SumoCup — Privacy Policy

SumoCup has two controllers, depending on the data: (a) Competition data in the SumoCup service — competitors, coaches, referees, entries, weigh-in, results, rankings, accreditation and accommodation. The controller is EUROPEJSKA FEDERACJA SUMO, ul. Mały Rynek 13, 63-700 Krotoszyn, Polska (europeansumofederation@gmail.com). Jakub Nowakowski runs the software as its processor. This processing is described in full in the Terms of Use and Privacy Notice at https://sumocup.com/terms. (b) Data obtained from Google and YouTube through the Sumo Cast app. The controller is Jakub Nowakowski, Lubzina 11e, 39-102 Lubzina, Polska, registered under NIP: 8181742754, contact: jakobn.jn@gmail.com ("we"). No federation instructs this processing; sections 3 to 11 describe it.

The service processes the data needed to organise sumo competitions and keep their historic record: names, dates of birth, country, club, photograph, weigh-in weight, results and appearances of competitors; names, roles and contact details of coaches, referees and officials; account data of users. Results, names, countries and clubs are published on sumocup.com as the official record of an event. Browser storage is used to keep you signed in and to let the competition flow work offline. Purposes, legal bases, recipients, retention periods, cookies and your rights for this data are set out in the Terms of Use and Privacy Notice at https://sumocup.com/terms, and requests about it go to the controller named in section 1(a).

Sumo Cast is the SumoCup mobile app that event staff use to film a sumo ring and broadcast it live to YouTube, with the scoreboard drawn over the picture. It uses YouTube API Services to do so. By connecting a YouTube channel to Sumo Cast you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google processes your data under the Google Privacy Policy (https://policies.google.com/privacy). You sign in with your own Google account, on Google’s own page, in the phone’s browser. Google asks you which account to use and, if that account manages more than one channel, which channel. Sumo Cast never sees your Google password.

Sumo Cast asks Google for one permission, "Manage your YouTube account" (scope https://www.googleapis.com/auth/youtube). It is the narrowest permission that allows an app to create a live broadcast and bind a video stream to it. With it, Sumo Cast accesses only: · the ID and name of the channel you chose; · the live broadcasts and live streams it creates on that channel — their title, description, privacy setting, scheduled time, status and stream ingestion address and key; · the health status of those streams (whether YouTube is receiving video); · the description of the videos of those broadcasts, which it edits once to add chapter timestamps. It does not access your email address, contacts, subscriptions, comments, analytics, or any video it did not create.

Only to provide the broadcasting you start in the app: · to show you, before you go live, which channel the broadcast will go to; · to create a live broadcast with the title and privacy you chose when you press Go live, and to send the camera picture and sound from the phone to it; · to tell you when YouTube is not receiving the video; · to end the broadcast when you press Stop, and to delete a broadcast that failed before it went on air; · after the broadcast, to write the list of weight categories and the time each started into that broadcast’s description; · to show the link to the broadcast on the event’s page on sumocup.com, if the broadcast is public or unlisted. We do not use Google data for advertising, do not sell it, do not use it to build profiles of you, and do not use it to train artificial-intelligence or machine-learning models.

Sumo Cast’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

On the SumoCup server, against the event you connected the channel to: · the OAuth refresh token Google issues, and a short-lived access token (valid for one hour); · the channel ID and name, the permission granted, who connected it, and when; · the ID, title, privacy and start and end time of each broadcast started from the app. While you sign in we also keep a one-time sign-in record (a random state value and a PKCE verifier) that links Google’s answer back to you. The server is operated for us by our hosting provider, Convex, Inc., in the European Union. Data are encrypted in transit and at rest. The refresh token never leaves the server: the phone is given only the one-hour access token, held in memory. Only signed-in SumoCup users holding a streaming role can use the connection. Tokens are never written to logs. Video and sound go from the phone directly to YouTube and are not stored on SumoCup’s servers. Replay clips in the app’s video-review (VAR) mode stay on the devices at the venue and are not uploaded to SumoCup or to YouTube.

We do not share Google user data with third parties, except: · YouTube (Google), to perform the actions you ask for; · our hosting provider, Convex, Inc., which stores the data on our behalf as a processor and may not use it for anything else; · where the law requires it. Within SumoCup, the name of the connected channel is shown to other staff with a streaming role at the same event, so that every camera publishes to the right place. The link to a public or unlisted broadcast is shown on the event’s public page, as the broadcast itself is already public on YouTube. The link to a private broadcast is shown only to signed-in staff.

· Refresh and access tokens, and the channel ID and name: until you disconnect the channel, until the permission is revoked or expires at Google, or 30 days after the last day of the event — whichever comes first. They are then deleted, and the permission is revoked with Google unless another event you connected still uses the same channel. · Sign-in records: deleted within 24 hours. · The record of broadcasts started from the app (ID, title, privacy, times): kept as part of the event’s historic record, like its results. The broadcasts themselves are videos on your YouTube channel, and you manage and delete them on YouTube. To have the data above deleted sooner, disconnect the channel (section 10) or write to jakobn.jn@gmail.com; we delete it within 30 days of a request.

· In the app: open the broadcast settings and press "Disconnect this channel". This deletes the tokens from our server and revokes Sumo Cast’s access with Google immediately. · At Google, at any time: https://myaccount.google.com/permissions — remove "Sumo Cast". The next time the app tries to use the connection, it deletes it. Revoking access does not delete broadcasts already on your channel.

We process this data because you ask us to broadcast to your channel — the performance of a service you request (Art. 6(1)(b) GDPR) — and, for securing the sign-in, on our legitimate interest in preventing unauthorised access (Art. 6(1)(f) GDPR). You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Write to jakobn.jn@gmail.com. You may also lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

Event pages on sumocup.com may embed a YouTube player showing the event’s broadcast. The player is provided by YouTube and, when it loads, YouTube may set cookies and process data under the Google Privacy Policy. SumoCup also uses the YouTube Data API with its own key to read public information about those videos, such as their length, to link bouts to the moment they appear in the recording; no personal data of viewers is involved.

Sumo Cast is intended for event staff and is not directed at children. Signing in to YouTube with Sumo Cast is subject to Google’s own age requirements.

We will update this page when what the service or the app does with personal data changes, and change the date at the top. If a change concerns the Google data described above, we will say so in the app before it takes effect.

Sumo Cast and YouTube data: Jakub Nowakowski, Lubzina 11e, 39-102 Lubzina, Polska, jakobn.jn@gmail.com. Competition data in the SumoCup service: EUROPEJSKA FEDERACJA SUMO, ul. Mały Rynek 13, 63-700 Krotoszyn, Polska, europeansumofederation@gmail.com.