Privacy policy

1. Controller

Jalgpalliklubi FC Ararat Jalgpallikool, registry code 80645892, Tallinn, Estonia. Contact: portal@fcararat.ee.

2. Who the portal is for

The portal is closed and intended for parents of FC Ararat players. Access is granted only if the parent's e-mail address is in the child's club record and the parent has given consent. There is no public sign-up.

3. What data we process

Sign-in data: e-mail address; when you sign in with Google, also your Google account ID, name and profile picture URL (we request only the openid, email and profile scopes from Google); session data (session identifier and expiry).

Club data from the club's register: the child's name, club reference number, family reference number, training group, active status and parental consent (with date), parents' e-mail addresses, tournament participation (answer, days, code), fee and payment status.

The parent's answer to a tournament: taking part or not, days of participation, type of reason for not taking part (family holiday, health reasons or other reason), transport (own transport, arranged with other parents, needs help with transport, or offers free seats and how many), optional additional information for the coach, time of the answer and the e-mail of the parent who answered. The answer is saved in the club register spreadsheet.

The reason "health reasons" is health data. We ask only for the type of reason, not for a diagnosis or other details; health details should not be written in the additional information field.

The portal does not process national identification numbers or dates of birth.

4. How we use the data

To sign you in and to show you your own child's information: the group's tournaments, squads and your child's participation status.

To send a one-time sign-in link by e-mail.

To keep the portal secure (sessions, error logs).

We do not use the data for advertising or profiling and we do not sell it. The portal has no analytics or advertising cookies.

5. Legal basis

General Data Protection Regulation (GDPR) Art. 6(1)(b) — performance of the training agreement (tournament information and fees), and Art. 6(1)(a) — the parent's consent to use the portal and to show the child's data in it. Consent can be withdrawn at any time by writing to portal@fcararat.ee or to the child's coach.

The legal basis for processing the reason "health reasons" is GDPR Art. 9(2)(a): the parent's explicit consent, given by choosing that reason. "Other reason" can always be chosen instead.

6. Who can see the data

A parent sees only the data of children in their own family. In a group's squad list, other parents of the same group see the child's name, squad code, answer status (confirmed / not taking part / awaiting answer) and transport note (needs help with transport, or offers free seats and how many). Fees, payments and other data are never shown to other parents.

The reason for not taking part and the additional information for the coach are visible only to the child's parents and to the club's coaches and administrator.

Access rights are checked on the server for every request.

7. Processors and data location

Hetzner Online GmbH — server and database, data centre in Helsinki (Finland, EU).

Google (Google Workspace and Google Cloud) — sign-in with a Google account, sending e-mails, and the club register spreadsheet the portal reads from.

Data is not transferred outside the European Economic Area, except for Google services, which are covered by Google's data processing terms and the EU Standard Contractual Clauses.

8. Google user data

When you sign in with Google, we receive only your e-mail address, name, profile picture URL and account ID. We use them only to sign you in and identify you in the portal. We do not read your e-mail, calendar or files, and we do not share Google user data with third parties.

The portal's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Cookies

The portal uses only strictly necessary cookies: the sign-in session and the selected language. No consent is asked for them because the portal cannot work without them.

10. Retention

A session lasts up to 30 days or until you sign out. A sign-in link is valid for 15 minutes and works once.

Club data is updated regularly from the club's register. If the child leaves the club or consent is withdrawn, access ends immediately and the data is removed from the portal at the next update.

Your user account (e-mail, name, Google account ID) is deleted on request and no later than 12 months after access ends.

11. Your rights

You have the right to access your data, have it corrected or erased, restrict or object to its processing, and withdraw consent. Write to portal@fcararat.ee.

You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

12. Changes

If this policy changes, we will publish the new version on this page with its effective date.