Privacy Policy
Last updated: 11 August 2026
This policy is a starting template for the tournament operator running this PickleBoard
instance. Text shown like [THIS] must be completed and the
whole document reviewed by the operator (and their legal adviser) before it is relied upon.
It is not legal advice.
This policy explains what personal data [CONTROLLER LEGAL NAME]
(“we”, “us”), the operator of this PickleBoard tournament service, collects about you, why we
collect it, how we protect it, and the rights you have over it. We are the data controller for
that information.
Who we are
- Controller: [CONTROLLER LEGAL NAME & REGISTERED ADDRESS]
- Contact for privacy questions: [PRIVACY / DPO CONTACT EMAIL]
- Governing jurisdiction: [JURISDICTION — e.g. England & Wales]
What we collect
- Account details you give us when you register: your first and last name,
email address (which is your login), and a password (stored only as a salted hash — we never
store it in readable form).
- Optional details you choose to add: your DUPR ID, a display name, a profile
photo and a short biography.
- Match data generated when you play in a tournament run on this service:
the teams, scores, results, timings and standings. This is competition data and is shown
publicly as part of running and broadcasting the event.
- Technical data needed to operate the service securely: your session cookie,
and limited server logs (including your IP address and the actions you take) kept for security,
dispute resolution and audit.
Why we use it, and our lawful basis
- To create and secure your account and sign you in — performance of a contract with you.
- To personalise your view (showing your own matches, standings and history) — your
consent, and our legitimate interest in a useful player experience.
- To run, display and broadcast the tournament, including public scoreboards, brackets,
leaderboards and commentary — legitimate interest in operating the event you are
taking part in.
- To send you account emails (confirm your address, reset your password) — performance of
a contract and consent.
- To keep the service secure and resolve scoring disputes — legitimate interest and,
where applicable, legal obligation.
Public information vs. private information
We deliberately separate the two:
- Public — your display name, profile photo, biography and your match results
and statistics. These may be shown on player pages, overlays and broadcasts. Don’t put
anything in your display name, photo or bio that you don’t want shown publicly.
- Private — your email address, your DUPR ID and your legal first/last name.
These are visible only to you and to tournament organisers whose role grants access, and
every time an organiser views your protected details it is recorded in our audit
log.
Who we share it with
- We do not sell your personal data.
- Public match data is, by design, visible to anyone viewing the tournament.
- We use service providers only to operate the service — for example an email provider to
send account emails ([EMAIL / SMTP PROVIDER]) and our hosting
provider ([HOSTING PROVIDER]). They process data on our
instructions.
- If you add your DUPR ID, results may be submitted to DUPR for rating purposes where the
tournament does so — see [DUPR / RATING PROVIDER LINK, IF USED].
How long we keep it
- Your account and profile: until you delete your account (see below) or the operator closes
the service.
- Match results: retained as part of the permanent competition record. If you delete your
account, your results remain under the name recorded at the time, but are no longer linked to
an identifiable account.
- Security and audit logs: [RETENTION PERIOD — e.g. 12 months].
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or
object to our use of your personal data, and to data portability. In particular:
- Access & correction — view and edit your details any time on your
My Profile page.
- Erasure — delete your account from My Profile, or
ask an organiser to do it for you. This removes your login and personal details; your match
results stay in the competition record but are de-identified.
- Withdraw consent — you can turn off personalisation or delete your account
at any time.
- Complain — you may contact us at [PRIVACY CONTACT
EMAIL], and you may lodge a complaint with your data-protection authority
([SUPERVISORY AUTHORITY — e.g. the UK ICO]).
Security
Passwords are stored only as salted hashes. Access to private personal data is restricted by
role and is audit-logged. We use transport encryption (HTTPS) in transit. No system is perfectly
secure, but we take reasonable measures to protect your information.
Children
This service is not directed at children under [MINIMUM AGE].
If a junior competes, an appropriate adult should manage their account and consent.
[ADD ANY EVENT-SPECIFIC JUNIOR / MINOR HANDLING.]
Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows the
current version, and your continued use after a change means the updated policy applies.
Contact
Questions about this policy or your data? Contact
[PRIVACY / DPO CONTACT EMAIL].