This site only uses the cookies it needs to work - no analytics or advertising. Live streams are YouTube videos: if you allow them, YouTube may store its own data in your browser. You can change your choice at any time. Cookie policy
This policy explains what personal data this tournament website processes, why, who can see it, how long it is kept and how to have it corrected or deleted. Many athletes are children, so their data is handled with extra care.
1. Who is responsible
The website is run by the organizer named below (the "operator"), which decides how the data is used. For any question about your data, write to viktor.my248@gmail.com or use the data request form.
Athletes: full name, gender, date of birth, weight (declared and at the weigh-in), club, coach, kyu/dan grade, disciplines entered, photo (optional), attendance, age check, category, bouts, scores and placings, and a record of the consent given (by whom and when). Purpose: to run the tournament - sort athletes into age, weight and grade categories, make the draw, record results and keep the results archive.
Staff and coach accounts: username, full name, role, a hashed password (never the password itself), failed login attempts and lockout time, and a log of actions taken in the system. Purpose: secure access and accountability.
Data requests: your name, how you relate to the person concerned, your contact details, whose data it is about, the tournament and your message. Purpose: only to answer the request.
Visitors: we do not create profiles of visitors and do not use analytics, advertising or tracking tools. Your IP address is held in server memory for up to one minute to limit abusive request rates, and is not stored in the database.
We only ask for what is needed: the date of birth and weight decide the category, the grade decides the division, and the photo is optional.
3. What is public
Anyone can view tournaments, participant lists, brackets and results without an account. Public pages show an athlete's name, photo (if one was uploaded), club, coach, gender, grade, category and results. The date of birth, exact weight and weigh-in data are only shown to signed-in staff.
4. Legal basis and consent
Athletes' data is processed and published on the basis of consent. An athlete aged 18 or over gives it themselves; for anyone under 18 it must be given by a parent or legal guardian. Whoever registers the athlete (organizer staff or the coach) confirms this consent in the registration form or the Excel import, and the system records who gave it and when. A minor cannot be registered on their own consent - the system refuses it.
Staff accounts are processed to provide the service the staff member works in.
Answering data requests is a legal obligation of the operator.
Consent can be withdrawn at any time with the data request form; this does not affect processing that happened before.
5. How long data is kept
Data of a running tournament is kept until the tournament is finished and moved to the archive.
The archive (names, clubs and results of past tournaments) is kept as the history of results until the operator deletes the tournament or the person concerned asks for erasure. Erasure removes the name, photo, date of birth, weight and coach; the anonymous place in the bracket stays so other athletes' results remain correct.
Photos are deleted from the server together with the participant or tournament.
Login sessions expire after 8 hours. Daily database backups are kept for 14 days, so deleted data disappears from backups within 14 days.
Contact details in data requests are erased one year after the request is closed.
6. Who else receives data
We do not sell or rent personal data and do not share it for advertising.
The website contains no third-party analytics, advertising or social media scripts. All its components (listed in THIRD_PARTY_NOTICES.md) run on the operator's server and send no data elsewhere.
Live streams are hosted by YouTube (Google). A video player is only loaded after you allow it in the cookie banner or by clicking "Load video"; YouTube then receives your IP address and may store data in your browser, under Google's privacy policy, possibly outside your country. Until then no request is made to YouTube.
The server may be run by a hosting provider on the operator's behalf.
7. Children
Athletes can be as young as 4. Children do not get accounts and do not enter data themselves: it is entered by organizer staff or the coach after a parent or legal guardian has consented. A parent or guardian can exercise all the rights below on the child's behalf.
8. Your rights
See what data we hold about you or your child.
Have incorrect data corrected.
Have data deleted, including from the archive of past tournaments.
Withdraw consent.
Complain to the data protection authority of your country.
Send a request with the data request form or by email to viktor.my248@gmail.com. It is free of charge. We aim to reply within 10 working days; if the law that applies to the operator sets a shorter deadline, that deadline applies. We may ask you to confirm that you are the person concerned or their parent/guardian.
9. Emails
The website sends no newsletters or marketing emails. Your contact details are only used to answer your request. If the operator ever sends newsletters, they will go only to people who have opted in, and every one will contain a working unsubscribe link.
10. Security
Passwords are stored as bcrypt hashes; access to editing is limited by role and checked on the server; forms are protected against cross-site request forgery; repeated failed logins lock the account; in production the site runs over HTTPS.
11. Changes
If this policy changes, the new version is published on this page with a new date.