Privacy Policy

This policy explains what data Book & Row collects, what it is used for and who it is entrusted to. The rules for using the service are set out separately in the Terms of Service.

§ 1. Who is responsible for the data

The data of club members belongs to the club. The club decides why it collects that data and who it is shared with, which makes the club its controller.

We process that data on the club’s instructions, as a processor. By accepting the terms, the club entrusts us with processing to the extent the service requires.

We are the controller for data we collect for our own purposes: enquiries sent through the contact form, correspondence with us and server logs.

Operator: Softeo Aleksander Rakucki, Polish tax ID (NIP) 5242947071, correspondence address: ul. Laurowa 35/5, 03-197 Warszawa. For anything concerning data, write to hello@softeo.dev.

§ 2. What data we process

Account data: name, email address and a password stored only as an irreversible hash.

Profile data, given voluntarily: contact details, information about build and rowing preferences, and a photo.

Club activity data: taking part in training and outings, results, plans, announcements and reports about equipment.

Technical data: IP address and server logs.

§ 3. Why, and on what legal basis

• Running the account and providing club features - performance of a contract (Art. 6(1)(b) GDPR); for members’ data, on the instructions of the club as controller.
• Profile details given voluntarily - consent, which can be withdrawn at any time by removing the data from the profile (Art. 6(1)(a) GDPR).
• Security, detecting abuse and diagnosing errors - our legitimate interest (Art. 6(1)(f) GDPR).
• Replying to a club enquiry sent from the form - also our legitimate interest (Art. 6(1)(f) GDPR).

§ 4. Who sees what inside the club

Each member decides which of their profile details they share with the rest of the club.

Withdrawing that consent in the profile applies across the whole service.

Name and role are always visible to club members - without them the club could not function.

No data flows between clubs. Someone belonging to two clubs has separate permissions and a separate view of the data in each.

§ 5. Who we entrust data to

We do not sell data and do not share it for advertising.

We use a single provider that processes data on our behalf: a hosting company based in Poland, which runs the server holding the database and files and handles outgoing mail. The club, as controller of its members’ data, will be given the provider’s name on request.

Data stays within the European Economic Area. We do not transfer it outside the EEA.

§ 6. How long we keep data

• Account data - until the user deletes the account or the contract with the club ends.
• Club data - deleted without undue delay after the contract ends; it disappears from backups as they are overwritten.
• Enquiries from the contact form - up to 24 months from the last exchange.
• Server logs - up to 12 months.

§ 7. Cookies

We use only the cookies the service needs to work: they keep you logged in, protect forms from abuse and - if you choose it - remember your login for later visits.

Because all of them are strictly necessary, the service shows no cookie consent banner. We run no analytics and no profiling.

§ 8. Security

• An encrypted connection (HTTPS), enforced across the whole service.
• Passwords stored as an irreversible hash - we do not know them and cannot read them.
• Access to data limited by the role held in the club.
• Each club’s data kept apart from every other club’s.

No safeguard is absolute. If a data breach occurs that could put people at risk, we notify the club without undue delay.

§ 9. Your rights

You have the right to access your data, to have it corrected, erased or its processing restricted, to object to processing, and to receive your data in a portable form.

Some data you can change yourself in your profile, and that is the quickest route. Otherwise: the controller of membership data is the club, so a request goes to the club and we carry it out on its instructions. A request sent to us is passed on to the club.

You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (UODO).

§ 10. Visit statistics

We count page views on public pages to know which of them are needed. This happens on our server and only in aggregate: we store the day, the page name, the language, the device type (phone, tablet, computer) and the site someone came from. Separately we record the bare fact that an account used the panel on a given day - without storing what anyone did - so that we know how many people actually use the system; those entries are deleted after 90 days. We do not store IP addresses, we do not use cookies for counting and we do not use external analytics tools - no visit data leaves our server.

§ 11. Changes to this policy

We give notice of material changes at least 14 days in advance. The date of the last change is shown at the top of the page.