Made on
Tilda
This policy explains how personal data is handled in Sportity Admin: the apps for iPhone, iPad, Mac and Android; the web app at admin.sportity.org, fs.sportity.com, fim.sportity.org and other Sportity Admin addresses; versions of it branded for a particular organisation; and the public registration, sign-up and invitation pages it serves. The Sportity app for participants has its own privacy policy.
Sportity OÜ ("Sportity", "we"), Paasukese 13, Tabasalu, Harju County 76911, Estonia, runs Sportity Admin. Our Data Protection Officer can be reached at [email protected].
We are the controller, the party that decides how and why data is used, for:
Your club, federation or competition organiser is the controller for the records it keeps in Sportity Admin: members, athletes, teams, registrations, form answers, accreditation, documents and messages. For these records Sportity is a processor: we handle the data only to provide the service, and only on the organisation's instructions. Several organisations can hold records about the same person for different purposes, for example a club that registers an athlete and the organiser of the competition it registers them for.
Each organisation should explain in its own privacy notice why it collects your data, its legal basis and how long it keeps the data. Ask the organisation first about those records. If you write to us instead, we'll help you find the right organisation and pass your request on.
Accounts and access. Your name, email address, profile photo and password; the organisations and competitions you can access; your roles, invitations and notification settings. Most accounts are Sportity accounts. They are held by Sportity's sign-in service (auth.sportity.org) and also work in other Sportity apps. Each Sportity Admin deployment keeps its own copy of your name, email address and access.
People and registrations. Name, date of birth, sex, nationality, email address, phone number, photo, guardian relationships, memberships, teams, equipment, categories, entry status and start numbers.
Forms and files. Answers to registration forms and other forms, including earlier versions kept as history, and uploaded files such as photos, documents and music. Organisations design their own forms, so a form may ask for more, including sensitive information such as health data. If it does, the organisation needs a lawful basis for asking and should tell you why it asks.
Competition activity. Accreditation badges with a photo and QR code; access and meal entitlements, and the meals used; document views, acknowledgements and feedback; messages between clubs and organisers; and a record of who submitted, changed or reviewed something, and when.
Technical data. IP address, browser or device type, sign-in attempts, sign-ins and security events, email delivery records, and server logs, which can include your email address and IP address. For data stored on your device and used for notifications, see "Your device" below.
Sources. Data comes from you; from your club, federation or competition organiser; from parents, guardians or others acting for you; and from records an organisation imports, including from systems it used before. Technical data is created when you use the service.
Public registration links. Clubs normally register athletes through their Sportity Admin accounts. An organiser can also publish a registration as a public web link, which anyone can fill in without an account. We receive what you enter there, including any file you upload, even if you don't finish the form, and we email you a confirmation.
Organisations use their records to manage members and entries, check eligibility, review forms, communicate, share documents, issue accreditation and meals, and produce results and exports. Each organisation is responsible for explaining its own legal basis.
Where we are the controller, the purposes and legal bases are:
| Purpose | Legal basis under the GDPR |
|---|---|
| Create and manage accounts and access, provide the service, send service emails (invitations, verification, confirmations) and the notifications you choose, and answer support requests | Our legitimate interest in providing a working service to organisations and the people who use it (Art. 6(1)(f)) |
| Protect accounts, limit repeated failed sign-ins, and investigate faults and misuse | Our legitimate interest in keeping the service secure and reliable (Art. 6(1)(f)) |
| Handle privacy requests and meet other legal duties | Legal obligation (Art. 6(1)(c)) |
You can object to processing that relies on legitimate interests; see "Your rights" below.
No part of Sportity Admin sends data to AI services, and we don't use personal data to train AI models.
Automatic rules. An organisation can set rules, for example by age, sex or discipline, that decide which categories and events a person can be entered for. It can also let some entries or sign-ups be approved automatically once conditions it has set are met. The organisation owns these rules. If a result affects you, ask the organisation to explain it or to have a person review it.
| Provider | What it does | What it receives |
|---|---|---|
| DigitalOcean | Servers, database and file storage, in Frankfurt, Germany | Everything stored in the service |
| Cloudflare | Delivers the web app for some deployments | Web requests, including IP address and browser details |
| Twilio SendGrid | Sends email | Recipient address, message content, delivery status |
| Google Firebase Cloud Messaging and Apple Push Notification service | Deliver push notifications | Push token, installation identifier, notification text |
| Google and UNPKG content networks | Deliver parts of the web app's software | Web requests, including IP address and browser details |
Notification emails can contain participants' names and short previews of messages. Push notifications contain only counts and the names of the competition and organisation, never participants' names or message text.
Each provider works under a data processing agreement. The agreement requires it to protect the data at least as well as this policy does, and to use the data only to provide its service to us.
We don't sell or rent personal data. Documents and forms can link to other websites, which have their own privacy policies.
Our database and files are stored in Frankfurt, Germany. Email delivery, push delivery, web delivery and our providers' support can involve processing in the United States and other countries outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses in our agreements with the provider. For details, write to [email protected].
You can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict its use or object to it, and ask to receive it in a portable format.
To make a request, write to [email protected] from the email address on your account. Say what you would like, and which organisation or competition it concerns. Never send your password. We'll answer within one month, or tell you within that month if we need longer, as the law allows. We may ask you to confirm your identity. If we have to keep some data, we'll tell you what we keep and why.
You can also ask an organisation directly about the records it controls. If you write to us about them, we'll pass your request on and help the organisation respond.
You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, [email protected], www.aki.ee) or to the data protection authority where you live or work.
The app doesn't have a delete button yet. To delete your account, email [email protected] from your account's email address. Tell us whether you want to leave Sportity Admin only, or to delete your Sportity account everywhere, which also ends your access to other Sportity apps. We'll confirm when your account has been deleted.
Deleting your account doesn't delete the records an organisation keeps about you as a member or participant; ask the organisation about those. An organisation's administrators can also remove your access to that organisation at any time.
Sportity Admin is a tool for organisations; it isn't meant for children to use on their own. Organisations do keep data about young athletes in it. Each organisation is responsible for collecting that data lawfully, including getting a parent's or guardian's consent where the law requires it. Recording a guardian in Sportity Admin doesn't by itself show that consent was given. A parent or guardian can contact the organisation or us about a child's data.
You need to give your name and email address to have an account. What else is required depends on the organisation and its forms; if you don't provide it, the organisation may not be able to accept a registration. Notifications, camera access and photo access are optional.
When we change this policy, we'll update the date at the top. Before a significant change takes effect, we'll tell you in the app or by email.