Privacy Policy

Privacy Policy — Virtus WIN

1. Who we are (data controller)

"Virtus WIN" (the "App") is a platform for matching athletes and booking court time. The service is available as a mobile app and as an app in the browser (https://app.virtus-win.com); this policy applies to both, and where they differ this is stated explicitly. The controller of personal data is:

Data protection contact: support@virtus-win.com · +381 63 619 090

2. What data we collect

We collect the following personal data:

• Identification data: first name, last name, email address, phone number
• Demographic data: gender, year of birth (also used for age verification — see section 10), sports level
• Location data: GPS coordinates and city name (with your consent; see section 9)
• Activity data: match requests, scheduled matches, game statistics, cancellation history and reliability score (see section 8)
• Technical data: device push notification token, platform (iOS/Android or browser); in the app in the browser also the sign-in cookie (see section 13)
• Billing data (clubs): business details required for invoicing (name, registered address, tax/registration number). We never see or store card details — the card is processed and tokenized by a certified payment processor; the card number is never available to us, and the CVV is not stored anywhere.
• Payment-related data (clubs): the IP address from which the payment was initiated and, if the payment processor provides it, the country of the card-issuing bank. These are collected only at the moment of payment and tied to that payment — we use them solely to verify that the club's registered-address details are accurate, so that the invoice and tax treatment are correct, and to prevent abuse.
• Communication content: messages you exchange with fellow players within a match (chat). They are visible only to the participants of that match; we do not use them for any analysis or advertising.
• Mutual player ratings: after a match, players may rate each other (stars and a level impression). A rating you receive is another player’s opinion of you and feeds into your aggregate display.
• Proof of acceptance of legal documents: document version, time of acceptance, IP address, the language you read the document in, and a cryptographic fingerprint of the exact text shown to you. This record is proof of what was accepted and when (see section 11).
• Server logs: our servers briefly record technical request data (IP address, time, requested address) for security and troubleshooting; logs rotate automatically and are not used for profiling. Our own error log may hold an account identifier (not a name) next to the technical description, so an error can be reproduced.
• Diagnostic error data: when the App encounters a technical error or closes unexpectedly, we collect a technical description of the error (error type, the screen where it occurred, App version, device type and model). These reports contain no personal data — they are deliberately configured not to send your name, email, location or IP address.

3. Purposes of processing

We use your data to:

• Match players based on location, level and availability
• Send notifications about matches and invitations
• Display a public player profile (to the extent you have approved)
• Produce statistics and reports (anonymised or with consent)
• Charge and invoice club subscriptions
• Calculate the reliability score and prevent abuse (see section 8)
• Detect and fix technical errors, for the stability and security of the App
• Verify that the club's registered-address details are accurate, for correct invoicing and tax treatment
• deliver messages between match participants (chat), display mutual ratings, and derive a level suggestion from results (see section 8)

Club news (direct communication). A club where you had a confirmed or played match in the last 12 months may send you news about its own offering and events through the App (e.g. a tournament, a change of opening hours). For that purpose we process only the fact that you played at that club; the sending frequency is limited. The legal basis is legitimate interest based on the existing relationship between the player and the club. You may object at any time, free of charge and without giving reasons (Art. 21 GDPR, Art. 37 of the Serbian Data Protection Act): by blocking the club in the App (news from that club stops) or by a request to support@virtus-win.com (news from all clubs stops). Once you object, no further news is sent to you — unconditionally.

4. Legal basis

Data is processed on the basis of:

• Contract (providing the App's services, charging the club subscription)
• Legitimate interest (security, abuse prevention, reliability score, error resolution)
• Legal obligation (accounting and tax records of payments; foreign-exchange regulations on the currency of payment)
• Your consent (location, push notifications, promotional offers)

5. Data sharing

We do not sell your data to third parties. Data is shared exclusively with:

• Sports clubs — when the system connects you with a club (a booking request or a confirmed match), the club sees the data needed to carry out the booking: your name and sports level (to the extent the club's plan allows), the selected time slot, and, once confirmed, contact details. Clubs may use this data solely to organise the booking and are bound to confidentiality by the Terms of Service. You can block a club at any time, which stops the sharing of your requests with that club.
• Technical providers (hosting, email, SMS, error tracking, payment processor) who process data on our behalf, under a data processing agreement and exclusively on our instructions

Clubs may act as independent controllers of the data they receive from you, in which case they are themselves obliged to comply with data protection regulations.

6. Transfers outside Serbia/EU

Some processors (e.g. the error-tracking tool, the payment processor) may process data outside Serbia/EU. In that case we ensure appropriate safeguards — transfer to a country with an adequate level of protection or standard contractual clauses.

The servers on which the data is stored are located in the European Union (Germany). The controller is established in the Republic of Serbia, which is not on the list of countries with a European Commission adequacy decision; for access to EU users' data from the controller's seat, appropriate safeguards (standard contractual clauses) are provided.

7. Your rights

You have the right to:

• Access your data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing and object to processing based on legitimate interest
• Data portability
• Withdraw consent at any time (without affecting processing carried out before withdrawal)

You do not need to ask us to delete your account — you do it yourself, in the App: Profile → Delete account, confirmed with your password. The account is deleted immediately, without our approval and without waiting. If you cannot access the App, instructions and a contact address are available at https://virtus-win.com/en/delete-account.html; such a request is handled within 30 days of receipt at the latest, after we verify your identity.

To exercise your other rights, contact us at: support@virtus-win.com

You may also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, or with the competent supervisory authority in the EU.

8. Automated decision-making and profiling (reliability score)

The App automatically calculates a reliability score based on your cancellation history. The score affects your visibility in lists and your priority in matching.

The App also derives a suggested adjustment of your sports level from the results of your played singles matches (at most half a level per step). The suggestion is applied by an administrator, and may also be applied automatically where that option is enabled — you always receive a notification with the old and new level, and every change is recorded. The level only affects who the App matches you with. If you believe your level is wrong, contact support@virtus-win.com — the change is reviewed by a person.

If automatic account restriction for excessive late cancellations is enabled, that is an automated decision which significantly affects you. In that case you have the right to request human intervention (a person reviews the decision), to express your point of view and circumstances, and to contest the decision.

You exercise these rights within the App itself: you receive a notification stating the reason (how many late cancellations were recorded and over what period they were counted), and on the restriction screen you can describe your circumstances and lodge an objection. A person reviews the decision and replies with an explanation. You can also contact us at support@virtus-win.com; an explanation of the score calculation logic is available on request.

9. Location

Location is collected only with your consent and only while the App is open (in the foreground), to display nearby clubs and players. It is read when you request it yourself (the 📍 button) and when you open a screen that needs it — the club list, the open-match board, or the form for a new request or a new ad — with a minimum interval between two readings, so the same position is not read repeatedly. The App does not track your location in the background or while it is closed. You can withdraw consent at any time in your device settings; all location reading then stops.

10. User age

The App is not intended for persons under 16 years of age. By registering you confirm that you are at least 16 years old; that confirmation is recorded together with your acceptance of the Terms of Service, with the version and time noted. If we learn that we have collected data of a person under 16, we delete it without delay. Juniors may participate through a club's or a parent's account.

11. Data retention

We keep your data while the account is active. When you delete your account in the App, personal data is removed immediately, not after some period — except where the law requires longer retention (see below). Some data has shorter retention periods — notifications and cancellation history are deleted within the periods indicated in the App.

When you delete your account, the messages you sent within matches and the ratings others gave you are deleted as well; ratings you gave to others remain (without your name), as they are part of another, active player’s aggregate.

The proof of acceptance of legal documents (section 2) is kept after account deletion for as long as a legal dispute about what was accepted remains possible — the basis is legitimate interest (provability), and the record is linked to the anonymised account without a name.

The account record is not removed from the database but anonymised: name, email, phone number, nickname, photo, year of birth and location are stripped from it. The reason is that invoices and payment records point to that record, and the law requires them to be kept for years — anonymisation keeps the documentation complete while it no longer identifies you. Matches and tournaments already played remain in the results without your name, because deleting them would change other players' results.

Payment documentation is subject to retention periods under the Law on Accounting, running from the last day of the business year: financial statements 20 years, journal and general ledger 10 years, accounting documents (including invoices) 5 years. While the statutory period runs, this data is not deleted on request — the basis is performance of a statutory obligation, not consent, so withdrawal of consent does not affect it.

The IP address and the card-issuer country are kept with the payment record they relate to, for as long as the payment documentation itself — because they serve as evidence that the currency of payment complied with foreign-exchange regulations. They are not used for any other purpose and are not linked to your activity in the App.

12. Error tracking and App stability

To detect and fix technical problems, we use an error-tracking tool that records when the App encounters an error or closes unexpectedly. That tool processes data on our behalf, as our processor, under a data processing agreement.

• What is sent: exclusively the technical context of the error (error type, the part of the App where it occurred, App version, device type and operating system).
• What is NOT sent: your name, email, phone number, location or IP address — the system is deliberately configured not to include personal data in error reports.
• Legal basis: legitimate interest (maintaining the stability and security of the service).
• Control: we can switch this feature off at any time; when it is off, no error report leaves our servers.

13. Cookies

The mobile app does not use cookies. The app in the browser (https://app.virtus-win.com) uses one strictly necessary sign-in cookie (__Host-vw_refresh; at most 30 days; deleted on sign-out) and keeps only the chosen language in the browser's local storage. The public website does not set any cookies. Neither the app nor the website uses analytics or advertising cookies, so cookie consent is not required. Details are in the Cookie Policy.

14. Language of this document

This document is drawn up in the Serbian language. Translations into other languages are provided for ease of understanding; in the event of any discrepancy between a translation and the Serbian text, the Serbian text shall prevail.