Privacy Notice – DTC Schedule

Dodig Tennis Center, Međugorje

This notice explains which of your personal data the DTC Schedule application – a system for managing training schedules, availability, coach records and travel orders for Tenis klub Dodig – processes, for what purposes, who has access to it, how long it is kept, and what rights you have. It applies to players (including minors), their parents/guardians, coaches, and administrators who use the application.

Who is the data controller

The controller of your personal data is:

Name: <CLUB'S FULL LEGAL NAME>
Address: <CLUB'S ADDRESS>
Contact e-mail for privacy questions: <CLUB'S CONTACT E-MAIL>

For any question about how your data is processed, to exercise the rights described in this notice, or to raise a complaint, contact the club at the e-mail address above.

What data we process

The application stores different data depending on your role.

Players (including minors)

first and last name, date of birth
phone and e-mail, where provided
for minor players: the parent's/guardian's name and phone number
sector, subgroup, level and training programme
the season enrollment period (from–to week)
an availability calendar (time ranges when the player is available for training); the calendar may optionally follow a preset defined by the club (e.g. "Međugorje school – shift A") – this is not an integration with an outside calendar service such as Google or Outlook Calendar
reported absences from training (with a reason, if one was entered) and attendance records (present/absent) for each session
notes entered about the player by coaches or administrators; some notes are visible to staff only, others to the player/parent as well, depending on how visibility is set

A minor player's data is entered into the application by club staff and by the parent/guardian linked to the child's profile – not by the child alone.

Parents/guardians

name, e-mail, interface language
a link to the profile(s) of the children they are guardian of (up to three children per account)
e-mail notification preferences

Coaches

name, e-mail, interface language
the code (short label), colour and status (head coach or support staff) used to show them on the schedule
the sectors and training types they are responsible for
monthly hour quota
travel orders for competitions: trip dates, per-diem and expense amounts, and any attached receipts

Administrators

name, e-mail, interface language
password – the only role that has one; every other role signs in exclusively via an e-mailed link
actions an administrator takes in the system (e.g. changing settings, deleting a profile, publishing a schedule) are recorded in the administrative action log

Purposes of processing

We process your data in order to:

run the training schedule and assign sessions, courts/halls and coaches
record attendance and absence from training
record coach working hours and quotas
process travel orders and related expenses for competitions
send e-mail notifications (about sessions, cancellations, travel orders and similar)
keep security logs and an administrative action log, for system security and accountability for actions taken

Legal basis for processing

Contract/membership – processing is necessary to provide the club's service (schedule, training, records) to a player, parent or coach at all.
The club's legitimate interest – for example security logs, the administrative action log, and preventing abuse of the sign-in system.
Consent – used only when and if the club explicitly asks for consent for a specific processing activity; in that case the club will state the purpose clearly, and consent may be withdrawn at any time.

For the exact legal basis of a specific processing activity, contact the club at the e-mail address in the first section.

Who has access to your data

Administrators – access to all data in the application, in order to run the club.
Coaches – data of players on their own sessions (schedule, availability, notes marked visible to coaches), and their own working-hours and travel-order data. They cannot see notes entered by other coaches.
Parents/players – their own data, or their children's: the schedule, a read-only availability calendar, and notes marked visible to the player.
The public weekly schedule link (available without signing in, if the club chooses to share it) – shows only the child's first name and the first letter of their surname (e.g. "Ana K."), the coach identified by their code (not their full name), the training type, the session time, the court/hall, and whether the session is canceled. It does not show e-mail, phone, notes, or attendance/absence records.

Processors and hosting

Application hosting: <NAME/DETAILS OF THE HOSTING PROVIDER>
Sending e-mail: notifications and sign-in links are sent through <NAME OF THE E-MAIL DELIVERY PROVIDER>

The club does not sell or share your data with third parties for marketing purposes.

Retention periods

Sign-in links (magic links): valid for 15 minutes and usable only once; the link records themselves are deleted from the system at the latest 24 hours after being issued.
Automatic schedule-generator plans: the plan content is cleared 90 days after a generator run is discarded, failed, canceled or applied; the sessions that resulted from the plan remain on the schedule.
Absence and attendance records: kept permanently as the club's records (statistics).
Failed background system messages: deleted after 30 days.
Application (technical) logs: kept for 30 days and then automatically deleted (rotation).
Travel-order receipts: kept for as long as the related travel order exists; deleted when a draft order is deleted.
Backups: kept for a limited number of days set by the club, currently 14. If a profile has been anonymised in the meantime, older backups may still contain the pre-anonymisation data until that backup itself is deleted once its retention period expires.
The administrative action log: kept permanently for accountability of actions taken, and is never deleted.

Your rights

Access – on your request, the club produces an export of your data (profile, sessions, absences, attendance, availability calendar) as a file that is handed to you. The application does not currently offer a self-service export – send your request to the club at the contact e-mail.
Rectification – if your data is inaccurate or incomplete, contact the club; club staff will correct it on your behalf.
Erasure (anonymisation) – once you stop training or working at the club, an administrator can, on request, anonymise your profile: your name is replaced with a label such as "Player #id" or "Coach #id", contact details and notes are cleared, and the linked user account (if any) loses the ability to sign in. Sessions, attendance/absence records and travel orders remain in the system for the club's statistics and accounting, but are no longer linked to an identifiable person. This action cannot be undone. Note that older backups may still contain pre-anonymisation data – see "Retention periods" above.
Objection – you may object to processing based on the club's legitimate interest; the club will consider your objection and respond.
Complaint to the supervisory authority – if you believe your data is not being processed lawfully, you may lodge a complaint with the Agency for the Protection of Personal Data in Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u Bosni i Hercegovini). Although Bosnia and Herzegovina is not an EU member state, the club aims to follow the principles of the General Data Protection Regulation (GDPR) in how it handles personal data.

Notification preferences

In your profile, under "My notifications", you can turn individual types of e-mail notification on or off (for example, about a moved session, a published schedule, or a generated plan).

A few notification types are always sent and cannot be turned off, because they are essential to the club's operation:

a session being canceled, individually or in bulk
your travel order being rejected
(administrators only) a new travel order being submitted for approval

Cookies

The application uses only one technical session cookie, needed to keep you signed in while you use the application. We do not use cookies for tracking, analytics, or advertising.

Security measures

Traffic to the application is encrypted with HTTPS (TLS). Signing in by e-mail uses a single-use link that is valid for only 15 minutes. The number of sign-in requests is rate-limited to prevent abuse, without revealing whether a given e-mail address exists in the system. Travel-order receipts are stored privately, outside the publicly reachable part of the server, and are visible only to administrators and the coach who submitted the order. Access to data is restricted by user role. Database and file backups are taken regularly. In technical logs, e-mail addresses are never recorded in readable form, only as a one-way cryptographic hash, so a log entry cannot be used to read out whose address it is.

Changes to this notice

The club may update this privacy notice from time to time, for example because of changes to the application or to applicable law. The current version is always available on this page.

Last updated: <DATE OF LAST UPDATE>