This Privacy Policy describes how the club67 app and service (“we”, “the service”) collects, uses and protects your personal data, in accordance with the General Data Protection Regulation (GDPR) and Greek law.
1. Data controller
For the platform: club67, email info@club67.gr. For the data of the athletes of a particular club, the controller is that club.
Full details of the legal entity (registered name, registered office, tax number) are available on request at info@club67.gr.
2. What data we collect
| Category | What it includes |
|---|---|
| Account | Email and name, through sign-in with Google, Apple or an email link (Firebase Authentication). We do not store passwords. |
| Athlete details | Name, year of birth, group and enrolment, as entered by the parent/guardian or the club. |
| Declaration of interest | First name, last name and email, and anything else the club's form asks for: year of birth, phone, preferred group, preferred days, how you heard about the club and up to 5 fields of the club's own (e.g. level), as filled in by a parent/guardian or an athlete on the club's public form, before any account exists. If the club has put its operating regulations on the form, we also keep whether it was declared that they were read and accepted. Which fields are asked for is decided by the club, as data controller. The form does not accept files, and we ask clubs not to request health information or AMKA (Greek social security number) through it. |
| Academy website | If a club has a website on club67 (name.club67.gr), its “Book a trial” form keeps the same details as the expression of interest, and a court rental request keeps a name, a phone number, an email if given, the note and the time asked for. Only the club's office sees them, and it receives an email for each rental request. The website uses no cookies and no measuring tools; it shows only what the club chooses to publish, and never the names of athletes or of their parents. |
| Free demo request | Email, the academy's name and, if given, a phone number, as an academy writes them in the “Free demo” form on club67.gr, a name if given to us later, the sport of the page and where the visitor came to the page from: the ad details carried by the link (e.g. “meta · paid”) or the site that referred them. They are used only to prepare the demo and are deleted if the academy does not carry on. |
| Athlete health | Medical note and AMKA, when written by the parent/guardian, the adult athlete or the club. The medical note is also visible to the athlete's coaches, for the athlete's safety in training; the AMKA only to the club's office and the family. If the club keeps body measurements (e.g. height, weight), they are recorded only with the family's consent, given in the app, and withdrawing that consent deletes them at once. |
| Athlete photo | One photo per athlete on the athlete's record, added by the club, for identifying the athlete and for federation forms. The camera's location data is removed. |
| Photos and videos from the coach | Only if the club has turned the feature on and only with the family's consent, given in the app. The coach or the office sends photos and short videos of one athlete, seen only by that athlete's family, or of a training session or a match, seen only by the parents/athletes of the group who were expected there. They are not published anywhere and there is no link for sharing them. Location data is removed before they are sent. The phone's camera and microphone are used only when the coach taps “Camera”, and the app does not read the photo library: the user picks what to send, and “Save to phone” only adds to it. |
| Activity | Participation responses (RSVP), attendance, makeups. |
| Fees | Status of charges and payments (amount, method, date). No payments are made in the app and we do not store card details. |
| Notifications | Device token for push notifications, through Firebase Cloud Messaging. |
| Technical | Basic technical operating data (device type, error logs) for stability and security. |
3. How we use the data
- To run the service: lesson schedule, responses, attendance register, fees, announcements.
- To send you notifications about your lessons and your club.
- For the security, maintenance and improvement of the platform.
We do not sell your data, we do not use it for advertising and we do not track behaviour for marketing inside the app. For the cookies on the presentation pages at club67.gr, see section 5.
4. Legal basis for processing
- Performance of a contract: providing the management service to the club and its members.
- Legitimate interest: the security and proper operation of the platform.
- Consent: for push notifications (you can turn them off at any time).
- Explicit consent of the family: for photos and videos from the coach and for body measurements. It is given and withdrawn in the app, on the athlete's page → “Documents and consents”, whenever you wish.
5. Third parties and processors
We use trusted providers solely to run the service:
- Google Firebase (Authentication, Cloud Messaging), for identification and notifications.
- Apple, for “Sign in with Apple”.
- Amazon Web Services (Frankfurt, EU): Amazon SES for sending the service's emails (sign-in links, invitations, reminders), and Amazon S3 with CloudFront for storing and showing the photos and videos from the coach. The files are private: they open only inside the app, through a link that expires in 15 minutes.
- Sentry, for error reports from the mobile app: when the app crashes, it sends the technical description of the error with an account code, without names, emails or athlete details.
- OpenAI, only when the club's administrator uses the import of athletes from a file: the content of the file (names, years of birth and any parents' contact details) is processed automatically to extract the records. The data is not used to train models and is kept by the provider for up to 30 days only for security checks. The transfer is covered by the EU-US Data Privacy Framework.
- OpenAI, also, when the club's administrator uses the “Ask club67” assistant in the admin: the question and the club data needed to answer it (athlete names, groups, charges, attendance, schedule) are processed automatically to write the answer. Coaches' notes, medical notes and files are never sent. The data is not used to train models. We store the conversations to check the quality of the answers.
- OpenAI, also, when a coach or administrator uses the “Ask club67” assistant in the mobile app, and only if the club has turned it on: there the assistant only explains how the app works and draws on no club data at all. What is sent is the question as the user writes it, together with the earlier ones in the same conversation, as well as the club's name and sport and today's date. No athlete, attendance, lesson or charge data is sent. But because the question is free text, whatever is typed there is sent: names or other athlete details must not be written there. The data is not used to train models. We store the conversations to check the quality of the answers.
- Google Fonts and Google Maps, on academy websites: the fonts load from Google Fonts, and a venue's map loads from Google only when the visitor taps “Show the map”.
- Infrastructure hosting, for the app's servers (within the EU).
They act as processors and are bound by their own terms and by data protection law.
The club67.gr website and cookies
The presentation pages at club67.gr (not the app) use two measurement tools, only if you tap “Accept” on the cookie message:
- Google Analytics, to measure how many people visit the pages and where they come from.
- Meta Pixel (Meta Platforms Ireland), to measure how our ads on Facebook and Instagram perform: that a visit came from an ad and whether a free demo was requested. The details you write in the demo form (name, email, phone) are not sent to Meta.
Demo request from a Meta ad. If you came to club67.gr by tapping one of our ads on Facebook or Instagram and you ask for a free demo, our server tells Meta that a request was made (Meta Conversions API), so that we know which ad brought it. Only the click code carried by the ad's link, the IP address and the browser type are sent. The academy's name, the email and the phone are not sent. This is done to measure our ads (legitimate interest) and you can object by writing to info@club67.gr.
If you tap “Decline” or do not answer, neither of the two is loaded and the page works normally. The app's data (athletes, parents, attendance, charges) is never used for advertising. To change your choice, clear the site's cookies and data in your browser and the message will appear again.
6. Minors
Many athletes are minors. Their data is entered and managed by the parent/guardian or the club. We do not address minors directly to collect data.
Photos and videos of a minor are sent only with the consent of the parent/guardian, and only to the minor's family or to the families of the minor's group. A family that does not want a photo taps “Ask for removal” on it, and the club deletes it.
7. Data retention
We keep the data for as long as your account or your relationship with the club exists. Photos and videos from the coach are deleted automatically 30 days after they are sent, and at once if the consent for the family's photos is withdrawn. We keep no backups of them. Whatever someone saves to their own phone remains their own responsibility. You can delete your account in the app (Settings → Delete account), in which case your personal data is deleted, except what must be kept for legal reasons (e.g. tax documents).
Declarations of interest live for a shorter time, because they do not belong to an account. When the club moves a declaration into its register, the declaration is deleted automatically within 7 days. A declaration that was not answered is deleted after 6 months. The club can also delete any declaration whenever it wishes. If the declaration contains preferred days, how you heard about the club or answers to the club's own fields, then on the athlete's enrolment these answers remain as a note on the athlete's record, visible only to the club's staff, and are kept for as long as the rest of the athlete's details.
8. Your rights (GDPR)
You have the right of access, rectification, erasure, restriction, portability and objection to the processing of your data. To exercise them, contact info@club67.gr. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
9. Security
We use encryption in transit (HTTPS), controlled access and modern security practices to protect your data.
10. Changes to this policy
We may update this policy. We will update the date at the top and, for material changes, we will notify you in the app.
11. Contact
For any matter concerning your data: info@club67.gr.
This is an English translation of the Πολιτική Απορρήτου.