PRIVACY NOTICE

ATASS Limited (trading as ATASS Sports)
Last updated: March 2026

1. Who We Are

ATASS Limited (company number 04807405), trading as ATASS Sports (“we”, “us”, “our”), is a UK-based sports analytics company. We collect and analyse sports-related data to develop statistical models and provide analytical insights for clients.

We are committed to protecting personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018
• Other applicable UK data protection laws

ATASS Limited is registered with the Information Commissioner’s Office (ICO), registration number ZA224320.

Contact details:
Data Protection Officer
ATASS Limited
Oxygen House, Grenadier Road, Exeter, Devon EX1 3LH
Email: [email protected]

2. The Types of Personal Data We Process

Personal data means information that identifies or could identify a living individual.

Depending on how you interact with us, we may process:

A. Website and Technical Data

When you use our website:

• IP address
• Device and browser type
• Pages visited
• Date and time of access
• Usage analytics
• Cookie data  

B. Business Contact Data

If you are a client, partner or supplier:

• Name
• Work email address
• Work telephone number
• Job title
• Organisation name

Invoicing, payment and other accounting is supported by Oxygen House Limited and your data maybe passed to, and processed, by them to administer our business relationships.

C. Recruitment Data

If you apply for a role with us:

• CV and employment history
• Education history
• Contact details
• Information to check your identity, right to work and criminal records
• Interview notes
• Any information you choose to provide during recruitment

D. Sports Performance Data

As part of our analytics and model-building activities, we may process:

• Athlete names
• Manager and Coach names
• Team affiliation (club and national)
• Match participation data
• Athlete Availability Data
• Performance and match related statistics
• Historical performance records
• Publicly available competition data

This data is typically obtained from:

• Publicly available sources  
• Licensed sports data providers
• Research or project partners

We focus on professional and semi-professional sports contexts.

3. How We Use Personal Data

We use personal data for the following purposes:

Website & Security

• Operating and improving our website
• Ensuring system security
• Preventing fraud and misuse

Client & Business Management

• Managing contracts and service delivery
• Responding to enquiries
• Maintaining business relationships

Recruitment

• Assessing job applications
• Managing our recruitment process

Sports Analytics & Model Development

• Developing and testing statistical and predictive models
• Conducting performance analysis and research
• Validating model accuracy
• Delivering analytical outputs to clients
• Sharing with secure sub-processors for operational purposes
• Providing analysis to sports governing body in relation to integrity threats.

We will only use personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another compatible purpose.

4. Our Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

Legitimate Interests

We rely primarily on legitimate interests for:

• Developing and improving sports analytics services
• Conducting statistical research
• Managing our business operations
• Maintaining website security

We have assessed that these interests are not overridden by individuals’ rights and freedoms.

Contractual Necessity

Where processing is necessary to perform a contract (e.g. recruitment, client services).

Legal Obligation

Where we are required to comply with law or regulation.

Consent

Where required, including electronic marketing communications.

5. Legitimate Interests Assessment (Summary)

Where we process sports performance data for analytics and model development, we rely on legitimate interests.

We have considered:

Purpose
To develop and provide high-quality statistical sports analysis services to clients.

Necessity
Identifiable performance data is necessary to ensure model integrity, validation and accuracy.

Balancing Test

• Most data relates to individuals acting in professional sporting contexts.
• The data primarily concerns performance metrics rather than private life information.
• Processing does not produce legal or similarly significant effects on individuals.
• Safeguards such as data minimisation, access controls and pseudonymisation are applied.

We consider our legitimate interests to be proportionate and compliant with UK GDPR.

Individuals have the right to object to processing based on legitimate interests (see Section 11).

6. AI and Statistical Model Governance

As a sports analytics company, we develop and use statistical models and analytical systems that may involve automated processing of sports performance data.

We are committed to ensuring that our use of analytics and AI-related technologies is responsible, transparent and compliant with UK data protection law.

Nature of Our Models

Our models may:

• Analyse historical sports performance data
• Identify patterns and trends
• Generate predictive outputs or performance insights
• Support client decision-making

Our systems are designed to analyse performance data in professional sporting contexts and are not intended to assess private life characteristics.

Human Oversight

We do not make solely automated decisions that produce legal or similarly significant effects on individuals without appropriate safeguards.

Human oversight forms part of:

• Model design and Research
• Testing and validation
• Output interpretation
• Client delivery

Data Minimisation & Safeguards

Where personal data is used for statistical modelling:

• We apply data minimisation principles;
• Access is restricted to authorised personnel;
• Data may be pseudonymised where appropriate;
• Security controls are applied to protect underlying datasets.

Where processing qualifies as statistical or research processing, we apply safeguards consistent with Article 89 UK GDPR and the Data Protection Act 2018.

Fairness and Transparency

We are committed to:

• Using data in ways that are fair and proportionate;
• Avoiding discriminatory or unjustified impacts;
• Regularly reviewing model performance and assumptions;
• Ensuring legitimate interests assessments are conducted where appropriate.

Ongoing Governance

We periodically review our analytical processes to ensure:

• Compliance with evolving regulatory guidance;
• Data protection by design and by default;
• Appropriate documentation of model development activities;
• Secure data lifecycle management.

7. Data Sharing

We may share personal data with:

• Cloud hosting and IT service providers
• Professional advisers (legal, accounting, compliance)
• Recruitment service providers
• Oxygen House Limited as a sub processor
• Clients and their end users
• Regulatory or law enforcement authorities where legally required

We do not sell personal data.

Where third parties process personal data on our behalf, we require them to do so under written contracts compliant with Article 28 UK GDPR.

8. International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• UK adequacy regulations
• International Data Transfer Agreements (IDTAs)
• UK-approved Standard Contractual Clauses
• Other lawful transfer mechanisms permitted under UK GDPR

9. Data Security

We implement appropriate technical and organisational measures, including:

• Secure data hosting
• Access controls
• Role-based permissions
• Encryption where appropriate
• Staff confidentiality obligations and security training
• Incident response procedures

We have procedures in place to manage suspected data breaches and will notify individuals and regulators where legally required.

10. Data Retention

We retain personal data only for as long as necessary for:

• Statistical modelling purposes
• Contractual requirements
• Legal and regulatory obligations

Recruitment data is retained for 18 months following the relevant vacancy being filled.

Where personal data is retained for research or statistical purposes, appropriate safeguards are applied.

Anonymised data may be retained indefinitely.

11. Your Rights

Under UK data protection law, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure (in certain circumstances)
• Restrict processing (in certain circumstances)
• Object to processing (in certain circumstances)
• Request data portability
• Withdraw consent where processing relies on consent

To exercise your rights, please contact: [email protected]

You will not usually have to pay a fee unless your request is unfounded or excessive.

12. Marketing Communications

We comply with the Privacy and Electronic Communications Regulations (PECR).

We will only send electronic marketing communications where we have your consent or are otherwise permitted to do so by law.

You can opt out at any time by:

• Using the unsubscribe link in marketing emails; or
• Contacting us directly.

13. Third Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies.

14. Cookies and Similar Technologies

Our website uses cookies and similar tracking technologies to distinguish you from other users, improve functionality and analyse website usage.

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help websites function properly and provide information to website owners.

Types of Cookies We Use

We use the following categories of cookies:

Strictly Necessary Cookies
These cookies are essential for the operation of our website and enable core functionality such as security, network management and accessibility. These cookies do not require your consent.

Analytics Cookies
With your consent, we use analytics cookies to collect information about how visitors use our website, including:

• Pages visited
• Time spent on pages
• Navigation paths
• Technical information such as browser type and device

This helps us improve website performance and user experience.

Functionality Cookies
These cookies allow the website to remember choices you make and provide enhanced features.

We do not use cookies for intrusive behavioural advertising.

Lawful Basis

• Strictly necessary cookies: Legitimate interests (website functionality and security)
• Analytics and optional cookies: Consent

You can:

• Accept or reject non-essential cookies via our cookie banner;
• Change your preferences at any time;
• Disable cookies via your browser settings.

Further information about how we use cookies is available in our separate Cookie Notice.

15. Complaints Procedure

This procedure explains how you can raise a complaint about how we collect, use or manage your personal data, and how we will handle it.

If you are unhappy with how we handle your personal data, please contact us at [email protected], providing details of your concern.

We will:

• acknowledge your complaint within 30 days;
• assess and investigate the issues raised;
• respond as quickly as possible and without undue delay;
• keep you informed if our investigation is likely to take longer; and
• explain the outcome clearly, including any steps we have taken.

Where appropriate, we will take steps to put things right.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.