Privacy and Data Protection (LGPD)

This document describes how the Torneyo platform (torneyo.com and app.torneyo.com) processes personal data in compliance with Brazilian Law No. 13,709/2018 (LGPD). It can be attached to proposals, contracts and public procurement processes as a formal data-protection commitment, together with the Service Level Agreement and the Technical Specification.

Processing roles

• Contracts with organizations (municipalities, leagues, clubs, sports schools): the contracting organization is the controller of the personal data of its athletes, students, guardians and members. Torneyo acts as processor (LGPD art. 39), processing data strictly under the controller’s instructions and this document.
• Individual accounts: Torneyo is the controller of the account data.

Data categories and legal bases

Category	Typical data	Legal basis
User account	name, e-mail, phone, city, photo	Performance of contract (art. 7, V)
Athlete	name, CPF, ID, date of birth, sex, photo, scanned documents	Performance of contract and regular exercise of the organization’s rights (registration and eligibility)
Sports-school student and legal guardian	name, date of birth, guardian, class attendance	Performance of contract; protection of minors under art. 14
Health (PAR-Q form and medical certificates)	questionnaire answers, signed attachment	Sensitive data — processed with specific consent (art. 11, I) and access restricted to the controlling organization
Payments	billing and payout history	Performance of contract. Card data never passes through nor is stored by Torneyo — payment happens in the processor’s environment (Stripe)
Public sports results	match sheets, standings, statistics	Legitimate interest/publicity inherent to the competition, controlled by the organization (championships can be private)

Lifecycle and deletion

• Deleted records go through logical deactivation with a timestamp (soft delete): they immediately disappear from the system and remain under technical retention for audit trail, legal defense and statutory obligations.
• At the end of the contract, the controlling organization can request the full export of its data in open formats (CSV/JSON/XML with a data dictionary) and certified definitive deletion after the agreed retention period.
• Backups follow a rotation policy; deleted data leaves backups as cycles expire.

Data subject rights

Data subjects may exercise the rights of art. 18 through the channel below. When Torneyo acts as processor, requests are forwarded to the controlling organization, which decides; Torneyo executes.

Data Protection Officer (DPO): Alessandro Guimarães — contact@torneyo.com. First response within 5 business days.

Incident notification

A security incident with risk to personal data is notified to the controlling organization within 24 hours of awareness, including nature, affected data, containment measures and recommendations — feasible because the platform has automatic detection: independent external monitoring (public status page) and health checks with automatic service restart. Notifications to the ANPD and to data subjects, where applicable, follow art. 48 under the controller’s coordination.

Subprocessors

Vendor	Purpose	Data location
Amazon Web Services	Application infrastructure and database	Brazil (São Paulo region, sa-east-1)
Cloudflare R2	File storage (photos, documents, match sheets)	Global network under contractual jurisdiction
Stripe	Payment processing	Processor’s own environment (PCI-DSS)
Resend	Transactional e-mail delivery	United States
Vercel	Public institutional website hosting	Global network (public content, no data-subject data)

Technical and organizational measures

• Encryption in transit (TLS) on all domains.
• Authentication: short-lived JWT with rotated refresh tokens stored as hashes (reuse of a revoked token revokes the whole session family); two-factor authentication (TOTP authenticator app or e-mail code, with backup codes); OAuth2 social login.
• Secrets encrypted at rest: the TOTP secret is stored with AES/GCM encryption.
• Multi-tenant access control: each organization accesses only its own data, with role-based permissions; isolation covered by automated tests.
• Audit trail: relevant actions record author, action and timestamp.
• Monitoring: availability verified by an independent external monitor with a publicly auditable history.
• Minimization: card data never touches the platform; CPF numbers are displayed masked (*.XXX.XXX-) in searches and invitations; internal infrastructure details are not exposed on public endpoints.

Revision history

Version	Date	Changes
2026.08.18	2026-08-18	Initial version.