Privacy and cookies

1. Data controller

The data controller is [GYM NAME], with registered office at [FULL ADDRESS], reachable at [CONTACT EMAIL].

No Data Protection Officer has been appointed: the processing does not fall within the cases where Article 37 GDPR makes one mandatory. If the gym appoints one, their contact details belong here.

Faixa BJJ hosts several gyms. Each gym is the controller of its members' data; the portal's operator processes it on the gym's behalf (processor) and does not access students', attendance or promotion data.

2. What data we process

Contact and identity data: name, email, phone number, date of birth. Name and email are required to create an account; phone and date of birth are optional.

Registration request through the gym's link: full name, email, username, date of birth, join date and, if stated, belt, stripes and their dates. Here the date of birth is required, because it decides which belt system applies. While the request is pending, only the gym's manager and head coaches can see this data: if they approve it, it becomes your profile; if they reject it, it is deleted together with the account.

Technical progression data: belt, number of stripes, date of the last belt promotion, date of the last stripe, join date, role held at the gym and its history.

Attendance data: present or absent for each lesson, recording whether the presence was entered by the member (check-in) or by the instructor (roll call).

Device location: if the gym has set its location, at check-in the browser asks for your phone's. It is used only to check that you are within 50 m of the gym: it is compared and discarded, never stored or written to logs. The browser asks for permission according to its settings; refusing only prevents checking yourself in, since the instructor can always record your attendance in the roll call.

Free-text notes: a field staff can fill in. It must not be used for special categories of data under Article 9 GDPR — health or injuries in particular — because this notice does not cover that kind of processing.

Access data: credentials handled by the authentication provider (passwords are stored only as hashes, never in clear text) and the service's technical logs.

3. Why we process it, and on what legal basis

Managing membership and the relationship with the gym, recording attendance and counting training hours: performance of the contract or membership relationship to which the person is party (Art. 6(1)(b) GDPR).

Assessing eligibility for stripes and belts and keeping the history of technical progression: the gym's legitimate interest in documenting its members' technical path (Art. 6(1)(f) GDPR). The promotion decision always remains the instructor's: the application promotes nobody automatically.

Keeping access to the portal secure: legitimate interest in protecting accounts and data (Art. 6(1)(f) GDPR).

We carry out no profiling and no automated decision-making producing legal effects on the person.

4. Who can see the data

Access is limited by role, and the limit is enforced by the database itself, not only by the interface. A student sees their own data and the lesson calendar. An instructor sees the member list read-only and manages courses and attendance. Head coach and admin have full access and can manage accounts.

No data is sold or handed to third parties for marketing purposes.

5. How long we keep it

Membership data and attendance history are kept for the whole duration of the relationship with the gym and for [NUMBER] years afterwards, a period to be set according to the applicable civil and tax obligations.

Revoking portal access deletes the sign-in credentials but keeps the person's record and their attendance history: they are the gym's technical register. Full deletion can be requested as described in point 7.

6. Where the data is and who it is shared with

Data is stored on Supabase (database, authentication and storage) and the site is published on Vercel. Both act as processors under Article 28 GDPR.

Account emails (password reset, email change confirmation, notices) are sent through a service running on Cloudflare Workers and delivered by the email provider configured for it. They receive only the recipient's address, name and the content of the message, and act as processors too.

The project is configured on infrastructure within the European Union. Where a provider processes data outside the European Economic Area, the transfer relies on the Standard Contractual Clauses adopted by the European Commission.

7. Your rights

You may at any time request access to your data, its rectification or erasure, restriction of processing, portability, and you may object to processing based on legitimate interest (Articles 15 to 22 GDPR).

Some corrections are immediate: from the Account page you can change your own name, email, phone, date of birth and notes. Belt, stripes and promotion dates are deliberately read-only, because promotion is the instructor's decision: to correct them, write to the controller.

To exercise your rights write to [CONTACT EMAIL]. If you believe the processing breaches the rules you may lodge a complaint with your national supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

8. Security

Access is through a personal account with a password. Passwords are stored only as hashes. The separation between what each role may read and write is enforced by the database through Row Level Security policies, so it holds for any request, including one that never goes through the interface.