English translation, for information only. The reference text is the Romanian version (confidentialitate-2026-11-f, „Politica de confidențialitate Sportavo Social”). In case of any difference between the two texts, the Romanian text prevails.

Sportavo Social Privacy Policy

Version confidentialitate-2026-11-f · in force from 11 November 2026

What changed compared with version confidentialitate-2026-11-e: the optional phone number in the sign-up form (sections 3 and 6); the description of backups (sections 6 and 8). The rest of the text is unchanged.

1. Who is responsible for the data

ANJA-MEDIA GROUP S.R.L., tax code RO28581817, trade register no. J2011001065167, Bucharest, sector 3, Str. Gheorghe Petrașcu nr. 16, camera 1, bl. 10, sc. 6, et. 3, ap. 115, Romania (“Sportavo”). For any question or request about personal data, including deletion requests: contact@sportavo.pro.

2. Who this policy concerns

club users (people with an account in Sportavo Social), including the people who create the club account through the sign-up form on sportavo.pro;
club representatives and contact persons, including for billing;
people who write to us (questions, complaints, reports, data requests);
visitors to the sportavo.pro page, for visit statistics (only if they accept them);
people who have agreed to receive Sportavo news and offers.

The policy applies in the same way to people from clubs in any country.

Players and other people entered by clubs are not covered by this policy: for their data the club is the controller, and Sportavo processes it only on the club’s behalf (Data Processing Agreement). A player or a parent should contact the club. If they write to us, we forward the request to the club and let them know.

3. What data we process and why

Data	Purpose	Legal basis (Art. 6(1) GDPR)
The account: name, e-mail, password (stored only in hashed form, never in clear text), interface language	Authentication and providing the service	(b) performance of the contract with the club; (f) legitimate interest in giving access to the people designated by the club
Club data: name, SPV-… identifier, town, country, tax code, legal name, billing e-mail and address	Identifying the club, the subscription, invoicing	(b); (c) tax and accounting obligations
Proof of acceptance of the terms: the account, date and time, version, language and fingerprint of the text	Proof of the contract	(f) legitimate interest
At online sign-up: club name, short name, town, the person’s name, e-mail, date and time, IP address and browser identification	Creating the account, confirming the e-mail address, limiting the number of new accounts (per day and per network) to prevent abuse	(b) entering into the contract at the club’s request; (f) legitimate interest (security, abuse prevention)
The phone number of the person who signs up the club, only if you fill it in (the “Phone (optional)” field in the sign-up form)	Support with sign-up and first use: we may contact you individually, for example if the confirmation link does not arrive or if you have difficulties with your first materials. The number is visible only to the Sportavo staff who administer the application. We do not use it for marketing, we do not send text messages or automated messages and we do not verify the number. Filling it in is optional: without a number, sign-up and the account work the same. We do not undertake to call you	(f) legitimate interest: support with sign-up and first use. You may object at any time (section 7); we then delete the number
The address confirmation link: we keep only its cryptographic fingerprint, the date it was sent and the date it was used	Confirming that the e-mail address belongs to the person who signed up	(b), (f)
When joining the Free plan and when starting the Pro trial: IP address and browser identification; comparison of the club’s name, town, people and e-mail addresses with those of existing clubs	Proof of activation; preventing duplicate accounts, accounts created in the name of another club and repeated trials (similarities are checked by a person; nothing is blocked automatically)	(f) legitimate interest
News and offers, only if you tick the separate box at sign-up: e-mail, name, club, town, country, language, date of consent and the exact text accepted (with its version), date of unsubscribing. After unsubscribing (through our link, through Brevo or by request), the address goes onto a suppression list, so that it receives no more messages even if it appears in an old list	Sending news about the application and Sportavo offers; proof of consent	(a) consent (and Art. 12 of Romanian Law no. 506/2004); proof of consent: (c), (f)
The subscription log: activations, extensions, recorded payments, decisions and their reasons	Subscription records, resolving disputes	(b), (c), (f)
Visit statistics on sportavo.pro, only if you click “Accept” in the page banner: pseudonymous identifiers from cookies, pages visited, buttons clicked (for example “Create free account”, WhatsApp, phone, e-mail), the source of the visit (for example an advert on 3plus.ro or 3minute.net), device and browser type, approximate location (country, city) derived from the IP address; Google Analytics 4 does not store the IP address	To find out how many visitors the page has, where they come from and what works in promotion (Google Analytics 4)	(a) consent (and Art. 4(5) of Romanian Law no. 506/2004); without consent, the page does not load Google Analytics and does not set these cookies
Correspondence with us	Support, complaints, content reports, data requests	(b), (c), (f)

We do not use the data for advertising, we do not sell it and we do no profiling. The only automated decision is the refusal of a second trial period for a tax code already used. The automatic limits on online sign-up (the number of new accounts per day, in total and from the same network) may delay a sign-up; in that case you can write to us and we will create the account manually. We send only the e-mails needed for the account (for example address confirmation). We send news and offers only to people who have given their consent; each message has an unsubscribe link, and unsubscribing does not affect the account. Neither account e-mails nor news messages track whether a message is opened or which links are clicked.

4. Cookies

ss_session — strictly necessary cookie for authentication, valid for 7 days or until you log out.
sportavo-ui-lang — the chosen language, stored in the browser.

The Sportavo Social application does not use analytics or advertising cookies and does not load third-party scripts.

On the sportavo.pro page, only after you click “Accept” in the cookie banner:

_ga — Google Analytics, distinguishes visitors; valid for 2 years from the last visit;
_ga_<ID> — Google Analytics, keeps the state of the visit; valid for 2 years from the last visit.

Without consent, the page loads no Google script and does not set these cookies. Your choice (“Accept” or “Refuse”) is stored in the browser (sportavo_consent_v1, local storage, strictly necessary). You can change it at any time from the “Cookie settings” link in the page footer; if you refuse, the _ga cookies are deleted and no more statistics are sent. Withdrawing consent does not affect the lawfulness of processing carried out before; statistics already sent are kept in Google Analytics for at most the period in section 6. We do not use advertising cookies; advertising features and Google Signals are switched off.

5. Who receives the data

Recipient	Role	Location and safeguards
Railway Corporation (USA)	Hosting the application, the database and the files	Servers in the EU (EU West region, the Netherlands); Railway’s data processing agreement, with GDPR safeguards for transfers (EU–US Data Privacy Framework or standard contractual clauses)
Cloudflare, Inc. (USA)	Storing backups	Backups encrypted by Sportavo before they are sent; Cloudflare does not have the key; storage in the EU
Google (Gmail), the mailbox to which messages sent to contact@sportavo.pro are forwarded	Receiving and sending e-mails	May involve a transfer to the USA, under the EU–US Data Privacy Framework
Brevo (Sendinblue SAS, France)	Sending the application’s automatic e-mails (address confirmation) and, for people who have agreed, news and offers messages (the contact list is kept in Brevo)	EU provider; Brevo’s data processing agreement. For automatic e-mails only the recipient’s address and the content of the message are sent. For news and offers, the list contains the e-mail, name, club, town, country, language and date of consent, plus the list of unsubscribed addresses (marked “blocked”, so that they receive no messages); open and click tracking is switched off
Romarg (the e-mail hosting provider for contact@sportavo.pro)	Receiving and sending e-mails	Romania
Google Ireland Limited (Ireland)	Google Analytics, only for sportavo.pro visitors who have accepted	Processor, under Google’s data processing terms; may involve a transfer to Google LLC (USA), under the EU–US Data Privacy Framework
The company’s accountant and invoicing software	Invoicing and accounting records	Romania
Public authorities	Only when required by law	—

6. How long we keep the data

The account and the club’s data: for the term of the contract, then 90 days, after which they are deleted (manually, within at most 30 days after this period). The club’s name, tax code and billing data remain in the subscription records.
A club on the Free plan: as long as the account exists; we do not delete Free accounts for inactivity. After the account is closed, the period above applies.
IP address and browser at activation and at online sign-up: 1 year.
The phone number given at sign-up: deleted automatically 30 days after sign-up, including when the email address has not been confirmed, or earlier, at your request. Only the number is deleted; the account and the sign-up record remain.
News and offers: until you unsubscribe. After unsubscribing we keep only the address, the date of consent and the date of unsubscribing, in the suppression list, for as long as Sportavo sends news: this way the unsubscribe request is respected even if the address appears in an old list. We do not use the suppression list for any other purpose.
Accounts created online and not confirmed: may be deleted after 30 days.
Confirmation links: valid for 48 hours; their fingerprint is kept as long as the account.
Proof of acceptance and the subscription log: 3 years from the end of the contract.
Invoices and accounting documents: the period required by accounting law (currently 5 years).
Correspondence: 3 years from the last message.
Google Analytics statistics at visitor level: 14 months; aggregated reports, with no identifying data, may be kept longer.
Automatic encrypted backups are made daily and rotate automatically: daily 14 days, weekly 8 weeks, monthly 12 months. They are not modified after they are made: deleted information (for example the phone number, after 30 days) remains in the backups made before the deletion and disappears from them within at most approximately 12 months.
Before application updates we also make full copies of the data. New manual copies, made from 11 November 2026 onwards, are encrypted and kept by the operator on its own computer. Each is deleted 30 days after the date it was made, even if no further copies are made in the meantime. Deletion is checked automatically every day; if that computer is switched off when the period ends, the copy is deleted when it is next started. These copies are not modified after they are made either: deleted information remains in them until the copy is deleted.
Earlier manual archives, made between 17 October and 10 November 2026, are not covered by the 30-day rule above. They are full copies of the data that existed on those dates (with no phone numbers: the field did not exist then), kept by the operator on its own computer, unencrypted, with a duplicate on the same computer; an encrypted copy of one of them is kept on an external storage device. They have no automatic deletion period: we keep them only to restore the service and delete them when they are no longer needed for that purpose. All backups are used only to restore the service.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. Write to contact@sportavo.pro; we answer within at most one month. We may ask for information to confirm your identity. You can withdraw your consent to news and offers at any time, through the unsubscribe link in any message or by writing to contact@sportavo.pro, without affecting the account or the lawfulness of earlier processing. For Google Analytics statistics, based on consent, you can withdraw it at any time from the “Cookie settings” link on sportavo.pro (or by deleting the site data in your browser), without affecting the lawfulness of earlier processing. You can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the data protection authority of the country where you live or work.

8. Security

Each club’s data is kept separate; connections use HTTPS; passwords are not stored in clear text; automatic backups and new manual copies are encrypted (the earlier manual archives in section 6 are not); photo metadata (for example GPS location) is removed on upload. Administrative access is limited to the Sportavo staff who need it.

9. Changes

Each version has an identifier and a date. Important changes are announced by e-mail before they apply.

SHA-256: f579fa4031f14c9c62928674448e5e1946af63d14c9f30585bdb6e1f273307a7