Rivalio — Privacy Policy
Data Controller: Rivalio s.r.o., Company ID 29509751, with its registered office at Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, registered with the Regional Court in Brno under file no. C 151679 (the "Controller").
Version: 1.6 Effective from: 16 September 2026 Related Terms of Service version: 1.5
Contact for data-protection matters: privacy@rivalio.cz
1. Introduction
1.1 Purpose of this document
1.1.1. This Privacy Policy (the "Policy" or "PP") describes what personal data the Controller processes in connection with the operation of the digital service Rivalio available at https://rivalio.cz (the "Service" or "Rivalio"), for what purposes, on what legal basis, for how long, and to whom it is disclosed.
1.1.2. The Policy is an integral part of the contractual relationship with the Data Subject and supplements the Rivalio Terms of Service (version 1.5).
1.1.3. The Policy reflects in particular:
- Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, "GDPR"),
- Czech Act No. 110/2019 Coll. on the processing of personal data,
- Czech Act No. 480/2004 Coll. on certain information-society services,
- Czech Act No. 127/2005 Coll. on electronic communications (§ 89 — cookies),
- Regulation (EU) 2022/2065 on a Single Market for Digital Services (DSA) — to the extent of the obligations of a hosting-service provider for user-uploaded content,
- CJEU judgments C-210/16 (Wirtschaftsakademie) and C-40/17 (Fashion ID) on joint controllership.
1.2 Who the Policy applies to
1.2.1. The Policy applies to all Data Subjects whose personal data the Controller processes — in particular:
- Users (registered consumers and business customers who have concluded a contract with the Controller) — including the use of the user Portal and its community features (Section 4.10),
- Players and other persons whose data is entered into Rivalio by tournament/league organisers (the Controller acts as a processor with respect to such data — see Section 10),
- Website visitors (cookies, analytics — if activated with consent).
2. Definitions
| Term | Definition |
|---|---|
| Controller | Rivalio s.r.o., the entity determining the purposes and means of processing (Article 4(7) GDPR). |
| Data Subject | An identified or identifiable natural person whose personal data the Controller processes. |
| Processor | A third party processing personal data on behalf of the Controller under contract (Article 28 GDPR). Recipients are listed in Section 7. |
| Personal Data | Any information relating to an identified or identifiable natural person (Article 4(1) GDPR). |
| Processing | Any operation performed on personal data (collection, storage, organisation, use, erasure, etc.) — Article 4(2) GDPR. |
| Cookies | Small text files stored in the Data Subject's browser. |
| Account | A user profile in Rivalio protected by login credentials. |
| Portal | The signed-in part of the Service for Users (dashboard, calendar, messages, community features) as defined in the Terms of Service. |
| Public Profile | An optional publicly accessible page of the User under Section 4.10.1. |
| Service | The Rivalio application as defined in Section 1 of the Terms of Service. |
3. Data Protection Officer (DPO)
3.1 The Controller has not appointed a DPO
3.1.1. The Controller is not required to appoint a DPO under Article 37(1) GDPR or § 6 of Czech Act No. 110/2019 Coll. The reasons:
- the Controller is not a public authority or body,
- the Controller's core activities do not consist of large-scale regular and systematic monitoring of Data Subjects,
- the Controller does not process special categories of personal data on a large scale (Article 9 GDPR) or data on criminal offences (Article 10 GDPR).
3.2 Contact point for data protection
3.2.1. All questions, requests, and complaints concerning the processing of personal data should be addressed to:
E-mail:
privacy@rivalio.czPostal address: Rivalio s.r.o., Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic
3.2.2. If the processing changes in such a way that the obligation to appoint a DPO arises, the Controller will appoint one and update this Policy.
4. Categories of personal data processed
4.1 Identification and contact data
- first name and surname,
- e-mail address,
- phone number (optional for Users, required for Players entered by organisers),
- username (login).
4.2 Billing data (for Business Customers and tax invoicing)
- company name,
- Company ID (IČ),
- VAT number (DIČ, if the Data Subject is a VAT payer),
- billing address.
4.3 Authentication data
- username,
- password hash (a plaintext password is never stored),
- date and IP of last successful registration/login,
- optional two-factor authentication (2FA) — shared secret encrypted in the database.
4.4 Account and Service data
- Tariff purchased,
- date of purchase, date of expiry, end of read-only phase,
- order and payment history,
- features used, number of tournaments/leagues created.
4.5 Operational and technical data
- IP address — in the scope and form depending on the type of record:
- for security records of login attempts, the IP address is stored anonymised (IPv4 truncated to
/24, IPv6 to/48), - for records of known (verified) devices — used to recognise a new device and send a security notice — the full IP address is stored for a limited time under Section 6 (legitimate interest in securing the Account),
- from the full IP address, when sending the security notice, the Controller derives the approximate location (city, country) and the name of the internet service provider, so the Data Subject can more easily recognise an unauthorised sign-in; the derivation runs solely on the Controller's servers against a local copy of the GeoLite2 database (MaxMind, Inc.) — neither the IP address nor any other data of the Data Subject is transferred to any third party; the derived values only form part of the e-mail notice and are not stored separately,
- for security records of login attempts, the IP address is stored anonymised (IPv4 truncated to
- User-Agent string,
- timestamps (registration, login, in-app actions),
- log files (errors, access audit, authorisation).
4.6 User Content
- tournament and league names, configuration,
- team logos, statistics, match results,
- names and contact details of players entered by an organiser (the Controller acts as processor for such data — see Section 10),
- the User's own content created in the Portal (Section 4.10) — for which the Controller acts as controller.
4.7 Operational and product telemetry and analytics
4.7.1. First-party operational statistics (legitimate interest, Art. 6(1)(f) GDPR). The Controller maintains aggregated internal statistics on the use of the Service for the purposes of measuring, securing and improving it, in particular:
- public page and article views for Tournaments,
- click counts on partner websites listed by organisers,
- conversion funnel (offer views, order completions) - for logged-in Users only,
- view and click counts in the public tournament catalogue,
- view and click counts on advertising slots (Section 4.11) — aggregate counters only, without identifying the visitor,
- anonymous technical metrics of the website's loading speed (Web Vitals) — without cookies, without IP address, without any visitor identifier; retained for a maximum of 30 days.
These statistics do not contain an IP address or identification of anonymous visitors (the IP address is used at most as an ephemeral in-memory hash for short-term deduplication and is not stored in records), are aggregated and retained for a maximum of 2 years (unless stated otherwise above). They do not constitute profiling (Section 12) or third-party analytics. The Data Subject has the right to object under Section 11.
4.7.2. Third-party analytics and measurement tools (consent only). The Controller uses Google Analytics 4 (Google Ireland Limited) for visitor statistics and Meta Pixel (Meta Platforms Ireland Limited) to measure the effectiveness of advertising on Facebook and Instagram. Both tools load in the browser only after consent is granted in the cookie banner — Google Analytics 4 after consent to the Statistical category, Meta Pixel after consent to the Marketing category. Without consent the respective script is not loaded at all. The scope of transferred data is set out in Section 7.4; server-side conversion measurement is described in Section 4.7.3.
4.7.3. Server-side conversion measurement (Meta Conversions API). In addition to browser-based measurement, the Controller transfers data about completed conversions to Meta directly from its server. The purpose is to measure the effectiveness of the paid advertising the Controller pays for and to limit multiple counting of the same conversion. Only the following data is transferred:
- e-mail address, telephone number, first name and surname solely as an irreversible hash (SHA-256); Meta cannot recover the original value from the hash, which serves only for comparison with a hash Meta already holds. First name and surname are hashed separately and without stripping diacritics,
- IP address and browser information (User-Agent) in unabbreviated form,
- the advertising click identifier (
fbclid), if the Data Subject arrived from an advertisement, - the browser identifier from the
_fbpcookie, if the Meta Pixel was loaded with consent; this is a random number with no link to identity that lets Meta join the server-side and browser events into one, - for a paid order the amount and currency, for a lecture registration the identifier of that lecture.
Address, date of birth and Account content are not transferred. Three events are transferred: submission of a lecture registration, completion of an organisation registration, and payment of an order. For a paid order neither the IP address, the User-Agent nor the browser identifier is transferred - that event arises only when the payment is matched on the server, at which point the Data Subject is not on the website.
Legal basis: consent of the Data Subject (Article 6(1)(a) GDPR) granted in the cookie banner for the Marketing category. Without this consent the Controller transfers nothing to Meta — not even from the server. Consent may be withdrawn at any time in the cookie settings; withdrawal also takes effect for server-side measurement. The Controller retains the advertising click identifier for a maximum of 90 days (Section 6), after which it is deleted automatically.
4.8 Marketing data and commercial communications
4.8.1. Commercial communications about own similar services (soft opt-in, Section 7(3) of Act No. 480/2004 Coll.). The Controller may send commercial communications about its own similar services to Users whose e-mail address was obtained in connection with registration or provision of the Service. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in conjunction with Section 7(3) of Act No. 480/2004 Coll. The User may opt out free of charge at any time - an unsubscribe link is included in each such communication; after opting out, the Controller will not send further commercial communications.
4.8.2. Marketing beyond similar services (consent). Sending of further marketing communications (e.g. a general newsletter) takes place only on the basis of the Data Subject's voluntary consent (Art. 6(1)(a) GDPR), which may be revoked at any time (Section 11).
4.9 § 1837 Czech Civil Code audit trail — consent before performance starts
4.9.1. In connection with § 1837(l) of the Civil Code and § 1822 of the Civil Code, the Controller keeps an immutable audit record that the Consumer expressly consented to performance starting before the 14-day withdrawal period and was informed about the loss of that right. The record contains:
- both consents (checkbox A and B),
- the verbatim text of the consents as shown to the Data Subject at the moment of the order,
- the language of the order, the Terms of Service version then in force,
- IP address and User-Agent of the device,
- server-side timestamp.
4.9.2. This record is necessary to prove the lawfulness of processing and to enforce contractual rights. Retention: see Section 6.
4.10 Portal and community features
4.10.1. Public Profile (opt-in). In the Portal settings, the User may voluntarily activate a Public Profile — a publicly accessible page displaying their name, game statistics, form, trophies, badges, teams and membership date. The Public Profile is switched off by default; the User may switch it off at any time with a single toggle (the page ceases to be accessible immediately). E-mail, phone and date of birth are never displayed on the Public Profile. Legal basis: consent expressed by activation (Art. 6(1)(a) GDPR), revocable by switching it off.
4.10.2. Comments and reactions on matches. The User may write comments and add reactions on live matches (where the organiser allows it). Comments are seen by other signed-in viewers of that match together with the author's name. A comment may be deleted by its author, the organiser of the competition, or the Controller. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
4.10.3. Direct messages (DMs). Users may exchange private messages in the Portal. The content of messages is encrypted in the database and is accessible only to the participants in the conversation (and, to the necessary extent, to the Controller when handling a report under Section 4.10.6). A User may block another user — a blocked user can no longer message them. Legal basis: performance of a contract.
4.10.4. Teammate listings and team challenges. The User may post a listing (looking for a team / looking for players — text and region) visible to other signed-in users, and may challenge another team to a friendly match (challenge text). Legal basis: performance of a contract.
4.10.5. Badges and game statistics. The Service automatically awards the User badges for gameplay milestones (e.g. number of matches played) and displays their statistics. This is a display of the results of sporting activity, not an evaluation of the person with legal effects (Section 12).
4.10.6. Content reporting. A "Report" function is available for comments and direct messages. A report record contains the identification of the reporter, the reported content, the reason and an optional note; it serves to examine and, where appropriate, remove objectionable content (procedure under the Terms of Service, section on user content). Legal basis: compliance with a legal obligation (the DSA Regulation) and legitimate interest in a safe environment for the Service.
4.10.7. Linked third-party accounts (OAuth). If the User signs in via Google or Microsoft (Section 7.4), the Controller records the identifier of the linked account and the e-mail. The User may cancel the link at any time in the Portal settings.
4.11 Advertising slots
4.11.1. On selected public pages, Rivalio displays its own advertising slots (sponsorship messages, partner links, the Controller's own messages) — see the Terms of Service, section "Advertising and partner content" for details. In connection with advertising, the Controller processes only aggregate impression and click counters, which contain no personal data — no IP address, user identifier or device fingerprint.
4.11.2. The selection of the advertising displayed is not based on the personal data, behaviour or profile of the Data Subject (no personalisation or targeting). The short-term technical identifiers used to deduplicate measurement are described in the Cookies Policy (Section 5).
5. Purposes of processing and legal bases
5.1 Performance of a contract (Article 6(1)(b) GDPR)
5.1.1. The Controller processes personal data to:
- register and maintain the Account,
- supply the Service in the scope of the chosen Tariff,
- operate the Portal and community features (Section 4.10) — comments, direct messages, listings, challenges, badges, calendar,
- process orders and payments,
- issue tax documents (invoices),
- send transactional e-mails (registration, order, payment, Tariff expiry, security notices),
- provide customer support.
5.1.2. If the Data Subject refuses to provide data necessary for the performance of the contract, the Controller cannot conclude or perform the contract.
5.2 Compliance with a legal obligation (Article 6(1)(c) GDPR)
5.2.1. The Controller retains:
- tax documents (invoices) for 10 years under § 35 of Czech Act No. 235/2004 Coll. on VAT,
- accounting records for 10 years under § 31 and § 32 of Czech Act No. 563/1991 Coll. on accounting,
- complaint records for the duration of statutory warranty rights,
- records of the Controller's compliance with information obligations (Articles 13 and 14 GDPR),
- records of the handling of reports of unlawful content (the DSA Regulation).
5.3 Legitimate interests (Article 6(1)(f) GDPR)
5.3.1. The Controller processes data on the basis of legitimate interests for:
- security and operation of the application — error tracking via Sentry (stack trace + IP at the moment of error), access logging, administrative-action audit, recognition of known devices and alerts on sign-in from a new device including deriving the approximate location and connection provider from the IP address (locally, without transfer to any third party),
- fraud prevention — analysis of access patterns (e.g. repeated failed login attempts),
- content moderation — examining reported user content and protecting other users,
- establishment and defence of legal claims of the Controller (e.g. debt collection),
- internal administrative purposes within a group of organisations (Article 47 GDPR, recital 48 — the Controller currently has no branches).
5.3.2. The Data Subject has the right to object to processing on the basis of legitimate interests (Article 21 GDPR) — see Section 11.
5.4 Consent of the Data Subject (Article 6(1)(a) GDPR)
5.4.1. On the basis of the Data Subject's consent (granted in the cookie banner, a separate form, or by activating a feature), the Controller processes:
- non-essential cookies (analytics, marketing — in the scope set out in the Cookies Policy),
- the Public Profile (Section 4.10.1) — by activating the toggle in settings,
- Google reCAPTCHA v3 on public registration forms (if activated),
- embedded YouTube videos on tournament pages (cookie-gated playback),
- (The Inter web font is self-hosted from
rivalio.cz— no request reaches Google, no consent required for typography.)
5.4.2. Consent is freely given, specific, informed, and unambiguous. The Data Subject may withdraw consent at any time — see Section 11.
5.5 Rivalio as processor for player data (Article 28 GDPR)
5.5.1. Where an organiser (a User — typically a club, association, sports federation) enters personal data of players into Rivalio (names, contacts, statistics), the organiser is the controller of such data and Rivalio acts as processor under Article 28 GDPR.
5.5.2. The organiser:
- is responsible for the lawful basis vis-à-vis its players (typically performance of a contract or legitimate interest in maintaining sports records),
- complies with the information obligation toward players (Article 13 GDPR),
- may ask the Controller to conclude a Data Processing Agreement (DPA) — the Controller will provide a template on request at
privacy@rivalio.cz.
6. Retention periods
The Controller retains personal data only for as long as necessary for the relevant purpose:
| Category | Retention | Legal basis for retention |
|---|---|---|
| Registration and contact data | for the duration of the Account + 3 years after closure | general limitation period (§ 629 Czech Civil Code) |
| Billing data, tax documents | 10 years from the end of the tax period | § 35 Act No. 235/2004 Coll., § 31 Act No. 563/1991 Coll. |
| Accounting records | 10 years | § 31 and § 32 Act No. 563/1991 Coll. |
| § 1837 NOZ consent audit | 10 years | link to accounting + evidentiary burden |
| Records of failed and successful login attempts (anonymised IP) | 90 days | security forensics |
| Known (verified) devices (full IP, User-Agent) | 180 days from the device's last activity, at most 365 days | securing the Account (new-device notice) |
| Other operational logs | 12 months | security forensics |
| Administrative action audit log | 12 months | security and audit purposes |
| Data-change audit log | 12 months | data minimisation |
| Sessions (session cookies) | 30 days since last use | automatic cleanup |
| Push subscriptions (web push) | 90 days since last activity | stale endpoints |
| Notifications (read) | 6 months | inbox cleanup |
| Direct messages (DMs) | for the duration of the participants' Accounts; upon deletion of an Account, the content of the sender's messages is replaced with placeholder text (redaction) | contract; Art. 17 GDPR having regard to the counterparty's rights |
| Match comments | until deleted by the author/organiser/Controller; deleted comments are permanently removed within 30 days; removed upon deletion of the Account | contract |
| Teammate listings and team challenges | 12 months from creation, then automatic deletion; immediately upon deletion of the Account | contract |
| Badges and game statistics | for the duration of the Account | contract |
| Content-report records | 12 months from resolution | DSA; defence of legal claims |
| Website speed metrics (Web Vitals, without identifiers) | 30 days | operational measurement |
Advertising click identifier (fbclid) and its capture time |
90 days from capture | advertising effectiveness measurement (Section 4.7.3); automatic deletion thereafter |
| Cookies (essential) | per banner expiry, max. 12 months | EDPB 05/2020 |
| Cookies (non-essential, consent-based) | per expiry, until consent withdrawn | Article 7(3) GDPR |
| Marketing data (newsletter consent) | until consent is withdrawn | Article 7(3) GDPR |
| User Content (tournaments, statistics) | for the duration of the Account, optional anonymisation upon deletion | contract |
| Personal data of players and registrations entered by the organiser | for the duration of the organiser's organisation; no later than 3 years after the organisation is archived/closed, contact data (name, e-mail, phone, date of birth) is anonymised (redacted) | contract / organiser's instruction (Art. 10) |
The Controller runs an automated cleanup process — once daily — that removes records older than the periods set out above.
7. Recipients of personal data (Processors and third parties)
The Controller discloses personal data only to the following Processors:
7.1 Infrastructure
| Subject | Registered office | Purpose | Data categories | US transfer |
|---|---|---|---|---|
| Hetzner Online GmbH | Industriestraße 25, 91710 Gunzenhausen, Germany | Application hosting, database, file storage, backups | All data stored in Rivalio | NO (DE/EU) |
7.2 Payments and invoicing
7.2.1. Payments are made by bank transfer to the Controller's account. The Controller's bank acts as an independent controller of the payment, not as a processor for the Controller. The Controller does not access payment-card data.
7.2.2. Tax documents (invoices) are issued by the Controller using its own resources — no external invoicing service is used as a processor.
7.2.3. Should the Controller engage an external payment gateway or invoicing service (as a processor of personal data) in the future, it will update this Policy and re-inform the Data Subject.
7.3 Security and monitoring
| Subject | Registered office | Purpose | Data categories | US transfer |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | Error tracking and application monitoring (backend only) | Stack trace, IP, User-Agent, optionally user ID | YES — DPF certification + SCC |
7.4 Functional third-party integrations
| Subject | Registered office | Purpose | Data categories | US transfer | Activation |
|---|---|---|---|---|---|
| Google Ireland Limited (reCAPTCHA v3) | Gordon House, Barrow Street, Dublin 4, Ireland (contracting entity for EU); data in US/EU | Bot protection on public registration form | IP, User-Agent, behavioural data | YES — DPF + SCC | only if the organiser enables reCAPTCHA protection |
| Google Ireland Limited (YouTube embed) | Dublin, IE; data in US | Embedded live-stream video (if organiser supplies a YouTube URL) | IP, User-Agent, behavioural data, cookies | YES — DPF + SCC | conditional; youtube-nocookie.com variant, gated by Functional consent |
| Google LLC (Sign in with Google) | Mountain View, CA, USA (contracting party Google Ireland Limited, Dublin, IE) | Login to Account via Google account (OAuth) | name, e-mail address, account identifier, profile picture | YES - DPF + SCC | only if the User chooses Google login |
| Microsoft Corporation (Sign in with Microsoft) | One Microsoft Way, Redmond, WA, USA | Login to Account via Microsoft account (OAuth) | name, e-mail address, account identifier | YES - DPF + SCC | only if the User chooses Microsoft login |
| Google Ireland Limited (Google Analytics 4) | Gordon House, Barrow Street, Dublin 4, Ireland; data in the USA/EU | Website visitor statistics | visitor identifier in a cookie, IP address, pages visited | YES - DPF + SCC | only after consent to the Statistical category |
| Meta Platforms Ireland Limited (Meta Pixel, Conversions API) | Merrion Road, Dublin 4, D04 X2K5, Ireland; data also processed in the USA | Measuring the effectiveness of paid advertising on Facebook and Instagram | hash (SHA-256) of e-mail, telephone, first name and surname, IP address, User-Agent, advertising click identifier, browser identifier (_fbp), order amount and currency |
YES - DPF + SCC | only after consent to the Marketing category; server-side transfer see Section 4.7.3 |
Beyond the integrations listed above, the Controller does not use any further tracking pixels, marketing tools (e.g. Google Ads, Microsoft Clarity), e-mail marketing platforms (e.g. Brevo), or third-party CDNs. The Rivalio advertising slots (Section 4.11) are fully first-party — no data is disclosed to third parties in connection with them. Should this change in the future, the Controller will update the Policy and re-inform the Data Subject.
7.5 Public authorities
7.5.1. The Controller discloses personal data to public authorities only on the basis of law — typically the Tax Office (VAT control), courts, the Police of the Czech Republic, ÚOOÚ.
8. International transfers (outside the EU/EEA)
8.1 Countries and processors
8.1.1. Some personal data is processed in the United States by the following processors:
- Functional Software, Inc. (Sentry) — California, USA,
- Google LLC (through Google Ireland Limited as the contracting entity) — part of the server estate for reCAPTCHA, YouTube and Sign in with Google is in the USA,
- Microsoft Corporation — Sign in with Microsoft (only if the User chooses this option), USA,
- Meta Platforms, Inc. (through Meta Platforms Ireland Limited as the contracting party) — advertising effectiveness measurement (Section 4.7.3), part of the processing in the USA; only after consent to the Marketing category.
8.2 Legal mechanism
8.2.1. Transfers to the USA are based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequacy of the protection of personal data under the EU-US Data Privacy Framework (DPF).
8.2.2. All US companies listed above are (or must be, prior to production deployment) certified under the DPF (https://www.dataprivacyframework.gov/list).
8.2.3. Standard Contractual Clauses (SCC) under Commission Decision (EU) 2021/914 of 4 June 2021 apply as a supplementary safeguard.
8.3 Right to a copy of the safeguards
8.3.1. The Data Subject has the right to request a copy of the appropriate safeguards for transfers to a third country (Article 46(2) GDPR) at privacy@rivalio.cz.
9. Joint Controllership
9.1.1. When measuring advertising effectiveness through Meta Pixel (Section 4.7.2) and the Meta Conversions API (Section 4.7.3), the Controller and Meta Platforms Ireland Limited act as joint controllers within the meaning of Article 26 GDPR, to the extent of the collection of the data and its transfer to Meta. For Meta's subsequent processing for its own purposes, Meta is an independent controller.
9.1.2. The allocation of responsibility is governed by the Joint Controller Addendum published by Meta at https://www.facebook.com/legal/controller_addendum. The Controller is responsible for obtaining the Data Subject's consent and for fulfilling the information duty (this Policy and the cookie banner); Meta is responsible for the processing on its side.
9.1.3. The Data Subject may exercise their rights with either joint controller (Article 26(3) GDPR) — with the Controller at privacy@rivalio.cz, with Meta through the tools available in its user account.
9.1.4. Should the Controller introduce a further tool triggering joint controllership, the Policy will be updated and the Data Subject re-informed.
10. Rivalio ↔ Organiser ↔ Player relationship
10.1 Dual role of the Controller
10.1.1. Vis-à-vis the User (organiser — typically a club, association, sports federation, or a Consumer hosting a private tournament), Rivalio is the controller of personal data. The relationship is governed by this Policy. Rivalio is also the controller with respect to the User's own content and community activity in the Portal (Section 4.10).
10.1.2. Vis-à-vis players, referees, and other persons whose data the organiser enters into Rivalio (for the purposes of sports competitions), Rivalio acts as a processor under Article 28 GDPR. The organiser is the controller of such data and:
- is responsible for the lawful basis vis-à-vis its players,
- complies with the information obligation toward players (Article 13 GDPR),
- responds to players' requests to exercise their rights (Articles 15–22 GDPR).
10.1a Public display of player data
10.1.3. The scope of public disclosure of player data - in particular via public Tournament pages, broadcast (streaming) graphics (overlays) and the public tournament catalogue including the organiser's contact details - is determined by the organiser in the Service settings. The organiser is responsible for having a legal basis for such disclosure and for informing the persons concerned; by publishing their own contact details in the catalogue, the organiser consents to their public display. The Controller provides only technical means and, as a processor, follows the organiser's instructions.
10.1.4. The User's Public Profile (Section 4.10.1) is distinct from the public display described in the preceding paragraph — the User activates and deactivates it themselves, and Rivalio is the controller with respect to it.
10.2 Recommended Data Processing Agreement (DPA)
10.2.1. The Controller recommends that B2B Users who enter personal data of third parties conclude a Data Processing Agreement (DPA) under Article 28 GDPR. A DPA template will be provided upon request at privacy@rivalio.cz.
10.2.2. Without an executed DPA, the Controller and User are bound by the general provisions of this Policy and the Terms of Service.
11. Rights of the Data Subject
11.1 Overview of rights (Articles 15–22 GDPR)
The Data Subject has the following rights:
| Right | Description |
|---|---|
| Right of access (Art. 15) | The Data Subject may obtain confirmation whether the Controller processes their personal data and obtain a copy. |
| Right to rectification (Art. 16) | The Data Subject may request correction of inaccurate data. |
| Right to erasure (Art. 17, "right to be forgotten") | The Data Subject may request erasure, unless there is a legal ground for retention. |
| Right to restriction of processing (Art. 18) | The Data Subject may request restriction of processing in statutory cases. |
| Right to data portability (Art. 20) | The Data Subject may obtain their data in a structured, commonly used, machine-readable format. |
| Right to object (Art. 21) | The Data Subject may object to processing based on legitimate interests or for direct marketing purposes. |
| Right not to be subject to automated decision-making (Art. 22) | See Section 12 below — the Controller does not engage in automated decision-making. |
| Right to withdraw consent (Art. 7(3)) | The Data Subject may withdraw consent at any time, with effect for the future. |
11.2 Exercising rights
11.2.1. A request may be submitted:
- self-service directly in the Portal (account settings): export of your own data (right of access and portability) and deletion of the Account (right to erasure — carried out by anonymisation under Section 6; data whose retention is required by law, e.g. tax documents, is retained for the statutory period),
- by e-mail to
privacy@rivalio.cz(preferred for the other rights), - in writing to the Controller's registered office.
11.2.2. For identity verification, the Controller may request additional information (e.g. confirmation from the registered e-mail address). The purpose is to prevent abuse of rights by a third party.
11.2.3. Time limit: at the latest 30 days from receipt of the request (Article 12(3) GDPR). In complex cases, the time limit may be extended by 2 months with notice to the Data Subject. Self-service actions under Section 11.2.1 are carried out immediately.
11.2.4. Handling of the request is free of charge. Where requests are manifestly unfounded or excessive (in particular repetitive), the Controller may:
- charge a reasonable fee covering administrative costs,
- refuse to act on the request (Article 12(5) GDPR).
11.3 Complaint to a supervisory authority
11.3.1. The Data Subject has the right to lodge a complaint with a supervisory authority — particularly in the Member State of habitual residence, place of work, or place of the alleged infringement (Article 77 GDPR).
11.3.2. The competent supervisory authority in the Czech Republic is the Office for Personal Data Protection (ÚOOÚ):
Pplk. Sochora 27, 170 00 Prague 7 Phone: +420 234 665 111 Web:
https://www.uoou.czE-mail:posta@uoou.cz
12. Automated decision-making and profiling
12.1.1. The Controller does not engage in automated decision-making within the meaning of Article 22 GDPR that would produce legal effects concerning the Data Subject or similarly significantly affect them.
12.1.2. The Controller does not perform profiling of Data Subjects for marketing or price-differentiation purposes. The selection of the advertising displayed (Section 4.11) takes place without the use of personal data and without personalisation; the automatic award of game badges (Section 4.10.5) is merely a display of sports results with no legal effects.
13. Security of personal data
The Controller has implemented appropriate technical and organisational measures to protect personal data (Article 32 GDPR):
13.1 Technical measures
- HTTPS/TLS encryption of communication between the browser and the server,
- password hashing (passwords are stored only as a cryptographic hash, never in plaintext),
- encryption of sensitive data in the database for:
- player e-mails, phone numbers and dates of birth,
- registration contact details (name, e-mail, phone),
- the content of direct messages between users (Section 4.10.3),
- IP addresses in feedback,
- IBAN bank account numbers in organisation settings,
- two-factor authentication secrets and recovery codes.
- encrypted backups,
- audit logging of all administrative actions,
- immutable audit record for § 1837 consents,
- automated cleanup of stale data (daily),
- regular security updates.
13.2 Organisational measures
- Role-based access control (system administrator, organisation owner and administrator, referee, hostess, team manager),
- Mandatory two-factor authentication (2FA) for system administrators; available to all other users as optional protection,
- Need-to-know access for employees and contractors,
- Contractual confidentiality obligations for all persons with access to data,
- Data Processing Agreements (DPAs) with every Processor (see Section 7).
13.3 Security incidents
13.3.1. In the event of a personal data breach likely to result in a high risk to the rights and freedoms of Data Subjects, the Controller will:
- without undue delay (within 72 hours of becoming aware) notify ÚOOÚ (Article 33 GDPR),
- without undue delay notify the affected Data Subjects (Article 34 GDPR).
14. Cookies
14.1.1. The Controller uses cookies of the following categories:
| Category | Purpose | Legal basis |
|---|---|---|
| Essential | Necessary for functionality and security — session, CSRF, cookie consent state, recognition of a verified device, integrity of the aggregate advertising counters | Article 6(1)(f) GDPR; cookies strictly necessary for service delivery (§ 89(3) Act No. 127/2005 Coll.) |
| Functional (optional) | Loading third-party content (YouTube, reCAPTCHA) | Consent (Article 6(1)(a) GDPR) |
| Statistical (optional) | Statistical analysis of visitor behaviour (Google Analytics 4) | Consent (Article 6(1)(a) GDPR) |
| Marketing (optional) | Measuring the effectiveness of paid advertising on Facebook and Instagram (Meta Pixel, Section 4.7.2) and identifiers for measuring interactions with advertising (click deduplication). The same consent also covers server-side conversion measurement under Section 4.7.3. | Consent (Article 6(1)(a) GDPR) |
14.1.2. A cookie banner appears on first visit and allows the Data Subject to grant or refuse consent for non-essential categories. Consent is stored in the browser's local storage and in a server-readable form (the encrypted cookie cc_prefs).
14.1.3. Details about individual cookies, their expiry, and providers are set out in a separate Cookies Policy, available at https://rivalio.cz/cookies-policy.
15. Children
15.1.1. The Rivalio Service is not primarily intended for children under 16 years of age. Under Article 8 GDPR, the processing of personal data of a child in the context of information-society services offered directly to a child is lawful only where the child is at least 16 years old (default under the GDPR).
15.1.2. Note for the Czech Republic: § 7 of Czech Act No. 110/2019 Coll. lowers this age to 15 years. The Czech threshold therefore applies to Data Subjects with habitual residence in the Czech Republic; other Member States may apply different thresholds (between 13 and 16).
15.1.3. Where the Data Subject is below the applicable age threshold, parental consent is required.
15.1.4. Note for organisers: organisers who enter player data of minors into Rivalio are responsible for obtaining consent from the parents/legal guardians, including for any public display of such players' names (public Tournament pages, overlays, catalogue). The Controller draws attention to this obligation but does not independently verify it.
15.1.5. If the Controller becomes aware of personal data of a child collected without parental consent, the data will be erased without undue delay.
16. Changes to this Policy
16.1.1. The Controller may amend this Policy at any time (particularly in response to changes in the legal framework, technology of processing, or scope of the Service).
16.1.2. The Controller will inform Data Subjects of material changes to the Policy:
- by e-mail to the address on file,
- by an in-app notice at the next login,
- at least 30 days before the change takes effect.
16.1.3. The Data Subject has the right to withdraw any consent given under the previous version at any time — see Section 11.
16.1.4. The version of the Policy is always indicated in the header. The current version is available at https://rivalio.cz/privacy-policy.
17. Right to lodge a complaint
The Data Subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the GDPR or Czech Act No. 110/2019 Coll.
The competent supervisory authority for processing carried out by the Controller is in the Czech Republic:
Office for Personal Data Protection (ÚOOÚ) Pplk. Sochora 27, 170 00 Prague 7, Czech Republic Phone: +420 234 665 111 Web:
https://www.uoou.czE-mail:posta@uoou.cz
The Data Subject may also lodge a complaint with the supervisory authority of their country of habitual residence.
18. Final provisions
18.1 Governing law
18.1.1. This Policy is governed by the laws of the Czech Republic, in particular the GDPR and Czech Act No. 110/2019 Coll.
18.2 Relationship to the Terms of Service
18.2.1. This Policy forms an integral part of the contractual relationship with the Data Subject. Terms not defined here have the meaning given in the Rivalio Terms of Service version 1.5 (/terms-of-service).
18.3 Effective date
18.3.1. This Policy takes effect on 18 July 2026 and replaces all previous versions.
18.4 Contact details
| Item | Value |
|---|---|
| Company name | Rivalio s.r.o. |
| Company ID | 29509751 |
| Registered office | Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic |
| Commercial register | Regional Court in Brno, file no. C 151679 |
| E-mail for GDPR matters | privacy@rivalio.cz |
| General contact | info@rivalio.cz |
| Phone | +420 775 132 147 |
End of Privacy Policy. Version 1.4, effective from 18 July 2026.