Privacy Policy

1. Introduction

TournaCore ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our tournament management platform, and your rights in relation to that information.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For the purposes described in this policy, TournaCore is the data controller for personal data we collect about account holders and visitors to our platform. If you have any questions, you can reach us using the contact details at the end of this policy.

2. Our Role: Controller and Processor

Our role under data protection law depends on the data in question:

• We are the controller for personal data relating to your use of the platform itself — for example, account details, organisation details, billing information, and usage data.
• We are a processor for the personal data that a tournament organiser collects about teams and participants through their tournaments (such as player and contact details). In that case the organiser is the controller and is responsible for how that data is used, for having a lawful basis to collect it, and for responding to participants' data rights requests. We process that data on the organiser's behalf and on their instructions.

If you are a participant with a question about how your data is used by a specific tournament, please contact the organiser of that tournament in the first instance.

3. Information We Collect

We collect information that you provide directly to us, and some information automatically:

• Account Information: Name, email address, and password when you create an account
• Organisation Information: Organisation name and details for tournament organisers
• Tournament Data: Tournament details, team information, fixture schedules, and results
• Payment Information: Payment details processed securely through Stripe (we do not store card details)
• Communication Data: Messages and correspondence you send to us
• Usage and Technical Data: IP address, device and browser type, and log data about how you interact with the platform, collected automatically through cookies and similar technologies (including reCAPTCHA, which Google uses to tell humans from bots)

4. Lawful Bases for Processing

Where we act as a controller, we rely on the following lawful bases under the UK GDPR:

• Contract: to create and manage your account, provide the platform, and process payments for our services
• Legitimate interests: to operate, secure, and improve the platform, understand how it is used, prevent fraud, and communicate with you about your account (balanced against your rights and interests)
• Consent: for non-essential cookies and analytics, and for any optional marketing communications — you can withdraw consent at any time
• Legal obligation: to comply with our legal and regulatory duties, such as tax and accounting requirements

5. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process tournament registrations and payments
• Send you updates about your tournaments and teams
• Respond to your enquiries and provide customer support
• Monitor and analyse usage patterns to improve user experience
• Detect, prevent, and address technical issues or fraud

We do not use your personal data to make solely automated decisions that have legal or similarly significant effects on you.

6. Information Sharing

We may share your information with:

• Service Providers: Third-party services that help us operate our platform, acting as our processors or as separate controllers in their own right:
  • Stripe for payment processing
  • Supabase for data storage and authentication
  • Google for reCAPTCHA verification and Google Analytics
• Tournament Participants: Team and fixture information is shared with tournament participants
• Legal Requirements: When required by law, regulation, or legal process, or to protect our rights, property, or safety, or those of others
• Business Transfers: In connection with a merger, acquisition, or sale of all or part of our business

We do not sell your personal data.

7. International Data Transfers

Some of our service providers may store or process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we take steps to ensure it receives an adequate level of protection, for example by relying on UK adequacy regulations or by putting in place appropriate safeguards such as the UK International Data Transfer Agreement (or Standard Contractual Clauses with the UK Addendum).

8. Cookies and Tracking

We use cookies and similar technologies to:

• Keep you signed in to your account
• Remember your preferences
• Understand how you use our platform
• Improve our services

Some cookies are strictly necessary for the platform to work and are always active. Non-essential cookies — including analytics cookies — are only set where you have given consent through our cookie banner, in line with the Privacy and Electronic Communications Regulations (PECR). We use Google Analytics to understand how visitors use our platform; it sets cookies and collects usage data (such as pages visited and approximate location) to help us measure and improve our services.

You can change your cookie choices at any time, and you can also control cookies through your browser settings. Disabling cookies may affect some features of our platform.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you services. We determine retention periods based on the purpose for which the data was collected, any legal or regulatory obligations (such as keeping financial records), and the need to resolve disputes or enforce our agreements. Tournament data may be retained for historical records unless you request deletion. When data is no longer needed, we securely delete or anonymise it.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request that we restrict the processing of your personal data
• Portability: Request transfer of your data to you or another service in a structured, machine-readable format
• Objection: Object to processing based on our legitimate interests, and to direct marketing
• Withdraw consent: Where we rely on consent, withdraw it at any time without affecting prior processing

To exercise these rights, please contact us using the details below. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.

12. Children's Privacy

Our platform is intended for use by adults (18 or over); we do not knowingly allow children to create accounts. Tournaments may involve children as participants. Where a tournament collects personal data about children, the organiser is the controller for that data and is responsible for obtaining any necessary consents and for ensuring appropriate safeguarding measures are in place. If you believe we hold personal data about a child without an appropriate basis, please contact us so we can address it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of our services after any changes constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, or wish to exercise your rights, please contact us at:

Email: privacy@tournacore.com