Privacy notice of the club platform

1. Data controller

PreciseSoft is the controller of account and club data. For any request: developer@precisesoft.it.

For the data of a tournament's players the controller is the club that organises it, and PreciseSoft processes them on its behalf (see the terms of use). For that data you can contact the club or us: we forward the request to the club.

A tournament among friends is organised by a group of people, not by a club: for the data of its players the controller is whoever organises it, and PreciseSoft processes them on their behalf in the same way.

2. What we collect

Accounts (people who manage a club or organise a tournament among friends): email address, name, language; the password only as a hash (PBKDF2 with salt and a server secret), never in clear; with Google sign-in, the Google account identifier, the email and the name Google gives us.

Sessions: for each open sign-in a short description of the device (for example "Edge · Windows") and the dates it was opened and last used.

Clubs: the data written by whoever registers them (name, address and position on the map, description, courts and facilities, contacts, affiliation, rules) and the images they upload. The president's name and the tax code or VAT number are never public; the club's email and phone are public only if the club chooses so.

Tournaments among friends: the group name and the time zone, besides what applies to every tournament. They are private: the page opens only with its link and does not enter lists, search, the map or search engines.

Tournaments: the data written by the organisers (title, dates, rules, entries, contacts) and the images they upload; the member list, if the club uses it, with first name and surname only; the matches with date, time and court, the results (retirements and walkovers included), the standings and the draw, which appear on the public tournament page with the name in the competition; the history of result corrections (who, when and why), seen only by those who run the tournament; the players' result proposals, with confirmations, disputes and their notes, seen by the players of the match and by those who run the tournament; the organisers' messages to the players.

Players, without an account: first name and surname, year of birth (needed for the age rules and never public), language and, if you leave them, email and phone (only the tournament organisers see them). The name in the draw appears on the tournament's public page; the photo, if you upload one, only from age 14, next to the name. We also keep what you declare when entering (that you have read this notice and, from 14 to 17, a parent's consent) and, for under-14s, that the club has the parents' consent; and the tournament notices you read on your personal page (results to confirm, schedules, next matches, organisers' messages). We keep the personal link only as a hash: the server can recompute it with a secret of its own, to put it in the notice emails. The first name, last name, year of birth and, if they write it, the email of a doubles partner or of teammates are left by whoever enters the pair or the team: each of them receives their own link and confirms, or says no; until they confirm (or the organizer does it for them), their name does not appear on the public pages.

App: if you enter from the TennisScore app, or link your phone from your personal page, we keep the anonymous identifier the app receives from its sign-in service (Firebase), to recognise you next time. No other data from the phone.

Images: we reduce them and remove their metadata (for example a photo's GPS position) before storing them.

Security: a log of the operations that matter (sign-ins, changes to clubs and tournaments, entries, draws, results, invitations, deletions) with date, author and a hash of the IP address computed with a server secret; we do not keep the IP address in clear.

3. Location, addresses and maps

"Near me" uses your device's location only inside the browser, after your permission, to sort clubs by distance: we send it to no one, not even to us.

When you register a club, the address you write goes from our server to the Photon (komoot) and Nominatim (OpenStreetMap Foundation) services to find its coordinates. Your browser does not contact them and they receive no data identifying you.

Maps use OpenStreetMap data distributed by OpenFreeMap: they go through our server, and your browser does not contact third parties.

4. Why and on what basis

Creating and managing the account and the club pages, and sending service emails (address confirmation, password recovery, invitations) and, to those who run a tournament, the tournament notices and one summary a day when there is something to do: performance of the service you ask for (art. 6.1.b GDPR).

Entering players in tournaments, showing the participants, sending the personal link and the tournament notices (on the personal page and, to those who left an email, by email: a result to confirm or disputed, schedules, the next match, the start, end or cancellation of the tournament, the organisers' messages): performance of the service the player asks for by entering (art. 6.1.b), on behalf of the organising club. No newsletters and no advertising.

Protecting the platform (attempt limits, operations log): legitimate interest (art. 6.1.f).

Keeping, for fifteen years after archiving, the tournaments' entries, matches and results with the players' names, as the club's sporting history (roll of honour, results, standings), and keeping the data of those who mark themselves as retired players: legitimate interest of the organising club (art. 6.1.f), which you can object to by writing to the club or to us (art. 21).

We do no advertising or profiling and we do not sell data.

5. Where the data is and who processes it for us

Cloudflare (servers, database and images): database and images stay in the European Union jurisdiction; pages are served by the Cloudflare data centre closest to the visitor, also outside the Union.

Resend (sending emails): sends from the European region, but keeps email data (recipient, content, outcome) in the United States, for thirty days.

Google: only if you choose to sign in with Google, and only for signing in. For app users, the anonymous identifier comes from the app's sign-in service (Google's Firebase), under the app's privacy notice: we only check that the app's code is genuine, with Google's public keys, without sending them any data. Facebook (Meta): in the same way, only if you choose to sign in with Facebook, and only for the sign-in: we receive the identifier, name and email of the profile; the link can be removed from the account, and a deletion request made from the Facebook settings reaches us, removes the link and deletes the account if it was the only way to sign in.

Cloudflare and Resend are US companies: transfers to the United States are covered by the EU-U.S. Data Privacy Framework, which both have joined, and by the European Commission's standard contractual clauses.

6. How long we keep it

The account until you delete it. On deletion, name, email, password, sign-in methods, sessions and roles (tournament ones included) are removed at once; the operations log stays for at most two years, without name or email.

Sessions last fourteen days from their last use; email links one hour (password recovery, ownership transfer), twenty-four hours (address confirmation) or seven days (invitations).

A player's personal link is valid until two months after the end of the tournament; at that point the finished (or cancelled) tournament is archived automatically.

The email and phone left for a tournament are deleted six months after its end.

Entries, matches and results stay with the tournament, archived too, as the club's sporting history: fifteen years after archiving, the players' names become initials, and the tournament's consents and messages go away; the profile of a person who has no tournaments with the full name left becomes initials too, without year of birth, photo and links.

A tournament among friends does not become sporting history: 24 months after it ends it is deleted entirely, with entries, matches, results, proposals, notices and messages, and with the profiles of players who have no other tournaments; the organisers can delete it earlier, from the tournament page, once it is over or cancelled. The fifteen years apply only to club tournaments.

The history of result corrections, closed result proposals, organisers' messages and the operations log are kept at most two years; the notices on the personal page and on the organisers' page, six months.

Invitations and ownership transfer requests, with the address they went to, are removed thirty days after they expire.

Emails stay in our queue at most thirty days, sent or not; Resend keeps their data for thirty days.

Images no club, tournament or player uses any more are deleted the following night.

The service's technical logs (addresses of the pages requested, IP address) are kept by Cloudflare for at most three days.

7. Your rights

You have the rights of arts. 15-21 GDPR: access, rectification, erasure, restriction, portability, objection. From your account page you download all your data in a file and delete the account; you edit club and tournament data from their pages.

If you play without an account, from your personal page (the entry link) you change your contacts, upload or remove your photo, withdraw from a tournament, make a new link, download your data for that tournament in a file and mark yourself as a retired player: [R] appears before your name in every tournament you have taken part in so far, and the data stays for the periods given above. While you are entered in a tournament that is not over, marking yourself as retired waits (withdraw from that tournament first, or wait for the end). To delete your data, or for any other request, write to the club organising the tournament or to us: we forward the request to the club.

For anything else write to developer@precisesoft.it: we answer within thirty days. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).

8. Cookies and browser storage

We only use technical cookies, needed by the service: the session (__Host-tps, fourteen days), a Google sign-in in progress (__Host-tps-g, ten minutes) and the chosen language (lingua, one year). No third-party cookies, no analytics, no advertising. The sign-in with Facebook in progress uses __Host-tps-f (ten minutes) in the same way.

If you tick "Remember my details on this device" in a tournament entry form, the browser keeps in its local storage (tps-profilo) first name, surname, year of birth, email, phone and a code that lets us recognise your profile at the next tournament. It is not a cookie: it stays in the browser and reaches us only when you enter. You remove it from your personal page ("Forget my details on this device") or by clearing the site's data in the browser.

9. Children

Accounts are for people who manage a club on behalf of an association or sports company, or who organise a tournament among friends, and are reserved for adults.

In tournaments: under 14, only the club can enter a player, collecting the parents' consent; from 14 to 17, whoever enters declares they have the consent of a parent (or guardian), and the organisers see the entry flagged. A photo can be uploaded only from age 14; the year of birth is never public.

10. Changes

Changes to this notice are published here, with the date updated at the top.

11. Push notifications and usage statistics

Whoever asks for it with the "Alert me on this device" button receives the same communications as the emails as browser notifications (Web Push). We keep the subscription address given by the browser's push service (Google, Apple or Mozilla, depending on the browser) and its keys, tied to the personal link or to the account; the content of the notifications is encrypted and the push service cannot read it. The subscription is removed with the same button, goes away by itself when the personal link expires or the account is deleted, and after five failed deliveries.

The public pages of clubs and tournaments count how many times they are opened, how many people arrive from the QR Code and how many registrations and results come from the web and from the app: daily counts, without IP addresses or identifiers of people, kept for two years. They are not personal data and use no cookies.