Privacy Policy
At GSX ("GSX", "we"), we work with players, many of them minors, and with their families. That is why we treat their data as carefully as their process. Here we explain, with no fine print, what data we process, why, on what legal basis, who we share it with and what rights you have.
1. Who is responsible
The controller is GSX Management LLC, a Missouri limited liability company doing business as GSX (charter No. LC014791585, Missouri Secretary of State).
- Address: 117 S Lexington St, Ste 100, Harrisonville, MO 64701, USA.
- Email: [email protected] (subject "Privacy").
- Phone: +1 (217) 316-9995.
- Privacy lead: Carlos Moreno Henao, member of GSX Management LLC (write to [email protected], subject "Privacy").
We have not appointed a data protection officer (DPO) because the law does not require one for our activity. We are appointing a representative in the EU under Article 27 GDPR; we will publish their details here. Until then, write to [email protected].
2. What data we process
- What you tell us in our forms: name, email, phone or WhatsApp, country, year of birth, position, club, level, English, a link to your video, an approximate budget, timeline, your message and how you found us (for example, the code of the person who referred you).
- If you hire our service: the documents for the process (passport, grades, English tests, eligibility registration, photos and videos), the universities we talk to, your plan and your payments.
- Our conversations: emails, WhatsApp messages and a written summary of our calls. We do not record calls.
- Health data: only if a university or the process needs it (for example, an injury history) and only with your explicit consent.
- Payments: who paid, the amount, the date and the payment reference. We do not store card numbers.
- Shop orders (when the shop is open): name, shipping address, email and what you ordered.
- Technical data: IP address and browser data for website security and our anti-bot filter; cookieless visit statistics; clicks on links in our emails; and, only if you accept marketing cookies, Meta Pixel data.
3. Why we use it and on what legal basis
- Answering your enquiry, the call application and our calls. Data: what you send us in the form, your messages and the summary of the call. Basis: steps you ask for before a contract (GDPR art. 6.1.b). This covers our replies to what you asked for. Any other email (news, guides, reminders that are not a reply to your request) is marketing, and we send it only as explained below.
- Providing the service you hire (profile, highlight video, recruiting strategy, outreach to coaches, admissions and eligibility guidance, practical visa guidance, your private family area). Basis: the contract (art. 6.1.b).
- Sending your profile to universities and college coaches and, only if you ask us in writing, to clubs you name (for example, your current club). Data: your athletic and academic profile, video and contact details. Basis: the contract and your explicit consent. Many of them are in the United States: we send it because you ask us to (art. 49.1.a and 49.1.b; see section 6).
- Marketing emails (news, guides and offers). Basis: your consent (art. 6.1.a), which you give by ticking the optional box in our forms (it is never ticked in advance), or, if you are already a client, our legitimate interest in telling you about similar services, which you can object to at any time. Every email includes an unsubscribe link, or reply to [email protected] with the word Unsubscribe. Links in our emails pass through gsxmanagement.com/api/r, which records on your contact record that you clicked: the number of clicks, the date of the last click and, for topic buttons, the topic you chose. We use it to know what interests you and to follow up. We do not record whether you open our emails. Our email delivery provider tells us if an email bounces or is marked as spam, and we then stop emailing that address.
- Cookies and the Meta Pixel. Basis: your consent (art. 6.1.a), which you give or refuse in our banner. When you accept, GSX and Meta are joint controllers for collecting the Pixel data on our website and transmitting it to Meta. What Meta does with it afterwards is Meta's responsibility, under its own privacy policy.
- Payments. Basis: the contract (art. 6.1.b) and our legal obligations on accounting and tax (art. 6.1.c).
- The shop (when it opens). Basis: the purchase contract (art. 6.1.b). Shopify runs the checkout and Printful makes and ships the products.
- Photos and videos of the player in our communications. Basis: consent of the parent or legal guardian and, if the player is 14 or older, also of the player (art. 6.1.a). It can be withdrawn at any time.
- Safeguarding. If someone reports a concern about a minor, we record it and act on it. Basis: our legitimate interest in protecting minors (art. 6.1.f) and, where applicable, our legal obligations (art. 6.1.c).
- Protecting the website and forms against bots, fraud and abuse. Basis: our legitimate interest (art. 6.1.f).
- Meeting legal obligations, such as accounting and answering authorities. Basis: legal obligation (art. 6.1.c).
Automated decisions and AI. In the call application, an indicative score decides whether we show you the booking calendar right away; if not, someone from the founding team reviews your case personally and writes to you. We never make a decision with legal effects on you automatically. We use an AI assistant to prepare draft replies to emails: a person always reviews and sends them, and the provider does not use your data to train its models.
4. Minors
- If the player is a minor, the parent or legal guardian provides and authorizes the data and signs the contract.
- A player can give their own consent to processing based on consent from the age set by their country's law (14 in Spain; up to 16 elsewhere in the EU); below that age, the parent or guardian gives it. For image use we ask both: the guardian and, from 14, the player.
- Health data (for example, injuries) only with explicit consent (GDPR art. 9.2.a).
- Our website is not directed to children under 13. For a child under 13, only a parent may contact us. If we learn that we received data from a child under 13 without a parent, we delete it.
How we work with minors is set out in our Safeguarding Policy.
5. Who we share it with
We do not sell your data. We only share it with:
- Universities, college coaches and athletic programs you ask us to contact, always with your or your family's permission and, only if you ask us in writing, clubs you name.
- Our independent contractors (the founding team and the collaborators who work on your case), who may use it only for your case and must keep it confidential.
- Providers that work on our behalf, under the data processing terms each provider offers (we are formalising our data processing agreement with Zoho): Cloudflare (website, security, anti-bot, document storage and backups), Notion (information management), Zoho (email, and Zoho Sign for signing contracts), WhatsApp (messaging), Resend (email delivery), Cal.com (bookings and video calls), Anthropic (AI assistance to draft replies; it does not train on your data), and Shopify and Printful (shop, when it opens).
- Meta, only if you accept marketing cookies (see section 3).
- Our bank, Mercury, and the payment providers you use when you pay.
- Authorities, only when the law requires it.
6. International transfers
GSX Management LLC is a U.S. company. When you give us your data directly (in our forms, by email or by WhatsApp), that collection is not an international transfer under the European Data Protection Board's Guidelines 05/2021; the GDPR still applies to how we treat it, as this policy explains. When we send your profile to universities and coaches in the United States, we do it because you ask us to under your contract and with your explicit consent (GDPR art. 49.1.a and 49.1.b). Where a provider processes data outside the EU on our behalf, we use the safeguards the GDPR provides for, such as the European Commission's Standard Contractual Clauses, when the provider offers them. Our email is hosted in the EU.
7. How long we keep it
- Requests without a contract: 24 months after the last contact, then deleted.
- Clients: for the duration of the service plus 5 years, the period for possible claims.
- Invoices and payments: 7 years, for tax purposes.
- Backups: a monthly encrypted copy in Cloudflare R2, kept for 12 months. The monthly email only tells us the copy was made; it contains no data.
- If you unsubscribe from our emails, we keep only your email on the unsubscribe list, so we can honor it.
8. Security
The whole website is encrypted. Only the GSX team can access the data, with identity verification and individual permissions: each person sees only what they need. Documents are stored only in our systems, never in personal chats.
If a personal data breach occurs, we notify the supervisory authority of each EU member state where affected people live (within 72 hours where the GDPR requires it), and we tell you directly if the breach is likely to put you at high risk.
9. Your rights
You can ask to access your data, correct it, delete it, restrict or object to its use, take it to another provider (portability) and withdraw your consent at any time, without affecting what was done before. Email [email protected] with the subject "Privacy", or write to us at the address in section 1. We may ask you to confirm your identity, and we reply within one month.
If you believe we have not handled your request properly, you can file a complaint with a data protection authority: in Spain, the Agencia Española de Protección de Datos (aepd.es), or the authority of your EU country; outside the EU, the authority in your country.
10. Do you have to give us your data?
No one is obliged to. But the fields marked as required in our forms are needed to answer you, and the data for the process are needed to provide the service: without them, we cannot do it. Consent for marketing, cookies and image use is always optional.
11. Cookies
We only use what is essential for the website to work and, if you accept it, the Meta Pixel. Details are in our Cookie Policy.
12. Changes
If we update this policy, we change the date above. If the change is significant, we email everyone with an active process with us.
See also our Legal Notice and Terms of Use.