Privacy Policy

The data controller is Dzmitry Kavalenka, a sole proprietor registered at ul. Wierzbowa 7/2, 63-004 Gowarzewo, Polish tax identification number (NIP) 7792542587.

You can reach us on any matter concerning personal data at kontakt@twojklub.com.

For club staff accounts, billing, and support requests we are the data controller and decide the purposes of processing.

For the client records a club enters into the application we are only a processor. The club remains the controller of that data — it decides what it enters and why, and we process it according to its instructions.

Club staff accounts: name, email address, a password stored only as a hash, and whether the email address has been verified.

Google sign-in: if you sign in with Google, we receive your name and email address from Google. We do not store a Google identifier or any other data from your Google account.

Client records entered by the club: name, optionally a phone number and free-text notes, plus a RODO consent flag and the date it was given.

Billing data: subscription status and your Stripe customer and subscription identifiers. Card numbers never reach our servers — you enter them directly on Stripe’s own payment page.

Support requests: the content of your message and any contact details you include in it.

Activity logs: a record of key actions in the application — who did what and when — together with a timestamp, IP address, and browser user agent.

Aggregate statistics: page views and performance metrics, collected in aggregated form.

Performance of a contract (art. 6(1)(b) GDPR) — providing the service and handling billing.

Legal obligation (art. 6(1)(c) GDPR) — retaining billing and accounting records.

Legitimate interest (art. 6(1)(f) GDPR) — application security, accountability for actions taken in it, and aggregate usage statistics.

Consent (art. 6(1)(a) GDPR) — where you give it. You may withdraw it at any time, which does not affect the lawfulness of processing carried out beforehand.

We use only essential cookies. These are: the sign-in session cookie, the NEXT_LOCALE cookie remembering your chosen language, and the gt_cookie_consent cookie recording that the cookie notice has already been shown.

If you install Twój Klub as an app on your device (PWA), your browser stores a copy of the application files on the device so it also works without an internet connection. This is necessary for a feature you explicitly requested by installing the app.

Our statistics use no cookies and store nothing on your device. We use no advertising or tracking cookies.

Vercel Inc. — application hosting and aggregate page-view and performance statistics (Vercel Analytics, Speed Insights). The infrastructure serving the application runs in an EU region.

Neon, LLC (an affiliate of Databricks, Inc.) — hosted PostgreSQL database, in an EU region.

Stripe Payments Europe, Ltd. — payment and subscription handling, including card data, which we do not store.

Resend, Inc. — sending email: invitations, confirmations, password resets, support requests, and expiring-membership digests sent to club staff. The digest contains club clients’ names, their membership names, expiry dates, and an unpaid marker.

Functional Software, Inc. (Sentry) — application error monitoring. Data is stored in an EU region (Frankfurt).

The application, the database, and error logs are stored within the European Union.

Some of our providers are companies established in the United States. To the extent data is transferred outside the European Economic Area — including support access by a parent company — the transfer takes place on the basis of the European Commission’s adequacy decision on the EU–US Data Privacy Framework, or on standard contractual clauses approved by the European Commission.

Email content is processed by Resend, Inc. outside the European Economic Area under the same safeguards.

Account and club data are kept while the account is active.

Client records deleted in the application are hidden but retained, so that payment history stays consistent. We delete them permanently on an erasure request.

Billing and accounting records are kept for 5 years from the end of the calendar year in which the tax obligation arose. This is a statutory obligation we cannot shorten on request — to that extent it limits the right to erasure.

Activity logs are kept for security and accountability.

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing.

Exporting your club’s data in a machine-readable format and deleting your account are both available directly in the application, under settings — you do not need to write to us for either.

To exercise the remaining rights, contact us. We respond without undue delay and no later than within one month.

If you believe we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Connections to the application are encrypted (HTTPS). Passwords are stored only as hashes and we cannot read them.

Each club’s data is isolated from every other — one club’s account has no access to another’s data.

The application creates no accounts for club clients. Clients exist in it only as records entered by the club.

The club decides what goes into a client record and remains its controller. This includes data concerning minors, who make up a substantial share of participants at sports clubs.

Obtaining consent from a parent or legal guardian for processing a minor’s data is the club’s responsibility, not ours.

We may update this Policy. The date of the last change is shown at the top of the page, and we will announce material changes in the application or by email.

For any matter concerning personal data: kontakt@twojklub.com.