Privacy Policy

Bua is a web app for Gaelic games teams, used in a browser at platform.team-bua.com and also available as an app for iPhone and Android. Players record a short daily check-in, log injuries, confirm availability and message their squad. Coaches, medical staff and team administrators use it to see who is fit to train, schedule sessions, take attendance and communicate.

This notice covers players, coaching and medical staff, and team administrators. Bua’s own staff, contractors and job applicants receive a separate notice.

It also covers our website, team-bua.com, including visitors who do not have an account.

Bua is for people aged 16 or over, and teams must not invite anyone younger. Under Irish data protection law, players aged 16 or 17 can use Bua without a parent’s consent, but they are still children and we take that into account in how we handle their data. Their team is responsible for following its own safeguarding policies, including any requirement for a parent’s or guardian’s consent. If we learn that an account belongs to someone under 16, we close it and delete its data. If you think this has happened, contact privacy@team-bua.com.

Bua does not diagnose, assess or treat injury or illness, does not give medical advice and is not a medical device. Anything the app displays about a player’s condition is a restatement of what that player entered. Clinical decisions, including return-to-play, are made by qualified people.

Data protection law separates the organisation that decides why and how data is used (the controller) from the one that handles it on the controller’s instructions (the processor). Bua is both, depending on the data.

So: why your club asks for a check-in, who sees it and how it feeds into selection are questions for your club. How we store it, who we share it with and how to get a copy are questions for us. Ask either of us and we will route it.

We do not track your location or collect anything from advertising networks, data brokers or social media. Club subscriptions are paid through Stripe; card details go straight to Stripe and we never see or store full card numbers.

Most of this comes from you. Some does not: when your club creates your invitation it may supply your name, email, role and squad.

We review usage data to fix and improve the app. Because few teams currently use Bua, that review is not anonymous — we can often see which team, and sometimes which person, a pattern relates to. We treat it as personal data accordingly.

Every use needs a lawful basis under Article 6; health data needs a second condition under Article 9. Because Bua is controller for some of this and processor for the rest, the table shows who holds each basis.

Where we rely on legitimate interests we document a written balancing assessment, and will give you a summary on request.

Health data is processed on the basis of your explicit consent, which is asked for separately from the app’s terms. Agreeing to the terms is not consent for data protection purposes.

You can withdraw at any time, in the app or by emailing us, and withdrawing takes the same number of steps as agreeing did. When you withdraw we stop processing your check-in and injury data and delete it under Section 08. Withdrawal does not affect anything lawfully done beforehand. You can use Bua for scheduling, attendance and messaging without sharing any health data.

Every club agrees, as a term of its contract with us, that declining or withdrawing consent will not affect a player’s selection, standing or access to the app.

We do not send marketing and there is no marketing list. Service messages — session reminders, injury notifications, security alerts and account emails — are part of the app rather than promotion.

• We do not sell your data. By "sell" we mean transferring or licensing personal data to a third party for their own commercial purposes, in exchange for value. There are no sponsors or commercial partners connected to Bua.
• We do not use your data to train AI models, and do not licence it to anyone who does.
• There are no advertising SDKs, ad identifiers or cross-app tracking in the app.
• Bua does not produce selection scores, rankings or player-comparison outputs from check-in data.
• Check-in and injury data is not visible to other players.

One exception to the first point, which we would rather state than have you discover: if Bua is acquired, merged or reorganised, personal data may transfer with the business. Any successor is bound by this notice, and we will tell you before anything changes about how your data is handled.

Authorised staff at your team see the data relevant to their role. Your club decides who holds which role.

Beyond that, only the service providers below, each covered by a written contract meeting Article 28 of the GDPR before it handles any personal data of yours.

We will tell you before adding any provider that handles health data.

We also share with professional advisers under a duty of confidence; with authorities where legally required, or to establish or defend legal claims, disclosing no more than necessary; and with emergency services where someone’s life or safety is at risk.

Injury records can be sought as evidence in a personal injury claim, an insurance investigation or a disciplinary process, and may have to be disclosed. Where such a request reaches us we assess whether it is valid and disclose no more than is necessary.

Bua stores personal data within the European Economic Area, in Ireland. Where a transfer outside the EEA takes place — support access, vendor administration, error monitoring and website analytics can each create one — we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, with a transfer impact assessment. Email us for a copy of the safeguards.

Because we are processor for team-entered data, we do not set those periods alone. The periods below are the defaults in every club agreement; a club can vary them within limits we specify.

If a club removes you by mistake, it can restore you, with your history, within those 30 days. Removing you from a single team doesn’t start the clock, because your check-ins belong to your club membership.

Data with names removed is often still personal data if a person can be picked out. We treat data as anonymised only where it passes a documented re-identification test; anything else stays personal data with all your rights attached.

If your club stops using Bua it chooses to export or delete its data, and if it does nothing the default is deletion. If Bua becomes a paid product and your club continues, we ask for your consent again rather than carrying it over. Any individual can ask for their own data to be deleted at any point, whatever their club decides.

• Sign-up is closed and invitation-only. There is no open registration.
• Data is encrypted in transit. Access to team data is controlled by role, and not everyone at Bua can reach production data.
• Also in place: encryption at rest for the database, backups and stored files, using keys we manage and rotate; body photos and invoices are never publicly accessible and open only through links that expire after an hour; MFA on administrative and production access; managed storage of credentials and keys; and restore-tested backups.

No system connected to the internet can be guaranteed secure. We implement measures appropriate to the sensitivity of the data, review them at least annually, and complete a Data Protection Impact Assessment before the app holds live personal data. Every club signs a data processing agreement, and every provider an Article 28 agreement, before either touches personal data.

If a breach happens we assess the risk without delay. Where it is likely to risk people’s rights and freedoms we notify the Data Protection Commission within 72 hours of becoming aware. Where the risk is high we tell affected people directly, in plain language. Where it concerns data we hold as processor we notify your club without undue delay. We record every breach, including ones we need not report.

On the last one: some of what the app displays is calculated automatically from what you entered, but Bua does not take a decision about you by automated means alone. What it shows is information put in front of a person, and selection, training and welfare decisions are human decisions your club is accountable for.

Two limits. Erasure does not reach records the law obliges us to keep. And where we hold data as processor, a request to delete team records is your club’s decision — we pass it on and act on their instruction.

To exercise any of these, email privacy@team-bua.com. We may need to verify your identity first. We respond within one month, extendable by up to two further months for complex requests, in which case we tell you within the first month and explain why.

Tell us first at privacy@team-bua.com. You can also complain to the Data Protection Commission at any time, whether or not you have contacted us: 6 Pembroke Row, Dublin 2, D02 X963, or in writing via the contact form at dataprotection.ie. Their phone lines ((01) 765 0100 or 1800 437 737) handle general queries, but complaints must be in writing. You also have the right to an effective judicial remedy before the Irish courts.

The iPhone and Android apps use a device identifier (Apple’s identifier for vendor or Android ID) and the device name only to deliver push notifications to the right device. We use Sentry to diagnose crashes and errors. It receives your device model and OS version, an app-installation identifier, and app logs. When an error occurs, it also receives a short masked screen replay of what led up to it, with all text and images hidden. We do not send your IP address to Sentry, and Sentry is set not to store it. There is no product analytics or advertising SDK in the mobile apps, and they do not track you across other companies’ apps.

Our website and the web app use Google Analytics to see which pages help clubs find Bua and how people move from the website into the app. It is off until you choose: nothing is loaded, and no analytics cookie is set, unless you click Accept in the cookie banner. Rejecting is as easy as accepting, and one choice covers both sites. Google signals and Google’s advertising features are switched off, Google Analytics does not store your IP address, and we never send it your name, email address or any check-in or injury data.

You can change your choice at any time using “Cookie settings” in the website footer or in the app’s settings. If you withdraw, we stop measuring and delete the Google Analytics cookies from your browser.

In the web app, Stripe processes card details and fraud-prevention signals on the billing page, and event location maps are loaded from Google Maps, which receives your IP address.

There are no advertising identifiers, attribution SDKs or cross-app tracking in Bua. If we later add anything non-essential, it will be blocked until you have made a choice.

Where we make a material change — a new purpose, a new category of data, a new provider handling health data, or a change to retention — we tell you in the app and by email at least 30 days before it takes effect, and where a change needs your consent we ask again rather than assume it.

This notice describes the app as it stands today. Each new purpose is explained, with its lawful basis, before the processing starts.

This notice is governed by Irish law, and nothing in it limits any right you have that cannot lawfully be limited.