Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is ВАЛА ЕООД (VALA EOOD), operating the TennisMasa platform (website tennismasa.club and the TennisMasa mobile application for Android and iOS).

Contact:

• Email: [email protected]
• Administrator: Yasen Kostov — [email protected]

At this time, the company is not required to appoint a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR.

2. Information We Collect

We collect information you provide directly to us when you create an account, use the website or mobile application, participate in tournaments, or contact us. We also collect certain information automatically when you use our services.

2.1. Account Information

• Name (first name, last name, middle name)
• Email address
• Phone number
• Password (stored in encrypted form only)
• Nationality
• Profile avatar/photo (optional)
• Language preference

2.2. Player Profile Data

You may optionally provide additional profile information:

• Equipment details (blade, forehand rubber, backhand rubber)
• Play style (offensive, defensive, all-round, chopper)
• Handedness (left or right)
• Preferred hall and tournament series
• Club membership and hall affiliation

2.3. Tournament & Competition Data

• Tournament registrations and participation history
• Match results (wins, losses, walkovers)
• Individual game scores within matches
• Tournament placements and standings
• Group stage results and elimination bracket positions
• Doubles partner and team tournament pairings

2.4. Ratings & Performance Data

• ELO rating (calculated from match results)
• Rating history with per-match changes
• Win/loss records and win rate percentages
• Ranking position and percentile among all players
• Tournament series points and standings

2.5. Statistical Analytics

We generate the following analytics from your match data:

• Head-to-head records against specific opponents
• Best and worst matchups, most frequent opponents
• Performance breakdown by tournament format
• Win/loss streaks and recent form trends
• Achievement badges and milestones

2.6. Device & Push Notification Data

When you use the mobile application and enable push notifications, we collect:

• Device token (for delivering push notifications)
• Device platform (Android or iOS)
• Device identifier and device name
• Application version
• Notification preferences (which types of notifications you wish to receive)

2.7. Location Data

The mobile application may request access to your device location to show you the nearest tournament venues. Location data is used only for this purpose and is not stored on our servers.

2.8. Contact Form Data

• Name, email address, and phone number
• Purpose of inquiry and message content
• IP address (for spam prevention)

2.9. Automatically Collected Information

We use Firebase Analytics and Firebase Crashlytics (provided by Google) in the mobile application to collect anonymous usage statistics and crash reports. This helps us improve app stability and user experience. Firebase may collect device information, app usage data, and crash logs.

On the website, we use Umami Analytics, a privacy-focused analytics solution that does not use cookies and does not track individual users.

2.10. Privacy Consent Records

• Whether you have accepted the privacy policy
• Date, time, and IP address at the moment of consent
• Privacy policy version accepted

3. Legal Basis for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a contract (Article 6(1)(b) GDPR) — to provide you with tournament management services, process registrations, calculate ratings, and maintain your account.
• Consent (Article 6(1)(a) GDPR) — for the public display of your detailed statistics and analytics, push notifications, and optional profile data.
• Legitimate interest (Article 6(1)(f) GDPR) — for improving the quality and stability of our services through anonymous analytics (including Firebase Analytics and Crashlytics), ensuring platform security, and preventing abuse.
• Legal obligation (Article 6(1)(c) GDPR) — to comply with applicable laws and regulations.

4. How We Use Your Information

• Provide and maintain tournament management services
• Process tournament registrations and manage competitions
• Calculate and update ELO ratings based on match results
• Generate player statistics, rankings, and performance analytics
• Display match results, standings, and player profiles (with your consent)
• Create tournament brackets and group stage draws
• Track tournament series points and standings
• Send push notifications about tournaments, matches, and account updates
• Respond to your inquiries via the contact form
• Improve our platform using aggregated, anonymous analytics data
• Detect and prevent fraud or abuse of the platform

5. Privacy Consent & Your Control

We require your explicit consent to display your detailed tournament statistics and analytics publicly. You have full control over your data:

• When you register for tournaments or view your player profile, you will be prompted to accept the privacy policy
• Without consent, your detailed statistics and analytics will not be displayed publicly
• Basic information (name, tournament participation) remains visible for tournament organization purposes
• You can revoke consent at any time from your account settings
• Revoking consent will hide your statistics but will not delete historical match data needed for tournament records

6. Public Display of Information

With your consent, the following information is displayed publicly on the website and in the mobile application:

• Player profile (name, avatar, club affiliation, ELO rating)
• Match results and tournament history
• Performance statistics and analytics
• Rankings and leaderboards
• Head-to-head records

Without consent, only your name and basic tournament participation will be visible (required for tournament organization).

7. Information Sharing & Third Parties

We do not sell, trade, or otherwise transfer your personal information to third parties. We share data only in the following cases:

• With your consent, tournament results and player statistics are displayed publicly on our platform
• With tournament organizers and hall administrators — for tournament management purposes
• Firebase Cloud Messaging (Google) — for delivering push notifications to your device
• Firebase Analytics and Crashlytics (Google) — for anonymous app usage statistics and crash reporting
• Umami Analytics — for anonymous website usage statistics (no personal data is shared)
• When required by law, court order, or to protect our legal rights

8. International Data Transfers

Some of our service providers (such as Google Firebase) may process data outside the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your personal data in accordance with GDPR requirements.

9. Cookies & Similar Technologies

The website uses only essential (strictly necessary) cookies required for the proper functioning of the platform, such as session cookies for user authentication and security. These cookies do not require consent as they are necessary for providing the service you have requested.

We do not use any tracking, advertising, or third-party cookies. Our website analytics (Umami Analytics) operate without cookies.

The mobile application does not use cookies. Firebase services in the mobile app may use device identifiers for analytics and crash reporting purposes, as described in section 2.9.

You can control and delete cookies through your browser settings. Disabling essential cookies may affect the functionality of the website.

10. Data Retention

• Account information — retained while your account is active and for a reasonable period after deletion as required by law
• Match results and tournament records — retained permanently for historical records and competitive integrity
• Rating history — retained permanently to maintain accurate historical rankings
• Device tokens — retained while active; automatically removed when you uninstall the app or unregister the device
• Contact form submissions — retained for up to 2 years
• Privacy consent records — retained for compliance and legal protection

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Passwords are hashed using industry-standard Argon2 algorithm
• All data transmission is encrypted via HTTPS/TLS
• Authentication tokens are signed and have limited validity periods
• Database access is restricted and monitored

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

12. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data, subject to legal retention requirements
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw your consent at any time, without affecting the lawfulness of processing prior to withdrawal

To exercise any of these rights, please contact us at [email protected] or [email protected].

Note: Match results and tournament records may be retained for historical and competitive integrity purposes even after account deletion, in anonymized form where possible.

13. Children's Privacy

Our services are not directed to children under 14 years of age. We do not knowingly collect personal data from children under 14. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us and we will take steps to delete such information.

If we become aware that we have collected personal data from a child under the age of 14, we will delete that data immediately.

14. Data Control & Liability Limitations

The controller processes personal data solely within the scope of the platform's functionality and based on information provided by the users themselves or generated as a result of their activity (e.g. participation in tournaments and matches).

Users are responsible for the accuracy and content of the information they provide, including data related to their profile, tournament participation, and match results.

The controller is not liable for:

• inaccurate, incomplete, or misleading data provided by users;
• content generated by users or third parties (including tournament organizers);
• actions by other users or organizers related to data entry or processing.

The user has the right at any time to request:

• correction of inaccurate data;
• restriction of processing;
• deletion of their personal data, where applicable under the law.

The controller will make reasonable efforts to process such requests without undue delay, except where retention of certain data is necessary for:

• compliance with a legal obligation;
• protection of legitimate interests;
• maintaining historical accuracy and competitive integrity (e.g. tournament results), in which case the data may be anonymized where possible.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the 'Last updated' date, and where appropriate, notifying you via email or push notification. Continued use of our services after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to revoke your privacy consent, please contact us at:

Company: ВАЛА ЕООД (VALA EOOD)
Email: [email protected]
Administrator: Yasen Kostov — [email protected]
Website: tennismasa.club