Privacy policy

Who is the controller?

The controller for Dynamo Manager's own processing is Sergio Blánquez Ovelleiro, tax ID 77922647G, address Carrer Puig de la Muga, 11, 17486 Castelló d'Empúries, España, email info@dynamomanager.com.

There is no data protection officer. To exercise your rights or ask a privacy question, write to info@dynamomanager.com.

When a club uses Dynamo Manager for its players, the club decides the purposes of that competition and is the controller. Sergio Blánquez Ovelleiro processes that data as a processor, under the processing agreement. This policy explains both roles so they are not mixed up.

See also: Data processing agreement

Why do we process your data?

User account: given name, surname, date of birth, gender, country, telephone, email and password, to create the account, identify you and provide the service.

Club and billing: club details, billing email and payment data processed by Stripe, to contract the plan, charge it and keep accounts.

Support and contact: the details in the contact form, to answer the enquiry.

Security: IP address and technical logs, to protect the service, prevent abuse and diagnose faults.

Entries and results, on the club's behalf: player data that the club or the player provides in order to enter, play and appear in the draw. The club decides that processing.

Marketing: we do not send newsletters or use advertising pixels today. If we later write to club owners who are already customers, it will only be about similar Dynamo Manager services, and they can object at that time and in every message.

How long do we keep it?

Account data is kept while the account is active. It is then blocked for as long as needed to meet liabilities, using six years as the criterion for accounting and contractual duties, unless a rule requires a different period.

Contact enquiries are kept while they are being handled and for no more than one year after the last message.

Player data we process for a club is kept according to the club's instructions and is deleted or returned when the processing agreement ends, unless the law requires us to keep it.

Security logs are kept for no more than twelve months, unless they are needed to investigate an open incident.

You can delete your account at any time from your profile, under Delete account, by confirming with your password and with the link we email you. The deletion is immediate once confirmed and also covers your records in the clubs: your email, phone number, date of birth and the rest of your personal data are erased, you stop appearing in the rankings and clubs can no longer contact you. Payments and acceptances of legal texts are kept blocked for the legal period. Stripe keeps, on its own account, the data of the payments it processed.

Your given name and surname are kept in the draws, order of play and results of tournaments that have already finished, because of the club's legitimate interest in keeping the record of its competition. This is pseudonymisation, not anonymisation. If you object when you delete your account, they are replaced there too with “Unknown player”; matches and results stay the same.

What is the lawful basis?

The account, the club plan and entries that depend on a contract are based on performance of that contract. Required fields are marked on the form. Without them we cannot create the account, the club or complete the entry.

Service security and replies to enquiries are based on the legitimate interest in running the service and answering the person who writes to us. You may object where that interest does not override yours.

Future messages to customers about similar products are based on the contract and on article 21.2 of Act 34/2002, with a right to object. Any other electronic marketing is sent only with consent.

Age is checked in order to apply article 7 of Organic Act 3/2018: an own account requires age 14. Creating a club requires age 18.

Who receives the data?

We do not sell data or disclose it to third parties for their own purposes, except where the law requires it.

We use processors: Laravel Forge, to administer the server; hosting is in Fráncfort del Meno, Alemania, inside the European Economic Area; Google, for the info@dynamomanager.com mailbox; Resend, for email the application sends; and Stripe, for plan payments and entries.

The Dynamo Manager team can see a player's data only to provide the service the club has instructed. Each club sees the data of players who belong to that club. A club does not, for that reason, see players who are not its own.

If the club publishes a ranking or a draw, visitors to that page can see the player's given name and surname. There is no profile photo. The rest of the record is not public. The public pages listing registrations, draws, order of play and rankings ask search engines not to index them.

Are there international transfers?

The production server is in Fráncfort del Meno, Alemania. That hosting is not a transfer outside the European Economic Area.

Google, Resend, Stripe and Laravel Forge may access data from the United States or other countries. Where that happens, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision, such as the EU-US Data Privacy Framework when the provider has joined it.

Are there automated decisions?

Draws and schedules are calculated by an algorithm using the rules the club sets. It is not an artificial intelligence system and it does not, on its own, decide to exclude a player from the competition. The club runs the tournament and can review the result. We do not build profiles for advertising.

What about children?

Only a person aged at least 14 can create their own account. Below that age there is no self-registration.

A child under 14 can appear in a tournament if their club enters them, without an own account. In the processing agreement the club warrants that it has the authorisation of the holder of parental responsibility.

The person who creates a club and pays for the plan must be at least 18.

People aged 14 to 17 may have an account. We will not send them advertising or build commercial profiles about them. In public, only given name and surname appear when the club publishes the ranking or the draw.

Where does the data come from?

Account and contact-form data come from the person concerned. A player's data may also come from the club, for example when it imports a list or enters a child who has no account. In that case the source is the club, which must have informed the player or their representative.

What are your rights?

You may request access, rectification, erasure, objection, restriction and portability, and you may withdraw consent where processing is based on it, without affecting the lawfulness of processing already carried out.

To exercise these rights, write to info@dynamomanager.com, name the right and give us a way to reply. You may also complain to the Agencia Española de Protección de Datos (https://www.aepd.es). If the club is the controller, you can send the request to the club; if it reaches us as processor, we will pass it on.