Privacy policy
- Operator
- SV Sport (svsport.ge)
- Contact
- [email protected]
1.Who is responsible for your data
This policy explains how personal data is processed when you use SV Sport at svsport.ge (the “site”). The data controller, the person responsible for the processing, is the site owner (“we”, “us”) named at the top of this page. Its name is shown there and, once it is registered, its identification code and address too. You can contact us about personal data at [email protected].
We process personal data in accordance with the Law of Georgia on Personal Data Protection (adopted on 14 June 2023; its main provisions have applied since 1 March 2024).
The policy is published in Georgian, English and Russian. If the versions differ, the Georgian version prevails.
2.In short
- You can read the site without an account and without giving us any personal data.
- The probabilities, the daily prediction sets and their archive are for people aged 25 or older. To see them you need a free account whose profile holds your date of birth and the 25+ confirmation (section 16).
- If you create an account, we keep only what the account needs: your e-mail address, date of birth, your confirmations and your preferred language (section 4).
- We do not use advertising cookies or third-party trackers, and we do not sell personal data. Visit statistics are switched on only with your consent (Cookies).
- We send no news or marketing by e-mail or SMS; if that ever changes, only with your separate consent (section 6).
- Our sports-data providers receive no personal data about you (section 9).
- You can ask us at any time to see, correct or delete your data (section 13).
- You can complain to the supervisory authority, the State Audit Office of Georgia (section 14).
3.When you visit the site
Every time a browser requests a page, our network provider Cloudflare and our server receive technical data about the request: the IP address, the date and time, the address of the requested page and the browser's identification string. This data is processed in logs for the security and operation of the site, for example to detect and block attacks, and is kept for a limited period needed for security.
For aggregate visit statistics we use Cloudflare Web Analytics, only if you allow it (“Allow all” in the cookie banner or on the Cookies page). It sets no cookies, but it loads a script in your browser and sends Cloudflare technical data about the visit. Without your consent the site tells your browser to block that script. You can withdraw the consent at any time on the same page.
The language you read the site in is part of the page address (/en, /ru); we do not use a cookie for it. Your colour theme is stored only in your own browser. Your answer to the age question in the first-visit window is kept in a cookie so that the site does not ask again (section 8); this answer does not unlock the probabilities, which need an account.
4.When you create an account
An account is optional. If you create one, we process the following data:
- e-mail address: to sign you in and to send account e-mails (confirming the registration and resetting the password);
- password: sent over an encrypted connection and stored by our authentication provider Supabase only as a cryptographic hash; we do not keep it in readable form;
- date of birth, and the dates and times when you confirmed that you are 25 or older and accepted the Terms of use and this policy;
- preferred language;
- your plan (currently “free” for everyone) and the date until which a paid plan is valid (empty while everything is free);
- a list of favourite teams (the feature is not available yet; the list is empty);
- the dates when the account and the profile were created and last updated;
- when your pause (self-exclusion) ends, if you started one;
- consent records: which version of which text (the Terms, this policy, the 25+ confirmation) you agreed to, with the text's fingerprint (hash), when, from which IP address and which browser (section 12);
- records of your requests (data download, account deletion, correction, pause): what and when.
At registration your answers (date of birth, the confirmations and the language) are saved with the account in the authentication service and copied to your profile at your first sign-in. Our database refuses a date of birth under 25.
If you sign in with Google, Google passes us, through Supabase, the basic data of your Google account: its identifier and e-mail address and, if Google provides them, your name and the link to your profile picture. Supabase keeps this data with the account. The site uses the e-mail address and the identifier; it does not show or use your name or picture. We never receive your Google password.
The authentication service also records technical data about sign-ins and sessions (such as the time, the IP address and the browser type) to protect the account.
We do not ask for your name, phone number, postal address, identity documents or payment details.
5.Payments (once paid services are introduced)
Nothing on the site is paid at present, so we process no payment data.
Once paid services are introduced, payments will be made by card through a Georgian bank or payment provider, which processes the card data itself; we will not store card numbers. Before the first payment we will require an identity and age check, carried out through a bank or a verification provider; we will not keep copies of identity documents.
We will keep the payment records that accounting and tax law requires, for as long as it requires. We will name the payment provider and the verification provider in this policy before the launch.
6.News and marketing messages
At present we send no news or marketing messages, neither by e-mail nor by SMS. We e-mail only account messages (the registration confirmation and the password reset), and we do not collect phone numbers.
If we ever start sending news or marketing messages, we will do so only with your separate, explicit consent, which will not be a condition of registering or of accepting the Terms of use and will not be pre-ticked. Every such message will contain a simple way to unsubscribe; you can withdraw your consent at any time, and we will then stop such messages within the time limit set by law. We will name the sending service and the data used for it in this policy beforehand.
7.What data we process, why and on what legal basis
Each entry gives the data, the purpose and the legal basis.
- E-mail address. Purpose: signing in and account e-mails. Basis: performing the agreement between us (the Terms of use).
- Password, only as a hash. Purpose: signing in and protecting the account. Basis: performing the agreement.
- Date of birth and the 25+ confirmation, with its time. Purpose: checking the 25-year age limit and opening the age-restricted parts. Basis: complying with a legal obligation.
- Preferred language, plan and account dates. Purpose: running the account. Basis: performing the agreement.
- Consent records (text version, time, IP address, browser). Purpose: proving what you agreed to and when (section 12). Basis: complying with legal obligations, and our legitimate interest.
- The end of your pause (self-exclusion). Purpose: keeping the pause you started until it ends. Basis: performing the agreement, at your request.
- Records of your requests (what and when). Purpose: proving that a request was carried out. Basis: complying with legal obligations, and our legitimate interest.
- Technical logs and sign-in records (IP address, time, page, browser). Purpose: security of the site and the accounts, and the prevention of abuse. Basis: our legitimate interest in keeping the site and its users safe.
- Your answer to the age question in the first-visit window (a cookie, with no personal data). Purpose: so that the site does not ask again. Basis: strictly necessary for the site to work; it needs no consent (section 8).
- Your messages and requests. Purpose: answering you. Basis: performing the agreement, and our legitimate interest in answering you.
- Payments and the identity and age check before the first payment, once introduced. Basis: performing the agreement and complying with legal obligations, including accounting and tax obligations.
- Visit statistics (Cloudflare Web Analytics). Basis: only your consent, which you can withdraw at any time on the Cookies page.
- News and marketing messages, if we ever send them. Basis: only your consent (section 6).
- Anything else optional: only with your consent; if such processing ever appears, we will ask you first.
The only automated decision about you is the age check at registration: the form and the database compare your date of birth with the 25-year limit, and an account cannot be created below it. If you think the check was wrong, write to us at [email protected].
9.Who receives data
We use the following providers. They process data on our behalf and only for the purposes described here:
- Supabase: the account database and the sign-in service, including account e-mails; data is stored in the EU region (Frankfurt, Germany).
- Google Cloud: the server that runs the site, in Tokyo, Japan.
- Cloudflare: network delivery, protection against attacks, the domain name system (DNS) and the forwarding of e-mails sent to [email protected]; Cloudflare works through a global network of data centres.
- Google: sign-in with a Google account, only if you choose it; for that sign-in Google acts under its own privacy policy.
- A bank or payment provider, once paid services are introduced: card payments; it processes the card data itself. We will name it here before the launch (section 5).
E-mails you send to [email protected] are forwarded by Cloudflare to the mailbox in which we read and answer them.
If we add a separate service for sending e-mails, we will name it here.
We receive sports data from providers such as API-Sports (API-Football, API-Basketball), football-data.co.uk, ESPN's public data feeds and a market-data provider. These providers receive no personal data about you.
We do not sell or rent personal data. We disclose it to public authorities only when the law requires us to.
10.Transfers outside Georgia
Because of the providers listed in section 9, personal data is stored and processed outside Georgia: in Germany (the account database), in Japan (the site's server) and in the countries where Cloudflare's network and Google's sign-in service operate.
We carry out these transfers in accordance with the Law of Georgia on Personal Data Protection. You can ask us at [email protected] for more information about them.
11.How long we keep data
- Account data: for as long as the account exists. After you ask us to delete the account, we delete it within 30 days, except data that the law requires us to keep, which we keep only for as long as the law requires.
- Technical logs: for a limited period needed for security.
- Consent records: for as long as the account exists; after the account is deleted only an anonymous record stays (without the account, IP address and browser), as evidence.
- Records of your requests: with the account's identifier, also after the account is deleted, as evidence that the request was carried out.
- Backups: every night a copy of the account data is kept on our server (Tokyo, Japan) for 14 days, then deleted. The data of a deleted account therefore stays in a backup for no more than 14 days.
- Messages you send us: for as long as we need them to handle your request.
- Payment records, once paid services are introduced: for as long as accounting and tax law requires.
12.Consent records
When you tick a consent box on the registration form or on the account page (the Terms of use, this policy, the 25+ confirmation), we keep a record of it: which text you agreed to, its version and the text's fingerprint (hash), the time, the IP address and the browser's identification string. Once paid services are introduced, each box ticked on the payment page will be recorded separately as well.
Why: these records prove which text you agreed to and when. Nobody can change or delete them: the database forbids it. After the account is deleted only an anonymous record stays, without the account, the IP address and the browser (section 11).
Your own consent records are part of the data download on the account page (section 13).
13.Your rights
Under the Law of Georgia on Personal Data Protection you have the right:
- to receive information about the processing of your data and to access it, including a copy;
- to have inaccurate or incomplete data corrected;
- to have your data deleted;
- to have the processing restricted;
- to object to the processing;
- to withdraw your consent at any time where processing is based on consent; this does not affect processing carried out before the withdrawal;
- to complain to the supervisory authority, the State Audit Office of Georgia (section 14).
These rights apply as provided by law and may be limited in the cases the law sets out.
On the account page you can yourself: correct your date of birth and preferred language; under “My data”, download everything we keep about you (a JSON file), including your consent and request records; and delete the account, after which the account and the profile are deleted at once. These options work during a pause too. To use any other right (for example to correct your e-mail address), write to [email protected] from the address of your account; we may ask you to confirm that the account is yours. Every such request (download, deletion, correction, pause) is logged.
We answer within the time limits set by law. We delete an account within 30 days of the request, except data that the law requires us to keep.
15.Security
The site is served only over an encrypted connection (HTTPS). Passwords are stored only as hashes. Our database lets each signed-in user read and change only their own profile, and only our server can change the plan. We use security headers that protect against common attacks. The administration panel opens only with two-factor sign-in. Nobody can change or delete the consent and request records: the database forbids it.
No system is completely secure, so we cannot promise that data will never be exposed. If a security incident affects your data, we will act and inform those concerned as the law requires.
16.Age
The site is intended for people aged 25 or older. Matches, results and tables can be read without an account; reading them requires no personal data beyond the technical data of every visit (section 3).
The probabilities, the daily prediction sets with their archive, and paid services are only for people aged 25 or older (see the Terms of use). To see them you need an account (a free one is enough): when you register you give your date of birth and confirm that you are 25 or older. This confirmation is a declaration, not a verification. Without an account these parts are not shown. Before the first payment, once paid services are introduced, the age will be checked through a bank or a verification provider (section 5).
Only people aged 25 or older can create an account, and the database refuses a date of birth under 25. If we learn that an account belongs to someone under 25 or was created with false data, we may close it and delete its data. If you believe that a person under 25 has created an account, please write to [email protected].
17.Changes to this policy
We may update this policy. The version and date are shown at the top of this page. We will announce material changes on the site, and we will also tell registered users by e-mail once we have set up sending such notices. Where a change concerns processing based on your consent, we will ask for your consent again.
18.Contact and complaints
For any question about personal data, or to use your rights, write to [email protected]. The operator's details are shown at the top of this page.
You can also complain to the supervisory authority, the State Audit Office of Georgia (section 14).
See also: Terms of use