1. Data Controller
The controller of personal data processed within the sportovo.io application is the sports club to which the user belongs. The sports club determines the purposes and means of processing users' personal data and bears full responsibility for ensuring that processing complies with applicable law.
The company providing technical services for sportovo.io โ DO SYSTEM Sp. z o. o. (VAT: PL5783172339, KRS: 0001123243, REGON: 529455490, ul. Powstaลcรณw Warszawskich 7/2, 82-300 Elblฤ g, Poland) โ acts as a data processor under a data processing agreement concluded with each sports club using the platform. This means that user data is processed solely on documented instructions from the controller โ the sports club.
For questions about personal data processing, users should contact the administrator of their sports club directly. Administrator contact details are available in the application's settings panel.
2. Data Protection Officer
If the sports club has appointed a Data Protection Officer (DPO), their contact details are available from the club administrator. The DPO is available to users for all matters relating to the processing of their personal data and the exercise of their rights.
For matters relating to data processing by the sportovo.io platform operator โ DO SYSTEM Sp. z o. o. โ inquiries can be directed to: contact@sportovo.io.
3. Scope of Processed Data
In the course of using the sportovo.io application, we process the following categories of personal data:
- Identity data: first name, last name, date of birth, national ID number (if required by the club)
- Contact data: email address, phone number, residential address
- Membership data: role in the club (player, coach, guardian), category membership, event participation history
- Payment data: transaction history, payment statuses, reference numbers (payment card details are not stored in the sportovo.io system)
- Technical data: IP address, browser/device type, operating system, session data, access logs, location data (if consent has been given)
- Activity data: attendance at training sessions and matches, sports results, participation statistics
- Communication data: content of messages sent via the application's internal communication system
For users under the age of 16, data may only be processed with the consent of a parent or legal guardian. The club administrator is responsible for obtaining such consent before registering a minor user.
4. Purposes and Legal Bases for Processing
Personal data is processed for the following purposes and on the following legal bases:
- Providing application services โ basis: Art. 6(1)(b) GDPR (performance of a contract)
- User account management and identity verification โ basis: Art. 6(1)(b) GDPR
- Processing and settling payments โ basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR (legal obligation)
- Sending notifications and system messages โ basis: Art. 6(1)(b) GDPR
- Handling complaints and refunds โ basis: Art. 6(1)(b) and (c) GDPR
- Maintaining attendance records and sports statistics โ basis: Art. 6(1)(f) GDPR (legitimate interests)
- Club marketing and promotion โ basis: Art. 6(1)(a) GDPR (consent)
- Fulfilling accounting and tax obligations โ basis: Art. 6(1)(c) GDPR
5. Data Retention Period
Personal data is retained for the period necessary to fulfil the purposes for which it was collected, and no longer than:
- User account data: for the duration of the agreement and for 3 years after its termination (limitation period for claims)
- Payment data and financial documents: for 5 years from the end of the tax year in which the transaction was made (legal obligation)
- Activity and attendance data: for the duration of club membership and 2 years after its termination
- System logs and technical data: for 12 months
- Marketing data: until consent is withdrawn by the user
After the retention period expires, data is permanently deleted or anonymised in a way that makes it impossible to identify the individual.
6. Recipients of Data
Users' personal data may be shared with the following categories of recipients:
- Payment operators: PayU S.A., Stripe Inc., Klarna Bank AB โ to the extent necessary to process payment transactions
- IT service providers: companies providing hosting, cloud infrastructure, technical support, and notification services (Firebase, Pusher)
- Invoicing service providers: Fakturownia โ for issuing electronic invoices
- Public authorities: courts, prosecution, tax authorities, supervisory bodies โ solely under applicable law and to the extent required
- Other persons authorised by the club: coaches, supervisors, and club owners to the extent necessary for club management
7. Data Transfers Outside the EEA
Some technical service providers (including Stripe Inc., based in the USA) may process data outside the European Economic Area (EEA). In such cases, data transfer is based on standard contractual clauses approved by the European Commission or other mechanisms ensuring an adequate level of data protection pursuant to Art. 46 GDPR.
Upon request, the administrator can provide information about the safeguards applied when transferring data to third countries.
8. User Rights
Every user has the following rights regarding the processing of their personal data:
- Right of access โ the right to obtain information about which data is being processed and for what purpose
- Right to rectification โ the right to request correction of inaccurate or completion of incomplete data
- Right to erasure โ the right to request deletion of data ("right to be forgotten") where no other legal basis for processing exists
- Right to restriction of processing โ the right to request restriction of data processing in certain cases
- Right to data portability โ the right to receive data in a structured, commonly used format and to transmit it to another controller
- Right to object โ the right to object to processing based on legitimate interests
- Right to withdraw consent โ where processing is based on consent, the right to withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of the above rights, contact the club administrator or, for matters relating to the platform operator, the application support team. Requests are fulfilled without undue delay, within one month of receipt.
9. Cookies and Technical Data
The sportovo.io application uses cookies and similar tracking technologies for the following purposes:
- Necessary cookies: ensuring the application functions correctly, maintaining user sessions, and security (no consent required)
- Analytical cookies: enabling analysis of application usage in order to improve it (consent required)
- Functional cookies: remembering user preferences such as selected language and display settings (consent required)
Users can manage cookie settings in their browser or mobile device settings. Disabling necessary cookies may prevent the application from functioning correctly.
10. Data Security
We apply appropriate technical and organisational security measures to protect personal data from unauthorised access, disclosure, alteration, or destruction. In particular:
- All data transmitted between the user's device and our servers is encrypted using the TLS/SSL protocol
- User passwords are stored exclusively in encrypted form (hashing)
- Payment card data is not stored in the sportovo.io system โ it is handled directly by certified payment operators (PCI DSS compliant)
- Access to personal data is restricted to authorised personnel only, to the extent necessary for their duties
- We regularly conduct security tests and system audits
11. Data of Minors
The sportovo.io application may process personal data of persons under the age of 16 only with consent given by parents or legal guardians. Registration of an account for a minor requires confirmation by the person with parental responsibility.
If we become aware that we have collected personal data from a person under the age of 16 without appropriate consent, we will take steps to delete such data.
12. Changes to the Privacy Policy
We reserve the right to make changes to this Privacy Policy. Users will be notified of any material changes via the application or by electronic means, with sufficient advance notice to allow them to review the new provisions.
Continued use of the application after the amended Privacy Policy takes effect constitutes acceptance of the changes.
13. Supervisory Authority and Contact
If a user considers that the processing of their personal data infringes applicable law, they have the right to lodge a complaint with the relevant supervisory authority โ in the UK, the Information Commissioner's Office (ICO); in Ireland, the Data Protection Commission (DPC); or the supervisory authority in the EU member state of their habitual residence or place of work.
For all matters relating to personal data protection, please contact the sports club administrator. Administrator contact details are available in the application's settings panel.