Privacy Policy

1. Who is responsible for your data

The data controller is Stefan Skrbic, a private individual from the Republic of Serbia and owner of the Turnamio platform. For any privacy question and for requests under this policy, write to podrska@turnamio.com.

There are two roles, depending on who entered the data:

• For accounts (organizers, team members and players who open a profile themselves) and for data about organizations, the controller is Turnamio.
• For data about players and teams entered by an organizer (names, nicknames, shirt numbers, results), the controller is that organization, and Turnamio stores and displays the data on its behalf and only on its instructions.

2. What data we keep

• Account: email, password (stored only as an encrypted hash that nobody can read), the name you enter, your role in the organization and the date the account was opened.
• Google sign-in: Google sends us your email, name and profile picture. We never receive your Google password.
• Player profile: the name shown in tables, the photo you upload yourself, email, the date of your last name change and requests to join organizations, with a message to the organizer if you write one.
• Organization: name, public page address, city, logo, colour, background, description, website and Instagram links, sponsors and team members.
• Tournaments: name, venue and time, teams and crests, players' names and nicknames, a player's email if the organizer enters it (used only to link the player to their profile), shirt numbers, results, scorers, cards and result photos.
• Scorekeeper code: who the code was created for (e.g. “Pitch 2”), how many times it was opened and when it was last used.
• Team registration by link: the team's name and crest, each player's name and shirt number, and the coach's name and phone or email. We do not ask for any other player details (date of birth, email, photo). The coach confirms that the players, and for players under 18 their parents, know that their name and number will be shown at the tournament. Only the organization's admins see the coach's contact.
• Payments (once enabled): from Google Play we receive only a purchase confirmation: which package, for which organization and until when it is valid.
• Technical data: IP address, device and browser type and time of access, in the server logs of our service providers. Used only for security and fixing errors.

We do not collect card numbers or other payment details, location, phone contacts or microphone recordings. We do not sell data, build advertising profiles or use visitor tracking tools. Ads in the app are our own or the organization's sponsors' and are the same for every viewer.

3. Why we use it and on what basis

• Providing the service you asked for: so that your account works, the tournament is run and displayed, emails are sent for account confirmation, password resets and team invitations, and the package you buy is activated.
• Legitimate interest: platform security, preventing abuse and fixing errors (technical data).
• Consent: player photos. Players upload their photo themselves and can remove it whenever they like; consent is then considered withdrawn.
• Legal obligation: keeping payment records for as long as tax and accounting regulations require.

4. Who sees the data

• Anyone with the link: the live table, TV and stream screens, the organization's public page and share images show the tournament name, team names and crests, players' names or nicknames, player photos, shirt numbers, results, scorers, cards, result photos and sponsors.
• The organization's team: the Head Admin and Admins see the emails of their organization's players, because they use them to link players to profiles. A scorekeeper sees names only.
• Other organizations do not see your organization's non-public data, and emails are never shown publicly.
• Images (logo, crest, banner, player or result photo) are stored at a public address so they can be shown on every screen. Anyone with the image address can open them.

5. Service providers we work with

Data is processed only by providers we need for the app to work, under a data processing agreement and only on our instructions:

Some of these providers are US companies or keep servers outside Serbia. In that case data is transferred only to European Union countries or under standard contractual clauses, as permitted by the Personal Data Protection Act. We do not give data to anyone else, except when required by law by a competent public authority.

6. How long we keep it

• Account and player profile data: for as long as the account exists.
• Tournament and organization data: until the organization deletes it or deletes the whole organization.
• Join requests: for as long as the player's account or the organization exists.
• Technical logs at service providers: briefly, for no more than 30 days.
• Team registrations by link: a rejected registration is deleted immediately. An approved team becomes part of the tournament, and the coach's contact is deleted no later than 30 days after the tournament ends.
• After deletion, data disappears from the database immediately and from backups within 30 days at the latest.
• Payment confirmations: for as long as tax and accounting regulations require.

7. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and objection, and to withdraw consent at any time.

• You can do most of this yourself in the app: change your name and photo, delete tournaments, the organization and your account.
• For anything else, write to podrska@turnamio.com from the email the account was opened with. We reply within 30 days at the latest.
• A player entered in a tournament by an organizer who has no account of their own can contact the organizer or us. We forward the request to the organizer and help resolve it.
• If you believe your rights have been violated, you can file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

8. Cookies and local storage

Turnamio does not set cookies. For sign-in and settings it uses only your browser's local storage (the data stays on your device and is not sent to anyone else). Everything stored is necessary for the app to work, so we do not ask for separate consent.

When you sign in with Google, Google uses its own cookies on its sign-in page, under its own privacy policy. You can clear everything Turnamio stores in your browser by logging out or by clearing the site data in your browser settings.

9. Security

• The connection to the app is always encrypted (HTTPS).
• Passwords are stored only as an encrypted hash.
• The database checks access rights for every row of data: each organization sees and changes only its own data, and team roles decide who may do what.
• A scorekeeper with a code can enter results for one tournament only, and the code switches itself off when the tournament ends.
• If a data breach occurs that may put your rights at risk, we notify the Commissioner within 72 hours, and you without delay if the risk is high.

10. Children

You must be at least 15 years old to open an account. Organizers enter data about younger players only with the consent of a parent or guardian. Packages are bought by an adult or a parent.

“Follow a team” notifications. Anyone who turns on following a team on the live page does not create an account and leaves no name, email or phone number. We keep only the browser’s technical notification address (created by the browser through its push service: Google, Apple or Mozilla), the team being followed and the language. That address does not tell us who you are. We send only notifications about that team’s matches. The data is deleted right after the last notification at the end of the tournament (at the latest 48 hours after it ends), and you can turn following off at any time on the same page or in your browser settings. The legal basis is your consent, which you give when you allow notifications.

11. Android app

• The Google Play app shows the same Turnamio website and stores the same data as the web version. On a computer (Windows, Mac), Turnamio runs in the browser, with nothing to install.
• It does not ask for access to your location, contacts or microphone.
• It opens the camera and gallery only when you choose an image yourself (crest, logo, player or result photo).
• You pay for packages through Google Play. Payment is handled by Google; we receive only the purchase confirmation (which package, for which organization and until when it is valid), not your card details.

12. Changes to this policy

We announce important changes on the platform or by email before they take effect. The date of the last change is shown at the top of the page.