This data processing agreement forms part of the terms and applies between the organizer (controller) and G.E. Recruitment, trading as TORNIO (processor), as soon as the organizer enters participant data in TORNIO.
Subject and data
On the organizer's behalf TORNIO processes data of participants and contact persons (names, team names, optional photos, team contact details, scores and standings) solely to schedule tournaments, process scores and publish standings, for as long as the organizer uses the service.
Instructions and confidentiality
TORNIO processes the data only on the organizer's instructions, as set in the service's settings (for example publishing publicly or privately), unless the law requires otherwise. Everyone with access on TORNIO's behalf is bound by confidentiality.
Security
TORNIO takes appropriate technical and organizational measures, including encrypted connections, role-based access (organizer, staff, scorekeeper), non-public team codes and restricted administrator access.
Sub-processors
The organizer gives general authorization for these sub-processors: Lovable (Sweden) with its infrastructure partners for hosting, database and storage; Google (Gmail) for system emails; Google Gemini via the Lovable AI service, only to translate tournament information at the organizer's request; and browser push services when participants switch on notifications. TORNIO imposes comparable obligations on sub-processors and announces new sub-processors on this page in advance; the organizer may object and terminate the service.
Transfers outside the EEA
Where sub-processors process data outside the European Economic Area, this only happens under an adequacy decision (such as the EU-US Data Privacy Framework) or the EU standard contractual clauses.
Data subject rights
TORNIO assists the organizer with participants' requests (access, correction, deletion) and with any data protection impact assessment. If a request reaches TORNIO, we forward it to the organizer.
Data breaches and audits
TORNIO notifies the organizer of a personal data breach without undue delay and where possible within 48 hours, with the information needed for any notification. On request TORNIO provides the information needed to demonstrate compliance.
End
After the service ends or the account or tournament is deleted, TORNIO deletes the data, except where retention is legally required; backups are overwritten on their fixed cycle. The organizer can export data before deletion.