Privacy policy

1. Who processes your data

Data the club enters (players, parents and guardians, coaches, staff, groups, attendance, membership fees, health data): the controller is the sports club you belong to or work with. Sportevo processes that data on behalf of the club as its processor, under the Data Processing Agreement. Questions and requests about that data go to the club; we help the club answer them.

Account and technical data (email address, password, device identifier for notifications, technical and error logs, the log of access to minors' data, data needed to bill the club, the record of Data Processing Agreement acceptances): the controller is Marko Pešić, 7.JULA 6, Smederevo, email privacy@sportevo.app. No data protection officer has been appointed.

2. What data we process

• Account: email address, password (hashed), role in the club, invitation code.
• Data Processing Agreement acceptance: the account and email of the person who accepted it on behalf of the club, the club's name, the agreement version and the time of acceptance.
• Players: name, date of birth, gender, nationality, photo, contact details, group, jersey number and position, joining date, membership type and fee, attendance and event RSVPs, a short message to the coach that a parent may add when saying the child is not coming (seen by the club's owner and the coaches of that session), charges, payments and debts with their amounts (no payment card data).
• Player health data, only with explicit consent: allergies, chronic conditions, medical exam documents. Height, weight and dominant foot are not health data.
• Parents and guardians: name, email, phone, relationship to the child.
• Consent records: status, text version, time given and withdrawn, IP address and device at the time of consent, or which club user confirmed that the club holds a written consent.
• Events: name, type, time and venue address. We do not track your location.
• Notifications and technical data: device push token, notification history, activity and error logs. The website uses no tracking cookies.

3. Purposes and legal basis

• Running membership, groups, training, events, attendance and fees: performance of the membership contract (ZZPL Art. 12(1)(2); GDPR Art. 6(1)(b)) and the club's legal obligations under the Serbian Law on Sports (ZZPL Art. 12(1)(3); GDPR Art. 6(1)(c)).
• Player health data: explicit consent of the parent or guardian (ZZPL Art. 17(2)(1); GDPR Art. 9(2)(a)), which can be withdrawn at any time.
• Security, access and error logs, proof of consent and of Data Processing Agreement acceptance: legitimate interest (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).
• Showing the club whether a club announcement was opened in the app (not when; not shown for children with their own account): the club's legitimate interest in knowing that members received important information (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).
• Push notifications: the permission you grant on your device and can revoke in its settings.

4. Minor players

Minor players generally have no account; a parent or guardian represents them in the app. Before a child is entered, the club obtains parental consent in one of two ways: through an email request the parent confirms via a link, or in writing kept by the club, where the club collects consent on paper. A child's health data is entered only with a separate explicit consent, distinct from the consent to membership; declining it does not affect membership, and withdrawing it deletes that data.

Once a child turns 9, a parent or guardian may give the child their own account by sending an invitation from the app to the child's email. Sending the invitation is the parent's consent, recorded with the time, IP address and device. In the app the child sees only their own groups' trainings, events and announcements, receives reminders and confirms attendance; the child does not see payments, health data or other players' data and cannot edit the profile. The parent can revoke access at any time, which deletes the child's account. When the child turns 18, the account becomes an adult player's account.

A parent or guardian can correct the child's first name, last name and date of birth in the app. Error reports from a child's account carry no account data.

5. Recipients and transfers abroad

We do not sell data. It is processed only by the providers the service cannot run without:

• database, authentication, file storage and server functions: Supabase, processed in the EU (Frankfurt);
• email delivery: Mailgun, processed in the EU;
• push notifications: Expo (USA), delivered to the phone through Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS); they receive only the device token and a generic notification text, and the app fetches the full text from the database in the EU;
• error logging: Sentry, processed in the EU;
• website and web app hosting: Vercel (USA), server functions in the EU (Frankfurt);
• address search, only for event venues: Google Places (Google, USA), which receives the search text.

Supabase, Mailgun, Sentry and Vercel process data in the EU, whose member states are parties to the Council of Europe Convention (ZZPL Art. 64(2)). Only the device token and a generic notification text (Expo, and through it Google and Apple) and the address search text (Google Places) go to the USA. Expo and Google LLC are certified under the EU-U.S. Data Privacy Framework, for which the EU has found an adequate level of protection (ZZPL Art. 64(2)); Expo is responsible for the onward transfer to Apple.

6. Retention periods

• Account and profile: while you use the account; deleted within 30 days of a request.
• Player data: for the duration of membership; deleted within 30 days after it ends.
• Health data: immediately on withdrawal of consent or end of membership.
• Consent records: 5 years after membership ends, as proof of lawful processing.
• Data Processing Agreement acceptances: while the agreement with the club lasts and 5 years after it ends, as proof of the agreement.
• Activity log and notification history: 12 months.
• A parent's message with a decline: deleted from the attendance record 30 days after the session; it stays in the coaches' notification history for 12 months.
• Charges and payments: together with the player data. The app does not collect or receive money; the club only records payments in it.

The account deletion procedure is on the Delete account page.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent, and the right to complain to the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs). Send requests to the controller named in section 1; you get an answer within 30 days.

8. Security

Data is encrypted in transit and at rest; access is role-based and enforced in the database; minors' data without a recorded consent is not visible to coaches and staff; access to minors' data is logged.

9. Changes and contact

We notify you of material changes to this notice in the app or by email; the date and version are at the top of the page. Contact for data questions: privacy@sportevo.app.