Privacy Policy

1. Controller and contacts

Data controller: DorsalCUP (dorsalcup.com). For any privacy question or to exercise your rights: [email protected].

2. What data we process

• Organiser accounts: email, name (optional), language, password (stored irreversibly), second authentication factor data (encrypted), registration and last access dates, acceptance of the terms (version and date) and, if you choose it, the newsletter subscription.
• Managers of invited teams: the invitation email and any emails the team adds to share access; temporary access codes.
• Match delegates: the label chosen by the organiser (we recommend "Pitch 1" or similar, not the person's name) and access by PIN or QR code.
• Technical data: IP address and browser type in sessions and server logs; approximate country (from the IP) to choose the language. In the action history, the IP is truncated.
• Alerts on a tournament's public page ("Notify me"): if you turn them on, your browser's push subscription (technical address and encryption keys, no name or email), kept until 7 days after the tournament ends or until you turn them off.
• We do not process: data about players or coaches (names, dates of birth, photographs, contact details, licences), payment data or health data. We ask that they are not entered on the platform.

3. What we use the data for and on what legal basis

• Providing the service (accounts, tournaments, invitations, registrations, email notifications): performance of the contract you accept when using the platform (Article 6(1)(b) GDPR).
• Security, abuse prevention, rate limiting and logging of actions taken within organisations: legitimate interest in protecting the service and its users (point (f)).
• News by email: only with your consent, which you can withdraw at any time (point (a)).
• Complying with legal obligations, such as requests from authorities (point (c)).
• We do not sell data, do not use it for personalised advertising, and do not carry out profiling or automated decision-making.

4. How long we keep it

• Account: for as long as it exists. It is deleted at your request or after 24 months without use (with notice 30 days beforehand).
• Emails of team managers and invitations: up to 12 months after the end of the tournament; club names and results remain.
• Sessions: expire after 30 days and are deleted; access codes and links: between 15 minutes and 24 hours.
• Action history: without emails and with the IP truncated.
• Server technical logs: rotated automatically within a few days.
• Backups: hourly backups kept for 48 hours on the server, a copy taken before each software update kept for up to 30 days, and up to 6 months in an encrypted external copy; they are then deleted automatically.

5. Who receives the data

• The organisers of a tournament see the emails of the managers of the teams they invited.
• Providers that help us deliver the service, under a data processing agreement: OVHcloud (server hosting, in a data centre in the United Kingdom) and Cloudflare (network, protection, page delivery and email sending).
• Authorities, when required by law.

6. Transfers outside the European Union

• The server is hosted in the United Kingdom, a country with an adequacy decision from the European Commission (renewed in December 2025, valid until December 2031): its level of protection is considered equivalent to that of the European Union.
• Cloudflare, Inc. is a United States company certified under the EU-US Data Privacy Framework; transfers are also covered by standard contractual clauses approved by the European Commission.

7. Your rights

You can request access, rectification, erasure, restriction and portability, and object to processing, as well as withdraw any consent given. Write to [email protected]; we reply within one month at most. You can also delete your account directly under Account → Delete my account.

You have the right to lodge a complaint with the data protection authority of your country of residence, for example: Comissão Nacional de Proteção de Dados (www.cnpd.pt), Agencia Española de Protección de Datos (www.aepd.es), the Information Commissioner's Office (www.ico.org.uk), CNIL (www.cnil.fr), the data protection authority of your federal state in Germany, or the Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Security

Encrypted connections (HTTPS), passwords stored irreversibly, mandatory second factor for platform administration, encrypted secrets, encrypted backups, isolation between organisations and logging of actions. In the event of a data breach that poses a risk, we notify the supervisory authority within 72 hours and, where necessary, the people affected.

9. Minors

Accounts are only available from the age of 16. The platform does not collect data about players, many of whom are minors.

10. Cookies

We only use cookies and local storage that are essential for the platform to work. Details in the Cookie Policy.

11. Changes

If we change this policy significantly, we will let you know on the platform or by email before the change takes effect.