Privacy Policy

1. Operator and contact

MyTeamTravel is operated by Janis Zarins, Gründerstrasse 14, 4600 Olten, Switzerland. Email: janis@myteamtravel.app. Telephone: +41 76 226 77 47.

2. Scope

This Policy covers the public website, account registration and the MyTeamTravel sports-team travel-coordination application. It does not replace a Customer's own notices where that Customer decides why and how member data is used.

3. Roles under data-protection law

A Club or independent Workspace Customer normally decides which members and TravelPlans are administered and may therefore act as controller for that operational data. MyTeamTravel may process that data on the Customer's instructions while separately determining processing needed for accounts, security, abuse prevention and its own legal obligations. The applicable allocation depends on the processing context and applicable law.

4. Account and identity data

We process names, email addresses, optional telephone numbers and images, preferred language, password hashes, verification status, account status and role information to authenticate Users and operate accounts. Plain-text passwords are not stored.

5. Club, team and relationship data

We process Club and team names, sports, seasons, roles, membership status, jersey numbers and Parent/Family/Player or other authorised relationships to provide scoped access and team administration.

6. Travel and transport data

TravelPlans can contain dates, timing, destinations, departure places, stops, transport choices, boarding points, carpool offers, passengers, drivers, Persons in Charge, attendance and cleanliness information. Customer-authorised Users enter and manage this data.

7. Location, route and weather data

Addresses, place identifiers and coordinates may be processed to verify destinations, calculate route estimates, create directions links and retrieve destination weather. Provider keys remain server-side. Normalised results may be cached and shown to authorised Users.

8. Home addresses and carpool meeting points

A saved home address is intended to be private to its owner and used for that person's private route functionality. Other roster views normally show only whether an address exists. A User may separately enter a carpool meeting address, which can be visible to authorised participants in that carpool, so Users should enter only information needed for the relevant journey.

9. Notes and sensitive information

Public Travel Notes are shown to authorised travellers. Private operational notes are intended for authorised Admins and Managers. MyTeamTravel is not designed as a medical-record system; Users and Customers should not enter unnecessary health or other sensitive personal information.

10. Updates and acknowledgements

The service records update versions, changed fields, recipients, reminder and manual-contact states, and acknowledgement timestamps. An acknowledgement records that a User confirmed seeing an update; it does not prove understanding or action.

11. Communications

We process email and notification details to verify accounts, reset credentials, communicate TravelPlan updates and operate Club deletion. Delivery records may include channel, provider status and error information. Delivery does not guarantee reading.

12. Exports and access links

Authorised Users can create calendar exports, Travel Lineup PDFs and limited driver-access outputs. Recipients must protect exported files and secret subscription or access links from unauthorised sharing.

13. Subscription and promotion data

We process plan, team-limit, access-status, promotion and redemption data. Stripe is not currently active and no payment-card data is processed by MyTeamTravel. This Policy will be updated before a payment provider is activated.

14. Technical, security and audit data

We process session information, security events, audit entries, request and delivery metadata, token hashes, quota ledgers and limited error information to protect the service, investigate incidents and demonstrate operational actions.

15. Sources

Data comes from Users, Customers and authorised Club representatives; imported schedule sources; generated route, place and weather providers; and technical operation of the service. A Club may have supplied basic roster data before a User registers.

16. Purposes

• Provide accounts, Club/team access and travel coordination.
• Create notifications, acknowledgements, directions, forecasts and exports.
• Protect accounts, enforce permissions, prevent abuse and maintain audit evidence.
• Handle support, deletion, legal requests, promotions and future subscription administration.

17. Legal bases where the GDPR applies

Depending on the context, applicable bases may include performance of a contract, legitimate interests in secure service operation, compliance with legal obligations, and the Customer's independently selected basis for team administration. Consent is used only where legally required for a distinct purpose; Privacy Policy acknowledgement is not blanket consent.

18. Minors and youth teams

Players aged approximately 13–15 may use their own accounts. The Customer is responsible for informing Parents or guardians and having any legally required authority. MyTeamTravel remains optional during the pilot and the Club must retain another method for essential communication.

19. Service providers and recipients

Current technical providers can include Vercel for hosting/runtime, a Supabase/PostgreSQL database, Resend for configured transactional email, and Google Maps Platform services for Routes, Geocoding, Places, Weather and directions links. A provider's role depends on the service used and the applicable contractual and legal context. Google is not automatically classified as a subprocessor.

20. International processing

The primary Supabase/PostgreSQL project is configured in Zurich. Provider support, subprocessors and related processing may take place elsewhere. Applicable safeguards and transfer mechanisms depend on the provider and processing context; we do not claim that all processing remains in Switzerland.

21. Retention

Operational data is currently retained while needed for the active Workspace and related functions. Club deletion uses a 30-day recovery period followed by soft deletion; immediate physical erasure is not implemented. Logs, token hashes, support records, caches, quota ledgers and backups may have separate operational or provider retention periods. Legal or accounting retention may apply where relevant.

22. Security

Measures include password hashing, verified-email checks, scoped memberships, role checks, server-side provider keys, hashed or signed security tokens in many flows, expiry or revocation checks and audit records. No system is risk-free. Users must protect secret invitation, driver-access and calendar-subscription links and revoke them where that option is available.

23. Data breaches

Suspected incidents are assessed, contained and documented. Relevant Customers, providers, the Swiss Federal Data Protection and Information Commissioner and, where applicable, GDPR authorities or affected people will be considered according to the facts and legal requirements.

24. Cookies and similar technologies

The service uses necessary authentication and security cookies plus functional browser storage for interface and selected-team state. Optional analytics or advertising tracking is not enabled. Development-only profile and weather preview state is not a normal production technology. See the Cookie and Storage Policy.

25. Automated decisions

MyTeamTravel does not currently make legal or similarly significant decisions about people solely by automated means. Route and weather risk outputs are informational and do not decide driver eligibility or safety.

26. Rights

Depending on applicable law and the processing role, people may request access, correction, deletion, restriction, portability or objection, and may withdraw a separate consent where consent was used. Rights can be limited by legal obligations and the rights of others.

27. Requests where a Club is controller

Where the Club controls operational member data, requests may need to be directed to or coordinated with that Club. MyTeamTravel will verify identity and role, route the request and assist the Customer as required by the current DPA and applicable law.

28. Complaints

People may contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority where applicable. The correct authority and process depend on the facts and location.

29. Changes

Material changes may require renewed acceptance or acknowledgement as indicated for the newly published version. The prior operative version remains available in the version archive where applicable.

30. Contact

MyTeamTravel is operated by Janis Zarins, Gründerstrasse 14, 4600 Olten, Switzerland. Email: janis@myteamtravel.app. Telephone: +41 76 226 77 47.