Go2Pro Privacy Policy

1. Controllers and Roles

Go2Pro Inc. (16192 Coastal Highway, Lewes, DE 19958, USA) is the principal controller for Go2Pro-specific platform and service purposes: athlete profiles, sport and discipline, age band or date of birth where needed, parent/guardian relationships, videos and highlights, performance information, comments and likes, professional discovery and search, contact requests, organization membership, competition and event information, licences and subscriptions, moderation, safety reports, sponsor and advertising leads from adult business contacts, customer support, and Go2Pro analytics subject to consent and law. Contact: privacy@go2pro.io.

Lutin Technologies Inc. (Delaware, USA) / LutinX is an independent controller for core LutinX identity, KYC and trust purposes where it independently determines the purpose and means: LutinX account identity and user identifier, core identity verification, KYC evidence and document processing, KYC result and status, trust/evidence events, blockchain and fingerprint records, core LutinX security and audit records, LutinX account/KYC confirmation communications, and separately activated LutinX trust services.

Go2Pro Football Srl (Via Mercalli 13, Rome, Italy) may be a controller, joint controller or processor only for specifically described football network and commercial activities — not for all user data. Go2Pro Media LLC (Lewes, DE, USA) is a controller of advertiser and sponsor business-contact data for media contracting where it is the contracting entity; it does not gain access to child profiles for advertising targeting. Go2Pro avoids the generic label 'joint controller' unless a specific joint-determination activity has actually been mapped.

2. Information We Process

• Adult account data: name, email, phone, country, language, authentication and security data, account role.
• Minor Athlete profile data: name or display name subject to privacy configuration, age or age band, country/region, sport/discipline, team or club where permitted, videos and images, performance/skills/stats, interaction data, visibility settings, parent/guardian link, consent records.
• Parent/Guardian data: identity and contact, relationship and authority information, child-profile management actions, consents, payment/licence metadata, KYC status where required.
• Professional data: identity, KYC status, role, organization/club/gym, credential evidence, professional verification status, searches, views and contact requests, moderation and safety signals.
• Organization data: business details, representative, organization verification/KYB where enabled, staff and admin users, sport/segment, event and roster data where enabled.
• Content data: videos, images, audio, captions, comments, metadata, technical fingerprints and hashes.
• Safety and moderation data: reports, evidence, moderation actions, suspicious-contact logs, abuse/fraud/security information.
• Technical data: IP, device and session data, logs, crash data, security events, cookie/SDK identifiers subject to consent.
• Payment data: transaction and order references, invoice data, product/licence, payment status. Go2Pro does not store full payment-card data; payment providers and app stores process card data.

3. Special Categories

Some data requires special care: children's data, identity/KYC documents, biometric identifiers or templates, health information, combat-sport weight or medical eligibility where it becomes health data, precise geolocation, criminal/safeguarding data and government identifiers. Go2Pro does not collect special-category or sensitive data merely because a database can store it.

4. Purposes and Legal Bases

We process personal data for: account operation; parent/guardian control; minor safeguarding; professional verification; talent discovery; profile visibility; contact routing; content hosting; moderation; fraud and security; licence and payment administration; events and organizations where enabled; customer support; legal compliance; analytics subject to applicable consent or law; contextual advertising and sponsorship; service improvement; and LutinX trust and verification.

Go2Pro does not use one global legal basis. In GDPR and UK GDPR contexts, the basis for each purpose is evaluated among performance of contract, legal obligation, legitimate interests (with child-specific balancing), consent, explicit consent where legally required for special-category data, and vital interests only when actually applicable. For minors, 'contract with the child' is never used as a shortcut around parental/guardian or child-protection requirements.

5. Children and Parental Authority

Go2Pro's baseline: all users under 18 use the protected minor flow; under 10 there is no general-service access; ages 10–17 use a Parent/Guardian-managed Minor Athlete profile. This baseline is intentionally stricter than some jurisdictions. Where local law imposes additional consent or age-assurance requirements, local law controls.

Minor profiles default to high privacy:

• no public precise geolocation; no public email; no public phone;
• no professional direct messages; no behavioural advertising; no advertiser profile access; no third-party ad tracking;
• controlled profile discoverability; external search indexing off by default.

Any public profile mode for minors requires dedicated risk review and Parent/Guardian control.

6. Advertising and Privacy

Go2Pro does not sell personal data for advertising. Advertisers receive aggregated, non-identifiable campaign metrics by default. Go2Pro does not deploy advertiser pixels or SDKs on minor-profile experiences for behavioural advertising. Contextual campaign inputs may use sport, page context, coarse market/country and event context, without building behavioural profiles of minors.

7. LutinX and Trust Records

LutinX may create or link an identity record, conduct KYC for adults, professionals and parents where required, and create trust events or fingerprints. Go2Pro receives only the minimum verification data needed — for example a pseudonymous LutinX user identifier, verification status and level, professional identity verified flag, verified-at date and status expiry where applicable. Raw KYC documents are not exposed to Go2Pro staff by default; access requires a documented legal or security need and explicit authorization. LutinX may contact adult users directly for account, KYC or security confirmation. See /legal/lutinx-trust-infrastructure.

Raw videos and raw KYC documents are not placed directly on a public blockchain by default. Where blockchain or trust recording is used, only the minimum necessary hash, fingerprint, reference or technical proof is recorded. Immutable records may not be technically erasable, so personal data is minimized before anything is written.

8. AI Processing

Where enabled, Go2Pro discloses AI-assisted processing for: content moderation assistance, duplicate and fraud detection, manipulation and integrity flags, safety prioritization, and recommendations or discovery where used. Minor content is not used to train general-purpose external AI models by default. If face matching or biometric identification is ever introduced, it will not be hidden inside general AI language: it requires a dedicated biometric notice, consent and legal review, and a country gate.

9. International Transfers

Go2Pro operates globally and does not claim that all data stays in one country. For EEA, UK and Swiss users, lawful transfer mechanisms are implemented where required — for example adequacy decisions, Standard Contractual Clauses, the UK IDTA/Addendum, Swiss-compatible safeguards, and documented transfer risk assessments where applicable. Non-European local transfer and localization requirements are respected.

10. Recipients

• Lutin Technologies Inc. / LutinX for shared identity, KYC and trust purposes;
• cloud and hosting providers; email, SMS and push providers; payment providers and app stores;
• analytics providers subject to consent; moderation and security vendors;
• professional users only through authorized visibility; organizations only through authorized workflows;
• regulators and law enforcement where legally required;
• Go2Pro Football Srl for scoped activities; Go2Pro Media LLC for advertiser/sponsor business contacts — never child targeting data.

11. Retention

Go2Pro maintains a versioned retention matrix covering accounts, minor profiles, videos and content, comments and interactions, parental consents, promotional consents, professional verification, KYC status, safety reports, security logs, payment and invoice data, advertiser leads, organization leads, event data and LutinX trust references. Each category has a retention rule, legal basis, country override, auto-delete or anonymize setting, legal-hold and safety-hold overrides, an owner and a last-reviewed date. Go2Pro does not apply indefinite retention by default.

12. Your Rights

Where applicable, you may request access, correction, deletion, objection, restriction, portability, and withdrawal of consent. For minors, rights may be exercised by the Parent/Guardian according to law, age and capacity; at 18 the adult athlete can exercise rights directly. Requests: privacy@go2pro.io.

13. Safety and Legal-Hold Exception

A deletion request does not require destruction of records that must be retained for: an active child-safety investigation; fraud or security; legal claims; mandatory financial retention; a lawful authority request; a dispute or legal hold; or an immutable trust record containing only minimized proof. Go2Pro explains any such retention transparently.

14. No Sale of Personal Data

Go2Pro does not sell personal data of users. Go2Pro does not give advertisers access to personal profiles for targeting.

15. Contact

Privacy questions and requests: privacy@go2pro.io. Safety: safety@go2pro.io. The simplified guide for young athletes is at /legal/children-privacy; the child safety policy is at /legal/child-safety.