Privacy Policy

1. Who we are and how to contact us

The spartON service (the “Service”) is operated by MACET, s.r.o., Nitrianska 32/189, 949 11 Nitra, IČO 35953781, Zapísaná v Obchodnom registri Okresného súdu Nitra, oddiel: Sro, vložka č. 17071/N (“we” or “MACET, s.r.o.”).

You can contact us on data protection matters by e-mail at info@sparton.eu or in writing at our registered office.

This policy explains how we process the personal data of club staff and administrators, visitors to our website, and club members, their legal guardians and applicants whose data is stored in the Service. It is based on Regulation (EU) 2016/679 (the “GDPR”) and Slovak Act No. 18/2018 Coll. on Personal Data Protection.

2. Our two roles

As a controller, we process personal data whose purposes and means we determine ourselves: user accounts of club administrators, our contractual relationship with clubs, billing, support communication, our marketing website and the security of the Service.

As a processor, we process personal data that clubs enter into the Service: data about members (including children), legal guardians, applicants, coaches and other club staff. The controller of this data is the respective club, which determines what data it processes and for what purpose. We process it only on the club’s instructions and under the Data Processing Agreement. If you are a member or guardian, please direct your questions and requests primarily to your club.

3. Data we process as a controller

Identification and contact details of club administrators and contact persons (first name, surname, e-mail, phone) and club details (name, registered office, company ID, tax ID).

Login credentials – e-mail and password, the latter stored exclusively as a cryptographic hash, never in readable form.

Billing and payment data – invoices and payments for the subscription and additional packages. Payment card data is processed by Stripe; we do not have access to card numbers.

Communication with us – the content of e-mails and support requests.

Technical and security data – IP address, browser and device type, time and outcome of logins, system activity records (logs).

4. Purposes and legal bases

Providing the Service, managing user accounts, customer support and service notices – performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR).

Invoicing, bookkeeping and tax compliance – compliance with a legal obligation (Art. 6(1)(c) GDPR) under Slovak Act No. 431/2002 Coll. on Accounting and Act No. 222/2004 Coll. on Value Added Tax.

Securing the Service, preventing abuse (for example limiting login attempts), analysing errors and establishing, exercising or defending legal claims – legitimate interest (Art. 6(1)(f) GDPR).

Sending news about the Service – consent (Art. 6(1)(a) GDPR) or, for existing customers and our own similar services, legitimate interest to the extent permitted by Slovak Act No. 452/2021 Coll. on Electronic Communications. You can unsubscribe at any time.

No automated decision-making or profiling producing legal effects concerning you takes place.

5. How long we keep data

Accounting records (in particular invoices) – 10 years from the end of the year to which they relate.

User account and club data – for the term of the agreement and 30 days after it ends; the data is then deleted.

System and security records (logs) – 12 months.

Data used for rate limiting and abuse prevention – only for the short time window to which the limit applies.

Consent to receive news – until withdrawn. Data needed to establish or defend legal claims – until the limitation period expires or proceedings end.

6. Data we process for clubs

For clubs we process in particular the following categories of data: identification and contact details of members and guardians, date of birth, group membership, attendance, payment requests and payments, applications, messages sent through the Service, documents and photos uploaded by the club, and user account data of members and guardians.

The scope, purpose, legal basis and retention period of this data are determined by the club as controller. If you send us a request concerning data we process for a club, we will forward it to that club without undue delay and help it respond.

We do not use this data for our own purposes, in particular not for marketing, profiling or sale to third parties.

7. Children’s data

The Service is not intended for children to set up clubs themselves. Data of children who are club members is entered into the Service by the club, which is the controller and is responsible for having a legal basis for processing and, where required, the consent of a legal guardian.

A club may upload and publish photos showing children only with the consent of their legal guardian or on another legal basis.

We do not pass children’s data from member records to the artificial intelligence provider, nor do we use it for any purposes of our own.

8. Recipients of personal data

We share personal data only to the extent necessary with the following categories of recipients: a hosting and infrastructure provider with data centres in the European Union; an e-mail delivery provider; an SMS gateway provider; operators of web browser push services (notification content is encrypted in transit); Stripe for card payments; Anthropic for AI text generation; Meta, if a club connects its page and publishes a post; our external accounting, tax and legal advisers bound by confidentiality.

Stripe processes payment data as an independent controller under its own privacy policy. Meta processes published content on its platform under its own terms.

We may also disclose personal data to public authorities where required by law. We will provide the current list of processors on request at info@sparton.eu.

9. Transfers outside the European Union

Service data is stored in the European Union. Transfers to third countries (in particular the USA) may occur when the services of Anthropic, Stripe and Meta are used.

Such transfers take place only with appropriate safeguards under Chapter V GDPR – on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or standard contractual clauses adopted by the European Commission. We will provide a copy of the relevant safeguards on request.

10. Artificial intelligence

When generating posts, we pass to the artificial intelligence provider (Anthropic) only the event description and photos that the club uploads for that purpose. We do not pass on personal data from member records. If photos show people, they constitute personal data for whose use the club is responsible.

Under its commercial terms, the provider does not use data passed on in this way to train its models.

11. Cookies

We use only strictly necessary cookies: a session cookie to keep you logged in and a cookie to remember your chosen language. The application also uses browser storage to the extent necessary for offline mode and push notifications.

We do not use analytics or marketing cookies or any third-party tools to track visitors. Strictly necessary cookies do not require consent under Slovak Act No. 452/2021 Coll. on Electronic Communications.

12. Data security

Passwords are stored only as hashes created with the Argon2id algorithm. All communication between your device and the Service is encrypted (HTTPS/TLS).

Data of individual clubs is logically separated; every access to a club’s data is checked against the user’s permissions in that club. Access rights are role-based, login attempts are rate-limited and data is backed up regularly.

Only authorised persons bound by confidentiality have access to data, and only to the extent necessary for their tasks.

13. Your rights

You have the right of access to your personal data, to rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing before it.

You can exercise your rights at info@sparton.eu. We will respond without undue delay and at the latest within one month; in justified cases this period may be extended by two further months. For data we process for a club, please contact the club.

If you believe that the processing of your personal data infringes the law, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk, or with the supervisory authority of your place of residence.

14. Changes to this policy

We may update this policy, in particular when the Service or the law changes. We will inform club administrators of material changes by e-mail. The date of the last update is shown in the header.