Privacy Policy

1. Who we are – the data controller

The Padel Moldova Tour platform (padeltour.md) is operated by AO „Federația Sportivă Națională de Padel din Republica Moldova” (the National Padel Sports Federation of the Republic of Moldova, FPRM), hereinafter referred to as the “Controller” or the “Federation”, in its capacity as personal data controller.

The platform is used by the Federation to run the national Padel Moldova Tour circuit. The Federation creates and administers the competitions, approves accounts, checks sports licences, keeps records of entry fees, enters and validates results and administers the rankings.

Identification and contact details for data protection:

• President: Mihai-Ionuț Burciu
• Tax code / IDNO: 1020620007190
• Address: R. Moldova, Mun. Chișinău, Stradela Angela Păduraru, Nr. 7, Ap 14
• Phone: 068797724
• Email: padel.moldova@gmail.com

For any question about the processing of personal data or to exercise your rights, you can contact us at the email address above.

2. Categories of personal data collected

We collect and process the following categories of data:

2.1. Data you provide directly (when signing up or editing your profile):

• Full name;
• Email address;
• Phone number (optional, with the option to hide it);
• District (raion) and country of residence;
• Gender;
• Date of birth;
• Preferred playing position (left / right);
• Profile photo (optional);
• Custom username (optional);
• Description / bio (optional);
• The club whose community you choose (optional);
• Messages posted in the platform’s chats.

2.2. Data collected automatically during use:

• IP address – needed for authentication and account security to work;
• Estimated geographical location – the city and country derived from the IP address, stored for statistics on the use of the platform;
• Date and time of last activity (last_seen_at) – used to display presence status (online / idle / offline) to other logged-in users;
• Technical session data – browser type, operating system, screen resolution, pages visited – exclusively for statistical and diagnostic purposes;
• Cookies – described in detail in the Cookie Policy.

2.3. Data generated by your activity on the platform:

• History of tournament participation and registrations;
• Points accumulated and ranking positions;
• Match results, entered and validated by the Federation;
• Points obtained at external competitions (for example FIP tournaments), entered manually by the Federation;
• The status of the account and of the sports licence (awaiting approval, approved – active licence, inactive licence, suspended or blocked), set by the Federation;
• The payment status of the entry fee (paid / unpaid, cash or bank transfer), confirmed by the Federation;
• Administrative notes on the waiting list (“No active licence”, “Entry fee not paid”, “Federation sanction”).

3. Purposes of processing and legal basis (Article 6 of Law No. 195/2024)

4. Location estimated from the IP address – full transparency

4.1. The platform records the IP addresses of logged-in users as part of the normal operation of the authentication service provided by Supabase.

4.2. Using a geolocation service, the IP address is converted into an estimated geographical location (city, country). This estimate has an accuracy of approximately 50–200 km and does not reflect the user’s exact address.

4.3. The estimated location may be shown to other logged-in users in the “Active users” panel, alongside the presence status. It serves as an indication of the region from which the user is playing at that moment.

4.4. Right to opt out: Each user may turn off the display of their location at any time by going to Profile → Personal data → edit → “Show my real-time location to other users”. The setting takes effect immediately and retroactively for future sessions.

4.5. Full IP addresses are never shown to other users. The stored location is exclusively at city level, without street or GPS coordinates.

4.bis Analytics, event log and consent

4.bis.1. To improve the platform, we record in an internal table (user_events) the significant actions of logged-in users: registering for a tournament, uploading a photo, posting a comment, liking, following a profile and unfollowing it, sending a message, opening the “My matches” list, adding a player to or removing a player from the followed list. Each row contains the user_id, the type of action, a timestamp, the type of device (phone / desktop / tablet) and, optionally, the ID of the resource concerned (tournament, photo, comment, followed player).

4.bis.1.bis. The list of followed players (“my crew”, used so that you see in the schedule only the matches that interest you) is saved in your account (player_follows), so that you can find it from any device. The list is visible to you and to the platform administrator; the followed player cannot see who follows them. You can clear it at any time from the follow bar on the tournament page, and it is deleted automatically when the account is deleted. If you are not logged in, the list remains exclusively in your browser.

4.bis.2. This data is used exclusively for internal aggregation – DAU/MAU, retention cohorts, engagement score, conversion funnel – and for reporting in the event of a possible transaction (due diligence). It is not shared with third parties for advertising or behavioural profiling outside the platform.

4.bis.3. Legal basis: performance of a contract for events directly linked to the use of the service (tournament registration, etc.) and legitimate interest for anonymous statistical aggregation.

4.bis.4. Page and session tracking (DAU/MAU, retention) is conditional on your explicit consent, given through the “Cookie preferences” banner on your first visit. You can change your consent at any time by going to Profile → Cookie & GDPR preferences.

4.bis.5. All consents are recorded in an audit table (user_consents) with a timestamp, the IP and the policy version, as proof of consent. You may request a copy at any time.

4.bis.6. Retention: the event log is kept for as long as the account exists. When the account is deleted, the events are deleted automatically (ON DELETE CASCADE). Consent records are kept for 6 years after the last change, as proof of compliance with the legal obligations on data protection.

4.bis.7. The visitor counter – we show how many people are on the site right now and how many have visited in the last 24 hours. To do this we do not store the IP address and we do not write anything to your browser (no cookie, no identifier): the server calculates an irreversible cryptographic fingerprint (HMAC-SHA256) from the IP address and the user agent, with a key that changes every day, used exclusively so that we do not count the same person twice. The fingerprints are deleted automatically after 24 hours and cannot be linked from one day to the next or to your account. Only aggregate figures are displayed – never who exactly visited. The same fingerprint also counts visits to player profiles: each profile shows only the total number of visits (a person is counted once a day), not who made them. Legal basis: legitimate interest – audience measurement. Because nothing is stored on the device, this count is not subject to the cookie consent requirement and works regardless of the option chosen in the banner.

4.bis.8. The badge photo – at tournaments that print player badges (plastic accreditation passes), you can take a photo of yourself from the chest up. The camera guidance (framing, lighting, angle) runs on your phone; face detection is used only for framing – we do not perform facial recognition and we do not compare the photo with other photos. We do not record video: only the photo you confirm is uploaded, together with at most 4 frames taken while the photo was being taken (the sharpest ones), so that the organiser can choose a better one if the photo is blurred; the frames are deleted when you take a new photo or delete your account. For the uploaded photo, we remove the background on our servers, and its suitability for an ID-style pass is checked automatically by an artificial intelligence model (Anthropic Claude); uncertain cases are reviewed by a person from the organiser’s team. The approved photo is public: it appears on your public profile, in the official Padel Tour badge, and on the badges of the tournaments you are registered for. You can hide it from your profile at any time in Profile → “Show the badge on my public profile”, you can replace it at any time from your Profile, and it is deleted when the account is deleted. Photos that have not been approved and the frames can be seen only by you, the administrators of the badge tournaments you are registered for and the platform administrator. Legal basis: performance of a contract – participation in the tournament, for the tournament badges; legitimate interest for display on the public profile, with the right to object at any time using the same checkbox.

5. Recipients of the data – who else has access

5.1. Supabase Inc. (USA) – provider of databases, authentication and file storage. The data is transferred on the basis of contractual data protection clauses, with the safeguards required by the applicable law.

5.2. Vercel Inc. (USA) – hosting provider for the web application. The same safeguards apply.

5.2.bis. Anthropic PBC (USA) – automatic checking of badge photos and of Marketplace listings. It receives only the image (and, for listings, the text) to be checked, as a processor, with the same safeguards.

5.3. Platform administrators – have access to data to the extent necessary to manage the platform, resolve disputes and moderate content. This includes private messages, which platform administrators may access for user safety, moderation (for example following a report) and legal requests, and for no other purpose.

5.4. The Federation (FPRM) – the administrators appointed by the Federation have access to the data needed to approve accounts, check sports licences, manage registrations, waiting lists and payment records, enter and validate results, administer the rankings and moderate communication. Sports clubs have no administrative access to the Platform.

5.5. We never sell your data. We do not transfer personal data to third parties for commercial purposes and we do not use data for behavioural advertising or automated profiling.

5.6. Data may be disclosed to the competent authorities (the National Centre for Personal Data Protection, courts, law enforcement authorities) only where required by law or where necessary to protect the rights of the Controller or of other users.

6. International data transfers

Your data is stored on servers managed by Supabase and Vercel, which may be located outside the Republic of Moldova, including in the United States of America or in the Member States of the European Union. These transfers are carried out with the safeguards provided for by Law No. 195/2024 on personal data protection. Information about these safeguards may be requested at the contact email address.

7. Data retention period

Policies applied automatically by a nightly job (Postgres cron). Verifiable on audit.

• Account and profile data: for as long as the Account exists. When the account is deleted (self-service from the Profile or on request), the data is deleted immediately and permanently from all related tables (CASCADE).
• Competition history (participation, points, results): for 5 years from the last participation, for reasons of legitimate sporting interest and competitive transparency. Attributed anonymously (“Deleted player”) after the account is deleted.
• Chat messages (group chats and private conversations): for as long as the Account exists. When the account is deleted, the messages you sent and the private conversations you took part in are deleted.
• IP addresses: deleted (NULL) after 90 days in all tracking tables (site_sessions, user_events, user_consents). The rest of the session data (paths, timestamps) is kept without an IP identifier for aggregated internal analytics.
• Browser user agent: deleted after 180 days.
• Referrer (URL of origin): deleted after 365 days.
• Raw pageview and session rows: deleted after 2 years; only the monthly aggregates (DAU/MAU, retention) are kept.
• Per-user event log (user_events): kept for as long as the Account exists. Deleted automatically when the account is deleted.
• Consent records (user_consents): 6 years from the last change, as proof of consent.
• Location data estimated from the IP: max 90 days for the raw field; the derived city is kept on the profile for as long as the “Show location” setting is on.
• Audit and security logs: max 12 months.

8. Your rights (Articles 13–22 of Law No. 195/2024)

As a data subject, you have the following rights, which you can exercise free of charge by email to padel.moldova@gmail.com, stating in the subject line the right you are invoking:

• Right of access: Self-service – download a complete copy of your data in JSON format from Profile → “Download my data”. It includes all the tables that relate to you: profile, registrations, photos, comments, likes, messages, events, consents.
• Right to rectification: You have the right to request the correction of inaccurate data or the completion of incomplete data. You can do this directly from the profile section.
• Right to erasure: Self-service – delete your account permanently from Profile → “Delete account” (confirmed by typing your email). All related data is deleted immediately, except for the anonymised competition history, which is kept for 5 years.
• Right to restriction of processing: You have the right to request that the processing of your data be restricted in certain circumstances (e.g. if you contest the accuracy of the data).
• Right to data portability: You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format (JSON/CSV).
• Right to object: You have the right to object to the processing of your data based on legitimate interest.
• Right to withdraw consent: Where processing is based on your consent (e.g. displaying the location derived from the IP), you can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw it from your profile settings or by a request to the email address.
• Right not to be subject to automated decision-making: We do not use fully automated decision-making processes or profiling that produce legal effects concerning you.

We will respond to requests within one month of receipt at the latest.

9. Supervisory authority

If you consider that your rights have not been respected, you have the right to lodge a complaint with the national supervisory authority:

10. Data security

10.1. The Controller has implemented appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration or accidental destruction, including:

• Encryption of passwords using the bcrypt algorithm;
• Data transmission exclusively over HTTPS/TLS connections;
• Role-based access control policies (RLS – Row Level Security in the database);
• Two-factor authentication available through third-party providers (Google OAuth);
• Periodic auditing of access policies.

10.2. In the event of a security incident affecting your data, we will notify you under the conditions of Articles 33–34 of Law No. 195/2024, without undue delay.

11. Minors

The platform is not intended for persons under the age of 16. We do not knowingly collect data from minors under this age. If we learn that we have collected data from a minor under 16 without the consent of their parent or legal guardian, we will delete this data immediately. Persons aged between 16 and 18 may use the platform with the consent of their parent or guardian, who gave their agreement at sign-up.

12. Cookies

The use of cookies is described in detail in the Cookie Policy. By continuing to use the Platform after viewing the cookie banner, you agree to the use of the cookies described there.

13. Changes to the policy

The Controller may periodically update this Privacy Policy. Significant changes will be communicated by email or by displaying a notice on the Platform at least 30 days before they take effect. We recommend that you check this page periodically. Continued use of the Platform after the effective date constitutes acceptance of the changes.