Privacy Policy

This Privacy Policy explains how personal data is collected, used, and protected when you use Boiskowo (the "Service"), available at boiskowo.io. We are committed to processing personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Polish law.

1. Data Controller

The controller of your personal data is Radosław Filip, sole proprietorship (jednoosobowa działalność gospodarcza), NIP 6842509693, REGON 180956693. For any privacy-related matter you can contact us at kontakt@boiskowo.io.

2. What data we collect and its sources

• Account data you provide when registering: email address, display name, a securely hashed password, account creation date, and email-verification status.
• Google or Facebook sign-in: if you use it, the provider gives us your email address, name, and your account identifier with that provider. We never receive your Google or Facebook password.
• Reviews you post: the author name you provide, the rating, the review text, an optional child age group, the submission date, and a technical sender hash used to limit abuse.
• Trial training requests: the name and contact details of the person asking, the age group, and the message. We pass these to the academy concerned.
• Tournament data: the organiser's name, contact details of co-organisers and referees invited to a tournament, and the team and player names entered by the organiser.
• Contact form messages: email address, subject, and message body.
• Academy directory data: names, addresses, phone numbers, and email addresses of football academies, obtained from public external sources (the PZPN football-school certification programme and OpenStreetMap). See section 4.
• Technical data: IP address, an approximate country derived from a content-delivery-network header (used only to choose the interface language), and basic server logs needed to operate and secure the Service.
• Analytics and marketing data: collected only after you consent in the cookie banner. See sections 5 and 9.

3. Purposes and legal bases

• Providing the Service — creating and managing your account, publishing your reviews, running a tournament, passing on a trial request: performance of a contract (GDPR art. 6(1)(b)).
• Operating a public directory of football academies, ensuring security, and preventing abuse: our legitimate interests (GDPR art. 6(1)(f)).
• Sending transactional emails such as email verification and password reset links: performance of a contract and our legitimate interest in securing accounts.
• Measuring traffic and advertising performance: your consent (GDPR art. 6(1)(a)), which you may withdraw at any time.

4. Academy listings and third-party data

The academy directory is compiled in part from publicly available sources — the PZPN football-school certification programme and OpenStreetMap. This may include business contact details (such as an academy's email or address) that can constitute personal data. We process it on the basis of our legitimate interest in maintaining a useful, public sports directory. If you are connected with a listed academy and wish to have an entry corrected or removed, contact us at kontakt@boiskowo.io; academies can also claim and manage their own listing.

5. Sub-processors

We rely on the following service providers who process data on our behalf:

• Resend — delivery of transactional (verification and password reset) emails.
• Amazon Web Services (AWS) — hosting and infrastructure.
• Google — Google Analytics 4 (statistics, consent only) and Google sign-in.
• Meta Platforms — Meta Pixel (advertising measurement, consent only) and Facebook login.

6. International transfers

Our infrastructure is hosted in the European Union (AWS, Frankfurt region). Some sub-processors — in particular Google and Meta, as well as our email provider — may process data in the United States; where that happens, transfers are safeguarded by appropriate mechanisms such as the European Commission's Standard Contractual Clauses and the Data Privacy Framework.

7. Data retention

We keep account data for as long as your account exists and delete it after account closure, unless a longer period is required by law. Reviews remain published while they are part of the Service. Trial requests and contact messages are kept for as long as handling them requires. Email-verification and password-reset tokens are short-lived and expire a few hours after they are sent. Technical logs are kept only for a short period needed for security and diagnostics.

8. Your rights

Under the GDPR you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate data;
• erase your data ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at kontakt@boiskowo.io. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO).

9. Cookies and tracking

Strictly necessary cookies are always active: one that remembers your chosen language (NEXT_LOCALE) and one storing your consent choice (boiskowo-consent, valid for 12 months).

Beyond cookies, we store data in your browser's local storage (localStorage), which the rules on storing information on a user's device cover in the same way. We keep the token that keeps you signed in and basic account details there, plus a draft of a tournament or academy if you started filling in a form before creating an account — so that the fields are still there when you come back. The draft holds what you typed (including name, address, phone, and email), is kept for 7 days, and is not sent anywhere until you save the form. All of this is necessary for features you deliberately use, and you can remove it by clearing site data in your browser.

Beyond those, we use tools that load only after you consent in the banner shown on your first visit:

• Statistics — Google Analytics 4, measuring visits and how the Service is used. Without consent it runs in denied mode and stores no cookies.
• Marketing — Meta Pixel, measuring the performance of our ads on Facebook and Instagram. Without consent the script is not loaded at all.

You can change or withdraw your choice at any time — the "Cookie settings" link in the footer reopens the same banner.

10. Children

The Service is intended for adults. Accounts must be created by adults, and reviews are written by parents or guardians. A review may indicate a child's age group, and a trial request may include a child's first name and age group, where the adult filling in the form provides them; we pass those only to the academy concerned. We do not knowingly collect other personal data of children and the Service is not directed at them.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest version. Material changes will be communicated through the Service.

12. Contact

For any questions about this policy or your personal data, contact us at kontakt@boiskowo.io.