Privacy policy

1. Controller

Digital Diamant GmbH

Max-Reger-Str. 2, 50931 Köln, Germany

E-mail: datenschutz@digitaldiamant.de

Data protection officer: Frank Mühlenbeck, datenschutz@digitaldiamant.de

2. Overview

This privacy policy tells you how we collect, process and use personal data on karatedojo.app. We take the protection of your data seriously and process it exclusively on the basis of applicable data protection law, in particular the General Data Protection Regulation (GDPR).

3. What data we collect

When an account is created:

• name, e-mail address, password (encrypted)
• for clubs additionally the club name, address and contact person
• time of consent and version of the accepted privacy policy

When the app is used — and only as far as the club records it:

• member data (name, date of birth, belt grade, group)
• sign-ups and sign-offs for training sessions, confirmed attendance
• grading results and promotions
• profile photo, if provided
• guardianship links between parent accounts and children’s profiles

Collected automatically:

• IP address, browser type, operating system
• pages visited and time of access

4. Legal bases for processing

• Art. 6 (1) (a) GDPR (consent): push notifications, getting in touch via the form
• Art. 6 (1) (b) GDPR (performance of a contract): providing the app to the club and its members
• Art. 6 (1) (c) GDPR (legal obligation): retention duties
• Art. 6 (1) (f) GDPR (legitimate interest): platform security, abuse prevention

5. Technical service providers

We use the following service providers, with whom data processing agreements pursuant to Art. 28 GDPR have been concluded:

• Supabase (Supabase Inc., USA): database, authentication, file storage. Data is held in the EU (Frankfurt region). Processing on the basis of standard contractual clauses (SCC). https://supabase.com/privacy
• Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA): hosting and delivery of the web application. https://vercel.com/legal/privacy-policy
• Resend (Resend Inc., USA): sending e-mail. Processing on the basis of standard contractual clauses (SCC). https://resend.com/privacy

6. No analytics or advertising services

We use neither Google Analytics nor the Meta Pixel, Leadinfo or any comparable service. There is therefore no cookie banner either: there is nothing for you to consent to.

Where advertising space appears in this app, it belongs to the sponsors of that club. The club maintains it itself, and it embeds no third-party service.

7. Cookies

We use strictly necessary cookies only. No consent is required for them:

• a session cookie for signing in (Supabase Auth)
• a cookie for the chosen language

8. Push notifications

If you allow push notifications, we store the identifier your browser assigns to your device so that we can deliver cancellations and club news. You can withdraw the permission at any time in your browser or in the app; the identifier is then deleted.

9. Retention periods

• account data: until the account is deleted, then 30 days of backup retention
• member and training data: for as long as the club uses the app
• enquiries via the contact form: 3 years from the last contact
• records of consent: 3 years (GDPR duty of proof)
• invoice data: 10 years (statutory retention period)
• log data and IP addresses: 30 days

10. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR): you may request information about the data stored about you
• Rectification (Art. 16 GDPR): you may request that incorrect data be corrected
• Erasure (Art. 17 GDPR): you may request the deletion of your data
• Restriction (Art. 18 GDPR): you may request that processing be restricted
• Data portability (Art. 20 GDPR): you may receive your data in a machine-readable format
• Objection (Art. 21 GDPR): you may object to processing based on legitimate interests
• Withdrawal of consent (Art. 7 (3) GDPR): you may withdraw consent given at any time

To exercise your rights, please contact: datenschutz@digitaldiamant.de

11. Right to complain

You have the right to complain to a data protection supervisory authority. The competent authority for Digital Diamant GmbH is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany

Phone: +49 211 38424-0 · E-mail: poststelle@ldi.nrw.de · https://www.ldi.nrw.de

12. Currency of this policy

We reserve the right to adapt this policy when the app or the legal situation changes. The current version is always available at karatedojo.app/en/datenschutz.