Privacy Policy

Who we are and how to reach us

TechSport Ash LLC (“TechSport Ash”, “we”, “us”) operates techsportash.com and supplies wearable telemetry hardware and athlete analytics software to sports organisations. Our registered office is at 4120 Tech Parkway, Suite 200, Austin, TX 78701, United States.

For any question about this policy, about the personal data we hold, or to exercise the rights described in section 8, contact us at support@techsportash.com or on +1 512 555 0198. Written requests may be sent to the postal address above, marked for the attention of Data Governance.

This policy was last updated on 4 September 2026.

Two different roles: website visitor and client athlete data

This policy covers two distinct situations, and it matters which one applies to you.

As a visitor to this website or a business contact — someone who fills in our contact form, emails us, or attends a demo — TechSport Ash is the data controller. We decide why and how your details are processed, and this policy describes that processing directly.

As an athlete or member of staff at a client organisation whose data is held in our platform, TechSport Ash is a data processor. Your club or organisation is the controller: it decides what is collected, who may see it and how long it is kept, and it is the right first point of contact for questions about your record. We act on their documented instructions, and we support them in responding to your requests. If you contact us directly we will help, but we will normally need to route the request through the controlling organisation.

What we collect

Information you give us

Contact form submissions: name, work email, organisation, phone number where supplied, the subject you select and the message you write.
Correspondence: emails, call notes and demo scheduling details.
Files you choose to send us for a demo, such as an anonymised session export.

Information collected automatically on this website

Server log data: IP address, request time, requested URL, HTTP status, referring page and user-agent string, retained for security and diagnostics.
If — and only if — you accept optional analytics in the cookie notice: aggregated page-view statistics telling us which platform and research pages are read. Declining leaves this uncollected.
Your cookie choice itself, stored in your browser's local storage so that we do not ask again.

Information in the platform

Where we act as a processor for a client, the platform may hold athlete identifiers, session telemetry, derived load and readiness metrics, availability status and, depending on the client's configuration, health-adjacent data such as heart-rate variability. The categories are set by the client in the data processing agreement.

Why we process it, and on what basis

Purpose	Data	Basis
Answering your enquiry	Contact form and correspondence	Steps prior to entering a contract, and our legitimate interest in responding to business enquiries
Delivering the platform	Client and athlete data	Performance of our contract with the client organisation; the client determines the basis for the athlete
Security and abuse prevention	Server logs	Our legitimate interest in operating a secure service
Understanding site usage	Aggregated analytics	Your consent, given through the cookie notice and withdrawable at any time
Legal and accounting obligations	Contract and billing records	Compliance with a legal obligation

We do not sell personal data, we do not share it with advertising networks, and we do not use client or athlete data for our own product development, benchmarking or commercial purposes.

Cookies and local storage

This site sets no cookies at all unless you accept optional analytics. Your choice from the cookie notice is stored in your browser's local storage under the key tsa-cookie-choice; it never leaves your device and is not readable by us. Clearing your browser storage resets the choice and the notice reappears.

If you accept analytics, we record aggregated page views and referrers. We do not attempt to identify individuals from that data, we do not build advertising profiles, and we do not combine it with platform data. You can withdraw consent by clearing site data in your browser, after which the notice will ask again.

We use a small number of sub-processors, each under a written agreement with confidentiality and security obligations, and each limited to a specific function:

Cloud infrastructure providers hosting the platform in the region selected by each client.
Email and calendar providers used for correspondence and demo scheduling.
Error monitoring used to detect faults in the platform, configured to scrub personal fields.

A current list of sub-processors, with their locations and functions, is available to clients on request and forms part of the data processing agreement. We notify clients before adding or replacing one.

We may also disclose data where legally required — a valid court order, for example — and, in the event of a merger or acquisition, to the acquiring entity under equivalent protections. We would notify affected clients in either case, unless legally prohibited.

International transfers and retention

Platform data is stored in the tenancy region a client selects at contract — European Union, United States or Australia — with backups held in the same region. We do not move a client's data between regions without written instruction from that client.

Where personal data originating in the European Economic Area or the United Kingdom is transferred to the United States, the transfer is covered by the European Commission's Standard Contractual Clauses together with a documented transfer impact assessment and the supplementary technical measures described in section 9.

Retention periods

Contact enquiries that do not become a client relationship: deleted 24 months after the last contact.
Server logs: 90 days, then deleted.
Client platform data: for the term of the agreement plus the wind-down period stated in it, typically 60 days, after which it is deleted from primary storage and expires from backups within a further 35 days.
Contract and accounting records: as required by applicable law, typically seven years.

Your rights

Depending on where you are located, you may have the right to:

Ask what personal data we hold about you and receive a copy of it.
Have inaccurate data corrected.
Have data erased where we no longer have a basis to keep it.
Restrict or object to processing based on legitimate interests.
Receive data you provided in a portable, machine-readable format.
Withdraw consent at any time, where consent is the basis — this does not affect processing already carried out.

Contact support@techsportash.com to exercise any of these. We respond within 30 days and will tell you promptly if a request will take longer and why. We do not charge for a first request.

Residents of California and other US states with comprehensive privacy statutes have equivalent rights of access, deletion, correction and opt-out of sale or sharing. We do not sell or share personal information in the sense those statutes use, and we do not discriminate against anyone who exercises a right.

If you are an athlete at a client organisation, we will forward your request to that organisation and support them in fulfilling it. If you are dissatisfied with how a request has been handled, you may complain to your national data protection authority.

How we protect it

AES-256 encryption at rest and TLS 1.3 in transit across all services.
Field-level encryption for health-adjacent data such as heart-rate variability series.
Role-based access control enforced server-side, with medical and performance fields separated by default.
Mandatory multi-factor authentication for all staff accounts, and least-privilege access reviewed quarterly.
An immutable audit log of access to individual athlete records, exportable by the controlling client.
Independent penetration testing and a documented incident response process; confirmed breaches affecting personal data are notified to affected clients without undue delay and in any case within 72 hours of confirmation.

No system is perfectly secure, and we do not claim otherwise. What we commit to is a documented posture, honest disclosure when something goes wrong, and controls proportionate to the sensitivity of the data.

Young people and academy athletes

This website is not directed at children and we do not knowingly collect personal data from anyone under 16 through it.

The platform is used by academy programmes that include minors. Where that is the case the client organisation is responsible for obtaining appropriate consent from a parent or guardian, for applying its safeguarding policy to monitoring practice, and for configuring access so that a minor's data is visible only to staff who need it. We support them with role-scoped access, shortened default retention for academy records and an audit trail, but the responsibility for lawful processing sits with the club.

Changes to this policy

We update this policy when our processing changes, when we add a sub-processor category, or when the law requires it. The date at the top of section 1 reflects the current version. Material changes affecting clients are notified in advance through the account contact rather than by quietly editing this page.