Sportivoo

Privacy

With this document we provide all users of the "Sportivoo" application ("Sportivoo") with all the information needed to explain the features and methods of the processing of personal data carried out through the use of the App, in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR) and with Italian Legislative Decree 101/2018.

If you reside in the United Kingdom, the processing of your personal data will be carried out in accordance with the UK GDPR (United Kingdom General Data Protection Regulation) and the Data Protection Act 2018. The information contained in this policy – drafted in accordance with those standards – therefore also applies to you.

By installing Sportivoo, the user (hereinafter also the "Data Subject") consents to the collection and processing of the data indicated below, it being understood that specific consent will be requested for certain processing operations, as further explained below.

1. Data Controller

The controller of the data collected through Sportivoo is 3102 S.r.l., in the person of its legal representative pro tempore, with registered office at Viale della Repubblica 10, 37126 Verona, Italy, and operational office at Via Albere 8, 37138 Verona, Italy, Tax Code and VAT no. 04011560234 (hereinafter, "3102", "We" or the "Controller").

You may contact the Controller to request any information concerning the processing of your personal data, to exercise your rights, or to request a complete list of the data processors appointed by 3102, by contacting 3102 at the e-mail address privacy@3102-gsa.it.

Pursuant to Article 27 of the UK GDPR, the Controller has appointed the following representative in the United Kingdom:

Peak Logic Limited

2nd Floor 33 Newman Street, London, England, W1T 1PY

Company Number: 08707711.

Mail: info@peaklogic.co.uk

Data subjects residing in the United Kingdom may contact this representative on any matter relating to the processing of their personal data.

2. Categories of data processed, purposes, nature of the provision and legal basis

Through Sportivoo, the Controller may process the following categories of data, for the purposes described below.

A. Authentication data, such as:

provider ID (idpId)

the unique identifier assigned to each external authentication system used by an app to allow users to log in (in our case Google, Apple)

e-mail verification status
phone number verification status.

These personal data are collected on an alternative basis, depending on the authentication method chosen by the user. In any event, providing at least one of these data items is mandatory in order to access the services offered by Sportivoo.

The legal basis for the processing of these data is the performance of a contract to which the Data Subject is party, or the implementation of pre-contractual measures taken at the Data Subject's request, pursuant to Article 6(1)(b) of the GDPR.

B. Data relating to the Data Subject and their identity, such as:

first and last name
date of birth
e-mail address
phone number
gender
nationality
profile picture (optional)
profile description or "bio" (optional).

With the exception of the profile picture and bio, providing these personal data is mandatory in order to use the services offered by Sportivoo.

C. Data relating to the Data Subject's location, such as:

city name
geographic coordinates (latitude and longitude)
search radius (in kilometres)
real-time location sharing

Sportivoo may also collect these data via GPS or automatic location technologies. In that case, the legal basis for the processing is the Data Subject's consent, pursuant to Article 6(1)(a) of the GDPR.

Providing these personal data is optional; however, if you do not provide these data you will not be able to access the booking of matches and facilities closest to you.

Real-time location sharing by the Data Subject is always optional, is based on the Data Subject's consent and will have no consequence on the use of the services offered by Sportivoo.

If the Data Subject has enabled real-time sharing of their location for certain specific events classified as "public", such as "Cycling" and "Running", the location may be visible not only to the participants in the event but to all users registered on Sportivoo, even if they are not enrolled in the ongoing event.

Before enabling this feature, the Data Subject will be specifically informed and will have to give separate, explicit consent.

Consent may be withdrawn at any time through the Sportivoo settings, with no consequence on the enjoyment of the other services.

D. Data relating to the Data Subject's device, such as:

FCM token

the unique identifier automatically generated for each app installation on a specific device, essential for Firebase's push notification system

locale preferences

the device's regional settings, such as language, date and time format, numeric separators, currency and time zone

device identification data.

These personal data are acquired automatically by Sportivoo; providing them is therefore mandatory in order to use the services offered by the app.

These data may be used by us to derive anonymous statistical information, including for the benefit of other users, on the use of Sportivoo and to monitor its correct functioning. In addition, these data may be used to establish liability in the event of computer crimes committed against Sportivoo, attacks on the network infrastructure, or other unauthorised or abusive uses of Sportivoo.

The legal basis for the processing of these data is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR.

E. Data relating to the Data Subject's use of and activity on Sportivoo, such as:

online status
last access timestamp
activity logs (interactions with other users)
match participation history
follower/following relationships
interactions between users
messages exchanged between users
invitations sent to other users to participate in events
invitations received from other users
invitation status (e.g. sent, accepted, declined, expired)
events saved or followed by the user
reports submitted by the user concerning events, content or conduct connected with the use of Sportivoo, as well as their outcome or handling status
data relating to the sharing of an event through features integrated with Sportivoo (e.g. link generation or opening of sharing tools towards social networks or messaging applications)
data relating to adding an event to the device calendar or to third-party calendar services.

Providing these personal data is mandatory in order to use the related services offered by Sportivoo.

Reports of events, content or conduct submitted through Sportivoo may also be processed on the basis of the Controller's legitimate interest, pursuant to Article 6(1)(f) of the GDPR, in order to ensure the security of Sportivoo, the quality of the community, the prevention of abuse, fraud or uses contrary to the terms of use, and the proper handling of user requests.

Should the Data Subject choose to share an event outside Sportivoo via social networks, messaging apps or other third-party services, the data and information covered by the sharing will be transmitted exclusively on the Data Subject's initiative. Any subsequent processing carried out by the third-party service provider will take place under that provider's responsibility, in accordance with its own terms of use and privacy policies.

Should the Data Subject choose to add an event to their device calendar or to a third-party calendar service, Sportivoo may process the data strictly necessary to create or export the event (e.g. title, date, time, location and essential notes of the event). Any subsequent processing by the calendar provider will take place under that provider's responsibility.

With regard to the possibility of sharing information by exchanging chat messages with other users, we recommend that you exercise caution, because the Controller may not be able to control what others might do with your data once it has been shared. At the same time, the Controller reserves the right to access all data provided by users within Sportivoo, even if shared with individual recipients, on the basis of its legitimate interest in ensuring the security of the platform and preventing abuse and fraud pursuant to Article 6(1)(f) of the GDPR.

F. Data relating to the sports played by the Data Subject, such as:

preferred sports
sports statistics and ratings
users' answers for the profiling of sporting skills
authorisations and permissions for matches.

The Data Subject may freely decide whether and how much of the information listed here to share with the Controller from time to time, in order to personalise their user experience.

The legal basis for the processing of these data is the Data Subject's consent, pursuant to Article 6(1)(a) of the GDPR.

G. Data relating to the management of the Data Subject's account, such as:

account status (active/inactive)
onboarding status

this is the information showing where the user stands in the app setup process, i.e. which steps of the tutorial or guided setup they have completed (a sort of digital bookmark)

account deletion requests and their status.

Providing these personal data is mandatory to enable Sportivoo to manage the user account.

Please note that certain IT systems used by the user, such as the Apple Store or Google Play, may acquire data relating to Data Subjects, collected through the use of devices.

In general, the information contained in this document does not concern the processing of personal data that takes place as a result of the user's use of third-party software or services.

For further information on the processing and protection of personal data in this respect, we invite you to consult:

Apple's privacy policy

Google's privacy policy

H. Payment-related data

Sportivoo allows event organisers to indicate the payment methods accepted for collecting the contribution due from each user for participating in the event (e.g. bank transfer, PayPal, Satispay). For this purpose, the Controller may process the following data:

For organisers:

accepted payment methods
data needed to receive payments through the chosen methods
any payment instructions associated with the event

For participants:

payment methods chosen for participating in the event
payment status.

Sportivoo neither receives nor directly executes payments between users, and does not process the data of transactions carried out through external providers, except within the limits of the information entered or made available by users within Sportivoo.

Providing these data is necessary in order to use the feature that allows payment methods connected with events to be indicated and managed at an informational and organisational level; if these data are not provided, it will still be possible to handle payments directly with the facility outside Sportivoo.

The legal basis for the processing of these data is the performance of a contract to which the Data Subject is party, pursuant to Article 6(1)(b) of the GDPR.

Should the Data Subject use third-party payment services, such as bank transfer, Satispay or PayPal, the processing of the data necessary to execute the payment will take place under the responsibility of the respective providers or institutions involved, acting as independent data controllers. You are invited to consult their respective privacy policies:

Satispay's privacy policy

PayPal's privacy policy.

Organisers are advised to enter personal payment data solely in the fields dedicated to that purpose, which ensure secure handling of the information.

I. Data processed through artificial intelligence systems

Sportivoo uses an artificial intelligence system based on AWS Bedrock, a service provided by Amazon Web Services, Inc., to process data relating to users' sporting performance and to generate:

automated editorial content, in "news article" format, relating to the matches played
personalised coaching suggestions, aimed at improving team composition and performance.

For this purpose, the system processes data already collected under letter F (data relating to the sports played).

The purpose of this processing is to personalise the user experience and improve the service offered by Sportivoo.

The legal basis for the processing is the Data Subject's consent, pursuant to Article 6(1)(a) of the GDPR. Consent to the use of data by the AI system will be requested separately and may be withdrawn at any time through the settings.

The AI system carries out profiling of the user's sporting performance within the meaning of Article 4(4) of the GDPR. The generated content does not produce binding legal effects on the Data Subject, but may affect their experience within Sportivoo. The Data Subject is in any event entitled to object to such profiling and to request human intervention, pursuant to Article 22 of the GDPR.

J. Data relating to the user rating system

Sportivoo allows users to assign a rating to other users with whom they have taken part in sporting events. The data processed as part of this feature include:

ratings received from other users (numerical scores and, where provided for, comments)
ratings given by the user to other users
aggregate score (average rating) visible on the user's public profile.

The rating scores assigned to the Data Subject do not in any way affect their use of Sportivoo. The rating is calculated in an aggregate and automated manner on the basis of the ratings received. The Data Subject has the right to:

obtain information on the logic of the system used to calculate their score
challenge ratings they consider unfounded, by contacting the Controller at its contact details
request corrective human intervention.

The legal basis for the processing of rating-related data is the Controller's legitimate interest in ensuring the quality and safety of the user community, pursuant to Article 6(1)(f) of the GDPR.

3. Retention period

Without prejudice to the applicability of any specific sector-related legislation, the data collected (including content generated by the AI system and ratings) will be retained for the entire duration of the service offered by Sportivoo. The data will be deleted in the event of inactivity exceeding a period of 1 year.

In any event, the user remains free to delete their data at any time, using the dedicated functions available on Sportivoo or by writing to the Controller at the contact details indicated in this policy.

If the deletion request is submitted while the user is still part of an ongoing match, the procedure will be completed once the condition of total inactivity is reached.

Data relating to the payment methods indicated by users and any payment statuses managed within Sportivoo for organisational purposes will be retained for the time necessary to manage the event and any related disputes and, in any case, in accordance with the general retention terms applicable to the account set out in this policy. Any further retention remains possible where necessary to comply with legal obligations actually applicable to the Controller.

Data relating to invitations, followed events, calendar additions, sharing carried out through the app's features and reports may be retained for the time necessary to provide the relevant feature, handle any disputes, ensure the security of the platform and document the proper management of interactions between users, without prejudice to the general duration of the service and to any further legal obligations.

4. Methods of data processing

Data are processed exclusively through IT tools, for the time strictly necessary to achieve the purposes for which the data were collected and, in any case, with the adoption of specific security measures designed to prevent any personal data breach, such as data loss, unlawful or incorrect use, and unauthorised access.

However, due to the nature of online transmission, such measures cannot absolutely limit or exclude any risk of unauthorised access or data dispersion. We therefore recommend that you periodically check that your device is equipped with adequate means to protect the network transmission of data, both incoming and outgoing, and that your Internet service provider has adopted appropriate measures for the security of data transmission over the network (e.g. firewalls and anti-spam filters).

We also recommend that you use a unique, strong password, keep your access credentials carefully and prevent third parties from accessing your smartphone or Sportivoo.

5. Categories of recipients of personal data

Please note that the data will be processed by internal staff of the Controller, duly authorised to carry out the processing. In addition, we may disclose your personal data:

to third parties, such as third-party technical service providers, hosting providers, companies or professionals providing IT services, and the Controller's legal advisors, appointed from time to time, where necessary, as data processors pursuant to Article 4(8) of the GDPR (which defines a "processor" as the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller)
to Amazon Web Services, Inc. (through the AWS Bedrock service), as data processor, for the artificial intelligence processing purposes described in section 2, letter I
to payment service providers, to the extent strictly necessary to carry out the transactions requested by the user, and to providers of social network services, messaging applications or calendar services, solely where the Data Subject chooses to share an event or add it to an external calendar; these parties act as independent data controllers for the operations falling within their remit
to other Sportivoo users, limited to public profile content, ratings, AI-generated content, online status and, in the cases described in section 2, letter C, real-time geographic location
to parties to whom the right to access the data is granted by law or regulation, and to other parties provided for by law.

In any case, you may always ask us for an up-to-date list of the data processors.

6. Transfer of data outside the EEA

Personal data will be processed on servers located within the European Union belonging to the Controller and/or to third-party companies engaged and duly appointed as external data processors.

Any transfer of data outside the European Economic Area or the United Kingdom, or to an international organisation, will take place in accordance with applicable legal provisions. In that case, the Controller will provide Data Subjects with any further information regarding the conditions underlying the transfer.

Please note that AWS Bedrock is a service provided by Amazon Web Services, a US-based entity. The processing of data through that service may involve a transfer of personal data to third countries outside the EEA. Such transfer takes place in compliance with the safeguards provided for in Chapter V of the GDPR, in particular through the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR and, where applicable, through the EU-US Data Privacy Framework.

Similarly, should the Data Subject use sharing features towards social networks, messaging applications or calendar services operated by third-party providers, the subsequent processing of the data by those parties may involve transfers to third countries carried out under the responsibility of the respective providers, as set out in their privacy policies.

7. Rights of data subjects

You may exercise the rights listed below by submitting a specific request to the Controller at the contact details indicated above, or at the address privacy@3102-gsa.it.

For a better understanding of your rights, we invite you in any case to consult Articles 15 et seq. of the GDPR in full.

Right of access

You may ask for confirmation as to whether or not processing of data concerning you is taking place and, if so, obtain access to your personal data and to further information relating to the processing.

Right to rectification

You may ask for the data provided or otherwise held by the Controller to be rectified or completed, where inaccurate or incomplete.

Right to erasure (the "right to be forgotten")

You may ask for the data acquired or processed by the Controller to be erased without undue delay where, alternatively:

they are no longer necessary for the purposes for which they were collected
consent has been withdrawn and there is no other legal basis for the processing
you have objected to the processing of your personal data
the data have been unlawfully processed
there is a legal obligation to erase them.

Right to restriction of processing

You may request the restriction of the processing of personal data where one of the following applies:

you contest the accuracy of your data, for the period needed by the Controller to verify its accuracy
the processing is unlawful and you oppose the erasure of the data, requesting instead that its use be restricted
although the Controller no longer needs them for the purposes of the processing, the data are necessary for you to establish, exercise or defend a legal claim
you have objected to the processing pursuant to Article 21(1) of the GDPR, pending verification as to whether the Controller's legitimate grounds override your own.

Right to data portability

You have the right to:

receive your data in a structured, commonly used and machine-readable format
have it transmitted directly by the Controller to another controller designated by you, where technically feasible
transmit it to another controller without hindrance from the Controller.

Right to object

You may object at any time, on grounds relating to your particular situation, to the processing of your data carried out on the basis of Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions.

Right not to be subject to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Right to withdraw consent

You may withdraw at any time any consent given to the Controller, without affecting the lawfulness of processing based on consent given previously.

Finally, we remind you that you have the right to lodge a complaint with the Supervisory Authority competent for personal data protection – which in Italy is the Garante per la protezione dei dati personali – or, if you reside in the United Kingdom, with the Information Commissioner's Office (https://ico.org.uk/for-the-public).

How to exercise your rights

To exercise your rights, you may address a request to the Controller at the following contact details:

by e-mail, at: privacy@3102-gsa.it
by ordinary mail, writing to:

3102 S.r.l.

Via Albere 8

37138 Verona, Italy

8. Updates to this policy

This policy may be subject to periodic updates. You will always find the most up-to-date version of the policy in the relevant section of Sportivoo. In the event of substantial changes to the processing of your data, we will send you a notice.

Last updated: 19-08-2026