This data processing agreement (the "Agreement") is concluded under art. 28 of Regulation (EU) 2016/679 ("GDPR") between the club creating an account on kumite.ro (the "Controller" or the "Club") and DOBRE R FLORIN PFA, registered with the Trade Register under no. F8/46/14.01.2022, tax ID (CIF) 45478642, legally represented by Dobre Florin (the "Processor" or the "Platform"). It is accepted electronically when the account is created and forms part of the Terms and Conditions.
1. Subject matter and duration
The Platform processes, on behalf of the Club, the personal data of the athletes affiliated with the Club, for the purpose of managing them and registering them for and running competitions. The Agreement remains in force while the Club has an active account and until the data is deleted or returned under section 8.
2. Nature and purpose of the processing
- storing and displaying athlete data in the Club's account;
- registering athletes for competitions and passing the lists to organisers;
- placing athletes into age, sex and weight categories, draws, generating the bout schedule;
- recording results and displaying them on scoreboards, venue monitors and public results pages;
- displaying the athlete's photo, only where the Club has recorded the corresponding consent.
3. Categories of data and of data subjects
| Data subjects | Data |
|---|---|
| Athletes of the Club, including minors | first name, last name, sex, date of birth, weight, belt, country, NIKO card / FRAM number, photo, competition number, registrations, results; IBAN, if the Club fills it in |
| Parents or guardians of minor athletes | name, relationship, email address, proof of consent (where recorded through the Platform) |
The Club shall not enter special categories of data under art. 9 GDPR (for example medical data) into the Platform, other than in fields expressly designed for that purpose, should such fields exist.
4. Controller's instructions
The Platform processes data only on the Club's documented instructions. The instructions are: this Agreement, the Terms and Conditions, and the actions the Club performs in the Platform (adding, editing, deleting athletes, registering them for competitions). If the Platform considers that an instruction infringes the GDPR or other legal provisions, it informs the Club immediately.
5. Processor's obligations
The Platform undertakes to:
- process the data only for the purposes in section 2 and not for its own purposes, except those for which the Platform is a controller under the Privacy Policy (accounts, security, publication of results);
- ensure that persons authorised to process the data have committed themselves to confidentiality;
- implement the technical and organisational measures in section 10;
- respect the conditions in section 6 for engaging sub-processors;
- assist the Club, through the Platform's features and on request, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection);
- assist the Club in meeting its obligations regarding security, breach notification and impact assessments, taking into account the information available to the Platform;
- notify the Club without undue delay and at the latest within 48 hours of becoming aware of a personal data breach, with the information needed to notify the authority and the data subjects;
- at the end of the service, delete or return the data under section 8;
- make available to the Club the information necessary to demonstrate compliance and allow audits under section 9.
6. Sub-processors
The Club gives general authorisation for the following sub-processors:
| Sub-processor | Service | Location |
|---|---|---|
| [FURNIZOR GĂZDUIRE], Uniunea Europeană | server and database hosting | European Union |
| Railsware Products Studio LLC (Mailtrap) | email delivery | EU / USA |
| Functional Software, Inc. (Sentry) | technical error monitoring | USA |
| Google Ireland Ltd. (reCAPTCHA) | anti-spam protection on authentication forms | EU / USA |
The Platform informs the Club, by updating this page and by a notice at the next login, at least 14 days before adding or replacing a sub-processor. The Club may object in writing within that period; if no solution is found, the Club may close its account. The Platform imposes on sub-processors, by contract, obligations equivalent to those in this Agreement and remains liable to the Club for them.
7. International transfers
Data is stored in the European Union. Transfers to sub-processors outside the EU take place only under the standard contractual clauses adopted by the European Commission or an adequacy decision (including the EU-US Data Privacy Framework).
8. Deletion and return of data
The Club may delete athletes from its account at any time. On account closure the Platform deletes or anonymises the athletes' data within 30 days, except competition results (name, club, ranking), which are kept as the historical archive of the competition in the Platform's capacity as controller, and data whose retention is required by law. Before closure, the Club may request an export of its data.
9. Audit
The Club may request, at most once a year and with 30 days' notice, information and documents demonstrating compliance with this Agreement. An on-site audit may be carried out only if the information provided is insufficient, in a manner that does not disrupt the Platform's operation and that respects the confidentiality of other customers.
10. Technical and organisational measures
- encrypted communications (HTTPS/TLS) for every page;
- passwords stored only as irreversible hashes; login attempt limiting; anti-automation protection;
- role-based access control; each club sees only its own athletes;
- database reachable only from the server's internal network; administrative access via cryptographic keys;
- regular backups; access and error logs kept for at most 12 months;
- regular software updates; error monitoring;
- staff access limited to what is necessary and subject to confidentiality.
11. Controller's obligations
The Club warrants that it: has a legal basis for processing its athletes' data; has informed the data subjects (including parents or guardians of minors) in line with art. 13 GDPR; holds the consents required to publish photos; enters accurate and up-to-date data; answers data subject requests and notifies the supervisory authority where the law requires.
12. Liability
Each party is liable for damage caused by breaching its own obligations under this Agreement and the GDPR, in accordance with art. 82 GDPR.
13. Final provisions
This Agreement is governed by Romanian law. In case of conflict between this Agreement and the Terms, the Agreement prevails with respect to the processing of personal data. Amendments are notified to authenticated users and must be accepted to continue using the Platform. Electronic acceptance, by ticking the box at registration or login, has the value of a signature, and the Platform keeps proof of acceptance (date, time, IP address, document version).