Privacy Policy

Bowl4U is an online platform for organising and entering bowling tournaments, operated at https://www.bowl4u.com. It is used by players, tournament organisers, clubs, and bowling federations.

The controller responsible for your personal information is EZ BOWL APPLICATION, 91 Chemin de la Montagne, 01300 Parves et Nattages, France.

For any question about this policy or about your personal information, contact software@lexerbowling.com.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

Account information

• Email address and password (stored only as a salted hash, never in readable form)
• Your Bowl4U identifier (EZ Id) and invite code
• Preferred language, display preferences, and profile picture if you upload one
• If you sign in with Google or Facebook: your name and email address as supplied by that provider, and the identifier linking your Bowl4U account to it. We never receive your password for those accounts.

Player profile

• First name, last name, and initials
• Gender
• Date of birth, where an event or a federation licence requires it
• Nationality and country of residence
• Telephone number
• Club and playing hand

Licences and federation membership

• Federation licence numbers, the issuing federation, and the category or region recorded against them
• The verification status of each licence, and the record of who reviewed it and when

Participation

• Your entries into events, squads, and teams, including reserve and waiting-list positions
• Team memberships and the teams you manage
• Information organisers record against your entry, such as eligibility notes, options chosen, and amounts owed
• Your results and scores, where an event publishes them
• Friend requests you send or receive, and the connections that result

Technical and security information

• The date and time of your most recent sign-in
• A count of recent failed sign-in attempts, used to lock an account temporarily after repeated failures
• Technical logs recorded by our application and web server, which can include the pages requested, error details, and the IP address a request came from
• An audit record of significant changes, showing which account created or changed a record and when
• Analytics about how the site is used, but only if you accept analytics cookies — see Cookies and similar technologies below

Messages you send us

• The content of messages sent through our contact form or by email, and the address we reply to

You can browse public pages of the site without an account and without giving us any of the above, beyond the technical information described.

Most of the information above comes from you directly. Some of it reaches us from other sources:

• Tournament organisers and team managers may enter or import a player's details in order to register them for an event, or add them to a team.
• Bowling federations give us access to their member listings, which we use to match players to their licence numbers. See Federation licences and official averages below.
• Google and Facebook, if you choose to sign in through them.
• External registration forms operated by organisers, whose entries we import into the event they belong to.

If we hold information about you that did not come from you, you have the same rights over it, including the right to be told where it came from. Contact us at software@lexerbowling.com.

We only use your personal information where the GDPR gives us a basis to do so. Each purpose below names that basis.

• Creating and running your account — necessary to perform our contract with you (Art. 6(1)(b)).
• Registering you for events, squads, and teams, and managing those entries — necessary to perform our contract with you, and with the organiser running the event (Art. 6(1)(b)).
• Checking that you are eligible to enter, including age categories, gender categories, and licence requirements set by the organiser or federation — necessary to perform that contract (Art. 6(1)(b)) and in our legitimate interest in running fair competitions (Art. 6(1)(f)).
• Matching you to your federation licence, and sending your event scores to your federation for official averages — in our legitimate interest, and that of the federations and their licensed players, in accurate official averages (Art. 6(1)(f)).
• Sending service messages — account confirmation, password resets, registration confirmations and reminders, team and friend requests, and notices from organisers about events you entered — necessary to perform our contract with you (Art. 6(1)(b)).
• Publishing participant lists, squads, teams, and results — in our legitimate interest, and the organiser's, in running a public sporting competition (Art. 6(1)(f)). See Information we publish below, including how to limit this.
• Keeping the service secure — sign-in protection, lockouts, bot and abuse prevention, logging, and audit trails — in our legitimate interest in protecting the service and its users (Art. 6(1)(f)).
• Fixing problems and improving the service — in our legitimate interest in a service that works (Art. 6(1)(f)).
• Analytics — only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Meeting our legal obligations, and establishing, exercising, or defending legal claims — legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms, and you may object at any time — see Your rights.

Some information is required rather than optional: without an email address and a name we cannot create an account, and without the details an organiser requires we cannot enter you into their event. Where a field is optional, leaving it blank has no consequence other than the feature it powers being unavailable.

Bowl4U is used to run public competitions, so some information is shown on pages that anyone can visit, without signing in.

• Participant lists, squad lists, and team line-ups for an event — typically your name, club, country, and category. The organiser of each event decides whether these are public; where they have turned participant lists off, only the organiser and their managers can see them.
• Results and statistics, where the event publishes them.
• Your player profile, which you can hide from other users in your profile settings.
• Your email address and phone number, which are shared with other users only if you leave that setting enabled in your profile. It is off-limits to the public either way.

Public pages can be indexed by search engines and copied by others, and we cannot recall information once it has been published elsewhere. If you want your details removed from a published list, contact the event organiser or us at software@lexerbowling.com; bear in mind that withdrawing from a published list may mean withdrawing from the competition.

If you hold a federation licence, the scores you bowl in an event can count towards your official federation average. The federation computes that average from the results it receives after each event, so every score has to be attached to the right licence number. To make that reliable, participating federations give us access to their member listings, and we use them to match each Bowl4U player to their licence.

The federations currently taking part are the Fédération Française de Bowling et de Sports de Quilles (FFBSQ) and the Fédération Royale Belge de Bowling (FRBB).

How your information flows

• Matching. We read member records from the federation's listing — licence number, first and last name, gender, date of birth, club, category, and region — and compare them with the licence on your profile, or the one an organiser entered for you, to establish that they describe the same person.
• Review. The outcome is recorded against your licence as verified, unconfirmed, or queued for review. Where a licence cannot be matched automatically, managers of the federation that issued it can see the details needed to decide — including the name and date of birth held on both sides — and can approve or reject it. Their decision, and who made it, is recorded. An unconfirmed licence is advisory: it does not by itself remove you from an event.
• Running the event. The participant details needed to run the event, including licence numbers, are imported from Bowl4U into EZ Lexer, our scoring software.
• Official averages. After the event, the scores are sent to the federation's office, identified by licence number, so that it can compute official averages.

Who is responsible for what

We are responsible for the matching, for the review records kept in Bowl4U, and for preparing the participant and score data. Each federation is responsible for its own member listing and for the averages it computes, which it handles under its own privacy policy.

Your rights here

The matching is an automated comparison, not an automated decision with legal or similarly significant effects: a person at the federation decides anything that is not a clear match. You can ask us how a particular result was reached, ask us to correct the details we hold, and contest an outcome by contacting us or the issuing federation. Questions about how your average is computed, or about the member listing itself, are best sent to your federation.

The copy of the federation record kept alongside a review is deleted 90 days after the review is decided. After that the screen shows that the details are no longer retained.

We do not sell your personal information, and we do not share it with advertisers.

We share it only in these situations:

• Tournament organisers and their event managers receive the details of the players entered into their events, so they can run them. They are responsible for their own use of that information.
• Bowling federations receive event scores identified by licence number, so they can compute official averages. Their managers also see the details of licences that could not be matched automatically, so they can review them. See Federation licences and official averages.
• Team managers can see the members of the teams they manage.
• Other users see what you have chosen to make visible in your profile, and what appears on public event pages.
• Service providers acting on our instructions, under contracts that require them to protect your information and use it only for the service they provide to us:
  • SendGrid (Twilio) — sending and delivering our emails
  • Google Analytics — website analytics, loaded only if you accept analytics cookies
  • Cloudflare Turnstile and Google reCAPTCHA — telling humans from bots on our sign-in, registration, and contact forms
  • Google and Facebook — only if you choose to sign in with them
  • Google Fonts, Syncfusion, and public content delivery networks — serving fonts, scripts, and styles
  • OpenStreetMap / Nominatim — turning bowling-centre addresses into map coordinates. This uses the venue's address, not yours.
  • Cognito Forms — where an organiser sends us event information through an external form that we import
  • IONOS — hosting our website and email services.
• Authorities, courts, or advisers, where we are required to disclose information by law, or need to in order to establish or defend legal claims.

Our servers and databases are hosted in France and Germany.

Some of the service providers listed above are established in the United States, including Twilio SendGrid, Google, Cloudflare, and Meta. Where your information is transferred outside the European Economic Area, we rely on the safeguards permitted by Chapter V of the GDPR — an adequacy decision, including the EU–US Data Privacy Framework where the provider is certified under it, or the European Commission's Standard Contractual Clauses.

You can ask us for details of the safeguards that apply to a particular transfer by writing to software@lexerbowling.com.

We keep personal information only as long as we need it for the purposes described in this policy.

• Your account and player profile — until you ask us to delete them. See Deleting your account.
• Inactive accounts — we do not yet delete inactive accounts automatically, so an account is kept until you ask us to delete it, however long it has been since you last signed in. We intend to introduce automatic deletion after a period of inactivity, and will state that period here once it is in place.
• Entries and results for past events — kept indefinitely, as the historical record of the competition. Standings and results remain meaningful only if past events stay complete. This record is kept even if you delete your account.
• Federation records copied for licence review — 90 days after the review is decided.
• Sign-in details — we keep only the time of your most recent sign-in, which is replaced each time you sign in, and a failed-attempt count that resets once you sign in successfully. Both are deleted with your account.
• Server and application logs — we have not yet set a fixed period. Logs are kept only while they are useful for diagnosing faults and investigating security incidents. We intend to delete them automatically after a set period, and will state that period here once it is in place.
• Audit records of changes — we have not yet set a fixed period. They are kept so that changes to an event remain traceable, and we will state a period here once one is defined.
• Messages you send us — these reach us by email. We have not yet set a fixed period, and keep them only while they are needed to deal with your request and any follow-up.
• Backups — copies may persist in encrypted backups for 7 days after deletion from our live systems, after which they are overwritten.

Where we are required to keep information for longer by law, or need it to defend a legal claim, we keep only what is necessary for that purpose.

What they are

A cookie is a small file your browser stores on your device. We also use your browser's local storage, which works in much the same way. Both are covered by this section.

What we use

• Strictly necessary — these keep you signed in, protect forms against abuse and cross-site request forgery, and keep the site working. They cannot be switched off, and we set them without asking, as the law allows.
• Preferences — these remember choices you make, such as your light or dark theme, your language, and your cookie choice itself. Your cookie choice is stored in your browser's local storage under b4u_cookie_consent_v1.
• Analytics — Google Analytics, which tells us how the site is used so we can improve it. It is loaded only after you accept analytics, and we ask it to anonymise your IP address. If you reject, it is never loaded.

We do not use advertising or cross-site tracking cookies.

Your choice

We ask for your choice the first time you visit. You can change it at any time — accepting or rejecting analytics is equally easy, and rejecting costs you no functionality.

Change your cookie choice

You can also block or delete cookies in your browser settings, though strictly necessary cookies are needed for signing in to work.

Third-party requests

Some pages load resources from third parties — Cloudflare Turnstile and Google reCAPTCHA on our forms, and web fonts. Loading them reveals your IP address to those providers. Turnstile and reCAPTCHA are used to protect our forms from automated abuse, which we treat as strictly necessary security.

We take appropriate technical and organisational measures to protect your personal information, including:

• Encryption in transit (HTTPS) across the whole site
• Passwords stored only as salted hashes, never in a form we can read
• Temporary account lockout after repeated failed sign-in attempts
• Bot and abuse protection on sign-in, registration, and contact forms
• Access controls, so organisers and federation managers reach only the events, players, and licences within their remit
• Audit logging of significant changes
• Regular encrypted backups

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority as the GDPR requires.

Under the GDPR you have the following rights over your personal information:

• Access — to be told whether we hold information about you, and to receive a copy of it (Art. 15).
• Rectification — to have inaccurate information corrected and incomplete information completed (Art. 16). Most of it you can correct yourself in your profile.
• Erasure — to have your information deleted where the grounds in Art. 17 apply. See Deleting your account below.
• Restriction — to have us stop using your information, while keeping it, in the situations set out in Art. 18.
• Portability — to receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible (Art. 20).
• Objection — to object to processing we base on legitimate interests, including having your details published on public event pages, on grounds relating to your particular situation (Art. 21). You may always object to direct marketing.
• Withdrawing consent — where we rely on your consent, such as analytics cookies, you may withdraw it at any time, as easily as you gave it (Art. 7(3)). Withdrawing does not affect processing that happened beforehand.
• Automated decisions — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22). We do not make such decisions; see Federation licences and official averages.

To exercise any of these rights, write to software@lexerbowling.com. A request may be made verbally or in writing. We will respond within one month, and will tell you if we need longer because the request is complex. We may need to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in the country where you live, where you work, or where the alleged infringement took place. As we are established in France, our lead supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.

You can ask us to delete your Bowl4U account and the personal information held with it at any time.

• How: email software@lexerbowling.com and ask for your account to be deleted. Please send it from the email address linked to your Bowl4U account, so we can confirm the request is yours; if you cannot, we will ask you for other proof that the account is yours before deleting anything.
• What is deleted: your account, sign-in credentials, player profile, contact details, profile picture, licence records, and friend connections.
• What we keep, and why: entries and results for events that have already taken place remain part of the competition record, and audit records of changes made to an event remain traceable. Where we keep these, we reduce them to what is necessary and disconnect them from your account where we can. We also keep anything the law requires us to keep.
• When: your account is deleted when we process your request, which we do without undue delay and at the latest within one month of receiving it. We will confirm by email once it is done. Copies then disappear from our encrypted backups within 7 days.

You can also request a copy of your information before deleting it — see Your rights.

Bowling is a sport played by juniors, and events on Bowl4U include junior categories. Where a child takes part, we process only what the event requires — typically name, date of birth for the age category, club, licence, and the entry itself.

Bowl4U is not designed for children to use on their own. In practice, young players take part in one of two ways:

• a parent or guardian creates an account for the child and manages it on their behalf; or
• a club or team manager enters the child into an event as a player, without the child having an account of their own.

In both cases the adult is responsible for the details supplied, and a manager entering a child must do so with the agreement of the child's parent or guardian. Children under 16 should not create an account themselves.

We do not check ages when an account is created. If you believe a child has created an account without a parent's or guardian's knowledge, contact us and we will delete the account, or hand its management to the parent or guardian.

Where we rely on consent for a child under the age of 16 — or the lower age set by their country, down to 13 — we require that consent to be given or authorised by the holder of parental responsibility.

A parent or guardian may ask to see, correct, or delete a child's information at any time by writing to software@lexerbowling.com. Where an organiser publishes participant lists, they may ask for a child's details to be withheld.

Our pages sometimes link to sites we do not run — event organisers, bowling centres, federations, and sponsors. Those sites have their own privacy policies, and we are not responsible for their content or their handling of your information. We welcome feedback about any site we link to.

This policy covers the personal information we collect through the Bowl4U website and the services offered on it. It does not cover information an organiser, club, or federation collects from you by other means, such as on paper at the venue, where they act as controller in their own right.

We update this policy when the way we handle personal information changes. The date below always shows the current version. If a change materially affects you — a new purpose, a new category of recipient, or a longer retention period — we will tell you before it takes effect, by email or by a notice on the site, and where the change relies on your consent we will ask for it.

Last updated: September 2026