Privacy Policy

01Data controller

The controller of your personal data is SP- CLUB STSIAPAN PAPOU (NIP 8943270875, REGON 542975182), ul. Tęczowa 79/81, 53-601 Wrocław. For personal data matters, contact us: kontakt@orion-bjj.pl, phone: +48 889 297 030.

02What data we collect

• Trial training registration form: name, phone number, optionally e-mail, selected programme and group, and the content of the message.
• E-mail to kontakt@orion-bjj.pl: sender's e-mail address and name, subject, message content, and our reply. We do not save the contents of attachments — we only keep their names.
• The "Step by Step" game, if you save your score in the ranking: nickname, score, belt, game time, and a technical hash created from the IP address and browser. We do not save the IP address itself. We also save the date and time of saving the score. The nickname, score, and belt are publicly visible in the ranking on the game page, and the public ranking API makes them available together with the date and time of saving.
• Technical data upon each visit (IP address, browser, page address) are processed by our hosting provider to deliver the website and protect it against attacks. The website itself temporarily holds the IP address in the server's memory, without saving it in the database, to limit the number of submissions and game starts from a single address.

03Purposes and legal bases

• Replying to the application and arranging training — Art. 6(1)(b) GDPR (actions at your request prior to entering into a contract). Providing your name and phone number is necessary to contact you.
• Replying to an e-mail — Art. 6(1)(f) GDPR (legitimate interest of the controller in conducting correspondence), and if you ask about classes — also Art. 6(1)(b) GDPR.
• Maintaining the game ranking and protection against abuse (daily limit of scores) — Art. 6(1)(f) GDPR (legitimate interest of the controller).
• Website security and operation — Art. 6(1)(f) GDPR.

04Who has access to the data

Form submissions and e-mails are seen only by authorised club administrators. We do not sell data or transfer it for marketing purposes. We use the following services:

• Supabase — a database on servers in Frankfurt (European Union). The service is provided by Supabase Pte. Ltd. based in Singapore; potential access from Singapore and the USA (subcontractors, including Supabase, Inc.) takes place on the basis of standard contractual clauses (Art. 46(2)(c) GDPR).
• Cloudflare — hosting, website protection, and e-mail reception. Cloudflare, Inc. is based in the USA and participates in the EU-U.S. Data Privacy Framework.
• Resend — sending our e-mail replies. Plus Five Five, Inc. is based in the USA; the transfer of data takes place on the basis of the EU-U.S. Data Privacy Framework and standard contractual clauses.
• We will provide a copy of the standard contractual clauses on the basis of which data may go to the USA at your request — write to kontakt@orion-bjj.pl.
• YouTube (Google) — we download video previews in the "Lessons" section through our server, and the video itself loads only after clicking, from the youtube-nocookie.com domain. From that moment, Google processes the data in accordance with its privacy policy.

05How long we keep the data

• Form submissions — 12 months from sending, then they are automatically deleted. We will delete them earlier at your request.
• E-mails and our replies — 12 months from receipt or sending, then they are automatically deleted. We will delete them earlier at your request.
• Scores in the game ranking (nickname, score, belt, game time) — until the ranking ends or until your request for deletion. We automatically delete the technical hash after 24 hours — it is only used for the daily limit of scores.
• Technical data with the hosting provider — for a short time needed to protect the website, in accordance with Cloudflare's rules.

06Club members, video surveillance, and image

This section applies to people who have signed a contract for the provision of sports services, and parents concluding it on behalf of children; the information about video surveillance applies to all people present in the club.

• We process data from the contract (name and surname, date of birth, address, phone, e-mail, pass, and payments) to conclude and perform the contract (Art. 6(1)(b) GDPR), and the child's data — in the legitimate interest of organising classes (Art. 6(1)(f) GDPR). We store them for the duration of the contract, and then until the expiry of the limitation periods for claims under the contract (Art. 6(1)(f) GDPR). We store accounting documents for 5 years from the end of the year in which the tax payment deadline expired (Art. 6(1)(c) GDPR).
• We do not collect health information. You tell the instructor verbally about injuries and limitations before classes.
• The entrance, reception and training area are under video surveillance, marked at the entrance; the surveillance does not cover changing rooms or toilets. The recordings are used to protect people and property, investigate incidents, and establish, exercise and defend legal claims (Art. 6(1)(f) GDPR). We keep them for no longer than 3 months, and recordings secured in connection with a specific incident — until the case is closed.
• We publish photos and videos from classes and competitions on this website and on the club's Instagram, Facebook and TikTok profiles only with the consent given in the agreement (Art. 6(1)(a) GDPR), separately for the website and for social media, until it is withdrawn. You can withdraw your consent at any time, e.g. by e-mail — we will remove the materials without undue delay, no later than within 14 days. On social media profiles, data is also processed by their operators (Meta, TikTok) according to their own rules, including outside the EEA.
• We share data from agreements and settlements only with entities handling our accounting and payments, and with authorities authorised by law.

07Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, port it and object to its processing. To exercise these rights, contact us.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office — UODO (ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl).

08Voluntariness

Providing data is voluntary, but without a name and phone number we cannot reply to your application. Data in the sports services agreement is a requirement to conclude it. We do not make automated decisions and do not engage in profiling.

09Cookies

The website itself does not set cookies and does not use analytics (e.g. Google Analytics) or advertising tools. We load fonts from our own server. In case of suspicious traffic, Cloudflare may set a technical security cookie (e.g. __cf_bm), necessary to protect the website.

The game saves your settings and game progress in your browser's memory (localStorage): nickname, best score, fighter's appearance, unlocked items, sound, vibration and effects settings, and viewed hints. This data stays on your device — you can delete it by clearing site data in your browser.

10Policy changes

If we change the way we process data, we will update this page and the date at the top.