Privacy policy

What VirtuAdmin is

VirtuAdmin is software by GiT solutions for running a sports club: members, parents and coaches, training and attendance, competitions, membership fees and bills, medical checks, notifications and the public club website. Every club has its own instance, its own database and its own domain.

Who is the controller and who is the processor

The club is the controller of the data of its members, parents and coaches. The club decides what data it enters, who gets an account and how long data is kept. For requests about your data, please contact the club first; its details are on the club website.

GiT solutions is the processor: it provides, maintains and hosts VirtuAdmin and processes data on the club’s behalf, only so that the system works.

For this website (virtuadmin.rs) and for enquiries you send us by email or phone, the controller is GiT solutions:

What data we process

Only what the club needs to work with its members:

• account — email, role (administrator, coach, parent, player), a hashed password or a link to a Google or Apple account, and settings for receiving bills and notices;
• player — first and last name, date and place of birth, phone, address, citizenship, training group, jersey number, registration and member number, photo, dates of joining and leaving the club, fee discount;
• parent — first and last name, phone, email, ID card number if the club enters it, and the link to the child;
• coach — first and last name, phone, address, education, club function, groups, photo and a description for the club website;
• medical check — valid-until date, height and weight; we do not store findings or diagnoses;
• training and matches — attendance, stars for effort, rankings, players per match and results;
• location — when a player starts a training check-in, the app checks once whether they are within 400 m of the gym; we do not track location in the background;
• finances — membership bills, items, discounts, payments and debts, the payment reference and the delivery status of the bill email;
• notifications — the phone’s push token and device type (Android/iOS), messages sent and whether a message was opened;
• system log — which user created, changed or deleted data and when, for control and troubleshooting;
• photos and video — pictures and clips from training and matches that the club publishes in its gallery.

If you sign in with Google or Apple, we receive a verified email and an account identifier. We never see or store their password. The VirtuAdmin password is stored only hashed, never as text.

Children’s data

Most players in clubs are children. The club enters a child’s data based on the membership form signed by a parent or guardian. The club opens the child’s account, and in their portal a parent sees only their own child.

Player photos and documents in the admin are not public files and are available only to signed-in users with the right role. Whether photos from training and matches are published on the public website is decided by the club, in line with parental consent.

What we do not do

• we do not sell data or use it for advertising;
• we do not use one club’s data for another club;
• we do not track the phone’s location, except the single check at training check-in.

Why we process data

• club membership — records of members, training, competitions and fees (the membership agreement with the club);
• the club’s legal obligations — registering players with the federation, medical checks before competing, bills and payment records;
• security and control — the system log, sign-in protection and abuse prevention (legitimate interest of the club and users);
• notifications and publishing photos — push notifications can be turned off in the phone settings, and the club publishes photos of children based on parental consent.

Cookies and websites

• club admin and portals — a sign-in session cookie (valid for up to two days) and Google reCAPTCHA v3 against sign-in abuse;
• public club website — Google Analytics for visit statistics, if the club uses it;
• club apps — the same sign-in as on the web and a push token;
• this website — has no form and no sign-in; it uses Google Analytics for visit statistics (_ga cookies) and loads fonts from Google Fonts, so Google sees your IP address.

Who we share with

• Amazon Web Services — storing photos, videos and documents (S3 and CloudFront) and sending bill and notice emails (SES);
• Google — Firebase Cloud Messaging for push notifications, Google sign-in, reCAPTCHA, Analytics on club websites and on this site, and Google Fonts;
• Apple — Apple sign-in and delivering notifications to iPhones;
• National Bank of Serbia — the service that creates the IPS QR code for paying a bill (payment details are sent: payee, account, amount and reference);
• sports federation — data for player registration, when the club submits it;
• hosting — the servers that run VirtuAdmin and the club websites.

Some of these services store data outside Serbia, mostly in the European Union (photos and documents are in the AWS region in Ireland). We use them under their contractual data protection terms.

How long we keep data

• member data — while the person is a member; after leaving, it stays in the records of former members for as long as the club decides or the law requires;
• bills and payments — as long as accounting rules require of the club;
• phone token — while the device is active; when the service reports it as invalid, we stop using it;
• system log — for the limited time needed for control and troubleshooting;
• enquiries to this website — while we discuss cooperation, at most two years.

How we protect data

• every club has a separate database, data never mixes between clubs;
• access is checked on the server for every role and every request;
• passwords are hashed, sign-in is protected by reCAPTCHA and a lockout after three wrong attempts;
• player photos and documents are not publicly accessible;
• connections to the system use HTTPS, and every data change stays in the system log.

Your rights

Under the Serbian Law on Personal Data Protection (Official Gazette RS, No. 87/2018) you may request access to your data, correction, deletion, restriction of processing and a copy of your data, object to processing and withdraw consent. Parents exercise these rights for their children as well.

Send your request to your club. If you get no answer, or if it concerns this website, write to us at office@git.rs and we will help the club respond. You will get an answer within 30 days at the latest.

If you believe data is processed unlawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

Account deletion

You can request account deletion from the club app (the account deletion option in your profile) or by emailing the club. You can also write to us at office@git.rs with the email you sign in with and the name of the club.

After deletion, access, the phone token and settings are removed. Data the club must keep by law, such as bills and payments, stays in the club’s records for as long as that obligation lasts.

Changes

We publish changes on this page, with a new date at the top. Questions: office@git.rs.