Privacy policy

1. Controller

EasyTourney Rüfestrasse 3 9486 Schaanwald, Liechtenstein Email: hello@easytourney.com Website: https://easytourney.com

2. General information

We process personal data only where this is required to provide the website and the services, or where another legal basis allows it.

Legal bases under the GDPR, where it applies:

• Art. 6 (1) (b) GDPR – contract or steps before a contract (account, subscription, entry to an event)
• Art. 6 (1) (f) GDPR – legitimate interests (running and securing the website and the application)
• Art. 6 (1) (c) GDPR – legal obligation

For Switzerland we rely on the corresponding principles of the Swiss DPA, in particular processing in connection with a contract and overriding interests. Where we process participant data on the organizer’s instructions, the organizer is the controller and we are the processor under Art. 28 GDPR. A data processing agreement is available on request at hello@easytourney.com.

3. Visiting the website

When you open the website, the host processes connection data that is required to deliver the pages and to keep the service stable and secure:

• IP address of the device
• date and time of the request
• pages and files requested
• referrer URL
• browser type and version, operating system

Legal basis: Art. 6 (1) (f) GDPR (legitimate interests). The data is kept for as long as the host needs it for operations and security. We do not name the host or a location here.

The typefaces (Inter and Bricolage Grotesque) and the libraries used by the pages are served from our own domain. Loading a page does not contact Google Fonts and does not load scripts or libraries from a third-party CDN.

We do not use web analytics. There is no audience measurement, no tracking cookies and no session recording.

4. Cookies and local storage

The marketing website does not set analytics or marketing cookies. There is no consent banner, because no optional services are loaded.

In the application at app.easytourney.com, signing in sets a strictly necessary session cookie so the account stays signed in. That cookie is not set unless you sign in.

5. Account

For an account we process your name, email address and password, and the details you add to your profile: display name, time zone, billing address, company and billing email. The password is held by the authentication service, not in plain text in our application data.

The purpose is to open the account, perform the contract, provide support and handle billing. Legal basis: Art. 6 (1) (b) GDPR.

Sign-in, the database and server-side functions run on Supabase. We do not name a location here; the region is the one set on the project.

6. Tournament data

Organizers can store a team name, email address, country and a logo address, player names, shirt numbers and an optional date of birth, referee names and email addresses, and email addresses of co-organizers. The event also holds the schedule, results and whatever the organizer publishes.

The organizer remains the controller of this data. We process it on the organizer’s instructions in order to run the event. The public page shows what the organizer publishes, usually names, country, logo, schedule and results. Team email addresses are visible to the organizing team.

Legal basis in relation to the organizer: Art. 6 (1) (b) GDPR. In relation to participants, the organizer relies on their own legal basis.

7. Public registration and visit count

When an organizer opens registration, a team can enter its name, email address, country, an optional logo address, a roster and the answer to an optional question. If an entry fee is set, payment continues through Stripe.

Legal basis: Art. 6 (1) (b) GDPR (steps before a contract and carrying out the registration). The organizer remains the controller of participant data.

The visit count on a published event page only increments a number. It does not store an IP address or a visitor profile.

8. Payments, email and external images

Payments for event plans and entry fees go through Stripe. We do not store full card details. We keep the payment status, amount, currency and the link to the account or the registration. Stripe processes the payment as its own provider.

System email, such as account confirmation, password reset and a co-organizer invitation, is sent by Resend. The recipient address and the content of the message are processed.

If an organizer or a team enters a logo address, the browser loads that image from the address. That is not a service we operate. What the operator of the address sees depends on that operator.

9. Retention, deletion and portability

We keep account data for the life of the contract and afterwards where a legal retention duty applies, in particular for billing. You can delete the account in the account settings. That deletes the profile and the tournaments attached to the account.

After the contract ends we delete or anonymize personal data once it is no longer needed for the purposes above, subject to backups and legal retention. You can ask for a copy of your data at hello@easytourney.com.

10. Your rights

Where the GDPR applies, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where the Swiss DPA applies, the corresponding rights under Art. 25 et seq. DPA apply. An email to hello@easytourney.com is enough to exercise them.

You have the right to lodge a complaint with a supervisory authority. At the controller’s seat that authority is the Data Protection Authority of the Principality of Liechtenstein, Kirchstrasse 8, P.O. Box 684, FL-9490 Vaduz, www.datenschutzstelle.li.

11. Security

Pages are delivered over TLS (HTTPS). Access to accounts and tournament data is limited to the people who are allowed to see them. We cannot guarantee complete security of transmission over the internet.

12. No automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Processors

These providers process data in order to run the website and the application. The website host is not named here; its connection data is described in section 3.

14. Changes to this privacy policy

We update this policy when the law, the processing or the technology we use changes. The current version is the one on this page.