The ManageSportClub Platform
This Policy explains how CAMPUS TIRO S.R.L. processes personal data, in accordance with EU Regulation 2016/679 (GDPR) and applicable national legislation (Law no. 190/2018, Law no. 506/2004).
1. Data Controller
CAMPUS TIRO S.R.L.
Registered office: Bucharest, Sector 5, Strada Sănduliţa, Nr. 53 · CUI: 42302675 · Trade Registry: J2020002561406
E-mail: [email protected] · Phone: 0723240112
Data Protection Officer (DPO): Arapalea Iulian, e-mail [email protected].
2. Our Role: Controller and, Separately, Processor
This distinction is essential for our platform:
a) We act as Controller for data related to the Client's use of the Platform, namely:
- the data of the persons who create and manage the club's Account (representatives, administrators);
- billing data;
- Platform usage data.
b) We act as Processor for the Club Members' data that the Client (the sports club) enters into the Platform. In this case, the Club is the Controller and decides the purposes of processing; we process this data only in accordance with its instructions and the Data Processing Agreement (DPA). To exercise rights regarding this data, data subjects should contact the relevant club in the first instance.
This Policy details the processing operations for which we act as Controller.
3. What Data We Process
3.1. Account and contact data: name, surname, club name, position, e-mail, phone, authentication data.
3.2. Billing data: entity name, CUI/CIF, address, payment data (processed by the payment provider; we do not store full card details).
3.3. Usage data: IP address, device and browser type, access logs, actions performed in the Platform.
3.4. Cookies and similar technologies: as described in section 9.
3.5. Communications: messages sent to our support team.
4. Purposes and Legal Bases of Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing the Account | Performance of a contract (art. 6(1)(b)) |
| Provision and operation of the Platform | Performance of a contract (art. 6(1)(b)) |
| Invoicing and tax/accounting obligations | Legal obligation (art. 6(1)(c)) |
| Technical support and service communications | Performance of a contract / legitimate interest (art. 6(1)(b)/(f)) |
| Platform security, fraud prevention | Legitimate interest (art. 6(1)(f)) |
| Service improvement, statistics | Legitimate interest (art. 6(1)(f)) |
| Marketing communications (newsletter) | Consent (art. 6(1)(a)) |
| Defense of rights in disputes | Legitimate interest (art. 6(1)(f)) |
5. Data Recipients
We may disclose data to:
- infrastructure/hosting providers: Contabo GmbH (Germany);
- e-mail/communication providers: Contabo GmbH (Germany);
- payment processors: Stripe;
- support and maintenance providers;
- public authorities, where required by law;
- consultants (accountants, lawyers), bound by confidentiality obligations.
These recipients process the data under agreements that ensure its protection.
6. International Transfers
Our payment processor (Stripe) may process data outside the European Economic Area; our hosting and e-mail services (Contabo GmbH) run in Germany, within the EEA. For transfers outside the EEA, we ensure appropriate safeguards: European Commission adequacy decisions or standard contractual clauses (SCCs). You may request a copy of the safeguards at [email protected].
7. Retention Period
- Account data: for the duration of the contract and 30 days after termination (for export purposes), after which it is deleted or anonymized.
- Billing data: 10 years, in accordance with accounting and tax legislation.
- Technical/security logs: 6-12 months.
- Marketing data: until consent is withdrawn.
8. Rights of Data Subjects
Under the GDPR, you have the right to:
- access your data;
- rectification of inaccurate data;
- erasure ("the right to be forgotten"), under the conditions provided by law;
- restriction of processing;
- data portability;
- object to processing based on legitimate interest or marketing;
- withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal.
To exercise these rights, you can contact us at [email protected]. We respond within one month at the latest.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) – www.dataprotection.ro, B-dul G-ral. Gheorghe Magheru nr. 28-30, Bucharest.
Note: for your data as a Club Member (entered into the Platform by the club), please contact the relevant club first, as it acts as Controller.
9. Cookies
The Platform uses:
- strictly necessary cookies (operation, authentication, security) – do not require consent;
- analytics/performance cookies (Google Analytics) – with your consent.
You can manage your preferences through the cookie banner and/or your browser settings. Details in the Online Service Agreement and DPA.
10. Data Security
We implement appropriate technical and organizational measures: encryption in transit (HTTPS/TLS), access control, environment segregation, backups, monitoring, and security-breach management procedures. In the event of a high-risk breach, we notify the ANSPDCP and, where applicable, the data subjects, in accordance with art. 33-34 GDPR.
11. Data Concerning Minors
The Platform may handle data of minor athletes, entered by clubs. As processor, we process this data only in accordance with the club's instructions. The club (the Controller) is responsible for establishing the legal basis, including, where applicable, obtaining the consent of the parent/legal representative.
12. Changes to This Policy
We may update this Policy. The updated version will be published on the Platform, with the date indicated. Substantial changes will be communicated by e-mail and/or notification in the Platform.
13. Contact
For any question regarding data processing:
CAMPUS TIRO S.R.L. · E-mail: [email protected] · Phone: 0723240112
DPO: Arapalea Iulian · [email protected]