Privacy Policy for the platform
How the TurfTech management platform handles data belonging to clubs, pro shops and members: what is collected, why, who it is shared with and what you can demand about it.
- Last updated
- August 31, 2026
- In effect
- From the date of publication
In short
- Member and tournament data belongs to the club: the club is the controller and TurfTech is the processor.
- We collect member records, playing profile and club activity — no financial, biometric or health data.
- We don't sell data and we don't use advertising cookies. The platform's cookies exist to keep you signed in.
- We share only with parties involved in delivering the service, always under contract and only for the contracted purpose.
- You can access, correct, port and delete your data. The request starts at your club's pro shop, and we reply within 15 days.
The summary guides the reading; the sections are what counts.
Who is responsible for your data
TurfTech provides the platform; the club is the one deciding what to do with members' data. That distinction determines where each request goes.
In one sentence
In practice: if you're a member and want to correct your record, delete your history or understand why something was recorded, the request starts at your club's pro shop. If the club asks us, we execute it. Requests sent straight to us are forwarded to the responsible club, and we tell you when that happens.
Data the platform handles
Nothing is collected “just in case”. Every category below exists because a platform function doesn't work without it.
| Category | Data | What for | Legal basis |
|---|---|---|---|
| Identification | Full name, tax ID (where provided), email, phone, date of birth and gender. | To identify the member unambiguously, allow account access, and apply the category and starting-tee rules that depend on age and gender. | Performance of the contract between club and member. |
| Login account | Your password and the permission level you hold within the club. | To control who gets in and what each person can see or change. | Performance of contract; account security. |
| Playing profile | Handicap index and its history, federation, playing side, shirt size and profile photo. | To calculate handicaps under the official rules, build draws and flights, and organise tournament kits. | Performance of contract. |
| Club activity | Tee time bookings, attendance and absence, tournament entries, scorecards, results, rankings and points. | To run the course calendar, conduct tournaments and keep the member's playing history. | Performance of contract. |
| Privacy preferences | How visible your profile is, and permissions for another player to book on your behalf. | To respect your choice about who sees your name on a booking and who can book for you. | Consent of the data subject. |
| Tournament photos | Photos you upload to a tournament gallery, with an indication of who uploaded them. | To feed the live experience of the event, after the club approves them. | Consent, given on upload. |
| Access and usage logs | Date, time, internet address of the access and the pages used inside the platform, plus information about errors that occur during use. | To protect the account against unauthorised access, investigate faults and understand which screens need improving. | Legitimate interest in security and service improvement; legal obligation to retain access logs. |
| Change log | Who changed what and when, on the data the club needs to audit — handicap, result, member record. | So the club's management can check any sensitive change. Passwords never enter this log. | The club's legitimate interest in the integrity of its playing records. |
What we don't handle
Who we share it with
We don't sell personal data and we don't hand it to advertisers. Sharing is limited to those who need to take part in delivering the service:
| Who | What they receive | What for |
|---|---|---|
| Your club | The full member record and playing history linked to it. | It is the controller of that data: the pro shop and management run the club through the platform. |
| Other players | Name and handicap, to the extent your privacy setting allows — and, on bookings and start lists, the fact that you are playing at that time. | A tee sheet, a tournament draw and a leaderboard only exist because they are shared. |
| Your federation | Handicap and federation number, where you are a federated player. | To keep the official index recognised outside the club. |
| Service providers | Only what the contracted function requires: hosting and file storage companies, email delivery, and measurement of platform usage and faults. | To operate the platform. They act under contract, may only handle the data for that purpose, and are not authorised to use it for their own ends. |
| Authorities | Only what is strictly required. | Compliance with a court order or legal obligation. Where the law permits, we notify the club. |
The named list of companies acting as processors is provided to any data subject who asks, through the channel in section 10, and appears in the contracts signed with clubs.
International transfers
Some of the providers described above operate servers outside Brazil, which means some data — in particular usage and error logs, email delivery and file storage — is processed abroad. These transfers are made on the basis of article 33 of the LGPD, as necessary for the performance of the contract, and under contractual data-protection commitments signed with each company.
How long we keep it
- Records and history
- For as long as your relationship with the club and the club's contract with TurfTech last. Once the contract ends, the data is returned to the club or deleted, as the club determines.
- Handicap history
- Preserved for as long as the relationship exists, even if the member record is deactivated: an index without a history stops being auditable and stops counting as an index.
- Session
- Expires on its own after inactivity. Signing out or changing your password immediately ends any open session.
- Access logs
- Kept for at least 6 months, as the Brazilian Internet Civil Framework requires.
- Change and error logs
- Retained for the period agreed with the club and deleted automatically at the end of it.
After those periods, the data is deleted or irreversibly anonymised. We may retain it longer only as needed to comply with a legal obligation or exercise a right in legal proceedings, under article 16 of the LGPD.
How we protect it
- Your password is stored scrambled and cannot be read by anyone — including us. When you forget it, it is reset, never resent.
- All communication between your computer and the platform travels encrypted.
- The session expires on its own, and changing your password immediately drops any open session — including one obtained without authorisation.
- Repeated attempts to sign in with the wrong password are temporarily blocked.
- Each club is a separate environment, and what each person sees or changes depends on the permission level management granted them.
- Changes to sensitive data are recorded with author and date.
No system is immune. In the event of a security incident with material risk to data subjects, we notify the club and, where applicable, the Brazilian data protection authority, under article 48 of the LGPD.
Your rights
Article 18 of the LGPD guarantees you, at any time and at no cost:
- To confirm whether we handle data about you and to obtain access to it.
- To correct incomplete, inaccurate or out-of-date data.
- To request anonymisation, blocking or deletion of unnecessary or excessive data, or data handled contrary to the law.
- To request portability to another provider.
- To request deletion of data handled on the basis of consent.
- To know who we share your data with.
- To be informed about the possibility of withholding consent and the consequences of doing so.
- To withdraw consent — for example, by changing the privacy level of your profile or asking for a photo to be removed from a gallery.
How to exercise them
If you're a member of a club, start with the pro shop: it is the controller and resolves most requests directly in the platform. If you'd rather come to us, use the channel in section 10 — we receive the request, forward it to the responsible club and get back to you within 15 days. We may ask you to confirm your identity first: handing personal data to someone impersonating the data subject is a violation too.
You can also petition the Brazilian National Data Protection Authority directly.
Contact and changes
- Privacy matters
- privacidade@turftech.com.br
- Everything else
- Through the contact form.
If your request concerns data a club controls, tell us which club — that's what lets us forward it without another round of questions.
When the platform changes what it handles, this document changes with it. The last-updated date at the top indicates the version in force, and any material change to purposes or to your choices is communicated to the club before it takes effect.
A question about your data? Talk to us
Requests for access, correction, portability or deletion come through the same contact channel and are answered within 15 days.
