Privacy policy

1. Who we are

The Arenio app and the website https://arenio.club are operated by Vlad Roșu (a private individual), e-mail contact@arenio.club.

For your account (your sign-in, contact details, password and photo) we are the data controller. For the data a club keeps about its members (groups, attendance, memberships, payments, achievements), the club is the controller and the app processes that data on its behalf, as a processor. For questions about what a club keeps about you, you can write to the club (its contact details are in the app, on the club’s page) or to us.

The contract between a club and the app’s provider (the commercial terms and the agreement on processing its members’ data) is signed separately, outside the app, with [Denumirea firmei SRL, CUI]. This policy does not replace it.

For any question about your data, write to us at contact@arenio.club.

2. What data we use

Account data (given by you, or by a parent or a club when they create your account):

• first and last name, date of birth (required for athletes), an avatar colour;
• the e-mail address and/or phone number you sign in with, and whether you have confirmed them;
• your password, stored only in an irreversibly encrypted form (nobody, us included, can read it);
• your profile photo, if you choose to add one (we shrink it and remove its hidden data, such as the location);
• for admin accounts: the e-mail address, an optional display name and the club.

Club data (written by the club’s admins and coaches, or by you or your parent):

• the clubs, groups and levels you are in, and your enrolment history;
• attendance at practice, “coming” / “can’t make it” answers, unlocked achievements;
• memberships, amounts due, payments recorded or declared (amount, date, method, a note) — the app does not process card payments and never sees card details;
• private lesson requests and scheduled lessons;
• for coaches: working hours, days off, sessions led;
• who did something (for example who took attendance), for the club’s records.

Technical data:

• sign-in sessions (a session code, stored only encrypted, and optionally the device name);
• confirmation codes, password reset codes and activation links, which expire quickly;
• the app version and platform (iOS / Android), so we know when an update is needed;
• server logs (IP address, time, which request was made), for security and troubleshooting, kept for at most 30 days.

We use no analytics, advertising or tracking tools, and we don’t ask for access to your location, contacts or microphone. The camera and photo library are used only when you choose a profile photo.

3. Children’s data

Many athletes are children. A child’s profile is created by a parent (from their parent account) or by the club, for its records. The parent sees and manages the child’s data: sign-in details, photo and permissions (“Full control of the account”, “Can ask for private lessons”).

Under 16, a child’s own account is created with a parent’s consent: usually the parent creates it (from the child’s profile) or the club does, with the parent’s consent. If you find out that a child under 16 created an account on their own without your consent, write to us and we will delete it.

Children’s photos are visible only to their family and to the staff of their clubs, through links that expire.

4. Why we use data and on what legal basis

• to provide the app (account, sign-in, schedule, attendance, memberships, notifications): performance of the contract with you (Art. 6(1)(b) GDPR);
• to keep a club’s history (attendance, payments, who did what), also after an account is deleted: the club’s legitimate interest and its accounting obligations (Art. 6(1)(c) and (f));
• account security (limits on sign-in attempts, logs, confirmation codes): the legitimate interest in protecting accounts and the service (Art. 6(1)(f));
• your profile photo: your consent, which you withdraw by deleting the photo (Art. 6(1)(a));
• service messages (codes, links, invitations, notifications about practice and payments): performance of the contract. We don’t send marketing messages.

5. Who sees your data

• you and, for a child, their parents;
• the admins of the clubs you are in: your profile, groups, attendance, payments and sign-in details (not your password);
• the coaches of your groups and sessions: your name, photo, attendance, answers and level, and on the payments side only whether you have an overdue payment;
• other members of a group don’t see your contact details.

The providers that help us run the service process data only on our instructions, under contract:

• [Furnizorul de găzduire]: the app’s server and database (European Union).
• SMSO (Stage One Media SRL): sending text messages (confirmation and password reset codes, activation links) (Romania).
• [Furnizorul serverului de e-mail (SMTP)]: sending e-mails (codes, activation links, invitations) ([EU / USA, under standard contractual clauses]).
• Apple și Google: distributing the app through the App Store and Google Play (and, once we turn them on, push notifications) (USA / EU).

We don’t sell or rent data. We disclose it to authorities only when the law requires us to.

6. Where the data is

The server and the database run at a virtual private server (VPS) provider with data centres in the European Union ([Furnizorul de găzduire]). If a provider processes data outside the European Economic Area, the transfer happens only with the safeguards the GDPR requires (for example the European Commission’s standard contractual clauses).

7. How long we keep data

• account data: for as long as you have the account. When you delete it, we delete this data right away (see “Deleting your account”);
• the club’s history (name, date of birth, attendance, payments, achievements): for as long as the club keeps it, for its records and accounting obligations (accounting documents are usually kept for 5–10 years, by law). The club can delete it whenever it asks us to;
• sign-in sessions: they expire after 180 days without use;
• confirmation codes: 15 minutes; password reset codes: 30 minutes; activation links and invitations: 7 days;
• server logs: at most 30 days; database backups are overwritten periodically, so deleted information also disappears from them within 30 days at most.

8. Deleting your account

You can delete your account at any time, right in the app: Account → your profile → “Delete … account”, at the very bottom, then confirm. A parent deletes a child’s account from the child’s profile (at the very bottom → “Delete …’s account”): the child disappears from the family and from every club. A student whose account their parents manage can delete it themselves only if a parent gave them “Full control over the account”. The full steps and what happens to the data are on the Delete your account page.

What is deleted: your e-mail, phone, password, photo, confirmations, the sessions on all your devices, codes and links. The account leaves every club; what stays with each club, for its history: your name, date of birth, colour and what happened there (groups, attendance, payments, achievements), with no contact details and no account.

You can also ask for deletion by e-mail, at contact@arenio.club, from your account’s address; we reply within 30 days at most.

9. Your rights

You have the right to know what data we hold about you and to receive a copy (including in a format you can move to another service), to correct it, to ask for it to be deleted or restricted, to object to processing based on legitimate interest and to withdraw your consent (for example for your photo). You can do much of this yourself in the app (profile, photo, sign-in details, account deletion); for the rest, write to us. We reply within one month at most.

If you are unhappy, you can complain to the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or to the data protection authority of the EU country where you live.

10. How we protect data

All communication with the server is encrypted (HTTPS). Passwords and session codes are stored only in irreversibly encrypted form; sign-in attempts are limited; photos are served only through signed links that expire; every user sees only the data of their own clubs and family, checked on the server. No system is perfect: if an incident puts your data at risk, we will tell you and the authority, as the law requires.

11. Changes

When we change something important in this policy, we will let you know in the app or by e-mail before it applies. The date of the last update is shown above.