Global Privacy Policy

This Privacy Policy applies to users of the platform, including viewers, players, coaches, and club administrators, and covers the website, web application, live match views, statistics features, and related support services.

In particular, CurlTrack Kft. acts as the primary platform operator and may act as an independent or joint controller for certain processing activities, MagiCom Kft. supports the technical operation and development of the platform and may act as an independent or joint controller for certain processing activities, and participating curling clubs typically act as controllers for player, roster, and competition data they upload or manage in connection with their own sporting activities.

Depending on the context, the platform operator, affiliated operating entities, and participating clubs may act as independent controllers, joint controllers, or processors. Clubs typically control player, roster, and competition data they upload or manage for their own sporting purposes, while the platform may process that data to provide the service and may also act as a controller for platform security, product analytics, aggregated insights, and service improvement.

A high-level summary of how responsibilities are allocated between clubs and the platform for key data processing activities may be made available in a separate controller/processor responsibility overview.

We may collect account data such as name, email address, login credentials, role, and club affiliation; match and performance data such as player name, team, match participation, shot-level events, scores, statistics, and derived analytics; technical data such as device information, logs, IP address, browser type, and cookie identifiers; and communications you send to us through support or contact channels.

We do not intentionally collect special categories of personal data (such as health data, political opinions, or religious beliefs) through the platform.

We use personal data to provide the service, manage accounts and permissions, display live match data and statistics, allow players to review their own performance, allow coaches and club administrators to access data relevant to their teams, protect the platform, prevent abuse, comply with legal obligations, and communicate operational notices.

We may also use de-identified, pseudonymized, or aggregated data to improve the platform, develop analytics, train and validate models, produce benchmarking insights, and support commercial analytics offerings, provided those outputs do not identify individual players.

Where such analytics or models are based on personal data rather than fully anonymised data, they are generally processed on the basis of our legitimate interests in improving and securing the service, subject to appropriate safeguards and your right to object to such processing where applicable.

Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and we document this assessment as required by applicable law.

Where GDPR or similar laws apply, we rely on one or more of the following legal bases: performance of a contract, legitimate interests, compliance with legal obligations, and consent where required.

Core service functions, including account administration, match tracking, team access controls, player review tools, and coach-facing analysis, are generally provided on a contract and/or legitimate interests basis rather than consent.

Consent is generally reserved for optional functions such as marketing communications, non-essential cookies, and clearly optional public-sharing or promotional features.

Privacy is designed to be role-based. Players may access their own detailed data. Coaches and club administrators may access player data relevant to their own teams or clubs, subject to permissions. Public-facing users generally see only the data intentionally made available through the service.

If the service is used in connection with minors, additional safeguards may apply, including parental or guardian authorization where required by applicable law or club process. Clubs remain responsible for ensuring that they have an appropriate legal basis to submit or manage youth athlete data through the platform.

In jurisdictions where parental or guardian consent is required for information society services, the platform will provide technical means to support clubs and parents in meeting these requirements (for example, parental approval flows or confirmation emails), but clubs remain responsible for ensuring that such consent is valid under applicable law.

If the service is used in connection with minors, additional safeguards may apply, including parental or guardian authorisation where required by applicable law or club process. The platform may provide technical means to support clubs and parents in giving or managing such consent (for example, parental approval flows or confirmation emails), but clubs remain responsible for ensuring that they have an appropriate legal basis to submit or manage youth athlete data and that any required consent is valid under applicable law. Where EU law requires parental consent for information society services, we apply the age threshold that applies in the user’s country of residence (for example, between 13 and 16 years).

We use cookies and similar technologies for authentication, security, preferences, and analytics. Strictly necessary cookies are required to run CurlTrack; optional analytics cookies help us understand site usage and improve the platform.

Where required by applicable law, non-essential cookies are used only with your consent. You can accept or reject non-essential cookies through the cookie banner.

We retain personal data for as long as reasonably necessary to provide the service, maintain legitimate sporting and business records, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods may vary by data type, user role, club relationship, and applicable law. For certain operational, security, support and analytics records processed on the basis of our legitimate interests, we apply a general maximum retention period of 12 months, after which the data is deleted or irreversibly anonymised, unless a longer period is required by law or necessary for the establishment, exercise or defence of legal claims. Where appropriate, data may be deleted, anonymized, or de-identified after the active service relationship ends

Upon erasure request, personal identifiers are deleted. Match and performance data may be retained in anonymised form for statistical and sporting archive purposes under Art. 17(3) GDPR.

Because the platform may operate across the EU, Canada, and the United States, personal data may be transferred internationally. Where required, such transfers are made using lawful transfer mechanisms and appropriate safeguards, including adequacy decisions, contractual safeguards, or other recognized legal mechanisms.

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent where consent is the legal basis. California residents may also have rights relating to categories of personal information and certain opt-out rights under applicable state law, and Canadian users may request access to and correction of their personal information under applicable privacy laws.

This right to object applies in particular to processing carried out on the basis of legitimate interests, including the use of personal data for analytics or for training and validating models.

The platform does not sell personal data in the ordinary sense of selling user lists.

Where applicable U.S. state law (such as the California Consumer Privacy Act as amended by the CPRA) treats certain disclosures as a “sale” or “sharing” of personal information, we will provide a Notice at Collection and a clear “Do Not Sell or Share My Personal Information” link Do Not Sell or Share My Personal Information or equivalent opt-out mechanism as required.

We use reasonable technical and organizational measures designed to protect personal data, including access controls, logging, role-based permissions, and other security safeguards appropriate to the nature of the platform.

Personal data may be stored in digital systems and, in limited cases (for example, printed reports or administrative records), in physical form. Where we use physical records, we apply appropriate safeguards such as access controls and secure destruction of documents when no longer needed.

Users may contact the platform through the designated privacy contact channel (info@curltrack.com) for privacy requests, questions, or complaints. A single privacy request workflow may be used globally, with rights handled according to the law that applies to the requesting user.

For Canadian residents, we designate an individual or role responsible for overseeing our compliance with applicable Canadian privacy laws, who can be contacted through the same privacy contact channel or at the dedicated contact details provided on the platform.

This Privacy Policy may be updated from time to time to reflect product changes, legal developments, or operational needs. The latest version will be posted on the platform with its effective date.