Privacy Policy

Last updated: 16 July 2026

1. Introduction

This privacy policy informs users of the websites ruck-zone.fr and itsrugby.fr (hereinafter the “Sites“) about how the company RUCK ZONE collects, uses, retains and protects personal data, in accordance with Regulation (EU) 2016/679 (“GDPR“) and applicable French law.

2. Data Controller

RUCK ZONE — a French simplified joint-stock company (SAS) with share capital of 1 000 €
Registered office: 133 bis rue de l’Université, 75007 Paris, France
SIREN: 942 690 918
Telephone: +33 1 84 16 38 75
Email: hello@ruck-zone.fr

3. Data processing architecture

The Sites are built on a WordPress + Supabase architecture: WordPress provides the user interface and editorial layer, while Supabase (infrastructure hosted within the European Union, Frankfurt region) serves as the source of truth for business data and GDPR consents. Synchronisation flows between WordPress and Supabase pass through dedicated Edge Functions (in particular rgpd-archive, which propagates consents to marketing partners). This architecture ensures data traceability and portability.

4. Data processed and purposes

a) Sporting, biographical and statistical database

Purpose: to publish, structure, enrich and archive information relating to rugby stakeholders and competitions, for the purposes of public information, analysis, editorial content and historical archiving.

Legal basis: RUCK ZONE’s legitimate interest in its editorial and information activities.

Data subjects: players, referees, coaches, executives, managers, club presidents and other rugby stakeholders mentioned on the Sites.

Data concerned: depending on the case, surname, first name, club, position, role, sporting career, caps, appearances, match statistics, results, honours, nationality, year or date of birth, height, weight, online presence (website, social media, Wikipedia, LinkedIn) and, where provided for in the database, certain contact details or information relating to sporting career.

Data sources: public or publicly accessible sources (federations, leagues, clubs, match sheets, competitions, press releases, specialist press, open databases), as well as providers and partners specialising in sports data, including Opta, subject to applicable rights and usage terms.

b) Data concerning minors

Where a profile concerns a minor athlete, RUCK ZONE applies a data minimisation approach.

Purpose: publication of information strictly necessary for sports reporting and statistical archiving.

Legal basis: legitimate interest, with enhanced vigilance linked to the protection of minors.

Specific measures: unless there is a particular need, the full date of birth of minor athletes is not displayed publicly. RUCK ZONE favours displaying age or year of birth instead. No personal contact details of minors are intended to be published. Any request for rectification, objection or erasure may be made by the data subject or, where applicable, by their legal representative.

c) User accounts

Purpose: to create and manage user accounts and to provide access to restricted content and features.

Legal basis: performance of the contract (provision of the service).

Data concerned: surname, first name, email address, telephone number (E.164 format), postal address, account level, avatar and profile preferences.

Tools: Paid Memberships Pro (WordPress), Supabase (GDPR source of truth), Basic User Avatars.

d) Consent log

Purpose: to provide evidence of free, informed and unambiguous consent in accordance with Article 7.1 GDPR for each of the four independent checkboxes (Terms of Use, newsletter, marketing partners, SMS marketing).

Legal basis: legal obligation (proof of consent).

Data concerned: user ID, type of consent, value (granted/refused), version of the reference text, source (signup/profile), IP address, user agent, timestamp.

Storage: dedicated table rz_its_consent_log + Supabase mirror rgpd.V2_rgpd_journal.

e) Newsletter and marketing communications

Purpose: to send news, analysis and information relating to the Sites by email and, where applicable, by SMS where the user has expressly consented to this.

Legal basis: consent (Article 6.1.a GDPR + Article L. 34-5 of the French Post and Electronic Communications Code (CPCE) for SMS marketing).

Data concerned: email address, first name, telephone number (for SMS), favourite teams and clubs, sign-up source.

Tools: Brevo (newsletter + SMS), with a GDPR pipeline running through Supabase (Edge Function rgpd-archive).

Consent may be withdrawn at any time via the unsubscribe link in emails, by replying STOP to SMS messages, or from the personal account area.

e bis) Sharing with commercial partners

Purpose: to enable It’s Rugby and its commercial partners (kit suppliers, ticketing, clubs, events, training organisations, media) to offer users who have given their consent personalised offers, benefits and content, including on other sites and applications, through audience matching (Meta custom audiences, Google Customer Match, equivalents) and the insertion of tracking pixels in marketing emails. This arrangement enables It’s Rugby’s services to be offered free of charge.

Legal basis: explicit consent (Article 6.1.a GDPR + Article 82 of the French Data Protection Act (loi Informatique et Libertés) for trackers).

Data concerned: email address, first name, telephone number, favourite teams and clubs, behavioural data associated with pixels (date and time emails are opened, device used, cross-channel interactions). Direct identifiers (email, telephone) are transmitted in hashed form (SHA-256) to advertising networks for audience matching purposes.

Partner categories: kit suppliers, ticketing, clubs, event organisers, training organisations, specialist media, as well as the advertising networks acting as intermediaries for cross-site audience matching (Meta, Google, TikTok depending on the campaign). The named list of active partners is kept up to date and available on request at hello@ruck-zone.fr.

Withdrawal: consent is reversible at any time from the personal account area (the “Sharing with our commercial partners” section). Withdrawal stops the transmission of new data and triggers a request for erasure to the relevant partners as soon as possible.

f) Transactional communications

Purpose: to send emails related to the performance of the contract (registration confirmation, security alerts, validation of management requests).

Legal basis: performance of the contract.

Data concerned: recipient email address, message content.

Tool: Postmark (transactional email delivery, retained by Postmark in accordance with its own policy).

g) Social module (follows, public profiles, feed and notifications)

Purpose: to allow a logged-in user to follow other members, be followed, like content, receive in-app notifications and have an optional public profile.

Legal basis: performance of the contract (service feature).

Data concerned: user ID, public profile slug, list of follows, likes, notifications.

Storage: tables rz_its_social_follows, rz_its_social_likes, rz_its_social_notifs + Supabase mirror V2_user_social_*.

The user may disable their public profile and remove their follows at any time from their personal account area.

h) Predictions and polls

Purpose: to allow a logged-in user to play prediction games and appear (anonymised) in a leaderboard, and to allow any visitor to respond to anonymous opinion polls.

Legal basis: performance of the contract (predictions); legitimate interest in preventing multiple voting (anonymous polls, technical cookie).

Data concerned: user ID, prediction ID, answers, score and points (for predictions); technical cookie rzu_sondage_<id> valid for 1 year for anonymous polls.

Storage: table rz_rzu_entries (predictions). The public leaderboard is intentionally anonymised (no username or name displayed).

i) Classified ads (bars, clubs, players, staff)

Purpose: to allow members to publish recruitment or service classified ads.

Legal basis: performance of the contract.

Data concerned: advertisement, contact details, associated club or organisation, status (open/closed).

Some advertisements are visible only to registered clubs (professional gate).

i bis) Internal messaging between members

Purpose: to allow logged-in members to exchange messages with one another in connection with recruitment advertisements (player, staff, club looking for a player, club looking for staff) without exposing their email address. For volunteering or event advertisements, an “I’m interested” button sends a one-off notification to the author of the advertisement. Bar advertisements (Bar Events Calendar) do not have messaging.

Legal basis: RUCK ZONE’s legitimate interest in providing the matchmaking service, which constitutes the very purpose of the service provided (Article 6.1.f GDPR).

Data concerned: sender and recipient ID, ID of the relevant advertisement, message content (free text, 5 000 characters maximum), timestamp, read status, any reports, individual blocks, messaging preferences. For anti-spam purposes, an encrypted digest (SHA-256 hash) of the IP address and the user agent are retained for a maximum of 7 days, then automatically erased.

Retention period: conversation threads and messages are retained for 24 months from the last message exchanged. At the end of this period, they are automatically deleted by a daily process. Reported messages may be retained for up to 36 months for moderation purposes and as evidence in the event of a dispute.

Rights exercised online: each user can, from their Messaging page: export all of their conversations in JSON format (right of access and data portability), block another user (individual right to object), fully disable their messaging (overall right to object) and report a problematic message (moderation).

Account deletion: if a member’s account is deleted, their identity within conversation threads is anonymised (“Deleted user”). The content of messages received is retained on the recipient’s side, as it constitutes data belonging to the recipient, in accordance with applicable case law.

Moderation: only RUCK ZONE administrators may read the content of a conversation thread, and only where a message has been reported by a user. Each review by an administrator is logged in an audit trail (table v2_user_message_audit).

Notifications: when the user is offline, a single summary email may be sent via Postmark, limited to one message per hour per recipient. This notification can be disabled at any time from the Messaging page.

Tools: Supabase storage (tables v2_user_message_thread, v2_user_message, v2_user_message_intent, v2_user_message_block, v2_user_messaging_prefs, v2_user_message_audit), Postmark transactional notifications.

j) Partner bars and managers

Purpose: to manage partner bar listings, their geolocation and the publication of bar event calendars.

Legal basis: performance of the contract (managers); legitimate editorial interest (calendar publication).

Data concerned: bar’s postal address, latitude/longitude, manager’s identity, opening hours, prices.

Processor: Nominatim / OpenStreetMap Foundation for address geocoding (server-side request only, no user cookie).

k) Visitor contributions (UGC: photos and videos)

Purpose: to allow any visitor (without needing to create an account beforehand) to submit photos and videos for editorial publication following moderation.

Legal basis: explicit consent (assignment of rights + publication authorisation); legitimate interest in the technical traceability of the submission.

Data concerned: contributor’s name, email (optional), title, description, location, date of event, files (photos/videos), consent checkboxes (rights, publication, presence of minors, parental authorisation), SHA-256 hash of the IP address, user agent.

Retention: pending files are retained until moderation (rejection: deleted within 30 days; approval: transferred to the WordPress Media Library and published in accordance with editorial rules).

Rate limit: maximum of 3 submissions per rolling 30-minute window per IP address, to prevent abuse.

l) Match live coverage (comments)

Purpose: to enable live broadcast of matches with real-time text commentary.

Legal basis: legitimate editorial interest.

Data concerned: author’s ID and name, comment content, minute, event type.

Storage: tables rz_its_live_comments and rz_its_live_bans (moderation bans).

m) Video statistics (Presto Player)

Purpose: to measure consumption of hosted videos (viewing duration, video ID).

Legal basis: legitimate interest.

Data concerned: user ID (if logged in), video ID, duration, IP address, timestamp.

Storage: table rz_presto_player_visits. The IP address is stored in plain text by this third-party tool, in line with its default operation.

n) In-house advertising network (ITS Rugby Ads)

See the Cookie Policy for details. Two complementary channels:

  • Anonymous audience counter (exemption from the CNIL (French data protection authority), deliberation 2020-091 of 17 September 2020) — aggregation by advertisement and by day, no identifying data.
  • Detailed tracking subject to consent via Didomi — irreversible SHA-256 hash of the IP, sanitised URL (potentially identifying parameters removed), referrer. Retention: 30 days, after which anonymous aggregated data is retained indefinitely.

o) Traffic source cookie

Purpose: to identify the sign-up source of a new user (UTM, referrer) for marketing analysis.

Legal basis: legitimate interest.

Data concerned: cookie its_src (short value such as “direct”, “newsletter”, “utm_xxx”), duration 30 days.

p) Contact forms

Purpose: to respond to requests submitted via contact forms and to follow up on correspondence.

Legal basis: legitimate interest or pre-contractual measures depending on the nature of the request.

Data concerned: surname, first name, email address, message content, date and time of the request.

Tool used: Elementor Pro.

q) Profile claim and licence evidence

Purpose: to allow an eligible member to request management of their profile (player, club, staff, president, referee) and to verify their affiliation before granting them management rights.

Legal basis: legitimate interest (combating fraudulent claims and ensuring the reliability of profiles).

Data concerned: identity of the requesting account, profile claimed, date of the request, and — on an optional basis — licence evidence (for example an FFR licence) that the member may attach to facilitate verification.

Retention: the request is retained until it is approved or refused, and thereafter for evidential purposes. Any evidence provided is retained only for the duration of the verification: it is automatically deleted as soon as a decision is made (approval or refusal), and within 30 days at the latest.

Security: the evidence is stored in encrypted form, outside the site’s public area, and can only be viewed by authorised administrators for the duration of the review. It is never shared with third parties or transferred to the business database.

5. Cookies, trackers and audience measurement

The Sites use cookies, trackers and server-side counters to ensure their operation, improve their performance, measure audience and, in some cases, enable playback of multimedia content and the display of advertising.

Legal basis: legitimate interest for strictly necessary trackers and audience measurement exempted by the CNIL; consent for trackers subject to consent (managed via the Didomi platform).

Technical tools: Cloudflare, WP Rocket, Redis Object Cache.

Audience measurement tools: Google Analytics via Site Kit by Google, Independent Analytics, Presto Player, in-house advertising audience counter (CNIL-exempted).

Marketing/advertising tools: Google Tag Manager, ITS Rugby Ads (in-house advertising network), and, depending on the campaign, third-party advertising trackers (Google, Meta, TikTok).

Full details of cookies and the option to manage your consent at any time are set out in the Cookie Policy.

6. Hosting and security

The Sites are hosted by OVHcloud (France). The business database and GDPR flows are managed by Supabase (Frankfurt region, European Union). Technical administration may be carried out via Plesk. Static content is delivered through Cloudflare (CDN/security).

RUCK ZONE implements appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data: TLS/HTTPS encryption, capability- and role-based access control, irreversible SHA-256 hashing with salt for technical identifiers (advertising measurement), backups, access logging and protection against application-level attacks.

7. Retention period

  • User account data: up to 3 years after the account is closed or the last significant account activity.
  • Consent log (evidence under Article 7.1): retained for the entire period the account is active and for 3 years after deletion.
  • Newsletter and SMS data: until consent is withdrawn or the user unsubscribes.
  • Form data: for as long as necessary to process the request, followed by limited archiving where necessary.
  • Cookies and trackers: maximum lifespan of 13 months (CNIL recommendation).
  • Sporting, biographical and statistical data: for as long as necessary for public information, historical archiving and editorial management of the service, subject to legitimate requests for rectification, objection or erasure considered on a case-by-case basis.
  • Predictions and scores: retained indefinitely (leaderboard history).
  • Live comments: archived together with the match.
  • Pending UGC contributions: maximum 30 days if not moderated.
  • Licence evidence (profile claim): automatically deleted as soon as a decision is made (approval or refusal), within 30 days of submission at the latest.
  • Detailed advertising tracking (IP hash): 30 days, after which anonymous aggregation is retained indefinitely.

8. Recipients of data

Personal data is disclosed, within the limits of their respective remits:

  • to authorised personnel within RUCK ZONE;
  • to providers and processors acting on behalf of RUCK ZONE, namely: OVHcloud, Cloudflare, Supabase, Brevo, Postmark, Didomi, Google (Tag Manager + Analytics via Site Kit), Nominatim / OpenStreetMap, Presto Player, as well as the audience measurement services active on the Sites;
  • to advertisers, exclusively in aggregated and anonymous form, for the in-house advertising network’s performance reports;
  • to commercial partners and third-party advertising networks (Meta, Google, TikTok depending on the campaign), only for users who have given their explicit consent via the “Sharing with our commercial partners” checkbox (see section 4.e bis). Direct identifiers (email, telephone) are transmitted in hashed form (SHA-256) for cross-site audience matching purposes;
  • to the competent authorities where required by law.

9. Transfers outside the European Union

Certain data may be processed or transferred outside the European Union by some providers used by the Sites, in particular Cloudflare, Postmark and Google (United States). These transfers are governed by the appropriate safeguards provided for under applicable law, in particular these providers’ adherence to the Data Privacy Framework (EU-US DPF) or the implementation of standard contractual clauses (SCCs) approved by the European Commission.

The main providers host their data within the EU: OVHcloud (France), Supabase (Frankfurt), Brevo (France), Nominatim (EU).

10. Automated decision-making

RUCK ZONE does not carry out any decision-making based solely on automated processing that produces legal effects concerning data subjects or significantly affects them within the meaning of Article 22 GDPR.

11. Your rights

In accordance with applicable law, you have a right of access, rectification, erasure, objection, restriction of processing and data portability, as well as the right to withdraw your consent at any time where processing is based on it.

You can exercise these rights by writing to: hello@ruck-zone.fr

Postal address: RUCK ZONE — 133 bis rue de l’Université, 75007 Paris, France

You can also manage your cookie and tracking preferences at any time by clicking on Cookie preferences or from the footer of the Sites.

If you have any concerns, you can lodge a complaint with the CNIL: https://www.cnil.fr.

12. Updates

This privacy policy may be amended at any time to reflect legal, regulatory, technical or editorial developments. The date shown at the top of this page corresponds to its last update.