Privacy policy

This policy explains what personal data Banat Football Academy collects, why, how long we keep it and what your rights are. The academy trains children, so most of the data is about children and comes to us from their parents. We treat it accordingly: we ask for little, show it only to those who need it, and delete it on time.

1. Who we are

The controller of your data is Danube Global Sports Group SRL, the company that runs Banat Football Academy (BFA). For any question about personal data, write to us at contact@banatfa.ro.

We have not appointed a data protection officer (DPO). Data protection is handled directly by the academy's management, and your requests go straight to them.

2. What we collect

Only what we need to train your child and talk to your family:

• Through the trial form: the child's name and date of birth, optionally gender and experience, the base and programme you want, the parent's name, phone number and email, how you heard about us and anything you write in the message.
• After enrolment: the member number, group, attendance, absence notices, the written assessments twice a year and the state of the monthly fees.
• In your app account: the email you sign in with, your name and phone number, and your preferred language.
• Health information (allergies, conditions, medication) and an emergency contact, only if you fill them in. For health information we ask for separate, explicit consent.
• Photos and video, only with the consent given in the app for each child.

We use no analytics or advertising tools and do not track visitors to the site. Our hosting provider keeps short-lived technical logs (IP address, page requested) for security.

3. Why we use it, and on what legal basis

• Arranging the trial: because you asked for it, as a step before enrolment (GDPR article 6(1)(b)).
• Training, groups, attendance, assessments and fees: to perform the enrolment, which is our contract with your family (article 6(1)(b)).
• Accounting records of payments: because the law requires it (article 6(1)(c)).
• The emergency contact and safety at training: our legitimate interest in looking after the children and, in an emergency, the child's vital interests (article 6(1)(f) and (d)).
• Health information: your explicit consent (article 9(2)(a)), which you can withdraw at any time in the app.
• Photos and video: your consent (article 6(1)(a)), given or withdrawn at any time in the app.
• Security of the site and app: our legitimate interest in protecting them (article 6(1)(f)).

We make no automated decisions about children or families and do no profiling. We never sell or rent data to anyone.

4. Children's data

Everything we hold about a child comes from their parent or guardian. Children have no accounts in the app, and any consent for a child is given by the parent.

In the app, a child is visible only to the parents linked to them, the coaches of their group and the academy's office. Health information is seen only by the child's coaches and the office, so they know what to do at the pitch.

We do not publish photos in which a child can be recognised without the parent's consent, and we never put a child's full name next to a photo.

5. Who we share it with

Data leaves the academy only to the providers that keep our systems running, only as far as they need it for that, and under a data processing agreement:

• Supabase: the database and signing in to the app. The data is stored in the European Union (Ireland).
• Vercel: hosting for the website and the app.
• The academy's accounting firm, for payment records.

We pass data to authorities only when the law requires it, for example to the tax authorities, or to medical services in an emergency.

The WhatsApp alerts the academy receives about a new request contain no personal data: only the child's age, the base and a link to the app. The articles on the site are written with the help of an artificial intelligence tool (Google Gemini), which receives no data of any kind about children or families.

6. Transfers outside the European Union

The database is in the European Union. Supabase and Vercel are US companies; any access they have to data from outside the Union is covered by the standard contractual clauses approved by the European Commission and, where it applies, the EU-US Data Privacy Framework.

The photos on the site are delivered from our own domain, so your browser does not contact other servers for them.

7. How long we keep it

We keep nothing just in case. Deletion happens automatically, every night, on these periods:

• Declined trial requests: six months after the decision.
• Trial requests never completed, or that became an enrolment: twelve months.
• Health information and the emergency contact: thirty days after the child leaves the academy, or as soon as you withdraw consent.
• Everything else about a child who left (attendance, assessments, fees): three years, the general limitation period under the Romanian Civil Code.
• The record of a handled erasure request: three years, so we can show we answered it.
• Your app account: until you ask us to delete it, in the app or by email.
• Accounting documents (invoices, receipts): as long as accounting law requires.

8. Security

The database itself decides who sees what: a parent sees only their own children, a coach only their own groups, and a base's office only that base. The rules are checked by automated tests every time the app changes.

All connections are encrypted. You sign in to the app with a one-time link sent by email or with your Google account, with no passwords to remember. Staff get access by invitation, and it is removed the moment someone leaves.

If data were ever exposed, we would notify the supervisory authority within 72 hours and the affected families without delay, whenever the risk calls for it.

9. Your rights

You have the right to know what data we hold about you and your child, to correct it, to ask for it to be deleted, to restrict how it is used, to receive it in a machine-readable format, to object to processing based on our legitimate interest, and to withdraw any consent at any time, without affecting what was done before.

The simplest way is in the app: under Account, in the Personal data section, you can download all your data or ask for it to be deleted. You can also write to contact@banatfa.ro. We answer within one month.

If you are not satisfied with our answer, you can complain to the Romanian data protection authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, https://www.dataprotection.ro.

10. Cookies and tracking

The site uses no analytics, advertising or social media cookies, so we do not ask you to accept any.

We use only what is strictly necessary: session cookies that keep you signed in to the app and, in your browser's storage, your choice of theme and language. You can delete them at any time in your browser settings.

11. Links to other sites

The site links to Google Maps, WhatsApp and our social media. Nothing from them loads unless you tap the link, and from there those services' own policies apply.

12. Changes to this policy

When we change something important, we update the date above and tell families in the app or by email before the change applies.