Privacy notice

• If you play in your company's StaffCup (you were invited by your employer or joined with your work email), your employer decides that StaffCup is used and is the controller of your data there. We process it on your employer's behalf as a processor, under the data processing terms in our Terms of Service. For questions about how your company uses StaffCup, contact your HR team; we will also help.
• We are the controller for: company owners' and HR administrators' account and billing details, people who contact us or book a walkthrough, and visitors of staffcup.com.

• Account: work email, name, profile photo (if you add one), language, the company and office you belong to, your role (player or HR administrator).
• Sign-in: one-time sign-in codes and session tokens, so you stay signed in on your devices.
• Playing: the sports you joined, match results and scores, ratings and rankings, challenges, open games, tournament entries, feed posts and reactions, and disputes with the notes you write.
• Company setup (HR): company name and logo, offices and their city, email domains, people lists you import, announcements, settings, and a log of administrative actions.
• Notifications: a push token for each phone where you allow notifications, and your notification preferences.
• App diagnostics: crash reports from the mobile app (device model, operating system, app version, the error), to fix bugs. They do not include your results or messages.
• Billing (owners): billing name, address, VAT ID and invoices. Card details are entered with Stripe and never reach us.
• Contact form: your email, name and message.

We do not use advertising or tracking cookies, and we do not sell personal data. The website and dashboard only store what they need in your browser (your sign-in and your chosen language).

• To provide StaffCup (accounts, leagues, tournaments, notifications, support): on behalf of your employer for players; for owners and administrators, to perform our contract with the company (GDPR art. 6(1)(b)) and our legitimate interest in running the service (art. 6(1)(f)).
• To keep StaffCup secure and working (sign-in limits, logs, crash reports, backups): legitimate interest (art. 6(1)(f)).
• Billing, invoicing and accounting: contract and legal obligations (art. 6(1)(b) and (c)).
• Answering you when you contact us: legitimate interest, or steps before a contract (art. 6(1)(f) and (b)).
• Service emails (sign-in codes, invitations, results to confirm, billing): needed to provide the service. We send no marketing emails without your consent.

Colleagues in your company see your name, photo, office, ratings, results, tournament entries and the feed posts shared with them. HR administrators also see your work email, role and activity in the dashboard. Nobody outside your company sees your data, except our team when needed to provide support or keep StaffCup secure (and StaffCup support working in your company's dashboard at HR's request, which is recorded).

• Cloudflare, Inc.: hosting of the website, dashboard and API, database, file storage (photos, logos) and sending emails.
• Google (Firebase): delivering push notifications and collecting app crash reports. The website loads its font from Google Fonts.
• Stripe: payments, subscriptions and invoices (owners only).
• Apple and Google app stores: distributing the mobile apps, under their own terms.

Some of these providers may process data outside the European Economic Area, including in the United States. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

• While your company uses StaffCup. Sessions expire after 180 days without use; sign-in codes after a few minutes.
• If you delete your account in the app, your name, email and photo are removed at once; past results stay as "Deleted player" so colleagues' tables remain correct.
• If HR removes you, you lose access at once; your history stays with the company until it is deleted.
• When a company is deleted, its people, results, tournaments, posts and files are deleted. Paused companies are kept up to 12 months.
• Invoices and accounting records: as long as the law requires (in Romania, generally 5 years; some records 10).
• Contact requests: up to 24 months. Crash reports: up to 90 days. Backups: kept for a limited time, then deleted.

Under the GDPR you can ask to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. You can change your name and photo and delete your account yourself in the app. Where your employer is the controller, we forward your request to them or help them answer it.

Write to support@staffcup.com; we answer within one month. You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or the authority where you live or work.

Connections are encrypted (HTTPS). Sign-in uses one-time codes, with limits against guessing. Each company's data is kept apart from other companies', access follows each person's role, administrative actions are logged, and data is backed up. If a breach affects your data, we inform your company (and, where we are the controller, you and the authority) as the law requires.

StaffCup is a workplace tool and is not meant for anyone under 16.

We update this notice when StaffCup changes. The date at the top shows the current version; for important changes we also tell company owners in advance.