Privacy Policy

Controller & Hosting

Data We Process

• Account & security data: name, email, password hash, role, email verification timestamps, two-factor authentication secrets and recovery codes, session IDs, IP address, user agent, password reset tokens, and activity timestamps.
• Competition operations: competition name, slug, location, country code, start/end dates, federation name, nomination deadlines, competition status, public visibility flag, and time zone.
• Athlete registry: first and last name, sex, date of birth, country code, primary group/club, membership number, IPF ID, discretionary notes (please avoid sensitive data).
• Nominations: links to competition, athlete, and group; stage and status; age category; weight class; equipment; discipline; nominated lifts (squat, bench, deadlift, total); lot number; notes; audit fields (created by, updated by, locked at, timestamps).
• Participant photographs: a head-and-shoulders photograph of each athlete and official, used to produce competition access badges. Uploaded images are re-encoded on receipt, which removes embedded metadata such as camera details and GPS coordinates; we keep only the resulting image and the date it was last updated. We do not perform facial recognition or any other automated matching on these images — badges are checked visually by stewards — so they are not processed as biometric data within the meaning of GDPR Art. 9.
• Groups & memberships: group name, code, type, country code, activity status, user-group roles (coach/manager/delegate), timestamps.
• Operational metadata: cache entries, job queue payloads, and error logs needed to provide the service.

Notes fields are free text and may inadvertently contain special categories of data. Do not include health or other sensitive data unless strictly required and lawfully permitted.

Sources of Data

• Information you and other authorized users submit through the platform.
• Photographs uploaded by club managers and federation administrators on behalf of the athletes and officials they enter. These are usually supplied by the participant or, for a minor, by a parent or guardian, and are not collected from the participant directly through this platform.
• Data generated during competition management (e.g., nomination stages, audit logs).
• System-generated metadata (sessions, security logs, background job information).

Purposes & Legal Bases

• Provide and operate the platform (account management, competition setup, athlete registry, nominations).
  Legal basis: performance of a contract or pre-contractual steps (GDPR Art. 6(1)(b)).
• Competition access control (producing printed badges bearing a participant's photograph, name, role and club, so stewards can verify who is entitled to enter restricted areas of the venue).
  Legal basis: legitimate interests in the safe and orderly running of the competition (Art. 6(1)(f)), and performance of a contract where the participant has entered the event (Art. 6(1)(b)). Clubs and federations are responsible for ensuring the participant — or a parent or guardian, where the participant is a minor — has agreed to their photograph being used for this purpose before uploading it.
• Security and fraud prevention (roles, sessions, two-factor authentication, audit trails).
  Legal basis: legitimate interests in securing the service (Art. 6(1)(f)) and, where applicable, legal obligation (Art. 6(1)(c)).
• Communications regarding the service (password resets, platform notices).
  Legal basis: performance of a contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)).
• Record-keeping and compliance (audit logs, regulatory reporting).
  Legal basis: legitimate interests (Art. 6(1)(f)) and/or legal obligation (Art. 6(1)(c)).
• Optional communications (e.g., newsletters).
  Legal basis: consent (Art. 6(1)(a)). Consent can be withdrawn at any time without affecting prior processing.

Sharing & Disclosures

We share data only when necessary with:

• Hosting and infrastructure providers supporting the application (as processors bound to GDPR obligations).
• Email and messaging services delivering transactional communications.
• Professional service providers (legal, compliance) under confidentiality agreements.
• Competent authorities when required by law.

We do not sell personal data.

International Transfers

If data is transferred outside the European Economic Area (EEA) or United Kingdom, we rely on lawful safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses (Art. 46 GDPR). Details are available upon request.

Retention

• User accounts: retained while the account is active; upon deletion, limited data remains in encrypted backups for [30-90] days.
• Sessions: retained up to [30] days after last activity.
• Security and job logs: retained up to [12] months unless longer required for investigations.
• Competition, athlete, and nomination records: retained for the lifecycle of the competition and for [24] months afterward unless regulatory or archival needs justify longer retention.
• Participant photographs: retained for as long as the athlete or official record they belong to exists. A photograph is deleted immediately when that record is deleted, when it is replaced by a new upload, or when a club manager or administrator removes it. There is no separate expiry timer — the photograph's lifetime is the record's lifetime.
• Badge export records: the audit log of who generated badge exports, and for which competition, is retained for 12 months.
• Password reset tokens: retained for less than 24 hours.
• Cache entries: retained per operational necessity and automatically expire.

When retention periods expire, we delete or anonymize data.

Security

• Password hashing using industry-standard algorithms (e.g., bcrypt or Argon2).
• TLS encryption in transit and restricted access controls.
• Role-based permissions and optional two-factor authentication.
• Regular backups and disaster recovery procedures.
• Managed hosting with observability, intrusion detection, and least-privilege access enforced by Obsidian Corps.
• Participant photographs are held in private storage that is not served publicly. Each request for an image is authorized individually, and a request from someone not entitled to see it is answered exactly as if the record did not exist, so the platform cannot be used to discover who is registered.
• Uploads are re-encoded on receipt, which strips embedded metadata (including any GPS coordinates recorded by a phone camera) and neutralizes files that only appear to be images.
• Generating a badge export is rate-limited and written to an audit log recording who produced it and for which competition.

Your Rights

Under GDPR (and similar laws), you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure ("right to be forgotten").
• Restrict processing in certain circumstances.
• Receive data portability copies in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent (where processing relies on consent).
• Lodge a complaint with your local supervisory authority (e.g., CNPD in Luxembourg).

Children

Where minors are nominated, data is submitted by authorized officials (e.g., club coaches). Federations must ensure appropriate consent is obtained when required by law.

This applies with particular force to photographs. A club manager uploading a photograph of a minor must first have the agreement of a parent or guardian for it to be used to produce a competition access badge. A parent or guardian may ask at any time for a photograph to be removed, through the participant's club or by contacting us at office@pwf.lu; removal does not affect the athlete's nomination or their entry in the competition.

Cookies & Similar Technologies

• Essential cookies: session ID, CSRF token, remember token for "remember me". These are strictly necessary to provide the service.
• Analytics & marketing: No analytics or marketing cookies are set by default. If this changes, we will update this policy and request consent when required.

Automated Decision-Making

We do not use automated decision-making that produces legal or similarly significant effects.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post updates on this page and revise the "Last updated" date accordingly. Material changes will be communicated via the platform or email.