What we do with your data,and what we do not

Version 2, in force from 25 October 2026. This statement was written from what the platform actually does. The Dutch version is the original; this is a translation. Version 2 fills in the retention periods, describes deleting your account and downloading your data yourself, and says what a club can download from its entry list.

Who processes your data

PlayTour, Aletta Jacobsstraat 23, 7421 HN Deventer, the Netherlands. For privacy questions and requests about your data: [email protected].

PlayTour is in its early stage and is offered free of charge during that stage, so that we can refine it from the experience of the clubs using it. It is currently offered by a natural person trading under the name PlayTour. There is no Chamber of Commerce registration yet, because nothing is invoiced. This will be updated when that changes.

Often the club is responsible, not us

PlayTour is responsible for your account, signing in, platform security, the support we give and our own administration.

The organising club is responsible for everything to do with a tournament: what they ask when you enter, whom they enter, what they publish, which messages they send and how long they keep it. For those things PlayTour is the supplier carrying it out, a processor in GDPR terms.

For your participant profile, PlayTour is the controller. The profile does not belong to one club: you fill it in once and it travels with you to every club you enter. We decide that it works that way and which fields an organiser sees. What a club then does with that data inside its own tournament is its responsibility.

What we process

Your account: first name, last name, email address, password (hashed, we cannot read it), optionally your phone number, language, timezone, a photo, and when you last signed in.

Your participant profile, which is optional and which you fill in yourself: date of birth, gender, contact details, a photo, postcode, town and country, an emergency contact, your club, your federation and membership number, and the sports you play.

Health and diet. Your profile has fields for medical notes and dietary requirements. These are stored encrypted, and they are visible to the organiser of every tournament you enter, which is what the field is for: first aid and catering. Your profile's privacy setting does not hide them from the organiser. They are never visible to other participants or to visitors. Filling them in is voluntary and you can remove them at any time.

Your entries and matches: which part you entered, your partner or team, your status, your competitor number, your seeding, when you are unavailable, your check-in at the hall, your matches, the results and the standings. Where a club charges an entry fee: the amount, the payment status and any refund.

Participants without an account: a club can enter someone who has no PlayTour account. We then hold first name, last name, email address, date of birth and gender, supplied by the club. The club is responsible for that, including for informing the person.

Communication: messages from a club to its participants, notifications about your entry, email we send you, your preferences for it, and, if you use the app, the device token needed to deliver a push notification.

Technical and security: server logs, an audit trail of significant actions, and data needed to prevent abuse. Your IP address passes through our security layer and our captcha.

What becomes public

A club can set a tournament's entry list to public. When it is on, your first and last name are visible to anyone opening the page, with your competitor number and seeding. The same goes for schedules, results and standings. Those pages can be found through search engines, including for junior participants.

The club decides this, not PlayTour. If you would rather not appear, contact the organising club. You can also object to us (article 21 GDPR) and we will take it up with the club.

Who we share with

We sell nothing and share nothing for advertising. The parties that help us deliver the service: IONOS Cloud (Berlin, Germany) for our server, database, files and backups, all within the European Economic Area; Cloudflare in front of our websites, which processes IP addresses, and our captcha; Google Workspace, which sends our email; Google Firebase Cloud Messaging for push notifications; and OpenStreetMap for looking up an address.

Cloudflare and Google are US companies. Transfers rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.

What we do not use: no Google Analytics, no ad networks, no tracking pixels, no AI services. No personal data goes to an AI provider.

The organising club sees the data it needs to run the tournament. It is not a third party but the party you enter with. A club can also download its entry list for the desk: name, start number, event, status, entry fee and payment status, date of birth, gender, club and email address. Medical notes, dietary requirements and your address are deliberately left out of that file.

How long we keep it

We keep data for as long as it is needed for the purpose it was collected for, and no longer. Invoices and financial records are kept for seven years, which is a legal obligation. Your account is kept while you use it; after three years without a sign-in and with no open entry, we clear it. If you ask for deletion yourself, there is a thirty-day period in which you can undo the request. Tournament data is kept by the club for as long as the club keeps it; notifications and registered devices are cleared after six months; expired sign-in tokens are cleared automatically. A nightly task carries this out.

Your rights

You may ask us for access, correction, deletion, restriction, portability, and you may object. Where we rely on consent, you may withdraw it at any time. Email [email protected] and we will respond within one month.

You delete your account and download a copy of your data yourself, in the app under Settings. Deletion takes effect after thirty days and can be undone within that period. If that does not work, email us and we will handle it within one month.

You can complain to the Dutch Autoriteit Persoonsgegevens. We would appreciate it if you came to us first.

Security

What is demonstrably in place, and no more: passwords are hashed, medical and dietary data encrypted. Access to a club's data is separated per club and that separation is guarded by tests in the code. Every call to the API runs over a secure connection with scoped permissions. Significant actions are recorded in an audit trail. Sign-in attempts are rate-limited.

What we do not have, and therefore do not claim: an ISO certification, an external audit or a penetration test.

Children

Clubs run junior tournaments, so children's data is processed. For participants under 16 a parent or guardian gives consent. In practice the club enters junior participants and that responsibility sits with the club: it checks that it may enter a child and informs the parents.

A PlayTour account of your own therefore starts at 16. Younger than that, you take part through your club, which enters you and provides the data.

Changes

If something material changes we will update this statement and put a new date at the top. For significant changes we will tell you by email or in the app.