Privacy Policy

3a. Site visitors

Data: IP address, browser type, pages visited, referral source (via analytics). Contact form submissions (name, email, organisation, message).

Lawful basis: Legitimate interests (Article 6(1)(f)) for analytics — understanding how the site is used to improve it. Consent where cookie consent is given. Contract performance / pre-contractual steps for enquiry handling.

Retention: Analytics data: 26 months. Enquiry data: 3 years from last contact.

3b. Player and athlete data (platform deployments)

Data: Facial video footage, derived facial Action Unit (AU) scores across 44 FACS-standard muscle movements, VAD (Valence, Arousal, Dominance) emotional state scores, individual baseline emotional profiles, welfare alert flags.

Special category status: This data constitutes biometric data and health-related data under Article 9 UK GDPR and is subject to enhanced protection.

Lawful basis: Article 6(1)(a) explicit consent + Article 9(2)(a) explicit consent for biometric processing. For welfare monitoring, additionally Article 9(2)(b) (obligations in employment, social security and social protection law) where a duty of care obligation applies. Under-18 deployments require parental/guardian consent in addition to the player's own age-appropriate consent.

Retention: Raw video: not retained after processing. AU scores and VAD outputs: as specified in the Data Processing Agreement with the deploying organisation, typically the duration of the player's engagement plus 12 months. Individual baselines: recalibrated seasonally; prior baselines deleted after recalibration unless the DPA specifies otherwise.

Note: In platform deployments, the deploying organisation (club, academy, federation) is the data controller for player data. Cavefish acts as data processor under a signed Data Processing Agreement. Players should refer to their club's own privacy notice for full details of how their data is used.

3c. Manager Intelligence — press conference analysis

Data: Facial AU analysis derived from publicly broadcast pre-match press conference footage of professional football managers. Outputs: Genuine Confidence score, Instability Index, Net Confidence score — per manager per press conference.

Lawful basis: Article 6(1)(f) — Legitimate Interests. The processing is applied to public figures acting in their professional and public capacity in staged, intentionally broadcast media events. A full Legitimate Interests Assessment (LIA-ED-SPORT-001) is on file and publicly available. A Data Protection Impact Assessment (DPIA-ED-SPORT-001) has been completed.

Article 9 position: AU analysis measures emotional state, not identity. The data subject is identified by the event context, not by the processing. Processing is not used to uniquely identify individuals and therefore does not engage Article 9 biometric identification processing. This position is documented in DPIA-ED-SPORT-001. Alternatively, Article 9(2)(g) substantial public interest (sports journalism and editorial commentary) applies to published outputs.

Transparency: This notice serves as the Article 14 transparency mechanism for data subjects in this category. A dedicated transparency notice is available at echodepthsports.com/data-subjects/.

Retention: Composite scores retained as part of the analytical dataset. Raw footage not retained. No persistent biometric identification profile created.