Zaloguj się

Privacy Policy of the Student Open service

effective from 13 October 2026

This is an English translation. In the event of any discrepancy, the Polish version prevails. Wersja polska

§ 1. General provisions

  1. This privacy policy sets out the rules for processing the personal data of users of the Student Open website, available at https://studentopen.pl, and of the StudentOpen mobile application for iOS and Android (together: the “Application”).
  2. The controller of personal data is Free Construction spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Warsaw, ul. Złota 7 lok. 28, 00-019 Warszawa, entered in the register of entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under KRS number 0000290444, NIP (tax identification number) 5272561169, REGON 141105698 (the “Controller”).
  3. In all matters relating to the processing of personal data, the Controller can be contacted at the e-mail address: info@studentopen.pl.
  4. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and with Polish law.

§ 2. Processing principles

  1. The Controller uses personal data solely to operate the Application, in particular to maintain user accounts, handle registrations for tournaments and leagues, run matches, keep results and the ranking, handle payments, run the Community and the OpenPoints loyalty programme, and send related notifications.
  2. The Controller does not sell personal data, does not share them with other entities for marketing purposes and does not use them to display advertisements or for any other purposes unrelated to the Application.
  3. The Application does not use analytics or advertising tools that track users’ activity on the internet.

§ 3. Scope of data processed

  1. The Controller processes the following categories of data:
    1. account data: e-mail address, first name and surname or display name and, if provided by the user, also gender, phone number, university name, selected language and e-mail and push notification settings, as well as the date of acceptance of the privacy policy;
    2. data on participation in tournaments and leagues: registrations and their status (including the place on the waiting list), partners in pairs and pair invitations, an entry on the “Looking for a partner” board, match results, confirmation of attendance at the tournament, payment status, entitlement to free participation in a league, notes to the registration and tournament reviews;
    3. the player’s level on a scale from 0 to 7, calculated automatically on the basis of match results, together with its history, statistics and ranking position;
    4. information about followed clubs and players, blocked players, and posts and clubs hidden by the user in the Community;
    5. content published in the Community: posts, photos attached to them and likes;
    6. OpenPoints loyalty programme data: events for which points were awarded (for example attendance at a tournament, matches played, a tournament review, completing the profile), the points balance and history, including adjustments made by the Controller, the programme tier, and rewards and coupons redeemed together with their status, date of issue and date of use;
    7. messages in the notification inbox in the Application, including messages from tournament organisers and information about points and coupons, together with information on whether they have been read;
    8. reports of profiles and posts: the reason, description, an excerpt of the reported content, the reporting person and the reported person;
    9. payment data: amount, status and transaction identifiers;
    10. technical data: date of last login, device tokens used to send push notifications together with the operating system (iOS or Android) and the date of last use, a log of e-mails and push notifications sent, and data recorded automatically by servers, such as IP address, browser type and time of request.
  2. Gender is needed only for tournaments played in mixed formats or divided into women and men.
  3. If the user’s e-mail address belongs to the domain of a university known to the Application, the name of that university may be filled in automatically in the profile. The user can change or remove it in the profile settings.
  4. Photos added to the Application are processed on the server before being stored: they are cropped, resized and stripped of metadata, including data on the place where the photo was taken (GPS).
  5. The Controller has no access to payment card data and does not store them. The user provides such data directly to the payment operator.
  6. When registering a partner or guest for a tournament, the user provides that person’s first name, surname and e-mail address and should do so only with that person’s consent. An invitation or registration confirmation is sent to the address provided.
  7. If a person’s data were provided by another user who registered them as a partner or guest, the source of those data is that user. The provisions of this policy apply to such a person accordingly.

§ 4. Purposes and legal bases of processing

  1. Personal data are processed for the purpose of:
    1. creating and maintaining the account and enabling login, on the basis of Article 6(1)(b) GDPR (performance of a contract for the provision of services by electronic means);
    2. handling registrations for tournaments and leagues, forming pairs, maintaining the waiting list and the “Looking for a partner” board, confirming attendance, running matches and keeping results, on the basis of Article 6(1)(b) GDPR;
    3. calculating the player’s level and keeping statistics and the ranking, on the basis of Article 6(1)(b) GDPR;
    4. sending e-mails, push notifications and notification inbox entries concerning the user’s registrations and matches, including confirmations, reminders, offers of a place from the waiting list, information about a match to be played, a result to be confirmed, the end of a tournament, a change of level, points and coupons, information about a tournament cancellation and requests for a review, on the basis of Article 6(1)(b) GDPR;
    5. delivering organisational messages from the tournament organiser to tournament participants, on the basis of Article 6(1)(b) GDPR and, with respect to partners and guests without an account, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in providing participants with information about the tournament;
    6. running the Community, including publishing posts and photos and likes, on the basis of Article 6(1)(b) GDPR;
    7. running the OpenPoints programme, including awarding points, exchanging points for rewards and redeeming coupons, on the basis of Article 6(1)(b) GDPR;
    8. handling online payments for participation in tournaments and leagues sold by the Controller, and refunds, on the basis of Article 6(1)(b) GDPR and, to the extent required by tax and accounting laws, on the basis of Article 6(1)(c) GDPR;
    9. providing the club where a tournament or league round is played with information about participants to the extent set out in § 6(3), on the basis of Article 6(1)(b) GDPR;
    10. sending an invitation or registration confirmation to a partner or guest, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in enabling registrations in pairs and with guests;
    11. automatically filling in the university name on the basis of the e-mail address domain, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in making it easier to complete the profile;
    12. handling reports and blocks and moderating content, including removing content and accounts that violate the rules for using the Application, on the basis of Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in ensuring the safety of users;
    13. ensuring the security of the Application, preventing abuse and establishing, exercising or defending legal claims, on the basis of Article 6(1)(f) GDPR.
  2. Providing an e-mail address and first name and surname is necessary to create an account and register for tournaments. Providing other data is voluntary, except that without specifying gender it is not possible to register for a tournament that requires it.
  3. The user can turn off tournament e-mail notifications and push notifications in the profile settings, and push notifications also in the phone settings. Messages necessary to use the account, including messages with a login code, and entries in the notification inbox in the Application cannot be turned off.
  4. Messages from the organiser are purely organisational, contain no advertising or promotional content and concern only a tournament for which the user is registered (including on the waiting list). The organiser may send them from the publication of the tournament until 7 days after it ends, no more than 3 per day and 10 per tournament. A message is delivered to the notification inbox and as a push notification and, if the organiser so decides, also by e-mail, subject to the settings referred to in section 3.
  5. The player’s level is calculated automatically, and a tournament organiser may restrict participation in a tournament to players of a certain level. OpenPoints are awarded automatically according to fixed rules described in the Application. The Controller does not make decisions concerning users based solely on automated processing that produce legal effects concerning them or similarly significantly affect them. A user who believes that their level or points balance has been calculated incorrectly may report this to the Controller.

§ 5. Data visible to other people

  1. Due to the nature of the Application, some data are visible to other people.
  2. The following are visible publicly, including to people who are not logged in: first name and the first letter of the surname or display name, university name, the player’s level and its history, statistics, results, ranking position, participation in public tournaments, the player’s posts in the Community together with photos, and an entry on the “Looking for a partner” board together with the level, university name and tournament. Logged-in users see the full first name and surname. Results may also be displayed on screens at the tournament venue.
  3. A player may publish posts in the Community only under a tournament in which they played, during the tournament and up to 14 days after it. The number of likes is shown next to a post, without indicating who liked it. A post may be deleted by its author, the Controller and the staff of the club to which the post or tournament relates.
  4. Tournament organisers, i.e. the club and the people running the tournament, have access to participants’ data to the extent necessary to run it, including payment and attendance status and, where it is necessary to contact participants about the tournament, also contact details. For messages sent, the organiser sees the number of recipients and the percentage of people who have read them, without indicating who specifically read them.
  5. When a reward coupon is redeemed, the club staff see the player’s first name and surname (or, if the player has not provided them, the beginning of their e-mail address), the name and terms of the reward and the date the coupon was issued. The club also sees aggregate statistics of coupons issued and redeemed. The points balance and history are visible only to the user and the Controller. Reward sponsors do not receive data of the people who redeemed the rewards.
  6. A user may block another player. A block works both ways: blocked players do not see each other in the player search, on the “Looking for a partner” board or in Community posts, cannot send each other pair invitations, and pending invitations between them are cancelled. The blocked person is not notified of the block.
  7. A user may report a profile or post that violates the rules. The report, together with the data of the reporting person, goes only to the Controller, by e-mail and to the administration panel. The reported person is not informed of the identity of the reporting person. A reported post is no longer visible to the person who reported it. The Controller may remove content or an account that violates the rules; deletion of an account by the Controller has the same effects as deletion of an account by the user (§ 7(2)).
  8. The user’s e-mail address and phone number are not made public. Player profiles are not indexed by internet search engines.

§ 6. Recipients of data

  1. Except in the cases described in sections 2 and 3, the Controller does not transfer personal data to other entities for their own purposes. Data may be entrusted only to entities without which the Application could not operate, namely:
    1. providers of hosting and IT infrastructure services on whose servers the Application runs and the data are stored;
    2. the provider of the e-mail service through which messages from the Application are sent;
    3. the provider of the push notification service, which delivers notifications to devices through the notification services of Apple (iOS) and Google (Android); the device token and the title and content of the notification are transferred;
    4. the online payment operator handling online payments for participation in tournaments, which acts as a separate controller with respect to processing payments.
  2. Tournament organisers and clubs also have access to data to the extent set out in § 5(4) and (5).
  3. The Controller provides the club where a tournament or league round is played with information on which people take part in it: the participant’s first name, surname and e-mail address and, for a league, also the group, round, date of play and information on whether participation has been paid for. These data are provided in order to run the tournament or league and to enable the club to provide services included in the fee, for example additional games on the club’s courts.
  4. The entities referred to in section 1 points 1–3 process data on the basis of data processing agreements, only on the Controller’s instructions and for the purpose of providing services to the Controller.
  5. If, in connection with the use of the services of these entities, data are transferred outside the European Economic Area, this takes place on the basis of a European Commission decision finding an adequate level of protection or standard contractual clauses approved by the European Commission. A copy of the safeguards applied can be obtained by contacting the Controller.
  6. Data may be disclosed to public authorities if such an obligation results from the law.

§ 7. Data retention period

  1. Account data are stored until the account is deleted.
  2. After an account is deleted, regardless of whether it was deleted by the user or by the Controller:
    1. registrations for upcoming tournaments are cancelled and login sessions on all devices expire;
    2. the user’s first name and surname in the results of tournaments already played and in the ranking are replaced with an anonymous label, so as not to distort the results of other players;
    3. profile data, level history, information about followed clubs and players, blocks, device tokens, points, coupons, notification inbox entries and likes are deleted;
    4. Community posts and tournament reviews remain without a link to the account and without the author’s first name and surname;
    5. payment data are stored for the period specified in section 4.
  3. Community posts are stored until they are deleted by the author, the club or the Controller.
  4. Payment data are stored for the period required by tax and accounting laws, as a rule for 5 years from the end of the year in which the payment was made.
  5. Data of partners and guests without an account are stored until the tournament has ended and been settled, and then for 12 months.
  6. The history of points and coupons is stored until the account is deleted. A coupon not used within its validity period expires and the points are returned to the user’s account.
  7. Notification inbox entries are deleted after 90 days.
  8. A device token is deleted after logout, after the mobile application is uninstalled (when the notification service reports that the device is no longer registered) and after the account is deleted.
  9. The log of messages sent, technical data and resolved reports of profiles and posts are stored for no longer than 12 months.
  10. Notwithstanding the above, data may be stored until the limitation period for claims expires, if this is necessary to establish, exercise or defend them.

§ 8. Rights of data subjects

  1. Every data subject has the right to:
    1. access their data and obtain a copy of them;
    2. rectify their data, whereby most data can be changed by the user in the profile settings;
    3. erasure of their data;
    4. restriction of processing;
    5. data portability;
    6. object to the processing of data on the basis of the Controller’s legitimate interest.
  2. The user may delete the account at any time in the profile settings, on the website or in the mobile application. The effects of deleting the account are set out in § 7(2).
  3. To exercise other rights or to delete the account through the Controller, please contact the Controller at info@studentopen.pl. The Controller responds without undue delay and in any event within one month of receiving the request.
  4. Every data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warszawa).

§ 9. Cookies and device storage

  1. The Application uses only cookies and device storage mechanisms that are necessary for it to function, namely:
    1. a session cookie that keeps the user logged in;
    2. a cookie that remembers the selected language;
    3. browser storage that allows the Application to be used with a weak internet connection, for example entering results without network access;
    4. in the mobile application: a login token and a push notification token stored in the device’s secure storage.
  2. The Application does not use analytics, advertising or tracking cookies.
  3. Since the mechanisms used are necessary to provide the service, their use does not require the user’s consent. The user can delete them in the browser settings, which will log them out of the Application.

§ 10. Mobile application permissions

  1. The mobile application may request access to:
    1. the camera, solely to scan QR codes on tickets at the tournament entrance and, by club staff, on reward coupons; the camera image is analysed on the device and is neither stored nor transmitted;
    2. photos on the phone, solely to select a photo the user wants to add to a Community post and, for organisers and clubs, also a tournament cover, a message image or a reward photo; only the photo selected by the user is uploaded to the server;
    3. notifications, in order to display push notifications; once permission is granted, the notification service assigns the device a token, which the Application stores on the server and links to the user’s account.
  2. A tournament is added to a calendar by opening a link to the calendar chosen by the user. The Application does not request access to the phone’s calendar and does not read events stored in it.
  3. If the user shares a result graphic in another application, for example on a social network, the data are transferred to the application chosen by the user and are subject to its rules.
  4. The user may withdraw the permissions granted at any time in the phone settings.

§ 11. Data security

  1. The Controller applies technical and organisational measures appropriate to the risk, in particular encrypted connections (HTTPS), passwordless login using one-time codes sent by e-mail with a limited number of attempts, restricting access to data to people who need it, and separating the Application’s data in the database.

§ 12. Changes to the privacy policy

  1. The Controller may change this privacy policy. The new version is published in the Application together with the date from which it applies.
  2. The Controller informs registered users of material changes by e-mail or by a message in the Application.
  3. The privacy policy is also available in an English language version. In the event of discrepancies between the versions, the Polish version prevails.

Pytania o dane osobowe: info@studentopen.pl