remain temporarily in automatic backups until they expire, for a maximum of 35 days. The club can export its players’ data itself |
| Deactivated and inactive accounts | The club is alerted after 24 months of inactivity and decides whether to delete them |
| Security logs in the database | 12 months, then deleted |
| Security log files | 90 days (365 days for critical events) |
| Login attempts | 7 days |
| IP addresses used to prevent booking form abuse | 24 hours |
| Password reset links | 15 minutes (72 hours when an administrator sends the link) |
| Account activation links | 72 hours |
| Product usage events | 13 months |
| Anonymised data (only on the club’s instruction) | No longer personal data; retained by DataMatchLab to improve InsightsLab, including after the end of the club’s contract |
| Audience measurement data (Google Analytics) | Detailed audience measurement data is kept for the period configured in Google Analytics 4, currently 2 months. This period is separate from the lifetime of the cookies stored on the device (see the cookie policy) |
| Demo requests with no follow-up | 3 years from the last contact |
| Notification subscriptions | Deleted as soon as they expire or are revoked |
| Cookie choice | 6 months |
| Database backups | Automated backups kept for a few days (35 days maximum), then erased as they expire |
7. How is data protected?
- Encrypted HTTPS connection with HSTS;
- passwords stored exclusively as secure hashes, with length and complexity requirements;
- login attempts limited per IP address and per account;
- automatic logout after a period of inactivity;
- cookies and authentication mechanisms protected by appropriate cryptographic measures; two-factor authentication for staff accounts;
- role-based access rights and strict separation between clubs;
- data and files encrypted at rest and kept in private storage, reachable only through secure temporary links;
- external provider credentials encrypted at rest;
- security event logging and alerting;
- single-use activation links (no password is ever sent by email) and reset tokens stored in hashed form.
8. Your rights
You have the following rights over your data:
- Access and portability: the “Download my data” feature in the application provides a copy in JSON or CSV format; the club can also export a player’s data;
- Rectification: you can correct your profile directly in the application, or ask your club to do so;
- Erasure: you can request erasure of your data under the conditions laid down by the GDPR. For data processed on behalf of a club, the request is handled under the club’s authority. InsightsLab provides the club with the features needed to manage and, where applicable, delete the data concerned;
- Restriction: in the cases provided for by the GDPR, you can request that the processing of certain data be restricted. For data managed by a club, this request must be sent to the club;
- Objection: you can object to processing based on legitimate interest, on grounds relating to your particular situation;
- Withdrawal of consent: at any time, without affecting processing already carried out (for example for health data or analytics cookies);
- Instructions regarding your data after death, where national law provides for them.
How to exercise your rights
For player or staff data, please contact your club first, as it is the controller. If you contact us directly, we will forward your request to the club and help it respond. For processing for which DataMatchLab is the controller (demo requests, security, audience measurement), write to contact@datamatchlab.com. We reply within one month, which may be extended by two months for complex requests. We may ask for proof of identity if we have reasonable doubts.
9. Minors
InsightsLab may be used for players who are minors. The club, as controller, determines the legal basis applicable to processing concerning minors and ensures that, where the consent of the legal guardian is required by applicable law, it is obtained.
Where the club collects consent, the application lets it record and document it: status, who gave it (the player or a legal guardian), date, the club member who entered it, and a separate consent for health data.
Parents can exercise their child’s rights through the club.
10. Cookies
InsightsLab uses cookies that are strictly necessary for it to work (session, language, selected team, remembering your choice) and, only with your consent, Google Analytics audience measurement cookies. Details are in our cookie policy. You can change your choice at any time: manage cookies.
11. Complaints to a supervisory authority
If you believe your rights have not been respected, you can lodge a complaint with the data protection authority of the country where you live, where you work, or where the alleged infringement took place.
As DataMatchLab is established in Belgium, its supervisory authority is the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.
12. Changes to this policy
This policy may change, in particular when new features or providers are introduced. The date of the last update is shown at the top of the page. Users will be informed in the application of any significant change.
13. Contact
For any question about this policy: contact@datamatchlab.com. See also our legal notice.