Last updated: 25 February 2026
1. Personal data controller
The controller of personal data is:
Stowarzyszenie Darts Polska
ul. Rozłogi 26, 85-179 Bydgoszcz
KRS: 0000705819 | NIP: 9532740759 | REGON: 369369593
E-mail: dawid@dartspolska.pl
Tel: 693 19 00 20
2. Purposes and legal bases of processing
Personal data is processed for the following purposes:
| Purpose | Legal basis | Retention period |
|---|---|---|
| Handling tournament registrations | Art. 6(1)(b) GDPR (performance of a contract) | Duration of performance + 6 years |
| Handling accommodation bookings | Art. 6(1)(b) GDPR (performance of a contract) | Duration of performance + 6 years |
| Payment handling and settlements | Art. 6(1)(c) GDPR (legal obligation) | 5 years from the end of the tax year |
| Maintaining the user account | Art. 6(1)(b) GDPR (performance of a contract) | Until account deletion + 6 years |
| Publishing tournament results and rankings | Art. 6(1)(f) GDPR (legitimate interest — promotion of sport, transparency of results) | Until an effective objection is raised |
| Publishing start lists | Art. 6(1)(b) GDPR (performance of a contract — a condition of participating in the tournament) | Duration of the tournament + archive |
| Communication with users | Art. 6(1)(f) GDPR (legitimate interest) | Duration of handling + 6 years |
| Analytics and statistics (GA4) | Art. 6(1)(a) GDPR (consent) | Until consent is withdrawn |
| Pursuing and defending claims | Art. 6(1)(f) GDPR (legitimate interest) | Limitation period (max 6 years) |
| Handling complaints | Art. 6(1)(b) and (c) GDPR | Duration of handling + 6 years |
3. Categories of processed data
Depending on the service, we process the following data:
- Tournament registration: first and last name, e-mail address, tournament category, team name (team tournaments)
- Accommodation bookings: first and last name, e-mail address, phone number, stay dates
- User account: nickname (display name), e-mail address, encrypted password
- Payments: transaction data (processed by Przelewy24 — we do not store card data)
- Tournament results: first and last name, match statistics, ranking
- Technical data: IP address, browser information (automatically, in server logs)
4. Data recipients
Personal data may be transferred to the following recipients:
- PayPro S.A. (Przelewy24) — payment operator, Poland
- Resend, Inc. — transactional e-mail delivery service, USA
- Supabase, Inc. — database infrastructure provider, EU region (Frankfurt)
- Vercel, Inc. — website hosting, global CDN network (including the EU)
- Google LLC — analytics (Google Analytics 4), USA
- Upstash, Inc. — rate limiting service (Redis), EU region
All recipients are obliged to comply with the provisions of RODO (GDPR) or equivalent data protection standards.
5. Data transfer outside the EEA
Some of our service providers (Google, Resend, Vercel) are based in the United States. Data transfer to the USA takes place on the basis of:
- The European Commission implementing decision of 10 July 2023 on the adequate level of protection of personal data (EU-US Data Privacy Framework) — applies to entities certified under the DPF (Google LLC holds certification).
- Standard Contractual Clauses (SCC) — for the remaining providers.
6. Data retention period
Detailed retention periods are given in the table in point 2. General rules:
- Transaction data — 5 years from the end of the tax year (legal obligation)
- Contract data — duration of performance + 6 years (limitation period for claims)
- Data based on consent — until consent is withdrawn
- Data based on legitimate interest — until an effective objection is raised
7. Rights of the data subject
Under RODO (GDPR) you have the following rights:
- Right of access to your data (Art. 15 GDPR)
- Right to rectification of data (Art. 16 GDPR)
- Right to erasure of data — the "right to be forgotten" (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on legitimate interest (Art. 21 GDPR) — in the case of direct marketing the objection is absolutely effective
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal
To exercise the above rights, contact us at: dawid@dartspolska.pl
You also have the right to lodge a complaint with the supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stawki 2, 00-193 Warszawa
uodo.gov.pl
8. Profiling
The Service does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. The ranking system calculates ratings based on sports results, which does not constitute profiling within the meaning of the GDPR.
9. Voluntary provision of data
Providing personal data is voluntary but necessary to use certain services:
- Tournament registration — without a first name, last name and e-mail, registration cannot be completed
- Accommodation booking — without contact details, a booking cannot be made
- User account — without an e-mail and password, an account cannot be created
10. Cookies
The Service uses cookies. Detailed information about the cookies used, their purposes and ways of managing consent can be found in the Cookie Policy.
11. Data security
We apply appropriate technical and organisational measures to protect personal data, including:
- Encryption of connections (HTTPS/TLS)
- Password hashing (bcrypt, 12 rounds)
- Role-based access control (RBAC)
- Row Level Security (RLS) in the database
- Security headers (CSP, HSTS, X-Frame-Options)
- Audit logging of operations in the admin panel
12. Changes to the privacy policy
We reserve the right to update the Privacy Policy. We will inform you of significant changes via the Service. The current version is always available at dartspolska.pl/prywatnosc.
Controller: Stowarzyszenie Darts Polska
ul. Rozłogi 26, 85-179 Bydgoszcz
KRS: 0000705819 | NIP: 9532740759 | REGON: 369369593
Contact: dawid@dartspolska.pl | Tel: 693 19 00 20