Privacy Policy
Your privacy matters. This Privacy Policy explains how SPORTR, an association under Swiss law (art. 60 ff. Swiss Civil Code) (“SPORTR,” “we,” “our,” or “us”) collects, uses, stores, shares, and protects your personal data when you use our application and services. This policy is designed to comply with the Swiss Federal Act on Data Protection (FADP/nFADP, in force since 1 September 2023), the Swiss Data Protection Ordinance (DPO), and the EU General Data Protection Regulation (GDPR, Regulation 2016/679) where applicable to users in the European Economic Area (EEA).
1. Data Controller and Contact Information
1.1 Data Controller
The data controller responsible for the processing of your personal data is:
SPORTR, an association under Swiss law (art. 60 ff. Swiss Civil Code), registered with the Commercial Register of the Canton of Geneva
Route des Jeunes 35
1227 Carouge, Switzerland
Email: privacy@sportr.ch
UID: CHE-199.854.425
1.2 Data Protection Contact
For any questions or requests relating to the processing of your personal data or the exercise of your rights, you may contact our designated data protection contact at:
Email: privacy@sportr.ch
Postal: Data Protection Contact, SPORTR, Route des Jeunes 35, 1227 Carouge, Switzerland
1.3 EU Representative (Art. 27 GDPR)
Our Services are primarily directed at users located in Switzerland. If and to the extent that we offer our Services to users in the European Economic Area and Article 27 GDPR applies, we will appoint a representative in the EU and update this Policy with their contact details. Until then, please direct any enquiries to privacy@sportr.ch.
2. Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with our Services. We are committed to collecting only data that is necessary for the purposes described in this Policy (data minimisation principle).
2.1 Data You Provide Directly
| Data category | Examples | When collected |
|---|---|---|
| Account data | Name, email address, phone number, date of birth, profile photo, password (hashed) | At registration and profile setup |
| Profile data | Sports preferences, skill levels (self-assessed and peer-rated), preferred locations, bio, certifications | When you complete or update your profile |
| Event data | Events created, events joined, RSVP status, cancellation history, reviews | When you create, join, or interact with events |
| Communication data | Messages sent through in-app chat, event comments, feedback | When you communicate through the platform |
| Payment data | Payment method details (processed by our payment provider), transaction history, amounts | When you make or receive payments through the platform |
| Verification data | Identity document (if verified), sports certifications (e.g., avalanche certificate, belay certification) | When you opt into verified profiles or safety-critical features |
| Support data | Support tickets, bug reports, correspondence with our team | When you contact support |
2.2 Data We Collect Automatically
| Data category | Examples | Purpose |
|---|---|---|
| Device data | Device type, operating system, app version, unique device identifiers, browser type | Service delivery, debugging, security |
| Usage data | Features used, pages viewed, search queries, click patterns, session duration | Service improvement, analytics |
| Location data | GPS coordinates (only when app is in use and with your explicit consent), IP-based approximate location | Event discovery, distance calculations, relevant content |
| Log data | Access logs, error logs, IP addresses, timestamps | Security, fraud prevention, debugging |
| Performance data | Crash reports, performance metrics | Service reliability and improvement |
2.3 Data from Third Parties
We may receive personal data from the following third-party sources:
- Authentication providers (Apple, Google) if you choose to register or log in via these services;
- Fitness tracking integrations (Strava, Garmin, Apple Health) if you choose to connect these services — only activity data you authorise will be synced;
- Venue booking partners, solely for the purpose of confirming and displaying booking status;
- Payment service providers, limited to transaction status and confirmation data.
3. Legal Bases for Processing
We process your personal data based on the following legal grounds, in accordance with both the Swiss FADP and, where applicable, Article 6 of the GDPR:
| Legal basis | Applicable processing activities |
|---|---|
| Contract performance (Art. 6(1)(b) GDPR / Art. 31(1) FADP) | Account creation and management; providing the core Services (event creation, joining, matchmaking, venue booking); processing payments; communicating with you about your account and activities |
| Legitimate interest (Art. 6(1)(f) GDPR / Art. 31(1) FADP) | Service improvement and analytics; fraud detection and prevention; security monitoring; enforcing our Terms of Use; aggregate statistical analysis; customer support |
| Consent (Art. 6(1)(a) GDPR / Art. 31(1) FADP) | Precise geolocation data collection; marketing communications and push notifications; connecting third-party services (Strava, Garmin, etc.); optional profile verification; cookies and tracking technologies (where consent is required) |
| Legal obligation (Art. 6(1)(c) GDPR / Art. 31(1) FADP) | Tax and accounting records; responding to lawful requests from authorities; compliance with anti-money laundering obligations (if applicable to payment features) |
| Vital interests (Art. 6(1)(d) GDPR) | Emergency safety features (GPS check-in, safety alerts) in life-threatening situations |
Withdrawal of consent: Where processing is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw consent through the App’s privacy settings or by contacting us at privacy@sportr.ch.
4. How We Use Your Personal Data
4.1 Core Service Delivery
- Creating and maintaining your account and profile;
- Enabling you to create, discover, join, and manage sports events;
- Matching you with events and players based on sport, level, location, and availability;
- Facilitating venue searches, court bookings, and related reservations;
- Processing payments, cost-splitting, and refunds;
- Enabling in-app communications between users;
- Displaying player reliability scores, ratings, and reviews.
4.2 Service Improvement
- Analysing usage patterns to improve features and user experience;
- Conducting aggregate, anonymised statistical analysis;
- Testing and developing new features;
- Resolving technical issues and bugs.
4.3 Safety and Security
- Detecting and preventing fraud, abuse, and security incidents;
- Enforcing our Terms of Use and community guidelines;
- Verifying user identities and certifications for safety-critical features;
- Providing emergency safety features (GPS check-in, safety alerts).
4.4 Communications
- Sending transactional notifications (event confirmations, cancellations, reminders, payment receipts);
- Sending service-related announcements (updates, maintenance, policy changes);
- With your consent: sending promotional communications, event recommendations, and newsletters.
5. Data Sharing and Disclosure
5.1 Sharing with Other Users
Certain profile information is visible to other SPORTR users as part of the platform’s functionality. This includes your display name, profile photo, sport preferences, skill ratings, reliability score, event history (events you’ve joined or organised), and reviews. You can control the visibility of certain profile elements through your privacy settings.
5.2 Service Providers (Data Processors)
We share personal data with carefully selected third-party service providers who process data on our behalf to support our Services. These processors are contractually bound to process data only for specified purposes and in accordance with our instructions, and must implement appropriate technical and organisational security measures. Categories of processors include:
- Cloud hosting and infrastructure providers;
- Payment processing providers;
- Email and push notification delivery services;
- Analytics and performance monitoring providers;
- Customer support tools;
- Venue booking integration partners.
5.3 Venue Partners
When you book a venue through the platform, we share the minimum data necessary to complete the booking (typically your name, contact information, and booking details) with the venue operator. The venue operator becomes an independent data controller for the data they receive. We encourage you to review the venue’s own privacy policy.
5.4 Legal and Regulatory Disclosure
We may disclose your personal data if required to do so by law, regulation, or legal process, including:
- Responding to valid requests from Swiss or foreign law enforcement or regulatory authorities;
- Enforcing our Terms of Use or protecting our legal rights;
- Preventing fraud, security threats, or illegal activity;
- Protecting the safety of any person.
5.5 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and of any changes to this Privacy Policy resulting from it.
5.6 No Sale of Personal Data
SPORTR does not sell your personal data to third parties. We do not share your data with advertisers for profiling or targeted advertising purposes outside our platform.
6. International Data Transfers
Your personal data is primarily stored and processed in Switzerland, which is recognised by the European Commission as providing an adequate level of data protection (Commission Decision 2000/518/EC, as maintained). Where data is transferred to countries outside Switzerland or the EEA that do not provide an adequate level of data protection, we ensure appropriate safeguards are in place, including:
- EU Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914), with the necessary Swiss-specific modifications as recommended by the FDPIC;
- Adequacy decisions by the Swiss Federal Council or the European Commission;
- Other safeguards permitted under Art. 16–17 FADP and Art. 46–49 GDPR.
You may request a copy of the safeguards in place by contacting privacy@sportr.ch.
7. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:
| Data category | Retention period | Basis |
|---|---|---|
| Account and profile data | Duration of active account + 30 days after deletion request | Contract performance; legitimate interest for orderly wind-down |
| Event and activity data | Duration of active account + 1 year after deletion (anonymised) | Service improvement (anonymised); dispute resolution |
| Payment and transaction data | 10 years from the date of transaction | Swiss Code of Obligations Art. 958f (accounting retention obligation) |
| Communication data (in-app messages) | Duration of active account + 90 days after deletion | Contract performance; safety investigations |
| Location data | Maximum 12 months in identifiable form | Service delivery; anonymised thereafter for analytics |
| Log and security data | 12 months | Security, fraud prevention, legal compliance |
| Marketing consent records | Duration of consent + 3 years after withdrawal | Demonstrating compliance with consent requirements |
| Support tickets | 3 years from resolution | Quality assurance; legal compliance |
After the applicable retention period expires, personal data is either securely deleted or irreversibly anonymised so that it can no longer be linked to you.
8. Your Rights
Under the Swiss FADP and, where applicable, the GDPR, you have the following rights regarding your personal data. SPORTR is committed to facilitating the exercise of these rights:
| Right | Description | How to exercise |
|---|---|---|
| Right of access (Art. 25 FADP / Art. 15 GDPR) | You have the right to obtain confirmation as to whether your personal data is being processed and to access a copy of that data, together with information about the purposes and categories of processing. | In-app privacy settings or email privacy@sportr.ch |
| Right to rectification (Art. 32(1) FADP / Art. 16 GDPR) | You have the right to request correction of inaccurate personal data and completion of incomplete data. | Edit your profile directly in the App, or contact us |
| Right to erasure (Art. 32(2)(c) FADP / Art. 17 GDPR) | You have the right to request deletion of your personal data, subject to legal retention obligations. Also known as the “right to be forgotten.” | Account deletion feature in the App, the web form at sportr.ch/delete-account, or email privacy@sportr.ch |
| Right to data portability (Art. 28 FADP / Art. 20 GDPR) | You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and to transmit it to another controller. | In-app data export feature or email request |
| Right to restrict processing (Art. 18 GDPR) | You have the right to request restriction of processing in certain circumstances (e.g., while we verify the accuracy of your data). | Email privacy@sportr.ch |
| Right to object (Art. 21 GDPR) | You have the right to object to processing based on legitimate interest, including profiling. Where processing is for direct marketing, you may object at any time. | In-app settings or email privacy@sportr.ch |
| Right to withdraw consent (Art. 7(3) GDPR / Art. 31(1) FADP) | You may withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal. | In-app privacy settings, notification settings, or email |
| Right not to be subject to automated decisions (Art. 21 FADP / Art. 22 GDPR) | You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. | Email privacy@sportr.ch |
Response time: We will respond to your request within thirty (30) days. This period may be extended by an additional sixty (60) days for complex or numerous requests, in which case we will inform you of the extension and the reasons for it.
Verification: To protect your data, we may need to verify your identity before processing your request. We will not charge a fee for legitimate requests unless they are manifestly unfounded or excessive.
Right to lodge a complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or, for EEA users, with the supervisory authority in your country of residence.
9. Cookies and Tracking Technologies
Our App and website may use cookies and similar tracking technologies. We distinguish between the following categories:
| Category | Purpose | Consent required? |
|---|---|---|
| Strictly necessary cookies | Essential for the App to function (authentication, security, session management). Cannot be disabled. | No — legitimate interest / necessity |
| Analytics cookies | Help us understand how users interact with the App, identify issues, and improve performance. Data is aggregated and anonymised where possible. | Yes — opt-in consent required |
| Functional cookies | Remember your preferences (language, display settings, notification preferences). | Yes — opt-in consent required |
| Marketing cookies | Used to deliver relevant content and measure campaign effectiveness. We do not use third-party advertising trackers. | Yes — explicit opt-in consent required |
You can manage your cookie preferences at any time through the App’s privacy settings or the cookie banner displayed on our website. For full details, please see our separate Cookie Policy.
10. Data Security
SPORTR implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Art. 8 FADP and Art. 32 GDPR. These measures include, but are not limited to:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256);
- Secure password storage using industry-standard hashing algorithms (bcrypt/Argon2);
- Access controls: personal data is accessible only to authorised personnel on a need-to-know basis;
- Regular security audits, vulnerability assessments, and penetration testing;
- Incident response procedures for prompt detection and management of data breaches;
- Employee training on data protection and information security;
- Physical security measures for server infrastructure.
No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security vulnerability, please report it to privacy@sportr.ch.
11. Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, SPORTR will:
- Notify the FDPIC (and, where applicable, the relevant EU supervisory authority) as soon as possible in accordance with Art. 24 FADP and Art. 33 GDPR;
- Notify affected users without undue delay where the breach is likely to result in a high risk to their personality or fundamental rights, in accordance with Art. 24(4) FADP and Art. 34 GDPR;
- Document the breach, its effects, and the remedial actions taken.
12. Children’s Privacy
SPORTR is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete that data as soon as possible. If you believe a child under 16 has provided us with personal data, please contact us at privacy@sportr.ch.
For users between the ages of 16 and 18, we process data based on parental or legal guardian consent where required by applicable law.
13. Third-Party Links and Integrations
The App may contain links to third-party websites, applications, or services (e.g., Strava, Garmin, venue websites, payment providers). This Privacy Policy applies only to SPORTR’s Services. We are not responsible for the privacy practices of third parties. We encourage you to read the privacy policies of any third-party service before providing your personal data to them.
When you connect a third-party service (e.g., Strava integration), we will clearly inform you of what data will be shared and for what purpose before the connection is established. You may disconnect third-party integrations at any time through the App’s settings.
14. Profiling and Automated Decision-Making
SPORTR uses limited automated processing to enhance your experience, including:
- Skill-level matching: automated assessment of your player level based on self-reported data, peer ratings, and match outcomes, used to suggest events and opponents at compatible levels;
- Event recommendations: automated suggestions of events based on your sports preferences, location, and activity history;
- Reliability scoring: an automated score based on your attendance history (confirmed events attended vs. no-shows) displayed to event organisers.
These processes assist in providing a better experience but do not produce legal effects or similarly significant effects. No decisions regarding your access to the platform or your fundamental rights are made solely on the basis of automated processing. You have the right to request human review of any automated decision by contacting privacy@sportr.ch.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or features of the Services. We will notify you of material changes at least thirty (30) days before they take effect by publishing the updated policy in the App and, where appropriate, by sending a notification to your registered email address or via push notification. The “Effective Date” and “Last Updated” date at the top of this document will be revised accordingly.
Where changes to data processing require your consent under applicable law, we will request such consent before the changes take effect.
16. Contact Information
Data Controller:
SPORTR (association under Swiss law)
Route des Jeunes 35, 1227 Carouge, Switzerland
Email: privacy@sportr.ch
UID: CHE-199.854.425
Data Protection Contact:
Email: privacy@sportr.ch
Swiss Supervisory Authority:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
Website: edoeb.admin.ch
EU Representative (if applicable):
To be appointed if and when required under Art. 27 GDPR (see Section 1.3).
This policy is available in English. A French version is also available. In case of inconsistency between language versions, the French version will prevail for users resident in Switzerland.