Privacy Policy

1. Introduction

Welcome to TurniCup. This Privacy Policy explains how TurniCup ("we", "us", or "our") collects, uses, stores, and protects personal information when you use our website, application, and related services available at turnicup.com (the "Service").

TurniCup provides tools for creating, managing, and sharing tournament brackets and tournament results.

We respect your privacy and process personal data in accordance with applicable privacy laws, including the General Data Protection Regulation (GDPR) where applicable.

2. Our Role: Controller and Processor

TurniCup processes personal data in two different roles, depending on whose data it is.

As a controller, for data about our own users: account information, subscription and payment records, and technical and security data. We decide why and how this data is processed, and this Policy describes that processing. The controller is:

• Solid Code s. r. o.
• Bulharská 5560/80, 821 04 Bratislava, Slovakia
• Company ID: 54598681
• Email: support@turnicup.com

As a processor, for the information a tournament organizer enters about tournament participants. The organizer decides which tournaments to create, which participants to enter, whether to use real names, nicknames or made-up identifiers, whether to enable sharing for a tournament at all, how long it stays shared and who receives the shared link. We process that information solely to provide the Service to the organizer and do not use it for any purpose of our own.

For that participant information the organizer is the controller. Organizers are responsible for having a legal basis to enter it, for informing participants where required, and for handling participants' requests about their data. The terms of our processing are set out in the Data Processing Agreement in our Terms of Service.

We do not use participant information to build profiles of individuals, we do not sell it, and we do not disclose it to anyone other than the infrastructure providers listed in section 7 and, where the organizer shares a tournament link, the people who receive that link.

If you are a tournament participant and you want your name corrected or removed, contact the organizer who created the tournament. If you cannot reach them, write to support@turnicup.com and we will help where we can.

3.1 Account Information

When you create an account or authenticate using a third-party provider, we may collect: email address, first name, last name, profile image URL and authentication provider information.

You may create an account using Google or Facebook.

We use this information to:

• create and manage your account
• authenticate you
• provide access to TurniCup features
• communicate important service information

3.2 Subscription and Payment Information

Paid subscriptions are sold through our reseller Paddle.com Market Limited ("Paddle"), which acts as the Merchant of Record for all our orders. You complete the purchase in Paddle's checkout, where Paddle collects the information needed for the transaction, such as your name, email address, billing country and postcode, VAT number (if provided) and payment details.

Paddle processes this information as an independent controller — not as our processor — to process payments, calculate and collect taxes, issue invoices and receipts, prevent fraud, handle billing enquiries and refunds, and meet its own legal obligations. This processing is governed by Paddle's Privacy Policy, available at https://www.paddle.com/legal/privacy.

Paddle shares with us only the information we need to provide and manage your subscription: your Paddle customer and subscription identifiers, email address, country, the plan purchased, subscription status, and transaction details such as amounts, dates and refunds. TurniCup never receives or stores your full card number or bank account details.

3.3 Tournament Information

TurniCup allows registered users to create tournaments. Users may provide information such as:

• tournament name
• participant names
• nicknames
• other identifiers chosen by the organizer
• tournament brackets
• match results

3.4 Information About Tournament Participants

Tournament participants do not need to create an account.

A tournament organizer may enter participant information for the purpose of:

• creating tournament brackets
• managing matches
• displaying tournament progress and results

Tournament organizers are responsible for ensuring that they have the appropriate rights and permissions to submit participant information, especially when participants may be minors.

For this information the organizer is the controller and TurniCup acts as a processor, as described in section 2.

3.5 Location Information

We may determine your approximate country based on your IP address.

This information may be used for:

• security
• fraud prevention
• service localization
• compliance purposes
• improving the Service

We do not determine your precise physical location.

3.6 Technical Information

We may automatically collect limited technical information, including:

• IP address
• browser information
• device information
• application logs
• security-related information

This information helps us maintain and secure the Service.

3.7 Cookies and Local Storage

We use a small number of strictly necessary cookies and store limited information in your browser's local storage.

Our website sets two cookies, both on turnicup.com and its subdomains, and both valid for 12 months:

• tt-lang — remembers the language you selected
• tt-cookie-notice — remembers that you have already seen our cookie notice

The language you select is also stored in your browser's local storage under the key tt-lang. Authentication tokens may be stored in local storage after you sign in.

We do not use analytics, advertising or tracking cookies. Full details are set out in our Cookie Policy.

The payment checkout, which is provided by Paddle, may set its own cookies, as described in our Cookie Policy.

4. How We Use Information

We use information to:

• provide and operate TurniCup
• manage user accounts
• create tournament brackets
• display tournament information
• process subscriptions
• provide customer support
• maintain security
• prevent abuse
• improve the Service
• comply with legal obligations

5. Tournament Visibility and Shared Links

Tournaments are private by default. A tournament is not publicly available and cannot be viewed by other people unless the organizer actively switches sharing on for that tournament.

Once sharing is switched on, anyone who receives the link may be able to view tournament information, participant identifiers entered by the organizer, brackets and match results. The organizer may switch sharing off again at any time, after which the link no longer provides access.

Whether to switch sharing on, with whom to share the link and how long to keep sharing active is decided solely by the organizer, who is the controller for that information. TurniCup does not make any tournament public on its own initiative.

We cannot retrieve information that recipients already viewed, saved or copied while sharing was active.

6. Legal Basis for Processing (EEA Users)

For users in the European Economic Area, we process personal data based on:

• Contract performance — providing the Service and managing user accounts
• Legitimate interests — security, fraud prevention, service improvement and platform operation
• Legal obligations — compliance with applicable laws
• Consent — where consent is required, such as optional analytics or marketing cookies introduced in the future

6.1 Whether You Have to Provide Data

Providing account information is a contractual requirement: without an email address and authentication provider information we cannot create an account or give you access to the Service.

Providing subscription and payment information is necessary only if you choose a paid plan. If you do not provide it, you can continue to use the free plan.

All other information is optional. Tournament and participant information is entered at the discretion of the organizer; without it, tournaments cannot be created or displayed.

7. Third-Party Services and Recipients

We share personal data only with providers necessary to operate the Service. They act as our processors under written agreements, unless stated otherwise.

• Google and Facebook — sign-in and authentication
• Paddle (Paddle.com Market Limited, United Kingdom) — reseller and Merchant of Record for paid subscriptions; acts as an independent controller for purchase and payment data, as described in section 3.2
• Cloudflare — hosting, content delivery, DNS and security protection for our website and application, which includes processing IP addresses and server logs
• Railway — hosting for our backend application and database, where account, tournament and participant information is stored

These providers process information in accordance with their own privacy policies.

We do not sell personal data and we do not share it with advertising networks.

We may disclose personal data to public authorities where we are required to do so by law.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy. In practice we apply the following criteria:

• Account data — for as long as your account exists, and deleted or anonymized within 30 days of its deletion
• Tournament and participant data — for as long as the owning account exists, and deleted or anonymized together with it
• Subscription and transaction records — for as long as your account exists and, where they form part of our accounting records, for 10 years from the end of the accounting period, as required by Slovak accounting and tax law. Paddle keeps its own records of your purchase under its Privacy Policy
• Server and security logs — for up to 12 months
• Support correspondence — for up to 24 months from the last message

Where data has to be kept longer to comply with a legal obligation, or to establish, exercise or defend legal claims, we keep only what is necessary for that purpose.

9. International Transfers

TurniCup is available worldwide and some of our providers process data outside the European Economic Area. Where that happens, the transfer is covered by one of the following safeguards:

• an adequacy decision of the European Commission for the country concerned
• Standard Contractual Clauses adopted by the European Commission
• the EU-U.S. Data Privacy Framework, where the recipient is certified under it

You can request a copy of the safeguards we rely on by writing to support@turnicup.com.

10. Your Rights

Depending on applicable law, you may have rights including:

• access to your personal data
• correction of inaccurate data
• deletion of your data
• restriction of processing
• objection to processing
• data portability

These rights are not absolute; applicable law sets out conditions and exceptions for each of them.

10.1 How to Exercise Your Rights

To exercise any of these rights, write to support@turnicup.com. We may ask you for information needed to verify your identity before we act on a request.

We respond within one month of receiving a request. If a request is complex, or if you have made several requests, we may extend that period by a further two months and will tell you if we do.

Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive.

10.2 Withdrawing Consent

Where we process personal data on the basis of your consent, you can withdraw that consent at any time by writing to support@turnicup.com, or, in the case of cookies, by clearing them in your browser.

Withdrawing consent does not affect the lawfulness of processing carried out before it was withdrawn.

10.3 Complaint to a Supervisory Authority

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the country of your residence, your place of work, or the place of the alleged infringement.

Our lead supervisory authority is:

• Úrad na ochranu osobných údajov Slovenskej republiky
• Hraničná 12, 820 07 Bratislava 27, Slovakia
• statny.dozor@pdp.gov.sk
• https://dataprotection.gov.sk

You can contact that authority regardless of whether you have raised the matter with us first.

10.4 Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not carry out profiling for such purposes.

11. Children's Privacy and Minimum Age

You must be at least 16 years old to create a TurniCup account. This matches section 3 of our Terms of Service. If you are younger than 16, you may use the Service only through an account held by a parent, guardian, school, club or other responsible adult.

Where we rely on your consent as the legal basis for processing (see section 6), Article 8 GDPR sets the age at which a child can validly consent to information society services on their own. In Slovakia, where we are established, that age is 16; other EEA countries may set it anywhere between 13 and 16. Our own minimum age of 16 applies in all cases.

TurniCup does not knowingly collect personal information directly from children. Tournament participants may include minors because organizers may enter participant names or nicknames when creating tournaments.

TurniCup does not verify the age of tournament participants. Tournament organizers are responsible for ensuring compliance with applicable laws when entering information about minors, including obtaining any parental consent required in their jurisdiction.

If we learn that an account was created by a child below the applicable age without the consent or authority of a parent or guardian, we will delete that account and the associated personal data without undue delay. If you believe a child has provided us with personal data, contact us at support@turnicup.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.

13. Contact

If you have questions about this Privacy Policy or about how we process your personal data, contact us at:

• Email: support@turnicup.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR.

You can also lodge a complaint with the supervisory authority listed in section 10.3.