Privacy Policy — Tourney Command

Effective date: August 11, 2026
Last updated: August 11, 2026

1. Who we are

Tourney Command is operated by Carl Zuzart, a sole proprietor operating as Zedden I.T., based in Milton, Ontario, Canada.

We are responsible for the personal information we collect through this website. If you have a question about this policy or about how we handle your information, contact:

Carl Zuzart
[email protected]
863 Gazley Circle
Milton, Ontario L9T 6L6
Canada

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we are required to designate an individual accountable for our compliance with privacy obligations. That person is Carl Zuzart.

2. What this policy covers

This policy applies to the Tourney Command website at tourneycommand.com — the site you are reading now — including the contact form and the setup wizard used to commission a tournament site.

It does not cover individual tournament websites that we provision and host for event organizers, at addresses such as yourevent.tourneycommand.com. Those sites collect information from golfers, sponsors and donors, and each is operated by the organizer who runs that event. The organizer decides what is collected there and is responsible for it. If you registered for a specific golf tournament, contact that event's organizer directly. Each tournament site carries its own privacy notice.

We host those sites, which means we hold their data on our servers on the organizer's behalf. We do not use it for our own purposes.

3. Information we collect

3.1 When you contact us

When you fill in the contact form on this site, we collect:

Your name and email address
Your tournament name, event date and expected field size, if you tell us
The message you write

Contact form submissions are stored in this website's database as well as emailed to us, so that an enquiry is not lost if an email fails to arrive. You choose what to put in the message field. Please don't include sensitive personal information — we don't need it, and we'd rather not hold it.

If you email or phone us directly, we hold whatever you send us, for as long as we need it to deal with your enquiry.

3.2 When you use the setup wizard

If you begin creating a tournament site at /start/, we save your progress so you can leave and come back. That saved draft includes:

Your name, email address, phone number and organisation
The details of the event you are describing — its name, date, venue, cause and pricing
Any logo you upload

This is saved before any payment is made, and it is saved even if you never finish. We keep it so that a returning visitor can pick up where they left off, and so that we can follow up on a serious enquiry. If you started the wizard and would rather we didn't keep the draft, email us and we will delete it.

3.3 When you commission a tournament site

If you pay to create a tournament site:

Payment is taken by Square, not by us. You are sent to a payment page hosted by Square, and you enter your card details there. We never see or store your card number. We receive confirmation from Square that a payment succeeded, along with the amount and a payment reference.
We create a tournament website for you, and an administrator account on it using your name and email address.
We create an email alias at your event's address so that mail sent from your tournament site reaches you.
We keep a record of the order — what was bought, when, and for how much — for accounting purposes.

3.4 Information collected automatically

Like nearly every website, our web server records technical information each time a page is requested. This includes:

Your IP address
The date and time of the request
The page or file requested
Your browser type and version, and your operating system
The referring page, if you arrived via a link

We use this to keep the site running, diagnose faults, and protect against abuse.

3.5 Visitor statistics

We measure how the site is being used, so we know which pages people actually read. We use one tool for this, and it runs on our own server:

Burst Statistics — runs on our own server in Ontario and keeps its data in our own database. It records which pages were viewed, roughly how long each was read, the website you arrived from, your browser, device and platform, and the city and country your connection suggests you are in. It works out that location when you arrive and keeps only the result. It sets no cookies, and it sends nothing to any third party.

We do not use Google Analytics. We removed it in August 2026 and deleted the property. No third-party analytics service receives information about your visit to this site.

Because our site is delivered through Cloudflare (section 6), Cloudflare also produces traffic summaries from the requests that pass through its network in the course of serving pages to you. That is a by-product of how the site is delivered rather than anything added to the page, and it involves no script and no cookie.

Separately, we use Google Search Console to see how this site appears in Google's search results — which search terms showed it, and how often people clicked. That is Google reporting on its own search engine, using our credentials, and it involves no code on this website and no information about you. It tells us that a search term led somewhere, never who searched.

Burst is not given your name, your email address, or anything you type into a form.

3.6 Spam protection on the contact form

Our contact form uses Cloudflare Turnstile to tell people apart from automated bots. It runs a check in your browser and may set a short-lived item there in order to remember the result. Cloudflare receives your IP address and browser characteristics as part of that check. It does not receive what you type into the form.

3.7 Security logging

We run a security plugin (Wordfence) to protect the site from attacks and password-guessing. It records IP addresses, request details and login attempts. These logs stay on our own server — they are not sent to the plugin's vendor or anyone else. Failed logins are also written to our server's system log and blocked at the firewall. This is security housekeeping, not tracking.

3.8 What we do not collect

We do not run advertising, advertising trackers, or any third-party analytics service.
We do not track you across other websites, and nothing we run can.
We do not sell, rent, or trade your personal information to anyone, for any purpose.
We do not use your information for automated decision-making or profiling.
We never see or store your card number. Card details are handled entirely by Square.
We do not take a percentage of the money your tournament raises, and we do not have access to your own payment processor's account.

4. Why we collect it, and your consent

We collect personal information for these purposes only:

To answer you. If you send us a message about running a tournament, we use your details to reply and to have that conversation.
To let you resume. So that a half-finished setup is still there when you come back.
To provide what you bought. Creating, hosting and supporting your tournament site, and keeping the accounting records the law requires.
To keep the site working and secure. Server logs, spam protection, and defending against attacks.
To understand how the site is used. Visitor statistics, so we know which pages are worth improving.

Under PIPEDA we rely on your consent. By submitting the contact form, or by using the setup wizard, you consent to us using your details for the purposes above. You can withdraw that consent at any time (see section 8) — though if you withdraw it, we may not be able to continue the conversation or to keep providing a service you have bought.

We will not use your information for a new purpose without asking you first.

5. Cookies and similar technologies

Cookies are small files a website stores in your browser. This site involves the following:

cf_clearance — set by Cloudflare's bot protection. It records that your browser passed an automated security check, so you are not challenged on every page. Necessary for security.
Cloudflare Turnstile — may store a short-lived item in your browser on the contact page, to remember that the bot check passed. Necessary for the form to work.

If you log in to the site as an administrator, WordPress and our security plugin set additional cookies to keep that session working. Those apply to us, not to visitors.

We set no analytics cookies and no advertising cookies. Our visitor statistics are cookieless — they store nothing in your browser and cannot follow you to other websites. Because the only items we set are necessary for security and for the contact form to work, and because nothing we run tracks you, we do not show a cookie consent banner. There is nothing to opt out of.

You can block or delete cookies through your browser settings. If you block cf_clearance you may be repeatedly challenged before pages load.

6. Service providers, and information leaving Canada

We keep this list short on purpose. These are the only third parties involved in running this website:

Cloudflare, Inc. (United States, with servers worldwide) — delivers and protects this website, and provides the Turnstile check on our contact form. Cloudflare processes your IP address and connection details in order to serve pages to you and to block malicious traffic. Your connection may be handled by a Cloudflare server outside Canada.
Google LLC (United States) — fonts. The typefaces used across this site are served from Google Fonts. When you load a page, your browser requests the font files from Google's servers, which means Google receives your IP address and browser details.
Square, Inc. (United States, operating in Canada as Square Canada, Inc.) — payments. If you commission a tournament site, Square processes your payment and handles your card details. We receive confirmation of the payment, not your card number. Square's own privacy policy governs what it does with the information you give it.
Our own servers — this website, the tournament sites we provision, our database, and the mailboxes that receive contact form messages all run on infrastructure we own and administer ourselves, located in Ontario, Canada.

What this means for you: when personal information is held or processed in another country, it is subject to that country's laws, and may be accessible to that country's courts, law enforcement, and national security authorities. We use these providers because they are necessary to run a secure website and to take payment, and we've kept the number as small as we can.

We may also disclose personal information if we are legally required to — for example, in response to a valid court order or a lawful demand from a government authority.

7. How long we keep it

Contact form messages and email correspondence: 24 months from our last contact with you, after which we delete them, unless we have an ongoing business relationship with you or a legal reason to keep them.
Unfinished wizard drafts: 12 months from the last time the draft was touched, then deleted. Ask us sooner and we will delete it sooner.
Order and accounting records for a purchased tournament site: as long as Canadian tax law requires, currently six years.
Server logs: 90 days, then overwritten.
Visitor statistics: 12 months, then permanently deleted. Golf is seasonal, so we keep a full year in order to compare one season against the next.
Security logs: 30 days, and no more than the most recent 2,000 records, whichever comes first.
Backups: we keep a small number of recent backups on our own infrastructure and delete older ones. Backups are a snapshot — if we delete something at your request, a copy may survive in a backup until that backup ages out. We do not restore backups to recover deleted personal information.

PIPEDA requires us to keep personal information only as long as we actually need it for the purpose we collected it, and to destroy it after that. If you ask us to delete your information sooner and we have no outstanding reason to keep it, we will.

8. Your rights

Under PIPEDA you have the right to:

Know whether we hold personal information about you, and to be told what we use it for and who we've disclosed it to.
Access that information, and receive a copy of it.
Correct it if it's wrong or incomplete.
Withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.
Ask us to delete information we no longer need.
Complain if you think we've mishandled your information.

To exercise any of these, email [email protected]. We will respond within 30 days, as PIPEDA requires. We may need to verify your identity first, so that we don't hand your information to someone else. There is no charge.

If your information was collected by a tournament site rather than by us — for example because you registered as a golfer or a sponsor — please contact that event's organizer. We will pass your request on if you are not sure who to ask.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec, K1A 1H3
Toll-free: 1-800-282-1376
www.priv.gc.ca

9. Security

We protect personal information with safeguards appropriate to how sensitive it is. In practice that means: the site is served over HTTPS; our database and mailboxes sit on infrastructure we own and administer in Ontario, with access restricted to the owner; uploaded files are checked and stored in a directory that cannot execute code; failed login attempts are logged and blocked at the firewall; payment credentials are stored encoded rather than in plain text; and we keep the software up to date.

The site is backed up in three ways, all of them within Canada and none of them involving a third-party cloud service: a copy held on the server itself in a directory that is not reachable from the web; a scheduled daily, weekly and monthly backup written to a separate storage volume on our own hardware; and a weekly copy taken to an external drive held offline. Your information is not sent to any cloud backup provider, and backups do not leave Canada.

No method of transmitting or storing information is completely secure, and we can't guarantee absolute security. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner, as PIPEDA requires.

10. Children

This website is aimed at adults organizing golf tournaments. We don't knowingly collect personal information from children through this website. If you believe a child has sent us personal information, contact us and we'll delete it.

11. Visitors from outside Canada

This site is operated from Canada and intended for organizers in Canada. If you visit from elsewhere, your information will be handled in Canada under Canadian law.

12. Changes to this policy

If we change this policy we'll update the "last updated" date above. If the change is significant — for instance, if we start collecting something new or add a service provider — we'll say so clearly on this page. Material changes affecting how we use information you already gave us will not be applied without your consent.

13. Contact us

Questions, requests, or complaints about privacy: