Privacy Policy

Governing law: the Netherlands • Supervisory authority: Autoriteit Persoonsgegevens (AP)

This Privacy Policy explains how GolfScore (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you use our live amateur golf tournament scoring platform, accessible at golfscore.it (the “Service”). It applies to tournament organisers, club administrators, players, and all other users of GolfScore.

This policy should be read alongside our Terms and Conditions, also available at golfscore.it/en/terms. Defined terms used here have the same meaning as in the Terms and Conditions.

1. Who We Are and How to Contact Us

GolfScore is operated by Millerware, registered in the Netherlands. We are the data controller for the personal data we process for our own purposes: the account, usage, payment and communications data of our customers and users, and the data of visitors to our website. For the data of tournament participants that tournament organisers enter into the Service, we are the data processor on behalf of the tournament organiser, who is the data controller (see section 5).

For any questions about this Privacy Policy or your personal data, please contact us via email on privacy@golfscore.it.

If you have concerns about how we handle your data that we have not resolved satisfactorily, you have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (AP), at autoriteitpersoonsgegevens.nl.

2. Personal Data We Collect

We collect the following categories of personal data depending on how you use GolfScore:

Account data: name, email address, password (hashed & salted), organisation name, and billing contact details, collected when you register.

Tournament & player data: player names, handicap index, scores, and round results entered by tournament organisers or players.

Usage data: IP address, browser type, device information, pages visited, and feature interactions, collected automatically when you use the Service.

Payment data: billing name, address, and payment reference. We do not store full card details — payments are processed by our third-party payment provider.

Communications data: messages and requests you send to our support team.

Tournament participant data entered into GolfScore may include personal data of individuals under the age of 18, including minors under 16. GolfScore does not collect the age of participants. Instead, tournament organisers are required to confirm, before creating a tournament, that they have obtained appropriate parental or guardian consent for any participant under 16, in accordance with GDPR Article 8 and Dutch law. GolfScore processes minor participant data solely on the organiser’s instructions and does not use it for profiling, marketing, or any secondary purpose.

We only process your personal data where we have a valid legal basis. The table below sets out the basis for each processing activity:

Purpose	Type of data	Legal basis
Providing the Service and managing your account	Account data, Tournament data	Contract performance (Art. 6(1)(b))
Processing payments and invoicing	Payment data, Account data	Contract performance (Art. 6(1)(b))
Ensuring security and preventing fraud	Usage data, Account data	Legitimate interests (Art. 6(1)(f))
Improving GolfScore with aggregated analytics	Anonymised usage data	Legitimate interests (Art. 6(1)(f))
Sending service-related notifications	Account data	Contract performance (Art. 6(1)(b))
Sending marketing communications (opt-in only)	Account data	Consent (Art. 6(1)(a))
Complying with legal obligations (tax, accounting)	Account data, Payment data	Legal obligation (Art. 6(1)(c))

4. How We Use Your Personal Data

We use your personal data to:

create and manage your GolfScore account;
operate, maintain, and improve the Service;
display live tournament scores and leaderboards;
process subscription payments and issue invoices;
send you transactional messages (e.g. account confirmations, password resets, billing notifications);
respond to your support requests;
detect and prevent fraud, abuse, or security incidents;
comply with legal and regulatory obligations; and
send you product updates or marketing emails, where you have opted in.

We do not sell, rent, or trade your personal data to third parties.

5. Tournament Participant Data and Our Role as Processor

When tournament organisers use GolfScore to enter and display scores for players (tournament participants), those organisers act as the data controller for participant data, and GolfScore acts as the data processor. This relationship is governed by our Data Processing Agreement (DPA), which is Schedule A (section 16) to our Terms and Conditions and applies as soon as the organiser accepts the terms.

Tournament organisers are responsible for ensuring they have a valid legal basis to enter participant data into GolfScore, informing participants that their data will be processed, and complying with applicable data protection law in their jurisdiction.

GolfScore will only process participant data in accordance with the documented instructions of the tournament organiser and will not use it for any other purpose.

We share personal data only where necessary and with appropriate safeguards in place:

Sub-processors: We use trusted third-party service providers to operate the Service, including cloud hosting, payment processing, and email delivery. All sub-processors are contractually bound to process data only on our instructions and in compliance with GDPR. A current list is available on request.

Legal requirements: We may disclose personal data if required by law, court order, or to protect the rights, property, or safety of GolfScore, our users, or the public.

Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction. We will notify you in advance.

We do not share personal data with advertising networks or data brokers.

7. International Data Transfers

GolfScore is operated from the Netherlands and data is stored within the European Economic Area (EEA). Where we use sub-processors located outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequacy decision.

You may request details of the safeguards in place for any international transfers by contacting privacy@golfscore.it.

8. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this policy or as required by law:

Account data: retained for the duration of your subscription and deleted after account termination, unless a legal retention obligation applies.

Tournament & player data: retained for the duration of your subscription and deleted after account termination, unless a legal retention obligation applies.

Payment data: retained for 7 years to comply with Dutch tax and accounting obligations (Belastingdienst requirements).

Usage & log data: retained for up to one month for security and debugging purposes.

Support communications: retained for up to 2 years after resolution.

Website statistics: the anonymous visitor statistics of our website are kept for 24 months (see section 10).

When retention periods expire, data is securely deleted or irreversibly anonymised.

As a data subject under the GDPR, you have the following rights:

Right of access (Art. 15): you may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): you may ask us to correct inaccurate or incomplete data.
Right to erasure (Art. 17): you may ask us to delete your personal data, subject to legal retention requirements.
Right to restriction (Art. 18): you may ask us to restrict processing of your data in certain circumstances.
Right to data portability (Art. 20): you may request your data in a structured, machine-readable format, consistent with your rights under the EU Data Act.
Right to object (Art. 21): you may object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@golfscore.it. We will respond within 30 days. We may need to verify your identity before processing your request.

Tournament participants wishing to exercise rights over data entered by a tournament organiser should contact the organiser directly, as they are the data controller for that data.

10. Our Website

Besides the Service, we run the website golfscore.it. On this website we keep anonymous visitor statistics with Umami, which we host ourselves. No cookies are used for this and IP addresses are not stored. The statistics are kept for 24 months and are not shared with anyone. You can read more about this in our cookie policy.

11. Security

We implement appropriate technical and organisational security measures consistent with Article 32 GDPR, including encryption of data in transit (TLS) and at rest, access controls, and regular security assessments. While we take data security seriously, no system is completely immune to breaches.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware, and will inform affected individuals without undue delay where required.

12. Children’s Privacy

GolfScore is used to manage amateur golf tournaments, which regularly include participants under the age of 18, and potentially under 16. We acknowledge this reality and have designed our approach to minor data protection accordingly.

GolfScore does not collect or store the age of tournament participants. The responsibility for identifying minor participants and obtaining the required consents lies with the tournament organiser, who acts as the data controller for participant data.

Before creating a tournament in GolfScore, organisers are required to confirm the following by means of a mandatory, non-pre-ticked declaration in the platform: “I confirm that for any participant under the age of 16, I have obtained appropriate parental or guardian consent for their personal data to be processed in GolfScore, in accordance with applicable data protection law.”

This declaration is stored by GolfScore in a dedicated consent audit log, which is kept separately from tournament and account data. It constitutes the organiser’s documented instruction to process minor participant data under Article 28 GDPR. The consent audit log is retained for a minimum of 5 years from the date of the tournament, independently of any deletion of tournament or account data, in accordance with Dutch civil limitation periods (Article 3:310 BW).

In the Netherlands, the age of digital consent under GDPR is 16. For participants aged 16 or 17, organisers may rely on the participant’s own consent or another valid legal basis such as legitimate interests, depending on the context of the tournament.

GolfScore will never use minor participant data for profiling, marketing, analytics, or any purpose beyond displaying scores and results as instructed by the organiser. Minor participant data is subject to the same deletion terms as all tournament data and will not be retained beyond the organiser’s account lifecycle.

If you believe GolfScore holds data relating to a minor without a valid legal basis, please contact us immediately at privacy@golfscore.it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice within GolfScore at least 30 days before the changes take effect. The most current version is always available at golfscore.it/en/privacy.

Continued use of GolfScore after the effective date of any update constitutes your acknowledgement of the revised policy.

14. Contact and Complaints

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Privacy Team: privacy@golfscore.it

Website: golfscore.it/en/privacy

If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch data protection authority:

Autoriteit Persoonsgegevens (AP): autoriteitpersoonsgegevens.nl • Tel: +31 70 888 85 00