Privacy policy, written plainly.

1. Who we are

Tourney Command is operated by Carl Zuzart, a sole proprietor operating as Zedden I.T., based in Milton, Ontario, Canada.

We are responsible for the personal information we collect through this website. If you have a question about this policy or about how we handle your information, contact:

Carl Zuzart
[email protected]
Milton, Ontario L9T 6L6
Canada

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we are required to designate an individual accountable for our compliance with privacy obligations. That person is Carl Zuzart.

2. What this privacy policy covers

This policy applies to the Tourney Command website at tourneycommand.com — the site you are reading now — including the contact form and the setup wizard used to commission a tournament site.

It does not cover individual tournament websites that we provision and host for event organizers, at addresses such as yourevent.tourneycommand.com. Those sites collect information from golfers, sponsors and donors, and each is operated by the organizer who runs that event. The organizer decides what is collected there and is responsible for it. If you registered for a specific golf tournament, contact that event's organizer directly. Each tournament site carries its own privacy notice.

We host those sites, which means we hold their data on our servers on the organizer's behalf. We do not use it for our own purposes.

3. Information we collect

3.1 When you contact us

When you fill in the contact form on this site, we collect:

• Your name and email address
• Your tournament name, event date and expected field size, if you tell us
• The message you write

Contact form submissions are stored in this website's database as well as emailed to us, so that an enquiry is not lost if an email fails to arrive. You choose what to put in the message field. Please don't include sensitive personal information — we don't need it, and we'd rather not hold it.

If you email or phone us directly, or message us on Facebook Messenger (for example from one of our ads), we hold whatever you send us, for as long as we need it to deal with your enquiry. A Messenger conversation is also processed by Meta Platforms under its own privacy policy.

3.2 When you use the setup wizard

If you begin creating a tournament site at /start/, we save your progress so you can leave and come back. That saved draft includes:

• Your name, email address, phone number and organisation
• The details of the event you are describing — its name, date, venue, cause and pricing
• Any logo you upload

This is saved before any payment is made, and it is saved even if you never finish. We keep it so that a returning visitor can pick up where they left off, and so that we can follow up on a serious enquiry. If you started the wizard and would rather we didn't keep the draft, email us and we will delete it.

3.3 When you commission a tournament site

If you pay to create a tournament site:

• Payment is taken by Square, not by us. You are sent to a payment page hosted by Square, and you enter your card details there. We never see or store your card number. We receive confirmation from Square that a payment succeeded, along with the amount and a payment reference.
• We create a tournament website for you, and an administrator account on it using your name and email address.
• We create an email alias at your event's address so that mail sent from your tournament site reaches you.
• We keep a record of the order — what was bought, when, and for how much — for accounting purposes.

3.4 Information collected automatically

Like nearly every website, our web server records technical information each time a page is requested. This includes:

• Your IP address
• The date and time of the request
• The page or file requested, including any tracking tags in the link you followed (for example, tags that show you arrived from one of our ads)
• Your browser type and version, and your operating system
• The referring page, if you arrived via a link

We use this to keep the site running, diagnose faults, protect against abuse, and count how many visits our ads bring, without identifying who you are.

3.5 Visitor statistics

We measure how the site is being used, so we know which pages people actually read and which of our ads are worth paying for. We use two tools for this.

• Burst Statistics — always on. It runs on our own server in Ontario and keeps its data in our own database. It records which pages were viewed, roughly how long each was read, the website you arrived from, your browser, device and platform, and the city and country your connection suggests you are in. It works out that location when you arrive and keeps only the result. It sets no cookies, and it sends nothing to any third party.
• Google Analytics (Google LLC) — on unless you turn it off. A notice on your first visit tells you it is running, and one click turns it off (section 5). While it is on, Google receives the pages you visit on this site, how you arrived (including whether you came from one of our Google ads), your device and browser type, and your approximate location. Google Analytics does not log or store IP addresses. We use it to see which pages and ads lead people to contact us, book a call or start a tournament setup, and we share those results with our Google Ads account so we can measure our ads (section 6). We have turned off Google signals, and we do not use it to build advertising audiences or show you ads elsewhere. If you turn it off, or your browser sends a Do Not Track or Global Privacy Control signal, Google Analytics does not load.

Because our site is delivered through Cloudflare (section 6), Cloudflare also produces traffic summaries from the requests that pass through its network in the course of serving pages to you. That is a by-product of how the site is delivered rather than anything added to the page, and it involves no script and no cookie.

Separately, we use Google Search Console to see how this site appears in Google's search results — which search terms showed it, and how often people clicked. That is Google reporting on its own search engine, using our credentials, and it involves no code on this website and no information about you. It tells us that a search term led somewhere, never who searched.

Neither Burst nor Google Analytics is given your name, your email address, or anything you type into a form.

3.6 Spam protection on the contact form

Our contact form uses Cloudflare Turnstile to tell people apart from automated bots. It runs a check in your browser and may set a short-lived item there in order to remember the result. Cloudflare receives your IP address and browser characteristics as part of that check. It does not receive what you type into the form.

3.7 Security logging

We run a security plugin (Wordfence) to protect the site from attacks and password-guessing. It records IP addresses, request details and login attempts. These logs stay on our own server — they are not sent to the plugin's vendor or anyone else. Failed logins are also written to our server's system log and blocked at the firewall. This is security housekeeping, not tracking.

3.8 What we do not do

• We run no third-party analytics or advertising trackers other than Google Analytics (sections 3.5 and 5), and you can turn that off with one click.
• We do not use remarketing: we don't build audiences from your visit or follow you around the web with our ads.
• We do not sell, rent, or trade your personal information to anyone, for any purpose.
• We do not use your information for automated decision-making or profiling.
• We never see or store your card number. Card details are handled entirely by Square.
• We do not take a percentage of the money your tournament raises, and we do not have access to your own payment processor's account.

4. Why we collect it, and your consent

We collect personal information for these purposes only:

• To answer you. If you send us a message about running a tournament, we use your details to reply and to have that conversation.
• To let you resume. So that a half-finished setup is still there when you come back.
• To provide what you bought. Creating, hosting and supporting your tournament site, and keeping the accounting records the law requires.
• To keep the site working and secure. Server logs, spam protection, and defending against attacks.
• To understand how the site is used. Visitor statistics, so we know which pages are worth improving.
• To measure our advertising — unless you turn statistics off. Seeing which of our Google ads and pages lead to enquiries and sign-ups, so we spend our advertising budget on what works.

Under PIPEDA we rely on your consent. By submitting the contact form, or by using the setup wizard, you consent to us using your details for the purposes above. Google Analytics is used on the basis of implied consent: it is not sensitive information, the notice on your first visit tells you about it, and you can turn it off there or at any time. You can withdraw any consent at any time — for cookies, with the Cookie settings link at the bottom of every page; for everything else, see section 8 — though if you withdraw consent to the use of your contact details, we may not be able to continue the conversation or to keep providing a service you have bought.

We will not use your information for a new purpose without asking you first.

5. Cookies and similar technologies

Cookies are small files a website stores in your browser. This site uses two groups.

Always set — necessary for the site to work:

• cf_clearance — set by Cloudflare's bot protection. It records that your browser passed an automated security check, so you are not challenged on every page.
• Cloudflare Turnstile — may store a short-lived item in your browser on the contact page, to remember that the bot check passed.
• Your cookie choice — a small cookie that remembers whether you turned statistics off, so the notice doesn't reappear on every page.

Statistics — set unless you turn statistics off:

• _ga and _ga_GCY8WPMZJ8 — set by Google Analytics to tell one visit from another. They last up to 2 years.
• _gcl_… — set by Google to record whether you arrived from one of our Google ads, so a later enquiry can be counted against that ad. They last up to 90 days.

On your first visit, a notice tells you about these cookies and lets you turn them off. If you turn statistics off — or your browser sends a Do Not Track or Global Privacy Control signal — Google Analytics does not load and these cookies are not set. You can change your choice at any time with the Cookie settings link at the bottom of every page. Turning statistics off stops new data; to remove cookies already set, clear them in your browser.

If you log in to the site as an administrator, WordPress and our security plugin set additional cookies to keep that session working. Those apply to us, not to visitors.

You can also block or delete cookies through your browser settings. If you block cf_clearance you may be repeatedly challenged before pages load.

6. Service providers, and information leaving Canada

We keep this list short on purpose. These are the only third parties involved in running this website:

• Cloudflare, Inc. (United States, with servers worldwide) — delivers and protects this website, and provides the Turnstile check on our contact form. Cloudflare processes your IP address and connection details in order to serve pages to you and to block malicious traffic. Your connection may be handled by a Cloudflare server outside Canada.
• Google LLC (United States) — fonts, analytics and ad measurement. The typefaces used across this site are served from Google Fonts: when you load a page, your browser requests the font files from Google's servers, which means Google receives your IP address and browser details. Unless you turn statistics off, Google also provides Google Analytics and Google Ads conversion measurement, as described in sections 3.5 and 5. Google processes this information in the United States and other countries.
• Square, Inc. (United States, operating in Canada as Square Canada, Inc.) — payments. If you commission a tournament site, Square processes your payment and handles your card details. We receive confirmation of the payment, not your card number. Square's own privacy policy governs what it does with the information you give it.
• Our own servers — this website, the tournament sites we provision, our database, and the mailboxes that receive contact form messages all run on infrastructure we own and administer ourselves, located in Ontario, Canada.

What this means for you: when personal information is held or processed in another country, it is subject to that country's laws, and may be accessible to that country's courts, law enforcement, and national security authorities. We use these providers because they are necessary to run a secure website, to take payment and to measure our advertising (which you can turn off), and we've kept the number as small as we can.

We may also disclose personal information if we are legally required to — for example, in response to a valid court order or a lawful demand from a government authority.

7. How long we keep it

• Contact form messages and email correspondence: 24 months from our last contact with you, after which we delete them, unless we have an ongoing business relationship with you or a legal reason to keep them.
• Unfinished wizard drafts: 12 months from the last time the draft was touched, then deleted. Ask us sooner and we will delete it sooner.
• Order and accounting records for a purchased tournament site: as long as Canadian tax law requires, currently six years.
• Server logs: 90 days, then overwritten.
• Visitor statistics (Burst): 12 months, then permanently deleted. Golf is seasonal, so we keep a full year in order to compare one season against the next.
• Google Analytics data: 14 months, then deleted automatically by Google. Your cookie choice is kept for 12 months, then the notice shows again.
• Security logs: 30 days, and no more than the most recent 2,000 records, whichever comes first.
• Backups: we keep a small number of recent backups on our own infrastructure and delete older ones. Backups are a snapshot — if we delete something at your request, a copy may survive in a backup until that backup ages out. We do not restore backups to recover deleted personal information.

PIPEDA requires us to keep personal information only as long as we actually need it for the purpose we collected it, and to destroy it after that. If you ask us to delete your information sooner and we have no outstanding reason to keep it, we will.

8. Your rights

Under PIPEDA you have the right to:

• Know whether we hold personal information about you, and to be told what we use it for and who we've disclosed it to.
• Access that information, and receive a copy of it.
• Correct it if it's wrong or incomplete.
• Withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. For cookies, use the Cookie settings link at the bottom of every page.
• Ask us to delete information we no longer need.
• Complain if you think we've mishandled your information.

To exercise any of these, email [email protected]. We will respond within 30 days, as PIPEDA requires. We may need to verify your identity first, so that we don't hand your information to someone else. There is no charge.

If your information was collected by a tournament site rather than by us — for example because you registered as a golfer or a sponsor — please contact that event's organizer. We will pass your request on if you are not sure who to ask.

If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec, K1A 1H3
Toll-free: 1-800-282-1376
www.priv.gc.ca

9. Security

We protect personal information with safeguards appropriate to how sensitive it is. In practice that means: the site is served over HTTPS; our database and mailboxes sit on infrastructure we own and administer in Ontario, with access restricted to the owner; uploaded files are checked and stored in a directory that cannot execute code; failed login attempts are logged and blocked at the firewall; payment credentials are stored encoded rather than in plain text; and we keep the software up to date.

The site is backed up in three ways, all of them within Canada and none of them involving a third-party cloud service: a copy held on the server itself in a directory that is not reachable from the web; a scheduled daily, weekly and monthly backup written to a separate storage volume on our own hardware; and a weekly copy taken to an external drive held offline. Your information is not sent to any cloud backup provider, and backups do not leave Canada.

No method of transmitting or storing information is completely secure, and we can't guarantee absolute security. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner, as PIPEDA requires.

10. Children

This website is aimed at adults organizing golf tournaments. We don't knowingly collect personal information from children through this website. If you believe a child has sent us personal information, contact us and we'll delete it.

11. Visitors from outside Canada

This site is operated from Canada and intended for organizers in Canada. If you visit from elsewhere, your information will be handled in Canada under Canadian law.

12. Changes to this policy

If we change this policy we'll update the "last updated" date above. If the change is significant — for instance, if we start collecting something new or add a service provider — we'll say so clearly on this page. Material changes affecting how we use information you already gave us will not be applied without your consent.

13. Contact us

Questions, requests, or complaints about privacy:

Carl Zuzart
[email protected]
863 Gazley Circle
Milton, Ontario L9T 6L6
Canada