Privacy policy

Who processes your data

The data controller is PunkHive s.r.o. (“we”). For anything related to your data, write to podpora@kdovede.cz.

Tournament content (player names, photos, contact details) is entered by the organiser, who is responsible for it; we store and display it on their behalf. See Organiser content and what the public sees.

Organiser account

When you create an account, we process:

• your name, email, password and language; the password is stored only as a hash that cannot be turned back into the password,
• with Google or Apple sign-in, your account identifier at Google or Apple, your email and profile name; we ask for nothing else and have no access to your mail, contacts or files; with Apple you can hide your email, in which case we only get Apple's relay address,
• organisations, their members and roles, and invitations (the invitee's email),
• your team library: names, abbreviations, colours and logos of teams from your past tournaments, so you don't have to enter them again; only members of the account see it,
• sign-in sessions, so you stay signed in and can sign other devices out by changing your password.

Organiser content and what the public sees

You enter the tournament's content into kdovede: name, sport, dates and venue, pitches and playing sessions, teams with logos and colours, schedule, results, standings and bracket, a cover photo and a description with photos and videos, contacts on the Info page (name, role, phone, email), parking, refreshments, changing rooms and entry fee, messages for fans, the final ranking and awards with the name, team and photo of the awarded player.

Once the tournament is published, all of this is public: on the page kdovede.com/t/… (kdovede.cz/t/…), in the mobile app, on the hall screen, in the printable schedule and on share images. Anyone can open the page and search engines index it. A draft tournament is visible only to members of the account.

If you enter names, photos or contact details of people (players, referees, organisers), you are responsible for being allowed to publish them. For children and young people this means the consent of parents or legal guardians; for contact details, the consent of the person whose phone or email you list. When you edit or delete content or unpublish the tournament, it disappears from the public page and the apps too.

Uploaded images (logos, the cover photo, photos in the description and photos of awarded players) are stored on our servers in the European Union. On upload we strip their metadata (such as camera location) and store them resized in several sizes. An image belongs to the account that uploaded it.

Players and fans without an account

You can view a tournament's public page without an account and without being tracked. Your followed team, the dismissed language bar and your dark mode choice are stored only in your browser; they are not sent to us.

Mobile app: when you open a tournament in it, we store a device token for delivering notifications together with the tournament, the followed team, the platform (iPhone or Android) and the app language. When you follow a match as a Live Activity on iPhone, we also store its token. We don't need or ask for your name or email.

Live updates use a persistent connection to the server (WebSocket). We store nothing from it beyond ordinary server logs.

Contact form

A message from the form on the Contact page (name, email, message text and the site language) is sent by email to the podpora@kdovede.cz inbox so that we can reply. We don't store it in a database. Against bots we use a hidden field and a limit on the number of messages per IP address per hour; the server keeps that only in memory and it is gone after a restart.

Venue, map and videos

When an organiser picks a venue, our server sends the typed text to Google Places, which returns suggestions. The request comes from the server, so your IP address does not go to Google. For the chosen venue we store its identifier and coordinates so that the tournament page can show a map and directions.

On the public tournament page, the venue map and embedded YouTube and Vimeo videos load only after you click “Show map” or play. Only then does Google, YouTube or Vimeo receive your IP address and may set its own cookies in your browser under its own policies. Until you click, nothing is sent to them. The Directions button opens Google Maps only when you tap it.

Google Sheets

If an organiser connects a tournament to a Google Sheet, we store the email of their Google account and access keys limited to files that kdovede itself creates in Drive. We have no access to any other files. We write the schedule and group standings into the sheet and read scores back from it. You disconnect in the tournament settings and that deletes the keys.

We use data from Google (sign-in and the sheet) solely to sign you in to kdovede and to write into the spreadsheet kdovede created. We do not share it with third parties, sell it or use it for advertising. We comply with the Google API Services User Data Policy, including the Limited Use requirements.

Payments

Publishing a tournament is paid by card through Stripe. We pass Stripe the account name (your club, organisation or your name), email, language and the account and tournament identifiers so the payment can be matched. You fill in the billing address, company ID and VAT number directly with Stripe, which also issues the invoices. You enter your card number on Stripe's payment page; it never reaches us.

From Stripe we receive the payment and subscription status (paid, active, cancelled, period end) and a customer identifier that lets us send you to the Stripe portal with your invoices and Club Season management. Stripe (Stripe Payments Europe, Ltd., Ireland) may also process data outside the EU, with safeguards under the GDPR (standard contractual clauses).

Emails and notifications

We only send emails the service needs: address verification, password reset, an invitation to an organisation, confirmation that a paid tournament is published or a Club Season is active, and replies to your messages. No newsletters. Emails are sent through Amazon Web Services (Amazon SES) from a region in the European Union.

Phone notifications are delivered through the Apple Push Notification service (iPhone) and Google's Firebase Cloud Messaging (Android). They receive the device token and the notification content: the organiser's message, a revealed placing or award during the ceremony, or the match state for a Live Activity.

Cookies and technical data

The website uses only cookies required for it to work: the sign-in session (kdovede_session) and a short-lived cookie that secures Google and Apple sign-in. No advertising or analytics cookies and no third-party visitor tracking, so there is no cookie banner. Third-party cookies (Google, YouTube, Vimeo) can only appear after you click a map or a video, see above.

Our servers write operational logs for each request (time, page address, any error), which may include your IP address and browser type. We use them to secure the service and find bugs; they are overwritten continuously and not archived.

Why we process data

• to provide the service you signed up for: your account, tournaments, the public page and notifications (performance of a contract),
• to secure the service, fend off spam and find bugs (legitimate interest),
• to reply to your message from the contact form (legitimate interest),
• to meet legal obligations, mainly accounting and tax.

Who we share data with

Data and images run on our servers in the European Union. The services that help us and receive data:

• Amazon Web Services: sending emails (EU region).
• Stripe: card payments, invoices and subscriptions.
• Google: Google sign-in, Google Sheets, venue suggestions and coordinates; Google's Firebase: notifications on Android; Google map only after you click.
• Apple: Apple sign-in, notifications and Live Activity on iPhone.
• YouTube and Vimeo: embedded videos, only after you click play.

We do not share data with anyone else unless required by law.

How long we keep data

• Account and tournament data for as long as the account exists. After you delete the account it is gone from the database immediately and from backups within 14 days.
• A tournament you delete disappears from the web and the apps immediately; it stays hidden in the database in case of a mistake and is removed together with the account.
• We delete a device token when Apple or Google mark it as invalid (typically after the app is uninstalled or notifications are turned off), or when the tournament it belongs to is removed.
• Messages from the contact form stay in the support inbox until we have dealt with them.
• We keep invoices and payment records for as long as accounting and tax law requires, even after the account is deleted.

Deleting your account

You delete your account yourself: on the web in your profile (kdovede.com/app/profile, Delete account section), or in the mobile app under Settings → Delete account. You can also write to podpora@kdovede.cz from your account address.

Deleting your account removes your name, email, sign-in details and sessions, your personal account and the organisations where you are the only member, including their tournaments, team library and uploaded images. Organisations with other members stay with them; if you are their only owner, you transfer ownership first. An image file stays on the server only if another account uses the very same file.

A fan without an account has no account or name with us; their device token disappears after the app is uninstalled or notifications are turned off.

Your rights

You have the right to access, rectify and erase your data, restrict processing, data portability and the right to object. You can download an export of your data in your profile on the web and delete your account yourself (see above); for anything else, write to podpora@kdovede.cz.

Are you a player, parent or fan and a tournament page shows something about you that shouldn't be there? Contact the organiser first (their contact is on the tournament's Info page) and they will fix it. We can help too at podpora@kdovede.cz.

If you believe we handle your data improperly, you can lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).

Changes to this policy

We update this policy as the service changes. The current version is always on this page with the date of the last update.