Privacy policy
Last updated: 25 October 2026
This policy explains which personal data SubCoach Replay ("SubCoach", "we") processes, why, and what your rights are. We follow the General Data Protection Regulation (GDPR) and Belgian privacy law.
1. Who we are
The controller of your personal data is:
WEB Vlaanderen Comm V.Petrus Jozef Triesthof 26, 9050 Gentbrugge, BELGIUMEnterprise number: BE0671.846.150E-mail: info@web.vlaanderenwww.web.vlaanderenFor any question about privacy, e-mail us at info@web.vlaanderen or use the contact form.
2. Your data and the data you upload
For your account, our website and the contact form, we decide how your data is used: we are the controller.
Videos, athletes, tags and other content are uploaded by our users, for example a coach or a club. For that content, the user who uploads it decides what is recorded and who sees it, and we process it on their behalf. If you appear in a video and have a question about it, please contact the person or club who filmed you first. You can always contact us as well, and we will help.
3. What we process and why
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Account: username, name, e-mail address, password (stored only as a secure hash), account type (coach or athlete), language, plan and billing period, last login | Creating and running your account, logging in, password recovery | Contract (art. 6.1.b GDPR) | Until your account is deleted |
| Content: videos, thumbnails, tags, athletes, labels, teams, friends, coaching staff and shares | Providing the service: storing, playing, tagging and sharing videos | Contract (art. 6.1.b) | Until you delete it, or your account is deleted |
| Viewing statistics: which video was played, when, for how long, how far, where (video page, embed, playlist) and on what kind of device (computer, phone or tablet); for videos embedded on other websites without an account. No IP address is stored | Showing the owner of a video how it is watched, and keeping the service running and improving it | Legitimate interest (art. 6.1.f) | 13 months |
| Technical details of videos (capture date, frame rate, resolution, file size) | Sorting videos, accurate timing, showing your storage use | Contract (art. 6.1.b) | As long as the video |
| Notifications and service e-mails | Telling you about shares, requests and team changes, and sending password links | Contract (art. 6.1.b). You can switch off e-mail notifications in your account. | Until your account is deleted |
| Contact form: name, e-mail address, subject, message | Answering your message | Legitimate interest in answering questions (art. 6.1.f), or steps before a contract (art. 6.1.b) | Up to 2 years after the last contact |
| Payments: plan, amounts (incl. VAT), credits, dates and status, your Mollie customer and mandate reference, and the billing details you give (company name, address, VAT number) | Charging for paid plans, renewals, bookkeeping | Contract (art. 6.1.b) and legal obligation (art. 6.1.c, accounting law) | As long as accounting law requires |
| Security data: login session, IP address, failed login attempts, server logs | Keeping accounts and the service secure, preventing abuse | Legitimate interest in security (art. 6.1.f) | Sessions: 30 days. Login attempts: a few minutes, in memory only. Logs: a limited period. |
| Display preferences stored in your browser | Remembering choices such as an expanded timeline | Consent (art. 6.1.a), which you can withdraw at any time | Until you withdraw consent or clear your browser |
| Statistics about visits and use (Google Analytics): pages viewed, buttons clicked, sign-ups and purchases, device and browser type, approximate location | Understanding how the site is used, to improve it | Consent (art. 6.1.a), which you can withdraw at any time | 14 months in Google Analytics; cookies at most 13 months |
We don't sell personal data, don't show advertising, and don't use your data for profiling. Only if you allow analytics, we use Google Analytics 4 (Google Ireland Ltd.) as our processor to count visits, clicks and purchases. Google may process this data outside the EU under the EU–US Data Privacy Framework. We don't send names, e-mail addresses, searches or private links to Google, and advertising features are switched off.
4. Videos of athletes and children
Images of people are personal data. Only upload videos when you're allowed to, for example with the permission of the athletes, or of their parents or guardians for minors, in line with your club's rules. People in a video can ask the uploader, or us, to remove it.
Children under 13 may only use SubCoach with an account created or approved by a parent or guardian.
5. Who receives your data
Your data is only shared with:
- the people you share videos with, your team members, your assistant coaches and the athletes linked to your videos;
- if your coach adds you as an athlete with your e-mail address: your coach, who sees your name and whether you accepted;
- visitors of a website where you embed a video, if you turn on embedding for that video (only that video, its tags and the names of the athletes in it);
- service providers who process data for us under a data processing agreement: our hosting provider in the European Union (servers and database), Cloudflare (video storage), pCloud (archive of original video files), Resend (sending e-mails) and Mollie (payments, in the Netherlands). Your bank or card details are entered at Mollie and never reach us;
- OpenStreetMap: the map on the Locations page loads its map images from the OpenStreetMap Foundation (United Kingdom), so your browser sends them your IP address while you look at the map. No cookies, and none of your data or locations;
- YouTube: a video that a coach added from YouTube plays in YouTube's own player (Google Ireland Ltd.), and only after you click to load it. YouTube then receives your IP address and what you watch, and may set its own cookies under its own privacy policy. We only keep the link to the video; nothing of the video is stored with us;
- authorities, but only when the law requires it.
6. Data outside the European Union
Some providers are based outside the European Economic Area: Cloudflare and Resend in the United States, pCloud in Switzerland, the OpenStreetMap Foundation in the United Kingdom; Google (YouTube) can process data in the United States. Switzerland and the United Kingdom have an adequacy decision of the European Commission. For transfers to the United States we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
7. Security
All connections are encrypted (HTTPS). Passwords are stored only as a salted hash. Videos are reached through private, expiring links, and only people with access to a video can open it. Access within our company is limited to what is needed to run and support the service.
8. Your rights
You have the right to:
- see the personal data we have about you (access), and receive a copy;
- have incorrect data corrected;
- have your data deleted, including your whole account;
- restrict or object to processing based on legitimate interest;
- receive the data you gave us in a common format (portability);
- withdraw your consent at any time, without affecting earlier processing.
To use these rights, e-mail us at info@web.vlaanderen or use the contact form. We answer within one month. You can correct most of your data yourself on your account page, and delete videos and tags in the app. Cookie choices can be changed at any time in the .
If you're not satisfied with how we handle your data, you can file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
9. Changes
We may update this policy, for example when we add features. The date at the top shows the latest version. We will tell you by e-mail or in the app about important changes.