Version of October 29, 2026
The controller of the personal data of Users of the Ranfano service (ranfano.pl) is Wojciech Waśniowski, Bochnia, Poland. Contact regarding personal data matters: kontakt@ranfano.pl.
Account data: email address, first and last name, phone number, optionally a profile picture, and interface language.
Competition data: sign-ups for leagues and tournaments, match results, standings, rankings and sporting statistics.
Player fee records: amounts and statuses of entry fees charged by the Club. The Service does not process Players’ payment data (card or account numbers) — Players pay entry fees to the Club outside the Service.
Club billing data: Subscription orders (Plan, period, amount, order and transaction number), the content of the consents and declarations given when ordering (including whether the Club orders as a Consumer), together with the date and version of the Terms of Service, and the details shown on the receipt (the Club’s name and address, the owner’s first and last name, the Club’s tax identification number (NIP), if provided). For online payments we do not receive the payer’s card or bank account details — they are processed by the payment operator. For a traditional bank transfer we receive the sender’s details from the bank statement (name, account number).
Technical data: IP address and server logs related to the security of the service.
We count visits to club pages, signed-in players' visits to their own tournaments and leagues in "My matches", and visits to the Service's general pages – the home page, pricing, the terms of service and this privacy policy – as well as use of the FAQ section (reaching it and opening a question). Clubs see their statistics, and the numbers show us which information people need. To tell unique visits apart, we use a hash – of the account's e-mail address for signed-in users, of the IP address and browser data for everyone else – computed with a random key that changes every day. We delete the key and the hashes after one day and keep only the total number of visits. The legal basis is our legitimate interest (Article 6(1)(f) GDPR). We do not use cookies for this.
In the club panel we record help searches that returned no results and ratings of instructions (“Helpful” / “Not helpful”): the searched phrase, the club, the place in the panel and the date, without linking them to a user account. We use them to improve the help. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).
Managing accounts and administering competitions — Article 6(1)(b) GDPR (performance of a contract).
Concluding and performing the Subscription contract, including handling payments, refunds and complaints — Article 6(1)(b) GDPR.
Sending emails related to the account and the Subscription (address verification, password reset, invitation to take over club management, order confirmation with receipt, notice of the end of the paid period) — Article 6(1)(b) and (f) GDPR.
Ensuring the security of the Service, including logs and abuse prevention — Article 6(1)(f) GDPR (legitimate interest).
Establishing and pursuing claims and fulfilling statutory obligations — Article 6(1)(f) and (c) GDPR.
Storing receipts and billing documents — Article 6(1)(c) GDPR (obligations under tax law).
Competitions are sporting in nature — standings, match results and rankings, together with the Player’s first and last name, are publicly visible on club pages within the Service, including to users who are not logged in.
The profile picture is publicly visible only if the Player enables this option in their profile settings.
Infrastructure providers: Railway Corporation (application, database and stored-file servers — European Union region, Amsterdam), Vercel Inc. (frontend layer hosting) and Cloudflare, Inc. (storage of encrypted database backups in the European Union, and protection of forms against bots — Cloudflare Turnstile).
Email service provider: OVH SAS (European Union) — for the purpose of sending transactional messages.
Functional Software, Inc. (Sentry) — application error reports: technical data about the event, including the IP address, the browser and the page address, on servers in the European Union.
Clubs whose competitions the Player signs up for — to the extent necessary to manage sign-ups, competitions and fee records.
Autopay S.A., based in Sopot — the online payment operator, to the extent necessary to process payment for the Subscription: the payer’s email address, the amount, the order description and number, and the IP address. With respect to the payment itself, Autopay S.A. is a separate data controller and processes the data in accordance with its own privacy policy.
Railway, Vercel, Cloudflare and Sentry are companies based in the United States. We keep the database, stored files, encrypted database backups and error reports in the European Union, but use of these providers’ services may involve the transfer of data to the United States. Such transfers take place on the basis of mechanisms provided for under the GDPR — an adequacy decision (the Data Privacy Framework) or standard contractual clauses.
Account data — for as long as the account exists within the Service.
Competition results — indefinitely, as part of the sporting archive; after account deletion, the Player may request that data in the archive be restricted or anonymized.
Technical logs — up to 12 months.
Backups — data deleted from the Service may remain in backups: database backups for up to 35 days, backups of stored files (photos, logos) for up to 3 months. Backups serve only to restore the Service after a failure.
Player fee records — for as long as the Club exists in the Service.
Receipts, orders, consents and declarations given when ordering and bank transfer payment details — 5 years from the end of the calendar year in which the receipt was issued.
Help searches in the club panel and instruction ratings — 90 days.
You have the right to access your data, to rectify it, to have it deleted, to restrict its processing, to data portability, and to object to processing based on legitimate interest.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (uodo.gov.pl).
The Service uses only cookies necessary for its operation: session and authentication cookies (httpOnly) and cookies that remember the interface language.
The Service does not use advertising or analytics cookies.
Providing your data is voluntary but necessary to create an account and take part in competitions.
We will announce any changes to this Policy within the Service. The current version is always available at ranfano.pl/polityka-prywatnosci.