Transparency record
Privacy notice
How GolVolt handles account, workspace, communications, usage and security data, and how you can exercise your rights.
- Effective date
- 2026-09-01
- Version
- 2026.09
This notice is updated whenever the processing, recipients, transfers or retention it describes change materially; the version and effective date above identify the current text.
Who is responsible
- Controller / service provider
- ITTEST Michał Lejman
- Address
- ul. Pomorska 90c lok. 15, 80-333 Gdańsk
- Country
- Polska
- Tax identification number (NIP)
- 5842674931
- Statistical number (REGON)
- 382939540
- General contact
- [email protected]
- Privacy contact
- [email protected]
- Hosting and backups
- Hosting and backup service providers; servers in the EU/EEA
- International transfers
- Some providers (email delivery, including sign-in codes, and sub-processors of the payment operator Stripe) process data outside the EEA, including in the USA, under the EU–US Data Privacy Framework adequacy decision or standard contractual clauses (art. 46 GDPR).
- Supervisory authority
- Prezes Urzędu Ochrony Danych Osobowych
1. Scope and roles
This notice covers GolVolt's public football pages, account login, bettor workspace, Predictor and Clubhouse features, saved plans and shares, notifications, newsletters and feedback.
The configured controller determines why and how user personal data is processed. A linked website, bookmaker, social network or media host is responsible for its own processing. GolVolt is not a bookmaker and does not accept or place wagers.
2. Data, purposes and legal bases
| Data or activity | Why it is used | Legal basis |
|---|---|---|
| Account email, account ID, creation time, signed login state, one-time-code hash, delivery/attempt state and newsletter choice | Create and secure an account, deliver magic-code login, remember authentication and record marketing choice | Steps requested by you and performance of the service; legitimate interests in authentication and abuse prevention; consent for optional newsletters |
| Display names, private group/room membership, predictions, follows, notification choices, bet journal entries, saved plans, revisions, shares and game activity | Provide the workspace and social/game features you choose, settle records, synchronize devices and enforce ownership | Performance of the requested service and steps at your request; legitimate interests in integrity, support and fraud prevention |
| Optional feedback email, message and originating page; support and email correspondence | Answer feedback, support requests and operational messages | Your request; legitimate interests in support and service improvement; consent where a separate marketing message is sent |
| Pseudonymous daily visitor hash, route/template, sanitized path, status, duration, country, query-free referrer, HTMX/bot flags and allow-listed product events | Operate the service, measure aggregate use, diagnose failures and improve product flows without a cross-day visitor ID | Legitimate interests in reliable, privacy-limited analytics and service improvement |
| Signed-in account ID and existing account creation timestamp (used as the cohort anchor), plus UTC date and fixed full_page activity category; the creation timestamp is not duplicated into the activity-day record, which stores no route, path, query, referrer, IP address or User-Agent | Measure aggregate D1, D2–7 and D7 return rates and improve product flows; at most one row is stored per account, UTC day and category | Legitimate interests in privacy-limited service measurement and improvement |
| IP address, User-Agent, request time and security/host logs | Route traffic, defend the service, investigate abuse and maintain availability; raw IP and User-Agent are used to form the daily analytics hash but are not stored in its journal | Legitimate interests in network delivery, security and legal claims; legal obligations where applicable |
| Professional football data and public news/social-source material, which may include public names, handles or images | Show fixtures, analysis, editorial context and source links | Legitimate interests in providing and documenting the football information service, within the source's terms and applicable rights |
3. Where data comes from
- Directly from you when you log in, choose settings, save workspace items, join a room, request notifications or send feedback.
- From your browser and connection when it requests GolVolt, including technical headers, first-party storage and security signals.
- From football-data, news, search, public social-media and media providers and public-source collection services; source links identify third-party material where practical.
- From service operations, such as match settlement, delivery state, fraud controls and derived aggregate product events.
4. Recipients, processors and international transfers
Data is available only to people and suppliers who need it to host, secure, support or deliver GolVolt. Recipient categories: hosting and backup service providers, an email-delivery provider (sign-in codes, service messages and newsletters), the push service of your browser's vendor if you turn on notifications, monitoring/incident services and professional advisers. Feedback forwarded by email can include the message, optional email and source page.
Discord and Slack: if you connect a Discord server or a Slack workspace, the alerts you choose are posted to the channel you picked through that platform, which processes them under its own terms. GolVolt sends only the alert text and a link back to the page. It stores the connection's encrypted address, the server or workspace and channel identifiers the platform returned, the name shown in your list and the delivery status, until you disconnect it or delete your account. A predictor room's creator may connect the room to a Discord channel: each Monday the room's weekly table — members' room display names, ranks and points — is posted there, and every member sees a notice on the room page.
GolVolt Pro payments are processed by Stripe, which receives the data needed to take and record the payment, such as the account email, billing details and payment history. Card details go to Stripe directly and never reach GolVolt's servers.
Football-data, search/news, public-source collection and AI-model providers receive public football/news context and queries. GolVolt does not intentionally send an account email to those content-generation services.
The record above states whether user personal data is transferred outside the European Economic Area and, if so, the recipient categories and the safeguards relied on, such as an adequacy decision or standard contractual clauses. Ask the privacy contact for details of those safeguards.
Data may also be disclosed where required by law, to protect rights or security, or as part of a documented business transfer with appropriate safeguards. GolVolt does not sell personal data.
5. Retention
| Record | Retention rule |
|---|---|
| One-time login codes | Codes expire after 10 minutes; code records are pruned after 7 days. GolVolt stores a keyed hash, not the six-digit code. |
| First-party usage analytics | Pageview/product-event rows are pruned after 30 days; the pseudonymous visitor hash rotates every UTC day. |
| Account activity-day markers | On each successful scheduled prune, account activity-day rows on or before UTC today−30 are removed. Immediately afterward, the live database contains rows from up to 30 UTC calendar dates; failures are monitored and retried. Rows are deleted sooner when an operator/writer erasure deletes the owning account record. Each row contains only the account ID, UTC date and fixed full_page category; it stores no route, path, query, referrer, IP address or User-Agent. Backup copies follow the separate backup lifecycle below. |
| Account identity and login record | Kept while the account is active. A verified account-erasure request removes the active identity record; a minimal record remains only while needed to prevent abuse, satisfy a legal duty or resolve an active claim, then is erased. |
| Saved workspace and private feature data | Kept until you delete the item or account, revoke the share, leave the group, or a group owner removes the relevant group record. Residual backup copies follow the backup rule below. |
| Feedback and support correspondence | Kept until the request is resolved and necessary follow-up ends. It remains longer only for an unresolved security investigation, legal duty or active claim, then is erased or irreversibly anonymized. |
| Newsletter consent and delivery records | Active delivery data is kept until you unsubscribe or withdraw consent. A minimal suppression and consent record remains only while needed to honour the opt-out or demonstrate compliance. |
| Security and request logs | Kept only while needed to detect and investigate an incident or abuse, meet a legal duty, or resolve an active claim; unrelated records are deleted when that operational purpose ends. |
| Backups | Backup copies are kept on a rolling basis for 14 days and are then deleted. They are used only to restore the service; if a backup is restored, erasures made after it was taken are applied again. |
7. Your rights
Depending on the law and circumstances, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing, including through the newsletter unsubscribe link.
Send a request to the configured privacy contact. GolVolt may ask for information needed to verify identity and protect other users. You may also complain to the configured supervisory authority or another authority competent for your habitual residence, workplace or the alleged infringement.
8. Required data, choices and automated processing
- An email address is required only for account login; without it, account-bound workspace features cannot be provided.
- Newsletter consent, feedback email and preference storage are optional. Refusing them does not block public football pages, though the selected convenience may not be remembered.
- GolVolt models and AI-assisted football copy are informational. The service does not make solely automated decisions about a user that produce legal or similarly significant effects.
9. External links and media
GolVolt self-hosts its application scripts and does not embed advertising or third-party analytics scripts in the reviewed build. Some pages can load a logo, crest, flag, news/social image, avatar, thumbnail or OpenStreetMap map from an external host, or link to a news outlet, YouTube, X or Instagram. YouTube is an external watch link: no YouTube player request occurs until you navigate. When your browser loads or opens an external resource, the third party receives ordinary connection data such as IP address, User-Agent and request time and applies its own privacy/cookie terms. GolVolt does not control those services.
10. Security, changes and contact
GolVolt uses signed Secure/HttpOnly credentials where appropriate, least-privilege database roles, access controls, rate limits, monitoring and backups. No system is risk-free; report a suspected privacy or security issue to the privacy contact.
Material changes will update the version and effective date. Where the law requires notice or a new consent, the controller must provide it before the new processing begins.