Privacy policy
This text applies from 15 October 2026.
Service provider and contact
SPORTINI, obrt za izdavanje softvera, računalno programiranje i informatičke usluge, vl. Dario Zavišić
OIB: 30860479250
Vinkovci, Antuna Branka Šimića 11
dario@sportini.eu
+385958726449
Sportini's two roles
For the account, demo, enquiry, business outreach to clubs and subscription, Sportini is the controller. For members, families, attendance, membership fees, documents, medical deadlines and GPS routes that the club enters, Sportini is the processor and acts on the club's instructions. That relationship is governed by the processing agreement. The club informs persons who do not open an account themselves through the member notice.
Account data and the club application
At registration we collect first name, last name, email, telephone, club name and the time the terms were accepted. You choose a plan only after approval and after the club is set up; on activation we store the selected plan and the subscription status. For demo access we also store the selected sport. The data are used to open the account, process the application, protect access and provide the requested service. The legal basis is a contract, or steps taken before a contract. Confirmation at registration is not consent and is not consent for marketing. We do not publish the data in a directory of other clubs. We keep the account while it exists, and after the account is deleted we remove it, unless it is still needed for membership in a club that has not been closed or for the accounting record of the subscription.
Public demo without an account
For the public demo at /demo we collect your email and optional phone number, access time and acknowledgement of this notice. We do not verify email ownership or create a user account. Contacts are kept for up to 30 days after the latest access and then deleted. If you separately ask us to contact you about Sportini, we record that request; it is optional and does not subscribe you to a newsletter. To limit abuse we retain hashes of the IP address and email for up to two days, without storing the original IP address. Sample records and edits stay in browser memory and reset on reload. Do not enter real athletes’ personal data in the demo.
Use of the demo space
In the demo space we record the time of the last activity and the name of the application section used, for support and for managing inactive demo projects. In that record we do not record the IP address, geographic location, athletes' names or the content of documents. Deleting a demo project does not delete your account or the data of a real club. A project in the bin is kept for 30 days and is then permanently deleted.
Enquiries for a tailored solution
To reply to an enquiry we use your first name, last name, email, club name, a description of your needs and your telephone number if you enter it. The legal basis is the consent you give by the ticked box. An enquiry does not open a subscription and does not require data of real members. You withdraw consent by a message to dario@sportini.eu; withdrawal does not affect processing carried out before the withdrawal. We delete a closed enquiry 12 months after it is closed. An enquiry that stays open is deleted 12 months after we receive it. Deleting an account with the same email address also deletes the enquiry. You may also request earlier deletion.
Club business contacts
For individual introductions of Sportini to relevant clubs, we use the club name, sport, city and country, public business email, contact name and role where needed, official website and source, relevance notes and records of messages, replies and objections. Sources are official club websites, sports directories, public registers and business referrals. We identify the specific source in the first message. Providing data is optional; not replying or objecting does not affect access to the service.
Where these data identify an individual, the basis is a documented legitimate interest in introducing a relevant club-management tool, subject to necessity and balancing the contact's rights. Publication of an address is not consent. Permission to use email is reviewed separately for the recipient's country and type. The initial campaign is limited to business contacts of clubs that are legal persons in Croatia.
Only the authorised operator can access the directory. Firebase/Google Cloud processes storage and access; Spaceship/Spacemail processes delivery and business-email content. If another tool is used for preparation or sending, the operator reviews its processing terms and transfers before use. Applicable transfer information and how to request a copy of safeguards are described below. We do not use pixels to track email opens. We record confirmed opt-outs to honour your request.
CRM contacts and linked activities are deleted after 365 days of inactivity, or earlier when no longer needed. Local exports and mailbox copies are reviewed separately and deleted when no longer needed. A minimal email digest, suppression reason and time, and unsubscribe tokens are kept while needed to prevent renewed contact and maintain opt-out links; the operator periodically reviews that need. Digests are pseudonymous, not anonymous.
You can object to further sales messages at any time, free of charge by replying, confirming the message's opt-out link or emailing dario@sportini.eu. After an objection we stop using your data for direct marketing. Other rights and the complaints procedure are described under ‘Your rights’.
Data your club enters
The club decides which members, family contacts, sporting data, medical deadlines, attendance, membership fees, equipment and documents it records. The club's management is responsible for the lawfulness of what is entered and for the information members must receive. Sportini processes those data on the club's instructions in order to operate the platform. Access depends on the assigned role and on the groups or members with which the account is linked. We keep the records for as long as the contract with the club lasts. In settings, management can download the whole register: members, groups, the schedule, attendance, membership fees, messages, equipment, documents and, in the Pro plan, tasks, an exercise library, notes, activities, water intake, GPS routes and competition preparations with recorded weight. Closing the club deletes members, documents and athlete development records. For paid subscriptions we retain minimal identifiers for accounting, under a policy ending eleven years after the last related accounting year (or the closure year if unknown), without the member directory. For a free pilot, the minimal closure record is deleted after 30 days. The accountant must confirm the applicable period for the operator.
Children
In Croatia a child may consent on their own to an information society service only from the age of 16. An athlete aged 16 or over can complete an enrolment link themselves. For a younger athlete the holder of parental responsibility fills in the form and confirms it. The club can still enter a member directly, and then it must record a parent or guardian and confirm that the holder of parental responsibility has been informed. A GPS route for such an athlete is saved only after that confirmation.
Athlete development in the Pro plan
Individual tasks, coach notes, activities, water intake, routes and competition preparations are linked to the selected athlete profile. Water intake, activities and weight are voluntary personal records of the athlete or a linked parent, and not automatic measurements. The coach only requests a preparation. The athlete or a linked parent records the weight after accepting, and they can stop. Sportini does not set a weight-loss plan. Access for coaches depends on the assigned groups. Location for a route is recorded only when the user starts recording for the selected athlete, confirms saving and allows location access in the browser; the user can stop the recording. Permission for reminders is also voluntary and can be withdrawn. The expiry date of a medical examination, a recorded weight, notes and uploaded documents may be health data. For them the club must have a specific basis, for example a legal obligation for competitors or explicit consent. Sportini does not decide that basis.
Maps and the display of routes
The map base uses OpenStreetMap. Map tiles are requested only when you open the map, from the OpenStreetMap Foundation. The tile provider then receives an ordinary browser request, including the IP address and the requested map view. We do not attach account data, the athlete's name or the athlete's other club records to that request.
Recipients
Google Cloud and Firebase provide sign-in, the database, document storage and delivery of push notifications. Paddle sells Sportini's new subscription as merchant of record: at checkout Paddle collects the email, the billing country and the payment data and issues the invoice. Paddle's privacy policy and terms of sale apply. Sportini does not store the full card number, only the customer and subscription identifiers. Club membership fees are recorded separately, and the bank barcode contains the details for payment to the club. The OpenStreetMap Foundation receives a tile request only when the map is opened. PostHog receives only the public-page measurement described below and does not receive the member directory. We do not sell club-record data or use them for advertising.
Transfers outside the EU
Club records, documents and the application server are processed in the European Union. The database is in the European location eur3 (Belgium and the Netherlands), files are in EU storage, and the server is in Belgium (europe-west1). The project still contains an unused original database and storage outside the EU because Firebase does not allow them to be removed. They contain no client data and the application does not use them. Sign-in through Firebase Authentication is processed in the United States of America. Delivery of push notifications through Firebase Cloud Messaging may be processed in the United States of America. The safeguard for those transfers is the applicable Firebase/Google Cloud service-specific processing terms and recorded transfer safeguards. Paddle, as merchant of record, itself processes the payment data of a new subscription and displays that at checkout. You can request a copy of the safeguards at the contact above.
Security, invoices and automated decisions
To limit misuse of the enquiry form we keep a summary of the IP address and the email for up to two days, without the original record. The legal basis is the legitimate interest in protecting the service. For the language and the display of prices we read the country code forwarded by the network edge. We do not store that code and we do not keep the IP address for that purpose. Subscription invoices are kept by Paddle for as long as the accounting obligation requires, separately from the member directory. Sportini keeps minimal paid-subscription identifiers under the accounting policy described above, separately from member records. We do not make decisions that produce legal effects solely by automated processing.
Your rights
You may request access, rectification, erasure, restriction of processing and data portability, where the statutory conditions are met, and you may object. You may withdraw consent for an enquiry. In the account settings you can download your data and delete the account. For data in the club records, contact your club's management first. For account data, contact the service provider at the contact stated above. We respond within one month. You have the right to lodge a complaint with the Croatian Personal Data Protection Agency.
Storage in the browser
The browser stores data necessary for sign-in, language choice and enabled reminders. If you open support, sportini.support.token links the device to that private conversation. Visitor conversations expire after 90 days of inactivity; account conversations after 12 months of inactivity or club closure. We do not enable screen recordings or automatic click capture. Optional public-page measurement is off by default. If enabled after reviewing its basis and supplier terms, PostHog EU receives only public page counts without cookies, URL queries or private routes. Paddle.js loads when checkout starts. Fonts are local. PostHog's privacy policy applies to that measurement.