Privacy Policy

Data Controller

What We Process

We process account and platform usage data needed to provide tournament management functionality, user authentication, and platform security.

Whose Data We Process

We process data of athletes, of guardians (parents or legal guardians, with or without an account), of coaches, academy managers and academy staff, of event organizers, judges and other event staff, and of people who write to us through the contact and GDPR request forms.

Minors and Guardians

Hajime asks for a date of birth and a country when an athlete account is created. The digital consent age depends on the country set in the athlete's profile (for example 14 in Italy, and 16 for countries without a specific setting). An athlete who has not yet reached it needs a linked guardian to register for events and to use most features; settings and the guardian pages stay available. A guardian can also manage a child's account (no email and no login for the child) and act for them.

To register a minor for an event we record the following:

• the guardian's name, email address and phone number as entered, the relationship, and the IP address the declaration came from
• the version and language of the declaration text, and whether the guardian confirmed the email address through a single-use link or an organizer recorded an in-person check (we record who checked which kind of document and when, never a copy of the document)
• the guardian's consent for each event: date, text version, language and IP address
• an accompanying adult designated for an event (name, phone and notes)
• an audit entry, with identifiers only and no contact details, each time event staff open a minor's emergency contact

Who can see it: event organizers, staff assigned to the event and academy managers, under role-based rules. Emergency contact details at the mat and on the roster are shown to authorized event staff only when they ask for them, and every such view is logged with identifiers only. The guardian's contact details are also shown to authorized event staff and academy managers on registration and check-in pages. On public pages (brackets, results, statistics) a minor appears as initials and club, with no photo and no profile link. Country is still shown. A guardian with a linked account can allow more visibility to opponents in the same bracket or participants in the same event. Someone who was a minor at an event stays masked in that event's results until they choose otherwise as an adult.

Athlete Documents and Health Data

Athletes can upload medical certificates, membership cards and other documents (PDF, JPEG or PNG). Files are stored privately and are opened only through time-limited links. They can be opened by the athlete, by a guardian linked to a minor athlete's account, by administrators of the organization a membership card belongs to, by organizers and event staff with registration access for the events concerned, and by platform administrators. Owners and managers of an academy the athlete currently belongs to can upload a current minor's medical certificate or membership card and see its status, without opening the file. Blood type, if you provide it, is stored only after your explicit consent.

Documents are deleted automatically 90 days after an account is deleted, and membership card documents 30 days after the organization membership is suspended.

Legal Basis

Performance of contract and legitimate interest for platform operations, security, abuse prevention, and service reliability.

Retention

Current retention periods:

• Guardian consent evidence (guardian name, email and phone, IP addresses, consents, accompanying adult details, and records of guardian declarations) is kept for 10 years after the guardianship ends or the athlete's account is deleted, whichever comes first. It is kept to establish, exercise or defend legal claims (art. 17(3)(e) GDPR permits keeping it for that purpose). While kept, it is hidden from the screens of the product, can be read only by platform administrators for compliance and legal purposes (each read is logged) and by the guardian themselves through their own data export or an access request, and is deleted automatically when the period ends.
• Conduct acknowledgments of a deleted account are kept for the same number of years, hidden in the same way, and then deleted.
• Athlete documents: 90 days after account deletion, 30 days after an organization membership suspension (see above).
• In-app notifications: 90 days.
• Audit logs (new entries hold identifiers only): 10 years.
• Unused guardian invitation links, data exports and report exports: until they expire.
• Everything else: as long as needed to provide the service and comply with legal obligations.

Deleted data can remain in backups until the backups rotate out.

Deleting Your Account

When you delete your account it is anonymized and your athlete documents are deleted after the period above. Before you confirm, the deletion page tells you what Hajime has to keep and until which date, and the confirmation email lists what was actually kept. If you are an athlete with guardians, their consent evidence is kept as described under Retention. If you are a guardian with an account, your guardianships are ended and the evidence you gave is kept in the same way.

The retained records are not deleted earlier on request. If you ask for erasure of a retained record, we answer with the date on which it will be deleted.

Data Processors

Hajime acts as data controller. The following third parties process data on our behalf:

• Cloudflare, Inc.: web analytics (cookieless beacon). Your IP address is used transiently to derive country-level geography and estimate unique visitors; it is not retained as a personal profile. Cloudflare processes data on its global network under its standard Data Processing Addendum.
• Cloudflare, Inc.: bot protection (Turnstile), used on contact and GDPR request forms. No analytics profile is built.
• Fly.io, Inc.: application hosting (Amsterdam region).
• Supabase, Inc.: managed PostgreSQL database that stores account, profile, event and registration data (West EU region, Ireland).
• Tigris Data, Inc. (S3-compatible object storage, run on Fly.io): uploaded files such as athlete documents, avatars and event images, stored in the Amsterdam region (Netherlands). Covered by the Tigris Data Processing Addendum, which includes the EU Standard Contractual Clauses for transfers outside the EEA.
• Mailjet: sending of transactional emails (account, registration, notification and guardian confirmation emails). It receives the recipient address and the content of the message. Covered by the Sinch (Mailjet) Data Processing Agreement.
• Stripe: processing of event registration payments and donations, under the Stripe Data Processing Agreement. For fraud prevention and its legal obligations (such as anti-money-laundering checks) Stripe acts as an independent controller.
• Sentry: error reports and warning-level application logs used to find and fix bugs. Known sensitive fields (such as email addresses) are removed before sending. Data is stored in the United States, under the Sentry Data Processing Addendum.
• Browser push services: if you enable push notifications, the notification is encrypted for your browser and delivered through the push service of your browser vendor.

Some of these providers are based in, or may transfer data to, countries outside the European Economic Area, mainly the United States. These transfers rely on the EU-US Data Privacy Framework or on the EU Standard Contractual Clauses, as set out in each provider's data processing agreement.

Your Rights (GDPR)

You can request access, rectification, erasure, restriction, portability, or objection using the request form below. If you have an account, you can also download your data from your account settings (guardians with an account get their guardian-side records, including guardianships, consents and delegations) and delete your account there. If you are a guardian without an account, use the form and include the email address the records were declared with.

We answer within 30 days of receiving a request (art. 12(3) GDPR, extendable where the law allows). We may ask you to verify your identity first.

Contact

For privacy inquiries, contact info@hajime.it.