Privacy and Data Transparency Center

The Data Controller determines the purposes and methods of the processing carried out through Sportsuite. For services or content published independently by professionals, companies, associations, and other operators, these entities may act as independent controllers for the data they collect directly through their own channels.

Requests for access, rectification, deletion, restriction, objection, portability, or withdrawal of consent can be sent to the privacy contact indicated. To expedite verification, the request should specify the affected account or email address without attaching unnecessary additional data.

This policy applies to visitors, registered users, professionals, company and organization representatives, people who submit requests, customers who purchase services, support recipients, and individuals whose data is entered in a form or communication.

The document covers the public website, registration, dashboard, Professional and Company/Sport Partner tabs, Requests, Wallet, Premium, Boosts, support tickets, billing tools, statistics, and active technical integrations. External sites accessed via links apply their own privacy policies.

Registration data is used to create an account, verify your operational identity, grant access to the dashboard, associate cards and purchases, and secure the service. Passwords are not shown to administrators and are managed according to WordPress security mechanisms.

Login events, sessions, IP addresses, user agents, nonces, anomalous attempts, and application logs may be recorded to prevent fraud, unauthorized access, scraping, spam, and misuse. Users are responsible for maintaining the confidentiality of their credentials and must promptly report any suspicious access.

Profiles are designed for publication. Name or title, title, descriptions, skills, experience, city, province, region, professional address, website, social media, photos, cover art, products, and services can be viewed by anyone and indexed by search engines when the CPT and template are public.

In the detected configuration, your website, social media, and location are accessible on all plans, while your email and phone number are only displayed publicly when the plan or active feature allows it. Changing your plan can therefore change the visibility of your contact information without deleting it from your account.

Images may contain personal data of third parties. Uploaders must be authorized to do so, notify the individuals depicted when necessary, and remove irrelevant metadata. Sportsuite can generate thumbnails and optimized formats for publishing, previewing, and distribution.

A general request can be distributed to multiple operators matching your profile, interests, and geographic area. A direct request is addressed to a specific listing. Before unblocking, Sportsuite may display a reduced or masked version; after unblocking, the contact details are made available.

Unlocking can be done using a credit included in the Premium plan, your Wallet balance, or a payment via Stripe. Sportsuite records the transaction, the person who performed the unlocking, and the subsequent business management, including notes and outcomes. The recipient must use the contact information exclusively to respond to the request and not for third-party communications or unauthorized campaigns.

Sportsuite uses Stripe for card payments, Wallet top-ups, and, when configured, recurring charges. In the standard integration, full card details are entered into Stripe environments or components and do not need to pass through Sportsuite modules. Sportsuite, however, stores the technical identifiers of the session or payment, amount, currency, VAT, outcome, reason, and data required for reconciliation, support, fraud prevention, and tax compliance.

Stripe processes payment, device, network, cookie, and fraud signal data according to its own privacy policy and may act as an independent controller or processor depending on the business. Before going live, it is important to ensure that the configuration does not record the full card number or CVC code in Sportsuite systems.

The Wallet records bonuses, top-ups, purchases, refunds, and adjustments. The balance is linked to the account and can be used for Requests, Boosts, and other services indicated on the dashboard. The Premium plan and Boosts generate data on activation, expiration, package, promoted card, and expected coverage.

Sportsuite can measure visits to listings, visitors distinguished by shortened or hashed identifiers, device, origin, UTM parameters, duration, scroll percentage and interactions such as clicks on phone, email, site, social, products, shares, favorites and requests.

Technical cookies and session identifiers are used for login, security, preferences, and checkout functionality. Non-essential analytical or marketing cookies are activated only based on the banner settings and user choices, when consent is required. The actual list must be maintained in the consent manager installed on the site.

The IP address displayed in the analytics dashboard is masked; a hash may also be stored to estimate unique visitors. Hashing and masking reduce identifiability but do not automatically transform all data into anonymous information.

Data may be processed by authorized personnel, system administrators, hosting providers, email and support providers, administrative and legal consultants, Stripe, security, backup, analytics, and other essential providers. Access is limited to task-related tasks and regulated by appropriate instructions, agreements, and controls.

Requests are communicated to compatible operators or to the recipient's profile depending on the chosen function. Public content can be distributed on Sportsuite pages, in articles, and on partner sites when a Boost or other visibility initiative is active.

If a provider processes data outside the European Economic Area, the Data Controller verifies the applicable transfer mechanism, contractual guarantees, and required additional measures. The providers' privacy policies describe their respective transfers.

Specific timeframes must be recorded in the processing log and in the configuration of individual systems. The general rule is not to retain identifiable data longer than necessary.

The interested party may request confirmation of processing, access, rectification, erasure, restriction, portability in the applicable cases, objection, and withdrawal of consent without affecting the previous lawfulness of the processing. They may also lodge a complaint with the competent supervisory authority.

The Sportsuite dashboard allows you to export your account, tabs, and activity data, as well as request a verified deletion. Some data may be retained even after closure when required by law, security, exercising or defending a right, or protecting third parties.

Self-registration is reserved for individuals aged 18 or over, unless otherwise specified in applicable regulations or expressly established procedures. Sports organizations processing minors' data must ensure adequate authorizations, disclosures, legal bases, security measures, and visibility levels.

Anyone who enters the data of employees, collaborators, athletes, contacts, clients, or depicted persons declares that they are authorized and have fulfilled transparency obligations. Private addresses, health data, documents, or irrelevant information must not be published.

Sportsuite adopts measures proportionate to the risk, including access controls, roles and permissions, protected passwords, nonces, updates, backups, logging, privilege limitations, separation of environments, encryption in transit, and monitoring for anomalous events. No system can guarantee absolute security; measures are reviewed as the platform evolves.

In the event of a personal data breach, the incident is analyzed, contained, and documented. When the conditions are met, the Data Controller notifies the authorities and communicates with the data subjects within the applicable timeframes.

This section is constructed at runtime by reading registered Custom Post Types, WordPress supports, taxonomies, declared meta data, ACF groups, and a limited sample of the actual keys. Record values ​​are not read or published.