Data protection impact assessment (PIA/DPIA) - STATIQ, draft
Version 0.9 (draft for legal review) · Owner: JIWA HOLDING AS · §15.6
1. Description of processing
STATIQ lets adult coaches and parents record basketball statistics, check quality and share reports within their subscription features. Data subjects are the account holder and players, often minors. By default, player data is limited to jersey numbers, optional nicknames and performance data. The Personal owner may optionally import first and last names into a separate protected roster after an active per-team policy and explicit importer confirmation. Birth data, licence flags, images, location and health data are prohibited in Personal import. Primary data must be stored in the EU; the app works offline with encrypted local storage. Suppliers may nevertheless entail transfers outside the EEA, requiring a documented transfer basis and necessary supplementary measures.
2. Necessity and proportionality
- Purpose: give amateur teams accurate, verifiable statistics. The controller considers whether team totals, less player data or shorter retention meet the need. Paper and spreadsheets may be alternatives; necessity and privacy depend on actual use.
- Minimization: statistics and reports use jersey numbers, nicknames and internal IDs; optional names remain in the protected roster with limited access and expiry; operational metrics never use player names; no third-party analytics.
- Storage limitation: the retention schedule distinguishes controls enforced in the codebase, supplier settings and missing controls that block launch. Account deletion and player anonymization have an outer limit of 30 days, sharing links default to 7 days with a maximum of 30, and STATIQ's minimized audit events are deleted after 365 days.
- Rights: access/correction/export/deletion/anonymization/revocation are built into the app.
3. Roles
JIWA HOLDING AS is the controller for accounts, security and operations. Responsibility for player data follows actual use, not the subscription name. When recording on a club’s behalf, the club is normally the controller and the recorder acts under its authority. JIWA’s processing of player data on the club’s behalf must be covered by documented instructions and a data processing agreement, including when the club uses Personal.
When recording on their own initiative outside purely personal or household use, the account holder is normally the controller. Purely personal or household use may fall within the household exemption; purpose, extent and sharing determine this. JIWA remains subject to data protection law. Storage and statistics under the user’s instructions support a processor role, while JIWA’s own purposes are assessed separately.
The controller establishes a legal basis for each purpose and informs players and relevant guardians. Legitimate interests may apply after assessing necessity, expectations and the child’s interests. Consent is not a universal requirement; if chosen, it must be valid and withdrawable. The customer’s contract with JIWA does not automatically provide a basis for other players’ data. Name imports still require an active team policy and the importer’s responsibility declaration, which is not the players’ consent. Limited private use of one’s own child’s data does not automatically permit processing teammates’ data or further publication.
Assessment of 8 October 2026: EDPB on actual roles, GDPR Article 2 and Recital 18 and Datatilsynet on legitimate interests.
4. Risk assessment
| Risk | Likelihood | Impact | Measures | Residual risk |
|---|---|---|---|---|
| Unauthorized access across teams | low | high | RLS on all tables, cross-workspace tests without revealing existence | low |
| Exposure through shared report links | medium | medium | 256-bit token stored only as a hash, expiry 7/30 days, revocation, noindex, rate limiting | low |
| Profiling children | low | high | protected names are separate from statistics and sharing; no Personal birth data; no product analytics of player data; purpose restriction in terms | low |
| Lost device with local game data | medium | medium | SQLCipher + Keychain; completed game copies with server-confirmed events are removed at startup, on returning to the foreground and every hour while the iOS app is active. A stopped or suspended app cleans up on its next run. Unconfirmed data is retained | medium |
| Leaks through logs | low | medium | mandatory redaction and no bodies; 30/90/365-day limits must be configured and evidenced on every platform | medium |
| Payment data | low | high | never stored with us (Apple/Stripe), subscription status only | low |
| Missing deletion | medium | high | access blocked immediately on account deletion; run_retention covers core active data; measurable go-live requirements cover inactive Free, local data, dead-letter, abandoned registration, webhook receipts, privacy evidence, accounting and backups | medium |
Numbers, nicknames, teams and games can still identify a player. A valid report link permits reading and downloading without an account; revocation does not remove downloaded copies. Limit recipients and retention to the purpose. Ongoing assessment of children’s skills can carry greater risks than a single game report and needs specific assessment. Absence of AI or names does not establish absence of profiling. The table’s risk ratings assume that access controls, retention and terms of use are followed in practice.
5. Conclusion and follow-up
Controls for inactive Free accounts, abandoned registration, dead-letter data and privacy evidence are implemented and tested in the codebase. Privacy evidence uses 3 calendar years from case closure in UTC. iOS removes completed, server-confirmed game copies at startup, on returning to the foreground and every hour while the app is active; unconfirmed data is retained. Operational evidence for Jobs, retention and supplier log limits is reconciled in the operations records. Daily database backups with 7 days of retention have been selected. Isolated functional recovery and earlier provider recovery are separate evidence; they do not demonstrate a new production recovery of the latest schema. Paid sales are off. Diagnostic timestamps and duplicate review evidence are minimised after 365 days. Necessary event IDs, digests, bindings and financial fields remain for settlement and replay protection. They are deleted when historical inputs are closed, active/unresolved claims are settled and the applicable accounting period has expired; necessity is reviewed annually. Local controls are implemented; a completed ordinary retention run is not fully attested here. See the canonical retention schedule for details. This is technical status, not legal approval.
The roles and legal-basis assessment above is documented for adult coaches and parents, with conditions for actual use. Each customer’s authority, legal basis, information, recipients and deletion period relate to their activity and instructions. Supplier agreements and transfer mechanisms are described in the supplier register. This does not approve every use or constitute a completed review of all countries. JIWA HOLDING AS reconciles the assessment, agreement scope and operational evidence before public launch. Draft status remains until the combined legal delivery is complete.
Optional product analytics (2026-10-05)
These data are linked to your account and available only to the platform administrator with two-factor authentication. The purpose is to improve the product, based on your voluntary consent. Country is your own selection, not GPS or inferred from an IP address. No analytics SDK, analytics cookies, screen recordings, keystroke content or player data are included. Your choice is saved to your account. Measurements are deleted after 90 days, immediately on withdrawal or when you request account deletion. Your measurements are included in your account export. Name, email, access and last known sign-in are used separately for necessary access administration.