SumoCup — Terms of Use & Privacy Notice

The controller of the personal data processed in the SumoCup service (the "Service") — and the party responsible for granting, modifying and revoking permissions in the Service — is EUROPEJSKA FEDERACJA SUMO, with its registered seat at ul. Mały Rynek 13, 63-700 Krotoszyn, Polska, registered under KRS: 0000700980, REGON: 368703050, NIP: 8992832468. Questions concerning personal data, and all requests to exercise the rights described in section 17, should be addressed to europeansumofederation@gmail.com. The controller determines what data are collected in the Service, for what purposes, who is granted access to them, and for how long they are kept. Detailed information on the processing carried out by the controller — categories of data, purposes, legal basis (Art. 6 GDPR), recipients, retention periods, transfers to third countries, profiling and the rights of data subjects — is set out in this document and in the controller's own information clause, published at https://www.europeansumofederation.com/.

The Service is operated — in technical and administrative matters — by Jakub Nowakowski, Lubzina 11e, 39-102 Lubzina, Polska, registered under NIP: 8181742754 (the "Service Administrator"). Questions about the operation of the Service, faults and technical matters may be sent to jakobn.jn@gmail.com. The Service Administrator acts exclusively as a PROCESSOR within the meaning of Art. 28 GDPR: it processes personal data only on the documented instructions of the controller named in section 1, under a written personal-data processing agreement, and for no purposes of its own. Jakub Nowakowski is not the controller of your personal data, does not decide what is collected in the Service or who may see it, and does not verify on its own account whether the consents underlying an entry have been obtained — that responsibility rests with the controller and with the users who enter the data (section 16). Data subjects may address a request to either party, but requests concerning the substance of the processing (access, rectification, erasure, objection) are decided by the controller. Where the Service Administrator receives such a request directly, it forwards it to the controller and does not answer it on its own account unless the controller authorises it to do so.

SumoCup is a web application for managing sumo wrestling competitions — including entry of competitors, weigh-in, draws, scoring, results, rankings, reports, accreditation, accommodation and the publication of the course of a competition. The Service is offered to national and international sumo federations and their members. The Service collects data of competitors, club coaches, national team coaches, referees, referee coordinators, international federation administrators and national administrators, together with data concerning competitions and other sumo events.

Accounts in the Service are created by the national administrator. If you are a club coach or a referee waiting for an invitation, contact your federation office. Data are entered, modified and deleted by the controller or by persons it authorises. Permissions ("roles") are granted, modified and revoked by the controller or by persons it authorises; the Service allows roles to be combined. Verifying that a person is entitled to the access their role grants is the responsibility of the controller, not of the Service Administrator. Every user must use the Service only within the permissions granted to them and only for the tasks associated with their position or function. Where the permissions granted are incorrect or out of date, the user must notify the controller without delay and refrain from exercising them. No system is perfectly secure. You must use a strong password, protect your login credentials from disclosure, and protect the devices you use to access the Service (anti-virus software, firewall, physical access control, software updates). Data entered into the Service must be accurate and entered with due care.

Users must comply with these Terms and with applicable law, and must act in the Service in good faith and in accordance with accepted standards of conduct. Users must not: use the Service in a way that could cause it to fail or malfunction; interfere with the Service, in particular through viruses, bots or other automation software; circumvent, remove, modify or otherwise weaken its security measures; infringe the rights of third parties, including the rights of persons whose data are held in the Service; supply unlawful content; act to the detriment of the controller, the Service Administrator or any other person; or act in bad faith. Acceptance of these Terms and use of the Service do not transfer any title to the content held in the Service, nor any other rights or claims against the controller or the Service Administrator, beyond the rights expressly granted here.

An account may be suspended or deleted, or its permissions changed, where these Terms or applicable law have been breached, where steps towards such a breach have been taken, or where such steps are reasonably suspected — and also at the request of the user or of the controller.

Competitors: first name and surname, date of birth, sex, nationality / country, sports club, photograph, body weight measured at the competition weigh-in, sporting results and the full history of appearances (start lists, bouts, opponents, placings, points, statistics), accommodation and travel data connected with a competition, and archival competitor data comprising first name, surname, country, photograph and sporting results. Club coaches, national team coaches, referees, referee coordinators, international federation administrators and national administrators: first name and surname, email address, telephone number, country, role held and permissions, login data, referee performance assessments, and accommodation and travel data connected with a competition.

Personal data are processed in order to: (a) organise sumo competitions and other sumo events and to make their course public — entries, weigh-in, draws, scoring, rankings and publication of results; (b) keep a historic record of appearances, club affiliation, and the data of referees and coaches; (c) communicate with users and federations; (d) maintain the safety and integrity of the Service (audit trail, abuse prevention); (e) comply with legal obligations to which the controller is subject.

Processing is based on: Art. 6(1)(a) GDPR — consent of the data subject (or of the parent / legal guardian in the case of a minor); Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR — compliance with the controller's legal obligations; Art. 6(1)(f) GDPR — the legitimate interests of the controller in organising competitions and maintaining the historic sporting record. Where the data subject is a minor, Art. 8 GDPR applies in addition. Obtaining the necessary consents (or concluding agreements that constitute another basis for processing) and discharging the information duties under Art. 13 and 14 GDPR are the responsibility of the controller and of the users who enter data into the Service.

The following data are published on the public internet as part of the official record of a sporting event: competitor's first name and surname, year of birth, country, sports club, photograph, full results and history of appearances, rankings, and the first names, surnames and countries of referees and coaches. The following data are disclosed only to users signed in to the Service and holding the appropriate role: a competitor's full date of birth, body weight, email addresses and telephone numbers, user-account data, and accommodation and travel data.

The Service may profile competitors in order to predict the outcome of bouts, to support the preparation of a national team for a competition (analysis of competitor statistics), to enrich live broadcasts of a competition with additional statistics, and to build a competitor ranking system. Profiling is carried out on sporting data and does not produce legal effects concerning the data subject, nor does it similarly significantly affect them. The controller informs data subjects that their data may be subject to such profiling.

With your consent, data concerning your use of the Service and the sporting data held in it are processed for analytical purposes: producing competition and competitor statistics, building rankings and prediction models, comparing results across seasons and events, and measuring and improving the quality, reliability and usability of the Service. Analyses are produced on the controller's instructions and, where they are published, are published in the form described in section 10. This consent is given separately from acceptance of the Terms and is not a condition of using the Service — you are asked to answer yes or no when you accept the Terms, and answering no leaves every other function of the Service available to you. It may be withdrawn at any time in the settings of your account or by writing to europeansumofederation@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before it, and does not remove your results from the official record of a competition, which is kept on a separate basis (section 9).

Where the data subject is a minor, processing of their personal data requires the consent of the holder of parental responsibility or of their legal guardian, to the extent required by law (Art. 8 GDPR and the national law of the data subject). A user who adds a minor to the Service confirms, by ticking the dedicated consent box, that such written consent has been obtained and is held on file, and undertakes to produce it to the controller on request.

Recipients of personal data may include: (a) authorised personnel of the controller and of the national and international federations involved in running a competition; (b) organisers, referees and coordinators, to the extent required to carry out their assigned tasks; (c) the general public, where the data are published as part of the official record of a sporting event (section 10); (d) processors and sub-processors providing IT services to the controller — in particular hosting and transactional email providers. The Service is hosted on the Convex platform (Convex, Inc., United States). Personal data may therefore be transferred to and stored in a third country. The transfer takes place on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). Sub-processors are bound to data-protection obligations at least equivalent to those in the processing agreement between the controller and the Service Administrator.

Personal data are kept for as long as is necessary to achieve the purposes for which they were collected. As a default: account data — for as long as the account is active and for 24 months thereafter; competition-participation records — for 5 years after the end of the season to which they relate; sporting results, rankings and historical records — without a time limit, as part of the historic public record of the sport. The controller may set a different period. Earlier erasure may be requested in accordance with section 17.

Every user who, in the course of using the Service, adds the personal data of another natural person (a competitor, coach, referee or other person) must act on the basis of that person's consent to the processing of their personal data, or on another basis arising from the GDPR. Where required by law, the user must hold the consent of the competitor's parents or legal guardians. Adding personal data without holding such consent or another basis under the GDPR is a breach of these Terms and may result in the suspension of the user's account and in the user's personal liability under applicable law. The user must retain the signed consent and produce it to the controller on request. Responsibility for the infringement of any rights or interests — including personality rights — of persons whose data have been entered into the Service rests with the controller and with the user who entered them. The Service Administrator bears no responsibility in this respect; on receiving a demand from a person whose data have been entered into the Service, it notifies the controller without delay so that the controller can take the appropriate action.

The data subject has the right to: (a) obtain access to their personal data and a copy of them; (b) obtain the rectification of inaccurate data; (c) obtain erasure ("the right to be forgotten"), to the extent compatible with the legitimate interest in maintaining the historic sporting record; (d) obtain the restriction of processing; (e) data portability; (f) object to processing based on legitimate interests; (g) withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal; (h) lodge a complaint with the competent supervisory authority (in Poland: the President of the Personal Data Protection Office — UODO). These rights are exercised against the controller named in section 1, at europeansumofederation@gmail.com.

For every personal-data record created in the Service, the Service records the identity of the user who created it and the timestamp of creation. This trail is kept for the lifetime of the data subject's record and serves (i) to enable rectification or erasure on request, and (ii) to identify the responsible user in the event of a complaint concerning unlawful entry of data.

The Service applies technical and organisational measures appropriate to the risk of the processing, including encryption in transit, encryption at rest, role-based access control and logging. Persons authorised to process personal data are bound to keep them confidential.

The Service uses cookies and other technologies for storing and reading data in your browser (localStorage, sessionStorage, IndexedDB, Cache Storage and a Service Worker). Strictly necessary purposes — used without separate consent, because the Service cannot be provided without them: keeping you signed in (authentication tokens held in a cookie and/or browser storage), maintaining your session, security, load balancing, and remembering the choice you made in the consent banner. Functional purposes: remembering your interface language, your theme and layout preferences, and the state of the views you work in. Offline-first operation: SumoCup is designed to run a competition in a hall with no reliable network. To make that possible the Service installs a Service Worker and stores, in your browser's IndexedDB and Cache Storage: the application shell (code, styles, fonts, icons) and a copy of the competition data you have opened — start lists, weigh-in records, draws, bouts, results and reports — together with a queue of changes you make while offline (an "outbox"). Those changes are held on your device and sent to the server when the connection returns. This means personal data of competitors and other participants may be stored on the device you use, for as long as the cache is retained. Do not use the offline mode on a shared or public device. You can remove this data at any time by signing out, clearing the site's data in your browser, or uninstalling the application; clearing it while changes are still queued will discard those changes. The Service does not use third-party advertising cookies and does not profile you for advertising purposes across other websites. You can manage or block cookies and site storage in your browser settings; blocking the strictly necessary ones will prevent you from signing in and will disable offline operation.

With your consent, the email address held in your account is used to send notifications connected with the Service: information about competitions and entry deadlines, the status of your entries and those of your delegation, changes to the schedule, results and reports, invitations and requests for confirmation, and announcements about changes in the Service and new functionality. This consent is given separately from acceptance of the Terms and is not a condition of using the Service — you are asked to answer yes or no when you accept the Terms, and answering no leaves every other function of the Service available to you. It may be withdrawn at any time in the settings of your account, using the unsubscribe link in the message, or by writing to europeansumofederation@gmail.com. Withdrawal does not stop messages that are necessary to operate your account and that are sent without consent — in particular messages concerning the creation of the account, password changes and resets, security notices, and information about changes to these Terms.

The Service Administrator is responsible for the technical and administrative operation of the software that runs the Service and takes due care to keep it continuously available, but does not guarantee that it will be uninterrupted: the Service depends on a number of components, including third-party software with its own capacity limits and licence terms, whose functionality may change. The Service may be temporarily suspended in order to carry out changes, inspections or maintenance of the devices, systems or networks used to provide it, to remedy faults in them, or to remove unauthorised interference with the Service and its effects. The Service Administrator is not liable for unavailability of the Service or for loss of data caused by the unavailability of external services (for example a hosting provider), by failures of devices, IT systems and networks or of the power grid, by the acts or omissions of third parties, or by other circumstances beyond its control, including force majeure. Faults and failures should be reported to jakobn.jn@gmail.com with a description of the problem.

These Terms may be updated, in particular where: changes are made to the Service, such as the addition or removal of functionality or the modification of security measures; the Service is adapted to changes in generally applicable law or to judgments and decisions of courts or public authorities; or new rules for the operation and use of the Service are laid down. The current version is identified by a version number. A new version enters into force on the day it is published. After a new version is published, users must accept the Terms again before continuing to use the Service. Users are informed of a change by a notice placed in the Service; information about material changes may additionally be sent by email where possible. In connection with the use of the Service, users may receive administrative announcements, notices about new functionality and other information concerning the operation of the Service.

Any disputes arising in connection with these Terms are to be resolved by the court having jurisdiction over the seat of the Service Administrator. The governing law is Polish law.

Personal data — the controller: EUROPEJSKA FEDERACJA SUMO, ul. Mały Rynek 13, 63-700 Krotoszyn, Polska, europeansumofederation@gmail.com. Operation of the Service, faults, technical and administrative matters — the Service Administrator: Jakub Nowakowski, Lubzina 11e, 39-102 Lubzina, Polska, jakobn.jn@gmail.com.