1. Data Controller

The controller of personal data processed in the sportovo.io mobile application (available on the App Store and Google Play) is the sports club to which the user belongs. The club determines the purposes and means of data processing and bears full responsibility for compliance with applicable law.

DO SYSTEM Sp. z o. o. (VAT: PL5783172339, KRS: 0001123243, REGON: 529455490, ul. Powstańców Warszawskich 7/2, 82-300 Elbląg, Poland) acts as data processor under a data processing agreement with each club. For data-related queries contact your club administrator or: contact@sportovo.io.

2. Data We Collect

The mobile application may collect and process the following data:

• Account data: name, email address, phone number, date of birth, role in the club
• Device technical data: device model, operating system (iOS/Android) and version, unique device identifier, screen resolution, system language
• FCM token: Firebase Cloud Messaging token used to deliver push notifications to your device
• Activity data: training and match attendance, payment history, club messaging
• Location data: only if explicitly granted via OS settings
• Camera data: only if permission is granted and the feature is used (e.g. profile photo)

The app does not use browser cookies.

3. App Permissions

• Push notifications — required to receive club notifications; manageable in device settings
• Camera — optional, for profile photo upload
• Location — optional, if the club uses geolocation features
• Storage — optional, for saving/reading shared files

Denying optional permissions does not prevent use of core app features.

4. Purposes of Processing

• Providing app services and account management — basis: Art. 6(1)(b) GDPR
• Sending push notifications via FCM — basis: Art. 6(1)(b) GDPR
• Payment processing — basis: Art. 6(1)(b) and (c) GDPR
• Attendance records — basis: Art. 6(1)(f) GDPR
• Club marketing and communication — basis: Art. 6(1)(a) GDPR (consent)
• Security and fraud prevention — basis: Art. 6(1)(f) GDPR

5. Retention Periods

• Account data: for contract duration + 3 years after termination
• FCM token: until logout or app uninstall
• Payment data: 5 years from end of tax year of transaction
• Activity data: for membership duration + 2 years
• Technical logs: 12 months

6. Recipients of Data

• Apple Inc. — as iOS app distributor (App Store); subject to Apple's own privacy policy
• Google LLC — as Android app distributor (Google Play) and Firebase Cloud Messaging provider for push notifications
• Payment operators: PayU S.A., Stripe Inc., Klarna Bank AB
• IT infrastructure providers: hosting, cloud, technical support
• Public authorities: only as required by law

7. International Data Transfers

Firebase (Google) and Stripe may process data outside the EEA. Transfers are based on Standard Contractual Clauses approved by the European Commission under Art. 46 GDPR.

8. Your Rights

You have the right to access, rectify, erase, restrict processing, data portability, object to processing, and withdraw consent. Requests are handled within one month. You may also lodge a complaint with your national data protection authority.

9. Security

All communication between the app and servers is encrypted via TLS/SSL. Passwords are stored only in hashed form. Payment card data is not stored in the sportovo.io system — it is handled by PCI DSS-certified payment operators.

10. Minors

The app may process data of persons under 16 only with parental or guardian consent. The club administrator is responsible for obtaining such consent.

11. Changes

We notify users of material changes via push notification or email. Continued use after changes take effect constitutes acceptance. The current version is always available at the link provided in the app.