1. Who we are
The kumite.ro platform (the "Platform") is operated by DOBRE R FLORIN PFA, registered with the Trade Register under no. F8/46/14.01.2022, tax ID (CIF) 45478642, legally represented by Dobre Florin ("we" or the "Provider"). For any question about personal data write to contact@kumite.ro.
This policy explains which personal data we process through the Platform, for what purpose, on which legal basis, for how long, and what your rights are. It applies to everyone whose data reaches the Platform: club representatives, athletes (including minors), parents or guardians, referees, operators and visitors of the public pages.
2. Who is responsible for your data
Clubs that create an account and enter their athletes are controllers of their athletes' data: the club decides whom to register, based on its direct relationship with the athlete and the athlete's parent. For this data we act as the club's processor, under the Data Processing Agreement.
We are the controller for: Platform user accounts, technical and security data, proof of acceptance of the legal documents, and the publication of competition results on the public pages and scoreboards.
Competition organisers receive the registration lists and are controllers for running the event itself.
3. Data we process
| Category | Data | Source |
|---|---|---|
| User account (club manager, referee, operator, administrator) | first name, last name, email address, password (stored as an irreversible hash), role, account status, email verification date | directly from you |
| Club | name, country, address, phone, email, website | from the club representative |
| Athletes | first name, last name, sex, date of birth, weight, belt, club, country, NIKO card / FRAM number, photo, competition number; IBAN, only if the club fills it in | from the athlete's club |
| Registrations and results | competitions and categories the athlete is registered in, bouts, scores, penalties, rankings | generated by the Platform and by competition officials |
| Proof of acceptance | document accepted, version, date and time, IP address, browser | generated on acceptance |
| Technical data | IP address, browser and device type, pages visited, technical errors, session cookies | generated automatically when using the Platform |
4. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Creating and managing the account, authentication, account communications | performance of a contract (the Terms and Conditions) |
| Managing a club's athletes, registering them for competitions, draws, placing into age, sex and weight categories, refereeing and computing results | for the club: performance of the membership contract and the legitimate interest of organising sport; we process on the club's behalf |
| Displaying athletes' names, clubs and results on scoreboards, venue monitors and public results pages | legitimate interest in transparently organised sports competitions; you may object (section 10) |
| Displaying the athlete's photo on scoreboards and public pages | consent of the athlete or, for minors, of the parent or guardian, obtained by the club; can be withdrawn at any time |
| Sending operational emails (account approval, password reset, notifications) | performance of a contract |
| Platform security: abuse prevention, anti-spam protection (reCAPTCHA), access logs, error monitoring | legitimate interest (service security) |
| Keeping proof of acceptance of the legal documents | legal obligation (art. 7(1) GDPR) and legitimate interest |
| Answering requests, defending our rights, accounting or legal obligations | legal obligation and legitimate interest |
5. Minor athletes
Many athletes are minors. Their data is entered by the club they are affiliated with, which has the direct relationship with the athlete and their parent or guardian. By accepting the Terms and the Data Processing Agreement, each club declares that it has informed the parents and that it holds the required consents, in particular for publishing the child's photo.
For athletes under 18, consent to publish the photo is given by the parent or guardian. Without it, the photo is not displayed publicly. We do not knowingly request or collect data about minors beyond what is strictly needed to run the competition.
If you are a parent or guardian and want to check, correct or delete your child's data, contact the club or write to us at contact@kumite.ro.
6. What is publicly visible
Public results pages, scoreboards and venue monitors display: the athlete's first and last name, club, country, category, competition number, bouts, scores and ranking. The athlete's photo is shown only where consent to publish the image exists. We do not publish date of birth, exact weight, contact details or bank details.
7. Who receives the data
- Organisers of the competitions the club registers athletes for: they receive registration lists and results.
- Competition officials (referees, scoreboard operators): they see the data needed to run the bouts.
- The public, within the limits described in section 6.
- Our service providers, who process data on our behalf under data processing contracts:
| Provider | Service | Location |
|---|---|---|
| [FURNIZOR GĂZDUIRE], Uniunea Europeană | hosting of servers and database | European Union |
| Railsware Products Studio LLC (Mailtrap) | delivery of operational emails | EU / USA, standard contractual clauses |
| Functional Software, Inc. (Sentry) | technical error monitoring; personal data is stripped from reports as far as possible | USA, standard contractual clauses and EU-US Data Privacy Framework |
| Google Ireland Ltd. (reCAPTCHA) | anti-spam protection on the authentication forms | EU / USA, standard contractual clauses |
We do not sell personal data and do not use it for advertising. We may disclose data to public authorities when the law requires it.
8. Transfers outside the European Union
Data is stored in the European Union. Some providers (Sentry, Google, Mailtrap) may process data in the United States. In those cases we rely on the standard contractual clauses approved by the European Commission and, where applicable, on the provider's certification under the EU-US Data Privacy Framework.
9. How long we keep data
| Data | Retention |
|---|---|
| User account and club | while the account is active; deleted or anonymised within 30 days of account closure |
| Athlete identification data (date of birth, weight, photo, card, IBAN) | 3 years after the athlete's last competition, then anonymised |
| Sports results (name, club, ranking) | kept as the historical archive of the competitions; on request the name can be anonymised |
| Proof of acceptance of legal documents | 3 years after account closure |
| Technical and security logs | at most 12 months |
10. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, portability, the right to object to processing based on legitimate interest, and the right to withdraw consent at any time without affecting earlier processing.
For athletes' data, requests go first to the club, which is the controller. You may however write to us directly at contact@kumite.ro; we will forward the request to the club or handle it ourselves, depending on our role. We answer within 30 days at most.
If you believe your rights have been infringed you may lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the authority of your country of residence.
11. Security
We use encrypted connections (HTTPS), passwords stored with irreversible hashing algorithms, role-based access, access logs, backups, and a database reachable only from the server's internal network. Staff and contractor access is restricted to what is necessary.
12. Cookies
The Platform only uses strictly necessary cookies and Google reCAPTCHA on the authentication forms. Details in the Cookie Policy.
13. Changes
We may update this policy. The current version and its date are shown at the top of the page. For material changes, authenticated users will be asked to acknowledge the new version at their next login.
14. Contact
DOBRE R FLORIN PFA, contact@kumite.ro.