Privacy Policy

This Privacy Policy governs the manner in which personal data is collected, utilized, stored, shared, and safeguarded during the access and use of the ScoreEngine cloud platform, available at scoreengine.online and across all its subdomains.

Data processing is conducted in strict compliance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and applicable national legislation (Law no. 190/2018).

The platform operator and unified authentication controller is: EssenByte Solutions. Data Protection Officer (DPO) / Privacy Contact: [email protected] / [email protected]. General inquiries: [email protected].

The Company acts as Data Controller for: registration, identity, and contact details of direct Clients (account holders, legal representatives, instance administrators); financial, invoicing, and transaction records collected in connection with ScoreEngine license purchases; and technical telemetry, security logs, and connection records generated across the global scoreengine.online platform.

Regarding personal data entered, uploaded, or collected by Clients (event organizers) via allocated Event Instances (e.g. data of athletes, competitors, referees, volunteers, identity credentials), EssenByte Solutions acts exclusively as a Data Processor.

The Client provisioning the instance is the sole Data Controller and bears full legal responsibility for lawful collection, securing consent, and informing data subjects.

Technical obligations between Controller and Processor are exhaustively governed by the Data Processing Agreement (DPA - Art. 28 GDPR), accessible at: scoreengine.online/legal/dpa.

Account & Unified Authentication (SSO) Data: Full name, email address, telephone number, irreversibly hashed password (bcrypt/argon2), unique User ID, assigned administrative role.

Invoicing & Fiscal Data: Name of legal entity / individual, fiscal registration details, billing address, IBAN, transaction history (credit card data is processed exclusively by accredited payment gateways; the Provider never stores full card numbers or CVV/CVC codes).

Support & Communication Records: Messages submitted via helpdesk tickets, technical assistance inquiries, and correspondence records.

Traffic & Navigation Data: IP address, browser type and version, operating system, screen resolution, visited subpages, timestamps, session duration, and referrer URL.

Technical Audit Logs: Automated event recordings in instances (ranking changes, logins, data exports, point overrides), maintained for security audits and operational integrity.

Session Identifiers & Technical Cookies: JSON Web Tokens (JWT) and cookies strictly necessary for session persistence. Details are set forth in the Cookie Policy: scoreengine.online/legal/cookie-policy.

Where custom forms configured by Organizers collect sensitive identification data (such as National Identification Numbers, passport copies/series, sports medical records, or visa documents): such data is stored exclusively in encrypted instance databases; EssenByte Solutions does not analyze, extract, or share this data for its own purposes; and legal justification under GDPR Articles 6 and 9 rests solely with the Client (Organizer).

Processing of personal data by EssenByte Solutions is grounded upon the following legal bases under Regulation (EU) 2016/679:

The ScoreEngine architecture guarantees logical segregation of data across each event instance. Database queries and file access are strictly isolated and authorized via cryptographic tenant credentials.

No Client or End User can access or query data stored within another client's instance without explicit authorization.

In-Transit Encryption: All data transmitted between users, APIs, and ScoreEngine is encrypted using modern TLS 1.3 / HTTPS cryptographic protocols.

At-Rest Encryption: Databases, persistent volumes, and automated backup archives utilize industry-standard AES-256 encryption.

Comprehensive architectural details, DDoS mitigations, and compliance specifications are available at: scoreengine.online/legal/security-compliance.

API interactions are authenticated exclusively via secure tokens (API Keys / Bearer Tokens), subject to strict rate limiting and audit logging. Governing terms: scoreengine.online/legal/api-terms-of-service.

Client account data and SSO credentials are retained throughout the active lifecycle of the account.

Accounting and financial records are preserved in accordance with mandatory statutory fiscal timeframes (5 to 10 years).

Technical security logs and IP connection records are retained for a standard duration of 90–180 days before automated rotation or anonymization.

Upon expiration of an event instance, it enters passive archival mode (Read-Only) for 1 month to 1 calendar year to enable organizer archives and data exports.

Following expiration of the passive period, all databases, files, and backups associated with that instance are permanently and irreversibly purged from production systems.

Data may be transferred strictly to the extent technically necessary to: EU-based secure cloud infrastructure and data center providers; accredited online payment processors; transactional SMTP and system notification services; and competent public or law enforcement authorities solely under mandatory legal obligation.

Data processed by ScoreEngine is primarily hosted within European Union data centers.

Where global edge providers (e.g. CDN or DDoS protection) process metadata outside the EEA, such transfers are safeguarded via European Commission Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

ScoreEngine does not utilize automated decision-making producing legal or similarly significant effects concerning data subjects within the meaning of GDPR Article 22.

Scoring, ranking, and matchmaking algorithms execute strictly according to sporting parameters manually defined by the Client.

AI-assisted modules are governed by the AI Terms & Governance: scoreengine.online/legal/ai-terms-governance.

Every data subject whose personal data is processed by EssenByte Solutions as Controller holds: Right of Access; Right to Rectification; Right to Erasure ('Right to be Forgotten'); Right to Restriction of Processing; Right to Data Portability (JSON/CSV); Right to Object; Right not to be subject to automated individual decision-making; and Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP - dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, Romania).

Requests to exercise rights regarding data processed by EssenByte as Controller should be submitted in writing to: [email protected]. Inquiries are processed free of charge within 30 calendar days.

Important: For participants/athletes whose data is stored within a private event instance, requests must be submitted directly to the Tournament Organizer (the Data Controller).

In the event of a confirmed security incident affecting the confidentiality, integrity, or availability of personal data: the Provider will investigate and contain the incident promptly; notify the supervisory authority (ANSPDCP) within 72 hours where required by law; and notify affected Clients without undue delay with all necessary technical details.

External security research is coordinated via the Responsible Disclosure Policy (scoreengine.online/legal/responsible-disclosure) and Bug Bounty Policy (scoreengine.online/legal/bug-bounty-policy).

EssenByte Solutions reserves the right to periodically update this Privacy Policy to reflect operational, technical, or regulatory developments.

The current version is permanently accessible at: scoreengine.online/legal/privacy-policy.

In the event of substantial modifications affecting user rights, notification will be dispatched via email or prominent administrative dashboard alerts.