Read the FAQ
Information on the processing of personal data
Information on the processing of personal data pursuant to EU Regulation 2016/679
EU Regulation 2016/679 "General Data Protection Regulation" (hereinafter "GDPR") establishes the right of every person to the protection of the personal data concerning them. As a data subject, pursuant to art. 13 of the GDPR, we therefore provide you with the following technical and detailed information on the processing of your personal data.
For a shorter and more accessible notice, see the Privacy Policy.
1. Identity and contact details of the Data Controller
**Data Controller**:
- Name: Marrocco Simone
- Email: [email protected]
- General email: [email protected]
**Contact point for data protection**: [email protected]
2. Categories of personal data processed
Pursuant to art. 13, paragraph 1, letter c) of the GDPR, we inform you of the following categories of personal data subject to processing:
**a) Common data (Art. 4, no. 1 GDPR)**:
- Personal details: first name, last name, date of birth, sex, place of birth
- Contact data: email address, phone number
- Club identification data: club name, FIJLKAM club code, region
- Sports data: body weight, weight category, belt, competition results
- Data of parents/guardians: first name, last name, tax code, email and phone number, entered by the parent themselves through the parents' area or the club's links
**b) Authentication data**:
- Login credentials: email address (username), encrypted password (bcrypt hash)
- JWT (JSON Web Token) session token
**c) Financial data**:
- Payment documents: bank transfers uploaded voluntarily by the user
- Amounts paid for registration fees
- Transaction history for the Judo in Cloud service
**d) Data generated by the use of the service**:
- Date and time of access
- Actions performed on the platform
- Anonymized usage statistics (without IP address)
**e) Special categories of data (Art. 9 GDPR) - Only for Judo in Cloud Pro**:
- Medical certificates of the athletes (uploaded by the club or by the parents through the dedicated link)
- Legal basis: explicit consent of the data subject (Art. 9, paragraph 2, letter a GDPR)
**f) Content published by the clubs - Only for Judo in Cloud Pro**:
- Texts and images that the club chooses to publish on its own public website
**We do not collect**:
- IP addresses (they are not stored in our systems; the network providers process them only in transit)
- Geolocation data
- Profiling cookies
3. Purposes of the processing and legal basis
Pursuant to art. 13, paragraph 1, letters c) and d) of the GDPR:
**a) Provision of the IT consulting service for the management of sports competitions (Art. 6.1.b GDPR - Performance of the consulting contract)**
- Registration of athletes for competitions
- Creation of draws and brackets
- Management of matches and results
- Publication of rankings
- Competition history
**b) User account management (Art. 6.1.b GDPR - Performance of the consulting contract)**
- Authentication and authorization
- Management of login credentials
- Communications related to the consulting service
**c) Accounting and tax obligations (Art. 6.1.c GDPR - Legal obligation)**
- Invoicing of IT consulting services
- Retention of tax documents for 10 years
- Tax compliance
**d) Judo in Cloud Pro features (Art. 6.1.a GDPR - Consent)**
- Management of courses and attendance
- Collection of medical certificates
- Management of club payments
- Consent can be withdrawn at any time
**e) System security (Art. 6.1.f GDPR - Legitimate interest)**
- Prevention of fraud and abuse
- Protection of data integrity
- Anomaly detection
**f) Improvement of the service (Art. 6.1.f GDPR - Legitimate interest)**
- Anonymized usage statistics
- Performance optimization
- Development of new features
**g) Club websites (Art. 6.1.b GDPR - Performance of the consulting contract)**
- Publication of the club's public website with the texts and images chosen by the club
- Connection of a custom domain to the website
**h) Automatic document analysis and content moderation**
- Extraction of data from PDFs uploaded by the user — competition schedules, licences, training camps, bank transfers (Art. 6.1.b GDPR - Performance of the contract, at the user's request)
- Automatic check of the texts and images of the club websites before publication (Art. 6.1.f GDPR - Legitimate interest: security and lawfulness of the published content)
4. Nature of the provision of data
**Mandatory data**:
The provision of the following data is mandatory to use the service:
- Athletes' personal details (for competition registration)
- Email and password (for account creation)
- Club data (for the coach account)
Failure to provide them makes it impossible to:
- Take part in competitions
- Use the restricted features of the platform
**Optional data**:
- Phone number (for urgent communications)
- Medical certificates (only for Judo in Cloud Pro)
- Payment documents (if the bank transfer collection system is used)
5. Methods of processing
Pursuant to art. 13, paragraph 1, letter f) of the GDPR, the processing is carried out as follows:
**Methods**:
- Computerized processing through cloud systems
- Limited paper-based processing (printing of brackets for backup)
**Tools**:
- MongoDB database with encryption at rest
- Google Cloud Platform application servers
- HTTPS connections with SSL/TLS certificate
- Passwords encrypted with the bcrypt algorithm
- JWT tokens for authentication with automatic expiry
**Principles applied** (Art. 5 GDPR):
- Lawfulness, fairness and transparency
- Purpose limitation
- Data minimization
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
**Authorized personnel**:
Only expressly authorized personnel have access to the data, limited to the functions within their competence.
6. Recipients or categories of recipients of the personal data
Pursuant to art. 13, paragraph 1, letter e) of the GDPR, your data may be communicated to:
**a) External data processors (Art. 28 GDPR)**:
- **Google Cloud Platform**
- Purpose: hosting of application servers
- Location: Finland (hub europe-north1)
- Safeguards: Standard Contractual Clauses, ISO 27001 certification
- Privacy policy: cloud.google.com/privacy
- **MongoDB Atlas**
- Purpose: database management
- Location: Belgium (GCP hub europe-west1)
- Safeguards: Standard Contractual Clauses, SOC 2 certification
- Privacy policy: mongodb.com/legal/privacy
- **Fireworks AI, Inc.**
- Purpose: AI inference for the analysis of PDF documents and the moderation of website content
- Retention: zero data retention — the data sent exists only in volatile memory for the duration of the request, it is not logged or stored and it is not used to train models
- Location: United States (transient processing)
- Safeguards: Standard Contractual Clauses, SOC 2 Type II, ISO 27001/27701/42001 certifications
- Documentation: trust.fireworks.ai
- **Resend, Inc.**
- Purpose: sending of transactional emails (confirmations, notifications, personal links)
- Location: Ireland (EU region eu-west-1)
- Safeguards: Data Processing Addendum with Standard Contractual Clauses
- Privacy policy: resend.com/legal/privacy-policy
- **Cloudflare, Inc.**
- Purpose: content delivery network (CDN), protection and TLS termination for the service domains — transit only, no storage of content
- Safeguards: EU-US Data Privacy Framework, Standard Contractual Clauses
- Privacy policy: cloudflare.com/privacypolicy
**b) Categories of recipients within the service**:
- Organizers: access to the data of the athletes registered for their competitions
- Coaches/Clubs: access to the data of their own athletes
- Public: display of the published results and rankings, and of the content that a club chooses to publish on its own website
**c) Public authorities**:
In case of legitimate requests from judicial or administrative authorities.
7. Transfer of data to third countries
Your personal data **is stored exclusively on servers located in the European Union**:
- Database: Belgium
- Application servers: Finland and/or Belgium
- Email: Ireland
Google and MongoDB, although they are US companies, store our data exclusively in European data centers with adequate safeguards pursuant to arts. 44 et seq. of the GDPR.
Two processing activities involve a limited transit outside the EU, both covered by Standard Contractual Clauses pursuant to arts. 44 et seq. of the GDPR:
- **AI analysis (Fireworks AI)**: the documents and texts sent for analysis are processed transiently on servers in the United States, exist only in volatile memory for the duration of the request and are not stored (zero data retention)
- **Distribution network (Cloudflare)**: the traffic to the service domains passes through the Cloudflare network (EU-US Data Privacy Framework), without storage of content
8. Data retention period
Pursuant to art. 13, paragraph 2, letter a) of the GDPR:
**Retention criteria**:
- Account data and sports data: until deletion is requested
- Tax and payment documents: 10 years by legal obligation
- Texts and images of the club websites: as long as the club keeps them published or uploaded, or until deletion is requested
- Usage logs of the AI services: metadata only (token counts and costs) — never the analyzed content
**Right to erasure**: You can request the erasure of your data at any time by writing to [email protected]. Every request is fulfilled. If part of the data is subject to retention obligations (for example tax documents or medical certificates), we first provide you with the data export and then proceed to delete everything that is not subject to such obligations.
9. Rights of the data subject
Pursuant to arts. 15-22 of the GDPR, you have the right to:
**a) Right of access (Art. 15 GDPR)**:
Obtain confirmation of the existence of data concerning you and receive a copy of it in an intelligible format.
**b) Right to rectification (Art. 16 GDPR)**:
Obtain the rectification of inaccurate data or the completion of incomplete data.
**c) Right to erasure ("right to be forgotten") (Art. 17 GDPR)**:
Obtain the erasure of your data when:
- They are no longer necessary for the purposes
- You have withdrawn your consent
- You have objected to the processing
- They have been processed unlawfully
- There is a legal obligation to erase them
**d) Right to restriction (Art. 18 GDPR)**:
Obtain the restriction of the processing when:
- You contest the accuracy of the data
- The processing is unlawful but you do not want the erasure
- The data is no longer necessary but you need it for your legal defence
- You have objected, pending verification
**e) Right to data portability (Art. 20 GDPR)**:
Receive the data in a structured, commonly used and machine-readable format (JSON/CSV) and transmit it to another controller.
**f) Right to object (Art. 21 GDPR)**:
Object to processing based on legitimate interest on grounds relating to your particular situation.
**g) Right to withdraw consent (Art. 7 GDPR)**:
Withdraw the consent given for Judo in Cloud Pro at any time, without affecting the lawfulness of the processing carried out before.
**h) Right to lodge a complaint (Art. 77 GDPR)**:
Lodge a complaint with the supervisory authority:
- **Garante per la Protezione dei Dati Personali**
- Piazza Venezia n. 11, 00187 Roma
- Tel: +39 06.696771
- Email: [email protected]
- Web: www.garanteprivacy.it
10. How to exercise your rights
To exercise your rights:
**1. Send a request by email**:
- To: [email protected]
- Subject: "Exercise of GDPR rights"
**2. Response times**:
- Reply within **30 days** of receipt
- Extension up to 60 days for complex requests (with notice)
**3. Response method**:
- Reply by email with the requested data
- Data format: JSON or CSV for portability
**4. Costs**:
- Free of charge for the first request
- Possible reasonable costs for manifestly unfounded or excessive requests
11. Automated decision-making and profiling
Pursuant to art. 13, paragraph 2, letter f) of the GDPR:
**Judo in Cloud does NOT carry out**:
- Fully automated decision-making processes with legal effects
- Profiling within the meaning of art. 4, no. 4 GDPR
- Automatic scoring or evaluation of people
**Automated processing limited to**:
- Automatic calculation of the athletes' weight category (based on age, sex, weight)
- Algorithmic creation of sports draws (random, without bias)
- Automatic calculation of rankings (based on match results)
- Automatic extraction of data from PDFs uploaded by the user (AI analysis performed at the user's request, with a result that can always be checked and edited before use)
- Automatic moderation of the content of the club websites: texts and images receive an approved/rejected outcome before publication; a rejection blocks publication and shows the reasons to the club, which can always request a human review by writing to [email protected]
This processing does not produce legal effects on people or evaluations of the person.
12. Personal data breach (Data Breach)
In case of a personal data breach that results in a high risk to the rights and freedoms of the data subjects:
**Obligations of the Controller**:
- Notification to the Garante within 72 hours (Art. 33 GDPR)
- Communication to the data subjects without undue delay (Art. 34 GDPR)
**Measures adopted to prevent data breaches**:
- Encryption of sensitive data
- Regular and redundant backups
- Continuous security monitoring
- Incident response procedures
**In case of a data breach you will receive**:
- A communication by email
- A description of the nature of the breach
- The possible consequences
- The measures adopted or to be adopted
13. Source of the personal data
The personal data comes from:
**a) Directly from the data subject**:
- Data entered during registration
- Data entered by the coach for their own athletes
- Data entered by the organizer
**b) From third parties (with consent)**:
- Coaches who register underage athletes (with parental consent)
- Organizers who enter athletes on the day of the competition
14. Security measures
Pursuant to art. 32 GDPR, the following security measures have been implemented:
**Technical measures**:
- Password encryption with bcrypt (12 rounds)
- HTTPS/TLS 1.3 connections
- JWT tokens with automatic expiry
- Two-factor authentication for admins
- Firewall and DDoS protection
- Database with encryption at rest
**Organizational measures**:
- Access policies based on the "need to know" principle
- Staff training on data protection
- Backup and disaster recovery procedures
- Audit log of critical operations
- Security incident management procedures
15. Updates to this notice
This notice may be updated periodically. In case of substantial changes:
- Publication of the new version on this page
- Notification by email to registered users
- Date of the last update shown at the bottom
**Last updated**: August 2026
16. Contacts and information
For any information on the processing of personal data:
**Data Controller**:
- Marrocco Simone
- GDPR email: [email protected]
- General email: [email protected]
**Supervisory authority**:
- Garante per la Protezione dei Dati Personali
- Piazza Venezia n. 11, 00187 Roma
- Tel: +39 06.696771
- Web: www.garanteprivacy.it
---
**Declaration of compliance**: The Data Controller declares that the processing of personal data carried out through Judo in Cloud complies with the provisions of EU Regulation 2016/679 (GDPR) and of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.