Sport Match
PL EN
Log in
← Back to homepage

Privacy Policy

Last updated: 3 October 2026

§1 Data Controller

The data controller is Michał Wójtowicz, Sport Match, ul. Łosiowa 87, 43-300 Bielsko-Biała, Poland, NIP (Tax ID): 6762446401, REGON: 361062286, email: contact@sportmatch.pl (the "Controller").

§2 What data we process and why

  1. Formation and performance of the contract for the Sport Match Service (Account data, Club data, billing data) — legal basis: Art. 6(1)(b) GDPR (performance of a contract).
  2. Payment processing via Przelewy24 (PayPro SA) — legal basis: Art. 6(1)(b) and (c) GDPR (performance of a contract, tax/accounting obligations).
  3. Chat on the website and in the application (the conversation window in the bottom right corner): the content of messages and attachments and — if provided — an email address we can reply to — purpose: answering questions and handling requests, legal basis: Art. 6(1)(b) and (f) GDPR.
  4. The club's assistant on WhatsApp (if a club member uses it): phone number, the messages exchanged with the assistant, and the link between the conversation and the Account once the code from the application is entered — purpose: providing information about sessions, payments and schedule changes, legal basis: Art. 6(1)(b) and (f) GDPR.
  5. Signing in with a Google or Facebook account (if the user chooses it): first name, last name, email address and account identifier provided by the sign-in provider — purpose: creating the Account and signing in, legal basis: Art. 6(1)(b) GDPR.
  6. Handling support requests and complaints sent by email — legal basis: Art. 6(1)(b) and (f) GDPR.
  7. Establishment, exercise or defence of legal claims and fulfilment of tax/accounting obligations — legal basis: Art. 6(1)(c) and (f) GDPR.

§3 Recipients of data

Personal data may be shared with the following categories of recipients, only to the extent necessary for the purposes listed in §2:

  • payment operator Przelewy24 (PayPro SA), ul. Kanclerska 15, 60-327 Poznań, Poland — to process payments;
  • cloud infrastructure provider Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) — as a processor that stores and processes data on the Controller's behalf under a data processing agreement (the AWS GDPR Data Processing Addendum). AWS runs: the Sport Match website and application, the database (Account, Club, member, session, document and payment data), storage of files uploaded to the application (e.g. documents, photos, logos), user accounts and sign-in, email and SMS notifications, the chat, the AI assistant (models run in AWS regions in the European Union) and backups. Data is stored in the European Union: in the AWS Frankfurt region (Germany), with backups in the AWS Ireland region; the website and application are delivered through the CloudFront network (see §4);
  • redirect service provider redirect.pizza (Enflow, the Netherlands) — to redirect visitors from sportmatch.pl to www.sportmatch.pl; this involves the visitor's IP address and the requested page address, and the data is stored in the Netherlands;
  • Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) — in the application: displaying maps and searching for session addresses (Google Maps Platform; Google receives, among other things, the IP address and the address typed in), signing in with a Google account (if the user chooses it), and detecting the language of messages written to the club's assistant (Google Cloud Translation — only the beginning of a message is sent, solely to detect its language);
  • Meta (Meta Platforms Ireland Limited and WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, and Meta Platforms, Inc., USA) — signing in with a Facebook account (if the user chooses it) and handling conversations with the club's assistant on WhatsApp (WhatsApp Business Platform): Meta carries the messages between the club member and the assistant and, as the provider of the messenger, also processes them under WhatsApp's own terms and privacy policy;
  • providers of accounting and legal services to the Controller.

§4 Transfers outside the EEA

Service data is stored in the European Economic Area (§3). Amazon Web Services' CloudFront content delivery network, however, serves each connection from the server nearest the visitor, which may be outside the European Economic Area, in particular in the USA — in that case connection data (e.g. the IP address and the requested page address) may be transferred outside the EEA. Google and Meta (§3) may also process the data they receive in the USA. Such transfers rely on appropriate safeguards required by the GDPR: standard contractual clauses and these providers' (Amazon Web Services, Google, Meta) participation in the EU-U.S. Data Privacy Framework.

§5 Data retention

  1. Data related to performance of the Service contract — for the duration of the contract and until claims become time-barred or tax/accounting obligations expire (generally 5 years from the end of the year in which the tax obligation arose).
  2. Data contained in complaint correspondence — for 3 years from the end of the correspondence or resolution of the complaint.
  3. Backups of Service data — taken daily and kept in a separate, secured AWS account in Ireland (EU): daily backups for 35 days, monthly backups for 12 months; in addition, the database can be restored to any point in the last 35 days. Data deleted from the Service may therefore remain in backups until those periods end, after which it is permanently deleted. Backups are used only to restore the Service after a failure or data loss and for no other purpose.

§6 Rights of data subjects

Data subjects have the right to: access their data, rectify their data, erase their data, restrict processing, data portability, object to processing based on legitimate interest and to processing for marketing purposes, and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Data subjects also have the right to lodge a complaint with the Polish Data Protection Authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). To exercise these rights, contact the Controller at contact@sportmatch.pl.

§7 Voluntary provision of data

Providing data is voluntary but necessary to conclude and perform the Service contract.

§8 Cookies and similar technologies

The sportmatch.pl website does not use cookies for tracking or profiling and loads no resources from third-party providers — fonts are served directly from the site's own servers. Settings for cookies and site data can be changed at any time in your browser settings.

The chat window keeps a conversation token (valid for 30 days) in the browser's storage (local storage), so the same conversation can continue when you come back, and the website keeps a marker that a conversation exists. Neither is used for tracking or advertising; they can be removed by clearing the site's data in your browser settings — the conversation then starts afresh.

When you sign in to the Sport Match application (app.sportmatch.pl), the application saves one functional cookie for the sportmatch.pl domain: sm_signed_in, with the value 1. It contains no identifier, no personal data and no sign-in token — it only tells this website that this browser is probably signed in to the application, so the "Log in" button can read "Go to the app" instead. It is kept for up to 30 days, renewed while the application is in use, and deleted on signing out. It is not used for tracking, profiling or advertising and is not shared with anyone. As it only supports the sign-in the user started, it is a functional cookie that does not require consent. It can be deleted at any time in the browser settings — the button then reads "Log in" again.

§9 Automated decision-making

The Controller does not make decisions about data subjects based solely on automated processing, including profiling, that would produce legal effects concerning them.

§10 Changes to this Privacy Policy

The Controller reserves the right to amend this Privacy Policy, and will announce changes by publishing a new version at sportmatch.pl.