This notice sets out how the ASCoT Club app and the website at ascot1992.club process your personal data. It applies to all members of ASCoT Club since 1992 ASBL.
1. Who we are
The data controller is ASCoT Club since 1992 ASBL, a Luxembourg non-profit association (ASBL) registered at 16A Boulevard de la Foire, 1528 Luxembourg, Grand Duchy of Luxembourg (“the Club”, “we”, “us”).
For any privacy or membership question: appscot92@ascot1992.club.
We are responsible for your personal data under Regulation (EU) 2016/679 (“GDPR”) and any equivalent provisions under Luxembourg, Monégasque, or other applicable EU member-state law.
2. What we collect
We collect only the data needed to run the club:

• Identity & profile: salutation, first and last name, date of birth, gender, profile photo, citizenship(s), tennis level, current team, previous teams

• Contact: email address, mobile number (with country code), city and country of residence

• Membership lifecycle: application status, proposer details, admin notes on your application

• Authentication: login credentials handled by Firebase Authentication, session tokens, biometric opt-in flag (the biometric template itself never leaves your device)

• App usage: device push token, push-notification preferences, last-seen timestamps

• Match data: scores, encounters, leaderboard standings, captaincy assignments

We do not collect special-category data (health, religion, ethnicity, political views, sexual orientation, biometric identification, trade union membership).
3. Why we collect it (lawful bases)

• Operating the app and processing membership applications — performance of a contract (Art. 6(1)(b)).

• Authentication and account security — performance of a contract and legitimate interests (Art. 6(1)(f)).

• Sending tournament, schedule and news notifications — consent (Art. 6(1)(a)), withdrawable at any time.

• Anti-fraud, abuse prevention and audit logs — legitimate interests (Art. 6(1)(f)).

• Tax, accounting and regulatory record-keeping — legal obligation (Art. 6(1)(c)).

4. Where your data is stored
Your personal data is stored in the European Economic Area, specifically:

• Google Ireland Limited (Firebase) — authentication, database, storage and messaging — Frankfurt, Germany.

• Brevo (Sendinblue SA) — transactional email delivery — Paris, France.

• Hetzner Online GmbH — backend application server and database — Germany.

• STRATO AG — domain registration and DNS — Germany.

One processor operates outside the EEA: Twilio Inc. (United States) receives your mobile number for the sole purpose of sending and checking the SMS code when you verify your phone. Nothing else is shared with Twilio, and a verified mobile number is required to use the app.
Each processor is bound by GDPR-compliant data-processing agreements. The transfer to Twilio is covered by the European Commission’s Standard Contractual Clauses. Apart from that transfer, your data is not routinely sent outside the EEA.
5. How long we keep it

• Active membership: for the duration of your membership.

• Lapsed members: up to 12 months after membership ends, then anonymised or deleted.

• Rejected applications: 6 months from the rejection date, then deleted.

• Audit logs and financial records: as required by Luxembourg accounting and tax law (currently 10 years for accounting records).

• Backup snapshots: rolled off within 35 days of the last live record being deleted.

6. Your rights under GDPR
You have the right to:

• Access your personal data and receive a copy in a portable format.

• Rectify inaccurate information (most fields are editable in the app’s profile screen).

• Erase your account and all associated data — use Profile → Delete account in the app, or email appscot92@ascot1992.club.

• Restrict or object to specific processing.

• Withdraw consent for push notifications at any time via Profile → Notifications.

• Lodge a complaint with a supervisory authority — for Luxembourg, the CNPD (cnpd.lu); for Monaco residents, the CCIN (ccin.mc).

We respond to written requests within 30 days as required by GDPR Art. 12(3).
7. Security and breach notification
We use HTTPS/TLS in transit, encrypted storage at rest, platform keychain/keystore for tokens, two-factor authentication for administrative accounts, and limit access to personal data to authorised club administrators.
In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, notify you directly without undue delay (GDPR Art. 33–34).
8. Children
The app is not intended for users under 13. We do not knowingly collect data from children under 13. Members aged 13–17 are accepted only with the consent of a parent or guardian.
9. Cookies and tracking on the website
The ascot1992.club website uses only essential cookies needed for site functionality. We do not place advertising or cross-site tracking cookies.
10. Changes to this notice
We may update this page from time to time. Material changes will be highlighted at the top of this page and surfaced in the app on next launch. Continued use of the app or website after such notice constitutes acceptance.
ASCoT Club since 1992 ASBL · 16A Boulevard de la Foire, 1528 Luxembourg
Contact: appscot92@ascot1992.club