Privacy Policy

1. Who we are

[Club Name], with registered office at [address], registered under CUI/CIF [___], (hereinafter "the Club", "we") is the data controller for personal data processed through the [platform/website name] platform (hereinafter "the Platform"), within the meaning of Regulation (EU) 2016/679 (GDPR).

Contact details for data protection matters: Email: [dedicated email, e.g. dataprotection@club.ro] [If a DPO has been appointed: Data Protection Officer: name + contact]

2. What data we collect

2.1. Data about the child (young athlete)

• First and last name
• Date of birth
• Photograph (attached during enrollment, for identification/sports ID card purposes)
• Health-related data strictly necessary for practicing the sport (e.g. sports medical certificate, where applicable) — special category data, collected only if strictly necessary and with an appropriate legal basis
• Age group / team the child is enrolled in

2.2. Data about the parent/legal representative

• First and last name
• Email address
• Phone number
• Relationship to the child (parent, legal guardian)
• Signature/checkbox confirming consent to data processing

2.3. Technical data (collected automatically)

• IP address, device/browser type
• Traffic data/cookies (see separate Cookie Policy, if applicable)

3. Who gives consent, and why

Because the Platform collects data about minors, and the GDPR (Art. 8) requires the consent of the holder of parental responsibility for children under 16 (a threshold that may vary between 13-16 depending on local legislation — in Romania the threshold is 16), enrollment is always carried out through:

• Completion of the form by the parent/legal representative, on behalf of the child;
• Explicit checkbox confirmation of consent to the processing of the child's personal data, given by the parent/legal representative;
• Confirmation of the enrolling person's status as the child's legal representative.

Consent is specific, informed, freely given, and may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. Purposes of processing

Data is processed for:

1. Enrolling and managing the child's participation in the Club's sporting activities (athlete records, organization into groups/teams);
2. Issuing sports ID cards/membership cards, where applicable, using the attached photograph;
3. Communicating with parents regarding training schedules, competitions, and organizational changes;
4. Fulfilling the Club's legal obligations toward the basketball federation, sports insurance providers, or authorities, wherever the law requires reporting certain data;
5. Promoting the Club's activities (photos/videos from training sessions, matches, events) — only with separate, distinct consent, which is optional and does not condition the child's enrollment at the club.

Point 5 must be treated as a consent separate from the one required for enrollment — the parent must be able to check "yes" for enrollment and "no" for the use of the image for promotional purposes, without the refusal blocking the child's enrollment.

5. Legal basis for processing

• Consent of the parent/legal representative (Art. 6(1)(a) and Art. 8 GDPR) — for enrollment and the photograph;
• Performance of a contract/pre-contractual relations (Art. 6(1)(b)) — for managing participation in the Club's activities;
• Legal obligation (Art. 6(1)(c)) — wherever the federation or sports legislation requires records or reporting;
• Legitimate interest (Art. 6(1)(f)) — for administrative communications strictly necessary, while respecting the data subject's rights.

For health-related data (if collected, e.g. medical certificate), the legal basis is explicit consent (Art. 9(2)(a)) or another basis expressly permitted under Art. 9, in correlation with applicable sports legislation.

6. How long we keep the data

• Enrollment data and the photograph: for the duration of the child's participation in the Club's activities, plus an additional period of [e.g. 3 years] after participation ends, for any legal obligations/archiving purposes;
• Health-related data: strictly for as long as necessary for the purpose for which it was collected, with deletion or anonymization as soon as it is no longer needed;
• In the event consent is withdrawn, data is deleted or anonymized within [e.g. 30 days], except for data the Club is legally required to retain.

[Recommendation: define these timeframes concretely through an internal data retention policy, aligned with the sports federation's requirements.]

7. Who we share data with

Data may be disclosed, only to the extent necessary for the purpose:

• To the basketball federation/league the Club operates under, for registration/athlete records;
• To the Platform's technical service providers (hosting, form processing) — acting as data processors, under a data processing agreement;
• To public authorities, where required by law.

The Club does not sell or rent the personal data of children or parents to third parties for marketing purposes.

8. Rights of the parent/legal representative (on behalf of the child)

Under the GDPR, you have the right to:

• Request access to the data processed about the child;
• Request rectification of inaccurate data;
• Request erasure of the data ("right to be forgotten"), subject to the exceptions provided by law;
• Restrict processing under certain conditions;
• Object to processing based on legitimate interest;
• Request data portability, where technically applicable;
• Withdraw consent at any time, without affecting the lawfulness of prior processing;
• Lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

To exercise these rights, you may contact us at [dedicated email].

9. Data security

The Club implements appropriate technical and organizational measures to protect data (restricted access, secure storage, encryption where applicable) and imposes similar obligations on its service providers.

10. Children's photographs — additional clarifications

• The photograph attached at enrollment is used exclusively for internal identification/sports ID purposes, unless the parent separately checks consent for promotional use;
• Photographs used for promotional purposes (website, social media) require explicit, separate consent, revocable at any time;
• Upon withdrawal of consent for promotional use, photographs already appearing in previously published materials will be removed to the extent reasonably possible, within [e.g. 15 business days].

11. Changes to this policy

We reserve the right to update this policy. Significant changes will be communicated to parents/legal representatives via [email/platform notification], at least [e.g. 15 days] before they take effect.