Privacy Policy

1. Data controller

The Data Controller is Emanuele Giartosio, a partner of SANDR, acting as an individual until the company is incorporated. Address: Via Angelo Bascape 7, 27058 Voghera (PV), Italy; tax code GRTMNL89S29H501Q.

When the company that will run SANDR is incorporated, the Controller will become the company and this policy will be updated with its details.

For any privacy question, or to exercise your rights, write to privacy@sandr.tv. For other questions there is info@sandr.tv. We have not appointed a Data Protection Officer (DPO), because it is not mandatory for a service like ours.

Back to contents

2. What data we process

We process only the data the service needs. These are the categories:

• Viewer account: name, email address, password (stored only as a hash, never in plain text), language, registration date, the method you used to sign up (email, Google or Apple), where you signed up (website, iPhone or Android), email verification and date of your last sign-in. If you sign in with Google or Apple, the provider sends us an identifier of your account with them, your email and your name. With Apple the email may be a relay address created by Apple; we keep, encrypted, the code needed to revoke the link. We never receive your Google or Apple passwords. We do not ask for your date of birth: we ask you to declare that you are at least 14 years old.
• Terms, privacy policy and consents: the date and version of the Terms you accepted and of the privacy policy you read, your age declaration and, for marketing consent, every time you give or withdraw it, with date, policy version and channel (website or app). We do not store the IP address with consents.
• App sign-in: when you sign in from the app, your phone receives an access token, stored in the phone's secure storage together with your profile data (name, email, language and consent choices). The token expires after 30 days and is revoked when you sign out; when you sign out the app also deletes the profile from the phone.
• Preview and viewing: a random identifier to count the preview, video addresses, which may be temporary and signed, and a presence signal while you watch. See the section on the preview.
• Traffic statistics: only when they are on, aggregated, without cookies and without storing the IP address. See the dedicated section.
• Staff, operators and commentators: name, email, password stored as a hash, role and assignments (edition, court, period). For station phones the app records the device identifier and name, the operating system, the notification token (Firebase Cloud Messaging), the streaming status, readiness checks and the last heartbeat. We do not collect the phone's location, on Android or on iPhone. For people who use the staff Telegram bot, the chat identifier.
• Security logs: who creates, shows, changes or revokes a streaming key (user, IP address, software used), who joins or leaves a commentary station (user, IP address) and the staff's operations on the live streams.
• IP address and technical logs: for every request the server records the IP address, date and time, requested address and software used (browser or app). They serve security, fixing faults and understanding the load during live streams.
• Filming and live streams: images and audio of the courts, broadcast live and recorded, and the commentators' voices, broadcast live and normally not recorded. See the section on filming.
• Athletes and teams: name, nationality, photo, club, ranking, points, pairs, matches and results. If the organiser or the federation gives it to us, also the date of birth, which we use only internally and never publish. See the section on athletes.
• Backups: copies of the databases and configuration files, to restore the service after a failure.
• Messages: if you write to us, we keep your email address and the content of the message.

What we do not do: we do not profile, show ads, use tracking cookies or third-party analytics tools, run chats between users, handle payments, collect location or sell data. Statistics are not linked to your account.

Back to contents

3. Where the data comes from

• From you: your account data and what you write to us.
• From Google or Apple, if you choose to sign in with their account: the identifier, the email and the name.
• From your device: the browser or the app send the server the IP address, the software used, the random preview identifier and the technical data described above.
• From the fivbeach.com platform, federations and organisers: tournament schedules, courts, teams, athletes' names and results, which they already publish.
• From SANDR administrators: staff assignments.
• From filming the courts: images and audio of the people on and around the court.

Back to contents

4. Why we process it and the legal basis

• Managing accounts, sign-in, the personal area and the app, and sending you service emails (address verification, password recovery, security notices, deletion link and confirmation): performance of the relationship with the people who use the service (Art. 6.1.b GDPR).
• Signing in with Google or Apple: performance of the relationship (Art. 6.1.b). Google and Apple are independent controllers for their sign-in service.
• Recognising who is entitled to the launch offer: performance of the relationship (Art. 6.1.b).
• Organising the live streams (assignments, stations, notifications to phones, remote commentary): performance of the agreement with the people who work with us (Art. 6.1.b) and legitimate interest in organising the work (Art. 6.1.f).
• Filming, broadcasting and recording matches: legitimate interest of SANDR, the organisers and the public in documenting and sharing sports events that are open to the public (Art. 6.1.f).
• Publishing schedules, results and the names of athletes and teams: legitimate interest in documenting competitions, also as sports news, starting from data already published by federations and organisers (Art. 6.1.f). For minors, see the section on athletes.
• Free preview, abuse prevention and viewer counting: legitimate interest (Art. 6.1.f).
• Security, logs, audit records, fault handling and backups: legitimate interest (Art. 6.1.f) and the duty to protect data (Art. 32 GDPR).
• First-party traffic statistics, when they are on: legitimate interest in understanding how the service is used (Art. 6.1.f). You can object.
• Email marketing: your consent (Art. 6.1.a GDPR and Art. 130 of the Italian Privacy Code).
• Keeping proof of consents and of acceptance of the Terms: legitimate interest in being able to prove them (Art. 6.1.f).
• Answering your requests: steps taken at your request (Art. 6.1.b) or legitimate interest (Art. 6.1.f).
• Legal obligations and requests from authorities: Art. 6.1.c.

Where we rely on legitimate interest, we have assessed that it does not override your rights, with extra care for minors. You can always object, as explained in the section on your rights. We do not take decisions based solely on automated processing that produce legal effects on you.

Back to contents

5. Your account

You can create a free account with Google, Apple or with email and password. You must be at least 14 years old. When you sign up you accept the Terms, confirm that you have read this policy and confirm your age. Marketing consent is a separate, unticked checkbox.

If you sign up with email and password, we send you a link to verify the address. Until you open it, you cannot sign in. If you do not verify it within 7 days, we delete the account and the linked data. This rule does not apply to accounts created with Google or Apple.

You can link more sign-in methods to the same account and unlink them from the personal area, as long as at least one is left.

You can delete your account whenever you want, from the “Delete account” page of the website or from the app. First we ask you to confirm it is you: with your password, or with a link we email you if you do not have one. We remove the account, the consents and every open session. If you had linked Apple, we revoke the link with Apple; if Apple does not answer, we delete anyway. We send you a confirmation. Only the backups remain, for up to 35 days, and the technical logs for their duration.

Back to contents

6. Launch offer

Anyone who creates an account by 4 November 2026 is entitled to the offer described in the Terms. To recognise them we use only the account creation date, which we already keep: we do not ask you for any other data. When the offer becomes active we will write to your account address. It is a service message, not marketing. If you delete your account in the meantime, we can no longer recognise you.

Back to contents

7. Free preview and viewing addresses

When an account is required to watch the live streams, people without one see a 2-minute preview, once every 24 hours, for all live streams together. To count it, the server creates a random identifier. On the website it keeps it in your session, with no extra cookie. In the app, the app creates it on first launch and keeps it in the phone's secure storage. On the server we keep it, as a hash, for 24 hours, then it disappears.

The preview counts per device: two people on the same network each have their own. Reloading the page does not reset it. The identifier is not linked to your name. To limit abuse we also count how many new previews start from the same network in an hour: we use an encrypted code of the IP address, computed with a salt that changes every day, never the address in plain text, and the counter is deleted after one hour.

To watch a live stream, the website and the app receive a video address, which may be temporary and signed. When it is, it expires: after 15 minutes on the website and after 60 minutes in the app, and for the preview at the end of the 2 minutes. The address contains only the expiry and the signature, not your name or your email.

While you watch a live stream, the website and the app send the server a presence signal every 30 seconds, so we know how many devices are watching and can size the service. The server counts it in aggregated form: of the device it keeps, for a few minutes, only a code that changes every day and is not linked to your name or email, and it archives only the numbers. The IP address is used only to limit abuse: we keep it in encrypted form, with a code that changes every day, for one hour at most. The figure is internal only and we do not show it to the public. This count is technical and works even if the browser sends the Global Privacy Control signal.

Back to contents

8. Traffic statistics

We may measure, in aggregated form, how the website and the app are used: how many people visit the pages, which live streams are watched and for how long, how many sign-ups arrive. We do it with our own system, running on our servers, with no third-party services, and only after a decision by the Controller. While it is off, we collect none of what follows.

When it is on, we record the page or screen viewed (without the address parameters), the start and duration of viewing (in 60-second blocks), the start and end of the preview, the sign-up and sign-in steps with the method used (email, Google or Apple), the country, the language, the device type (phone, tablet or computer), the browser and the operating system without the version number, the site you came from (domain only) and the campaign parameters of links (UTM). We also record whether you were signed in, yes or no. We do not record your name, your email, your account number, the IP address, the full user agent or addresses with parameters. Personal area pages are not recorded.

To recognise the same visit within a day, we compute a code from the masked IP address (without its last part) and the user agent, mixed with a random salt. The salt changes every day and is deleted after 48 hours: the next day the same person has another code, and nobody can recompute the old ones. The masked IP address stays in memory for the duration of the request and is also used to find the country in a local database (DB-IP), to which we send nothing. In the app, the code is a session identifier kept in memory, which disappears when you close the app.

Statistics store and read nothing in your browser: no cookies, no local storage. We do not use them to profile you and we do not combine them with your account. If your browser sends the Global Privacy Control signal (Sec-GPC), we record nothing. You can also object by writing to privacy@sandr.tv. We keep the raw data for 13 months, then delete it.

Back to contents

9. Email marketing

Marketing consent is optional, separate from sign-up and does not affect the service. If you give it, we may email you news about tournaments, live streams and events and offers from SANDR. Today we do not send marketing emails yet. You can withdraw consent at any time from the personal area, on the website and in the app; every marketing email will also have an unsubscribe link. Withdrawal does not affect what was done before.

We keep proof of consent: at every change we store the date, the policy version and the channel. The history lasts as long as your account and is deleted with it.

If we use a specialised service for sending, we will add it to the list of providers before the first message. We do not sell or give away your address.

Back to contents

10. Filming, live streams and recordings

SANDR films and broadcasts beach volleyball and other sand sports matches, in agreement with the organisers. Players, referees, staff and spectators may appear in the images and in the ambient audio, live and in recordings. Live streams are visible to the website and app audience.

Match recordings stay on our servers for 30 days at most (less, if the organiser of the edition chooses a shorter period) and are then deleted. They are not public: only the administrator, the production team and the organisers of the edition can see them, with a link that expires after 60 minutes. Today we do not publish replays or clips: before doing so we will update this policy.

Commentators' voices go live together with the video. Normally they are not recorded: no file with the voice stays on our servers. The administration may, however, turn on recording of a commentated court for single events: in that case the voice is in the recording, with the same retention and the same access rules as the other recordings.

A live stream that has already been broadcast cannot be recalled. If you appear in footage and do not want it kept or shown, write to privacy@sandr.tv with tournament, court, day and time: we delete the recording without delay and in any case within one month. If the filming is in progress, tell us immediately: we will work out with the production team how to show you as little as possible or, if needed, stop.

Back to contents

11. Athletes, teams and minors

Schedules, courts, teams, athletes' names and results come from the fivbeach.com platform, federations and organisers, who already publish them. On the website and in the app we show the names of teams and players, including minors, as the federations' portals do. For amateur events or special cases we may show only the country instead of the names.

Athlete pages show everyone name, nationality, photo, club and ranking, and may appear in search engines; the details (such as season points) are visible only to people signed in with a verified email. This applies to all athletes, including those of the SANDR OPEN face, which hosts club and Open tournaments, including Under 18. Team names are visible in the tournament schedule and results.

We process this data on the basis of legitimate interest, as explained above. You can object at any time: an athlete or, for a minor, the person with parental responsibility can ask us to hide the name, the athlete page, the photo or a recording by writing to privacy@sandr.tv with the athlete's name and the tournament. For minors we hide the data without delay; in other cases within one month. We may ask for something that shows the request really comes from the athlete or their family.

We do not use the date of birth for publication or any other purpose: it is used only to tell age-group tournaments apart when the organiser gives it to us.

Back to contents

12. Remote commentary and live stream staff

Remote commentators join a station from the website with their own account and a valid assignment. Before joining they accept that their voice is broadcast to the audience of that court. We record who holds each seat and, for security, joins, exits and the IP address they connect from. For recording of the voice, see the section on filming.

For the production team, operators and organisers we process the account data, the assignments and the station phone data described above. Start and stop commands reach the phone through a Firebase Cloud Messaging notification. Technical alerts reach the staff on Telegram, without viewer data.

Back to contents

13. Who we share data with

We use these providers, who process data on our behalf and only to provide us with the service, or as independent controllers where stated:

• Contabo (VPS server): hosts the website, the app server, the databases, the live streams, the recordings and the logs. Contabo GmbH is based in Germany and the server is in the European Union.
• Bunny.net (CDN): delivers the video to viewers when, for the most popular events, we switch on the delivery network. In that case it sees the viewer's IP address and the signed address. The company, BunnyWay d.o.o., is based in Slovenia; the network nodes are also outside the European Union.
• Backblaze (B2 storage): keeps the backups in a private bucket in the European region (Amsterdam). Backups are encrypted before upload, with a key Backblaze does not have.
• Google Workspace (email): hosts SANDR's mailboxes, including privacy@sandr.tv, and delivers the service emails we send you (verification, password recovery, notices, deletion).
• Firebase Cloud Messaging (Google): delivers notifications to station phones, such as remote start and stop of streaming, and receives the device token. The app starts the Firebase service on viewers' phones too, which may give the installation a technical identifier with Google; for viewers we do not receive it and we do not ask for notification permission.
• Apple (App Store) and Google (Google Play): distribute the app. They process download and store usage data as independent controllers, under their own policies.
• Google and Apple as sign-in providers: if you choose to sign in with their account, the website or the app takes you to their page and brings back the identifier, email and name. They process your data as independent controllers, under their own policies. We do not send your SANDR account data to Google or Apple, except the request to revoke the Apple link when you delete your account.
• Telegram: used only by our staff, with their own accounts, for internal alerts and some live stream commands. It processes the chat identifier and the names of staff members that appear in operational notifications. It receives no viewer data. The company is based outside the European Union (Dubai).
• fivbeach.com: one of the sources of schedules and results. We send it only the list of our live streams with public links to the pages, without personal data.

Internally, data is accessible only to authorised people, according to their role and edition. We may disclose data to authorities when the law requires it. We do not sell data and do not give it away for marketing.

Back to contents

14. Transfers outside the European Union

Google (Google Workspace, Firebase Cloud Messaging and Google sign-in), Apple (Apple sign-in) and Backblaze are US companies or part of US groups and may process or access data from the United States. Bunny.net also delivers video from nodes outside the European Union. We do this only with the safeguards provided by the GDPR: the adequacy decision on the EU-US Data Privacy Framework for certified companies, or the European Commission's standard contractual clauses. Backups on Backblaze are encrypted and the provider cannot read them. Telegram, used only by staff, processes outside the European Union the chat identifier and the names that appear in operational notifications: we use it because staff members have chosen to receive, on Telegram and with their own accounts, the alerts and commands for the live streams they follow.

You can ask us for a copy of the safeguards by writing to privacy@sandr.tv.

Back to contents

15. How long we keep data

• Server access logs, with IP address, requested address and software used: 14 days.
• Technical logs of the server software, which in some warnings contain the IP address: the application's hold about 30 MB at most, then the oldest data is overwritten (about one month with normal traffic, much less during events); the video server's, which record the IP address of people streaming and of commentators, hold about 50 MB at most and with little traffic may last a few months.
• Records of streaming keys, commentary stations and staff operations: the IP address and software used are removed after 90 days, the rows are deleted after 12 months.
• Abuse counters and presence signal: one hour at most.
• Match recordings: 30 days at most.
• Backups: 14 days on the server and 35 days on Backblaze. Data deleted from the systems therefore remains in the backups for up to 35 days, then disappears.
• Website session (cookie): 120 minutes from the last activity. With the “Keep me signed in” box: 30 days.
• App access token: up to 30 days, or until you sign out of the app.
• Email verification and password recovery links: 60 minutes.
• Viewer account: until deletion, which you can do whenever you want. Email and password accounts that are never verified are deleted after 7 days.
• Apple link: the code needed to revoke it stays until the account is deleted, then we revoke it.
• History of consents and acceptance of the Terms: as long as the account exists, then it is deleted with it.
• Preview identifier: 24 hours on the server. Viewing addresses: 15 minutes on the website, 60 minutes in the app, when they are signed.
• Traffic statistics, when they are on: 13 months. The salt that generates the visit codes: 48 hours.
• Viewer numbers: minute-by-minute samples 30 days; the totals of each live stream, which are only numbers, stay in the archive.
• Staff and operator accounts: as long as the role is needed. Assignments may be limited to a period and expire at the end of the edition. We close the account on request.
• Sports data: as long as needed for the archive of tournaments and results, unless you object.
• Messages: for as long as needed to handle the request.

Back to contents

16. How we protect data

• Encrypted connection (HTTPS) with Let's Encrypt certificates.
• Role-based access: each staff member sees only the edition and courts assigned to them, and an assignment can expire. The administration area is on a separate address and requires a password.
• Streaming keys are encrypted and kept in a database separate from the catalogue.
• Recordings open only with signed links that expire. Live stream viewing addresses can also be signed and temporary.
• Passwords are stored only as hashes. If you change your password, we close the other open sessions.
• The code needed to revoke the Apple link is encrypted in the database.
• We limit sign-in and sign-up attempts.
• Server access only with SSH keys, security updates and service alerts.
• External backups encrypted before upload, with a key that is not on the server.

Back to contents

17. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a machine-readable format (portability) and to object to processing based on legitimate interest (Arts. 15-21 GDPR). If processing is based on consent, you can withdraw it at any time, without affecting what was done before.

From the personal area, on the website and in the app, you can correct your name and language, change your marketing consent and delete your account without asking us. To change your email address, or for any other right, write to privacy@sandr.tv. We answer within one month; if the request is complex we may take up to two more months, telling you within the first month. We may ask you for something to verify who you are, if we are not sure of your identity.

If you think your data is processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.

Back to contents

18. Cookies

The website uses only technical cookies, needed for it to work: the session and protection against CSRF attacks. Two more appear only in specific cases: one if you tick “Keep me signed in” (30 days) and one while signing in with Apple (10 minutes). We do not use analytics, profiling or third-party cookies, which is why there is no banner. Traffic statistics use no cookies. Details are in the Cookie Policy.

Back to contents

19. Minimum age and minors

To create an account you must be at least 14 years old (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code). When you sign up we ask you to confirm it, without asking for an ID. If we find out that an account was opened by someone younger, we delete it.

The preview requires no personal data. We do not knowingly collect, through the website and the app, data from people under 14, except the sports data and the filming described in the dedicated sections.

Back to contents

20. Changes to this policy

This is version 1.0 of 15 October 2026. We update it when the way we process data changes: for example after the lawyer's review, when the company is incorporated, when we change providers and before activating subscriptions, event passes or payments. Each version has a number and a date, shown at the top.

If you have an account, the personal area shows the version you read and the one in force. For changes that significantly affect you we will also email you. Previous versions are available on request at privacy@sandr.tv.

Back to contents