PRIVACY POLICY

“S4S User” Mobile Application and “Stats4sport” Platform

1. General Provisions

1.1. This Privacy Policy explains how Stats4sport Aps filialas (hereinafter – the Seller, the Data Processor, and in certain cases the Data Controller) and organisations engaged in non-formal activities (hereinafter – the Organisations, acting as Data Controllers) process the personal data of users of the “S4S User” mobile application and the related “Stats4sport” platform (hereinafter – the Buyers, Users, or Data Subjects).

1.2. When processing personal data, the Seller and the Organisations comply with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
• the Law on Legal Protection of Personal Data of the Republic of Lithuania;
• other applicable legal acts.

1.3. By using the “S4S User” mobile application and/or the “Stats4sport” platform, the User confirms that they have read, understood and agree to this Privacy Policy.

2. Definitions

2.1. Seller / Data Processor – Stats4sport Aps filialas, legal entity code 304086416, registered address: Elbingo g. 55-1, LT-06285 Vilnius, email: ds@stats4sport.com, which develops, administers and owns the “S4S User” mobile application and the “Stats4sport” platform.

2.2. “S4S User” Mobile Application – an application that allows Users to log in to the Organisation whose services they use.

2.3. “Stats4sport” Platform – the administrative platform used by Organisations, integrated with the “S4S User” application, where the Users’ personal data are processed.

2.4. Organisation (Data Controller) – any organisation engaged in non-formal activities that has concluded a Service Usage Agreement with Stats4sport Aps filialas and processes personal data of its members.

2.5. Data Subject – a natural person who is a member of an Organisation, uses the services provided by the Organisation and the “S4S User” application / “Stats4sport” platform, and whose personal data are processed.

2.6. Other terms used in this Privacy Policy have the meanings defined in the GDPR and other applicable legal acts.

3. Categories of Personal Data and Purposes of Processing

3.1. Only personal data that are necessary for the functioning of the Organisation, for User identification, communication and service provision are collected, stored and processed in the “S4S User” application and “Stats4sport” platform.

3.2. Main purposes of personal data processing:

• carrying out and organising activities;
• identification and administration of Organisation members;
• communication with Users (messages, notifications about activities, services, updates);
• provision of services, payment administration and billing;
• ensuring technical access to the application and the platform;
• security, fraud prevention and service quality improvement.

3.3. Personal data processed may include, but are not limited to:

• name and surname;
• email address;
• password;
• profile picture;
• child’s name, surname, date of birth (where applicable);
• optional medical or health information (if required for activity organisation, safety or specific services);
• communication and notification data;
• device usage data as provided by App Store / Google Play default analytics;
• payment history and payment-related details;
• IP address, device identifiers;
• browsing and usage data related to the application and/or associated websites.

3.4. Data about underage children are collected only through their parents/guardians or coaches. Parents/guardians or coaches are responsible for the accuracy, legality and right to provide such data.

3.5. By providing medical or health information about a child, parents/guardians confirm that they have the legal right to do so and provide consent for the processing of such data. This information is processed only to the extent necessary for activity and safety purposes and is protected with appropriate safeguards.

4. Legal Grounds for Processing Personal Data

4.1. Personal data are processed on the following legal bases:

• Performance of a contract (GDPR Art. 6(1)(b)) – when data are necessary to conclude or perform a contract (e.g., use of the application, provision of services, payment processing).
• Legitimate interest (GDPR Art. 6(1)(f)) – ensuring proper service provision, system security, payment management, fraud prevention, dispute resolution.
• Legal obligation (GDPR Art. 6(1)(c)) – when processing is required to comply with legal obligations (e.g., accounting, tax requirements).
• Consent (GDPR Art. 6(1)(a)) – when specific data (e.g., certain health information) are processed only with explicit consent of the Data Subject or their legal representative.

5. Disclosure of Personal Data to Third Parties

5.1. User personal data may be transferred to the following recipients, only to the extent necessary for the provision of services and compliance with applicable legislation:

5.1.1. UAB BLUE EMI LT, legal entity code 305682465, address: Antano Tumėno g. 4, LT-01109 Vilnius, tel. +370 66440414, email: info@blueemi.com – acting as an authorised payment collection partner of the Seller.

5.1.2. UAB Paysera LT, legal entity code 300060819, address: Pilaitės pr. 16, LT-04352 Vilnius, email: help@paysera.com – a licensed electronic money institution supervised by the Bank of Lithuania (Licence No. 1, issued 2012-09-27), acting as a payment collection partner.

5.2. UAB BLUE EMI LT and UAB Paysera LT may act as authorised Data Processors on behalf of the Seller, or in certain cases as independent Data Controllers, in accordance with the GDPR and other applicable legislation.

5.3. User data are not disclosed to third parties without the User’s consent, except:

• when required by law or by lawful requests of law enforcement, supervisory or judicial authorities;
• when the disclosure is necessary for the performance of the contract or for the legitimate interests of the Seller or the Organisation, provided this does not override the rights of the Data Subject.

6. Data Retention and Deletion

6.1. Personal data are retained no longer than necessary to achieve the purposes specified in this Privacy Policy or as required by applicable laws.

6.2. User data stored in the “S4S User” application and the “Stats4sport” platform are generally retained for the duration of the Organisation’s contract with the Seller and up to 10 (ten) years from the date of receipt, unless a longer retention period is required by law.

6.3. User data are deleted from the “S4S User” application and the “Stats4sport” platform when:

• the Organisation discontinues the use of Stats4sport services – within 40 (forty) calendar days, unless legal requirements or the Data Controller’s instructions provide otherwise;
• legal retention periods expire;
• the Data Subject legally requests deletion and no other legal grounds for retention apply.

6.4. When a Buyer’s subscription expires, their access to the “S4S User” application may be terminated.

7. Login Data and Security

7.1. The Buyer must keep their login credentials secure and must not disclose them to third parties.

7.2. If login credentials are lost or suspected to have been disclosed to third parties, the Buyer must immediately inform the Organisation where they are registered as a Member.

7.3. The Seller implements appropriate technical and organisational measures to protect personal data from unlawful or accidental destruction, alteration, disclosure, as well as from any other unlawful processing.

8. Rights of the Data Subject

8.1. The Data Subject has the following rights under the GDPR:

• the right to access their personal data and obtain information about their processing;
• the right to request rectification of inaccurate or incomplete data;
• the right to request deletion of data (“right to be forgotten”) under the conditions set out in the GDPR;
• the right to restrict processing;
• the right to data portability;
• the right to withdraw consent at any time when processing is based on consent (withdrawal does not affect processing carried out prior to the withdrawal);
• the right to lodge a complaint with the State Data Protection Inspectorate or another supervisory authority.

8.2. The User understands and acknowledges that all matters related to services provided by the Organisation, activity organisation or membership must first be resolved directly with the Organisation of which the User is a Member.

9. Final Provisions

9.1. This Privacy Policy may be reviewed and updated to reflect changes in legal requirements, services or technological solutions. The updated version of the Privacy Policy is published in the application and/or on the website.

9.2. By continuing to use the “S4S User” application and the “Stats4sport” platform after the updated Privacy Policy becomes effective, the User confirms their agreement with the updated version.