Privacy policy
Last updated: [TODO-JURIDIQUE : publication date]
This policy explains how Boxcore processes personal data across boxcore.io and app.boxcore.io, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
[TODO-JURIDIQUE : registered company name] , [TODO-JURIDIQUE : registered office address] .
Contact: support@boxcore.io
[TODO-JURIDIQUE : DPO contact details, if one has been appointed]
2. Data processed and purposes
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Organiser account creation and management | Email, hashed password, box name, language and theme preferences | Performance of the contract | Lifetime of the account, then [TODO-JURIDIQUE : retention period] |
| Competition registrations | Athlete identity, team, division, and any field requested by the organiser | Contract / organiser's legitimate interest | Duration of the event, then archived [TODO-JURIDIQUE : retention period] |
| Public leaderboard | Team or athlete name, division, scores | Legitimate interest: publication of sports results | Published while the public link remains active |
| Store orders | Name, contact details, items and sizes ordered | Contract concluded with the organiser | [TODO-JURIDIQUE : retention period] |
| Pass billing | Billing details, purchase history | Legal obligation | 10 years (accounting obligations) |
| Security and logging | IP address, connection timestamps | Legitimate interest: service security | [TODO-JURIDIQUE : retention period] |
3. Respective roles
Boxcore is the controller for its own account data.
For athlete, volunteer and buyer data collected through a competition, the organiser is the controller and Boxcore acts as a processor under Article 28 GDPR: it processes that data on the organiser's instructions and for no other purpose.
4. Recipients and processors
- The relevant competition organiser, for their participants' data.
- Hosting provider: [TODO-JURIDIQUE : name and country of hosting] .
- [TODO-JURIDIQUE : payment provider, if used for pass sales]
- [TODO-JURIDIQUE : analytics tool, if enabled — state the vendor and country]
No data is sold or shared for advertising purposes. [TODO-JURIDIQUE : describe any transfers outside the EU and the safeguards applied]
5. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability.
To exercise them: support@boxcore.io. You will receive a response within one month.
Where the data was collected by an organiser, your request will be forwarded to them as the responsible controller.
You may lodge a complaint with your supervisory authority. In France this is the CNIL: www.cnil.fr.
6. Cookies and local storage
Boxcore uses your browser's local storage for strictly necessary preferences: authentication session, language, and light/dark theme. These do not require prior consent.
[TODO-JURIDIQUE : if an analytics tool is enabled: describe the cookies, their lifetime and the consent mechanism]
7. Security
Traffic is encrypted over HTTPS and passwords are stored hashed. Access to production data is restricted to authorised personnel.
8. Changes
This policy may change. The last-updated date appears at the top of the page; account holders are notified of material changes.