Privacy policy

1. Who is responsible for the data

There are two different roles here and they need telling apart.

For user account data — e-mail, name, language, sign-in — the controller is the Provider named in the header of this page. You can write to hello@playcalldna.com.

For the data a club enters about its own people — roster, attendance, game records — the controller is the club and the Provider is its processor. The club decides what gets written down and how long it stays.

The Provider has no data protection officer; the law does not require one for this activity.

2. What data is processed

• Account: e-mail address, name, chosen language, role in the club and the password stored only as a hash. Optionally a profile photo and jersey number.
• Roster: player name, jersey number, positions and whether they are currently playing. The coach enters these and the player need not have an account.
• Attendance: the day a User signed in. How long they stayed is not measured — a tablet sits on the bench all game and the number would lie.
• Work content: playbooks, plays, call sheets, game and practice records, opponent scouting and uploaded logos. Scouting holds opponents’ jersey numbers, not their names.
• Server logs: IP address, browser type and the time of the request.

3. Why, and on what legal basis

• Running accounts and providing the service — performance of a contract.
• Invoicing and accounting — compliance with a legal obligation.
• Security, fault-finding and protection against misuse — the Provider’s legitimate interest in keeping the service running and unabused.
• Roster, attendance and game records — on the instruction of the club, which is the controller for them.

4. Players without an account

The coach fills in the roster and may enter a player who never signs in. Such a player will not learn about the processing from the application — they learn it from their club.

The club, as controller, is responsible for having a legal basis and for informing the player. The Provider does not take that duty over.

A player who wants to know what the application holds about them should ask their club. If they write to the Provider instead, the Provider passes the request to the club and says that it has done so.

5. Young players

Youth teams use the application too, so a roster may hold data about children. That is a name, a jersey number and positions — the minimum without which a team cannot be run.

The legal basis, and a guardian’s consent where one is needed, are the club’s responsibility, not the Provider’s.

An account of one’s own is not intended for children under 15. Members are invited into a club by its administrator, who is responsible for whom they invite; a team can be set up on the website only by someone who may enter into a contract, that is, a person over 18.

6. Who receives the data

The Provider does not sell data and does not use it for advertising or profiling. It engages these processors:

• Supabase — database, sign-in and file storage. The data sits in the European Union, in Frankfurt am Main.
• Vercel — running the website and the application.
• Resend — sending invitations and password reset links. It receives only the e-mail address and the content of the message.
• GameStatiq — only when a coach exports a finished game into competition statistics themselves. Player names, jersey numbers and the course of the game are sent. Without that step nothing goes there, and the coach switches the connection on themselves.
• The Provider’s accountant, and legal counsel in the event of a dispute.
• Public authorities, where the law requires it.

7. Where the data sits and for how long

The database and uploaded files are in the European Union. Some processors may run support operations outside the EU; for those cases the transfer relies on the European Commission’s standard contractual clauses.

Club data is kept for the term of the contract. It is deleted within 90 days of the contract ending, unless the club asks for earlier deletion or there is a reason to keep it longer — typically accounting or an ongoing dispute.

Attendance records are kept for as long as the account exists and go with it; the application shows the last 30 days.

Invoices and accounting documents are kept for 10 years, as the Czech Accounting Act requires.

8. Cookies

The application uses only cookies it could not work without. None for advertising, no cross-site tracking, no third-party analytics — which is why there is no consent bar here: strictly necessary cookies do not require consent.

• Sign-in cookies (Supabase) — keep you signed in so the password is not asked for at every click.
• gcox-jazyk — the chosen language, valid for a year.
• gcox-navsteva — so a visit is recorded once a day rather than at every click, valid for one day.

9. Your rights

Under the GDPR you have the right of access to your data, to its rectification, erasure and restriction of processing, to portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time.

Send your request to hello@playcalldna.com. An answer will come within one month. Where the club is the controller, the request is passed to the club.

You may complain to the Czech data protection authority: Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz.

10. Security

Connections are encrypted (HTTPS) and passwords are stored only as a hash — the Provider does not know them and cannot find them out.

Who can reach what is enforced by the database itself, row by row: a User sees only what belongs to their club and their role. It is not done in the application alone, so it cannot be bypassed with a hand-written request either.

Backups are held by the database provider.

If a personal data breach occurs that poses a risk to people’s rights, the Provider will report it to the Czech data protection authority within 72 hours and to the affected clubs without undue delay.

11. Changes

This policy may change — the effective date is at the top. The Provider will give notice of any substantial change by e-mail or in the application.