AT A GLANCE
- We collect only what we need for entries, orders and communication.
- We do not sell personal data. We never see or store card details.
- Meet results are public and are kept as a sporting record.
- You can exercise your rights at [PRIVACY EMAIL].
01Data controller
The data controller is [ORGANISER NAME], [LEGAL FORM], VAT no. [VAT NUMBER], registered at [ADDRESS] (the “Organiser”, “we”). Contact for data matters: [PRIVACY EMAIL].
This Policy covers the Athens Open Cup website, shop and communications with us. Processing of athlete data for running the meet is set out in the Athlete data notice, which forms an integral part of this Policy.
Athlete data notice →02What we collect
- Shop orders: full name, email, phone, products, size, amount and payment status.
- Contact form: full name, email, topic and message.
- Athlete entries: see the Athlete data notice.
- Technical data: IP address, device and browser type, date and time of access — for security and abuse prevention.
- Payment data: payments are made directly to Viva Wallet. We receive only a transaction confirmation (reference, amount, status) — never card details.
03Purposes and legal bases
- Fulfilling your order or entry (Art. 6(1)(b) GDPR — performance of a contract).
- Meeting tax and accounting obligations (Art. 6(1)(c) — legal obligation).
- Website security, fraud and abuse prevention, rate limiting and bot protection (Art. 6(1)(f) — legitimate interest).
- Replying to messages and requests (Art. 6(1)(b) or (f)).
- Organising, improving and promoting the meet and future editions, using aggregated or anonymised data (Art. 6(1)(f)).
- Newsletters about future meets and offers — only with your consent, which you can withdraw at any time (Art. 6(1)(a)).
- Establishing, exercising or defending the Organiser’s legal claims (Art. 6(1)(f)).
04Recipients and processors
We do not sell or rent personal data. Data is accessible only to authorised members of the organising team and to providers that support us technically, under a data processing agreement and only for our purposes:
- Supabase — database and authentication (hosted in an EU region).
- Vercel — website hosting.
- Cloudflare — content delivery, attack protection and Turnstile bot checks.
- Resend — confirmation and notification emails.
- Upstash — request rate limiting.
- Viva Wallet — payment processing, as an independent controller for payment data.
We may also disclose data to public authorities, courts, or our accountants and legal advisers where the law requires it or where it is necessary to protect our rights.
05Transfers outside the EU
Some providers (e.g. Vercel, Cloudflare, Resend) are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, with appropriate safeguards.
06How long we keep data
- Orders and payments: for as long as tax law requires (as a rule 5 years from the end of the tax year) and, if a dispute is pending, until it is finally resolved.
- Contact messages: up to 24 months after the last communication.
- Technical logs: up to 90 days, unless needed to investigate a security incident.
- Newsletter list: until you withdraw consent.
- Meet results: kept without time limit as a sporting record (see the Athlete data notice).
08Security
We apply appropriate technical and organisational measures: encryption in transit (HTTPS/HSTS), strict database access rules, admin access only with authentication and automatic sign-out, logging of admin actions and attack protection. No method of transmission or storage is completely secure; in the event of a breach we will act as the GDPR requires, notifying the authority and affected people where necessary.
09Your rights
- Access, rectification and erasure.
- Restriction of processing and data portability.
- Objection to processing based on legitimate interest.
- Withdrawal of consent, without affecting processing carried out before withdrawal.
To exercise your rights, email [PRIVACY EMAIL]. We will ask for information to verify your identity. We reply within one month; this may be extended by two further months where requests are complex or numerous. Manifestly unfounded or excessive requests may be refused or charged a reasonable fee, as Art. 12(5) GDPR allows.
These rights are not absolute: for example, we do not erase data we are required to keep by law or need to establish or defend legal claims.
You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr). We encourage you to contact us first so that we can resolve any issue promptly.
10Minors
The website is not intended for children under 15. Athletes under 18 may only be registered by, or with the consent of, a parent or guardian (see the Athlete data notice).
11Changes to this Policy
We may amend this Policy, for example because of new features or changes in the law. The new version applies from its publication on the website. For material changes we will notify by email those with an active entry or order.