Privacy Policy
Effective from: 6 August 2026
Version 2026-08-06.1
1. privacy.section1Title
privacy.section1Text
For the purposes of UK and EU data protection law, the data controller is Easy Comp Central Ltd, a company registered in England and Wales under company number 17250408, whose registered office is at 203 West Street, Fareham, Hampshire PO16 0EN, United Kingdom. Where we process data on an organiser's or club's instructions — for example, running their competition — they are the controller and we act as their processor.
2. privacy.section2Title
2.1 privacy.section2_1Title
privacy.section2_1Intro
- privacy.section2_1Item1
- privacy.section2_1Item2
- privacy.section2_1Item3
- privacy.section2_1Item4
- privacy.section2_1Item5
privacy.section2_1InfoIntro
- privacy.section2_1ContactInfo
- privacy.section2_1CompetitorInfo
- privacy.section2_1ClubInfo
- privacy.section2_1ParentInfo
- privacy.section2_1AccountInfo
privacy.section2_1PhoneNote
privacy.section2_1GenderNote
2.2 privacy.section2_1aTitle
privacy.section2_1aIntro
- privacy.section2_1aProfilePhotos
- privacy.section2_1aCompetitorPhotos
- privacy.section2_1aClubLogos
privacy.section2_1aNote
2.3 privacy.section2_2Title
privacy.section2_2Intro
- privacy.section2_2Item1
- privacy.section2_2Item2
- privacy.section2_2Item3
privacy.section2_2Note
2.4 privacy.section2_3Title
privacy.section2_3Intro
- privacy.section2_3Push
- privacy.section2_3Crash
- privacy.section2_3Performance
- privacy.section2_3Device
2.5 privacy.section2_4Title
privacy.section2_4Intro
- privacy.section2_4Interaction
- privacy.section2_4Usage
privacy.section2_4Note
2.6 privacy.section2_5Title
privacy.section2_5Text
2.7 privacy.section2_6Title
privacy.section2_6Text
2.8 Consent Records
When you accept our Terms of Service and Privacy Policy, we record that you did so, the version of each document you accepted, the date and time, the language it was shown to you in, and the IP address and browser or app the acceptance came from. We keep this as evidence of consent for as long as you hold an account and for a reasonable period afterwards.
3. Competition Results
Competition results are central to what the Platform does, and they contain personal data — most obviously competitors' names. This section explains what we receive, what we do with it, and on what legal basis.
3.1 What We Receive
Results are supplied to us by competition organisers, scrutineers and their scoring software, produced by the Platform when scoring runs through it, or submitted by parents, clubs and competitors. They typically include:
- Competitor and partner names, and the club or school they represent
- Event, category, age group and skill level
- Placings, marks, scores, recalls, field sizes and round structures
- The competition, its organiser, its date and its venue
3.2 How We Use Results
We use results to:
- Show results to parents and competitors: so that a competitor and their parent can see how they placed, and view their history over time.
- Build achievements and progression: personal bests, milestones, progression tracking and alerts when new results matching a competitor appear.
- Operate leagues: where a competition falls within a league's scope, its results are included in that league's standings, and competitors may appear by name on that league's pages.
- Produce leaderboards and rankings: including public leader displays on competition and league pages, which may show a competitor's name, club and profile photograph.
- Produce statistics and analysis: including aggregated and anonymised insight about participation and the sport, which may be published or supplied to third parties.
- Operate and improve the Platform: including matching names across competitions, detecting duplicates and improving how results are classified.
3.3 If You Upload Results
Organisers, scrutineers and clubs: your responsibility
By uploading or transmitting results to Easy Comp Central, you confirm that you have a lawful basis for doing so and that you consent, on your own behalf, to our using that data for the purposes described in this policy — including displaying results to parents and competitors, and including them in any league the competition falls within.
You are responsible for telling the competitors and parents whose data you supply that their results will be published on Easy Comp Central and may appear in leagues, leaderboards and achievements. Your own entry terms and privacy notice should say so. We provide the platform; we are not in a position to give that notice on your behalf at the point of entry.
For results published on the Platform beyond the running of the individual competition — achievements, leagues, historical records and statistics — Easy Comp Central Ltd is the controller and is responsible for that processing.
3.4 Our Lawful Basis for Results
We rely on legitimate interests: publishing competition results, maintaining the historical record of the sport, and operating leagues, rankings and achievements built on them. Publishing results is intrinsic to competitive sport, is expected by participants, and is what makes the Platform useful to them. We have assessed this against the rights of the individuals concerned and consider it proportionate, in particular because the data is limited to competition performance and is not used for advertising or profiling.
You have the right to object to processing based on legitimate interests. If you object, we will consider your objection on its merits and the particular circumstances. We may not be able to remove a result entirely where doing so would falsify the record of a competition or a league standing, but we can often restrict how it is displayed. Contact us to discuss it.
3.5 What Is Publicly Visible
Competition results pages, league pages and leaderboards may be publicly accessible without an account. Where they are, a competitor's name, club and placing may be visible to anyone, and may be indexed by search engines.
Competition results pages and league pages may be publicly accessible without an account. Where they are, a competitor's name, club and placing may be visible to anyone, and may be indexed by search engines. Photographs are NOT shown on these public pages — leader displays such as the Leaders Wall show initials, not photographs.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data based on:
- Consent: You have given explicit consent for processing your data
- Contract: Processing is necessary to fulfil our services to you
- Legal Obligation: We must process data to comply with the law
- Legitimate Interests: Processing is necessary for our legitimate business interests
We do not seek to collect special category data. Medical and dietary information supplied for competition safety is collected only where a parent, guardian or club chooses to provide it, is stored encrypted, is shared only with those who need it to keep the competitor safe, and is processed on the basis of explicit consent or, where applicable, the protection of vital interests.
5. privacy.section3Title
5.1 privacy.section3_1Title
privacy.section3_1Intro
- privacy.section3_1Item1
- privacy.section3_1Item2
- privacy.section3_1Item3
- privacy.section3_1Item4
privacy.section3_1Note
5.2 privacy.section3_2Title
privacy.section3_2Intro
- privacy.section3_2Item1
- privacy.section3_2Item2
- privacy.section3_2Item3
- privacy.section3_2Item4
5.3 privacy.section3_3Title
privacy.section3_3Intro
- privacy.section3_3Item1
- privacy.section3_3Item2
- privacy.section3_3Item3
- privacy.section3_3Item4
6. privacy.section5Title
privacy.section5Intro
- privacy.section5Item1
- privacy.section5Item2
- privacy.section5Item3
- privacy.section5Item4
- privacy.section5Item5
- privacy.section5Item6
- privacy.section5Item7
- privacy.section5Item8
- privacy.section5Item9
- privacy.section5Item10
- privacy.section5Item11
- privacy.section5Item12
- privacy.section5Item13
- privacy.section5Item14
- privacy.section5Item15
- privacy.section5Item16
privacy.section5Note
7. privacy.section6Title
privacy.section6Intro
- privacy.section6Expo
- privacy.section6OSRM
- Stripe: processes card and other payments. Payment card details are entered directly with Stripe and are not stored by us. Stripe receives the payer's name, email and payment details.
- Cloudinary: stores and serves images uploaded to the Platform, including profile and competitor photographs and club logos.
- Vercel and our database hosting provider: host the Platform and store its data, including the application database and file storage.
- Our email delivery provider: sends transactional email such as verification, notification, invoice and reminder messages.
- Google reCAPTCHA: protects registration and support forms from automated abuse. Google receives technical information about the request under its own privacy policy.
privacy.section6Note
9. International Transfers
We aim to store personal data within the UK and European Economic Area. Some of our service providers process data outside that area, including in the United States.
Where data is transferred outside the UK or EEA, we rely on an adequacy decision where one applies, or otherwise on the International Data Transfer Agreement or Standard Contractual Clauses together with any additional safeguards needed. You can ask us for details of the safeguards applied to a particular transfer.
10. privacy.section8Title
privacy.section8Text
10.1 How We Protect Your Data
The measures we apply include:
- Encryption of data in transit using HTTPS/TLS across the website, the mobile app and our APIs
- Encryption at rest for our databases and file storage, and additional field-level encryption for sensitive information such as medical details
- Passwords stored only as salted hashes, never in a form we or anyone else can read
- Session tokens held in HttpOnly cookies that browser code cannot read, with protection against cross-site request forgery on every change you make
- Role-based access control, so each account sees only the data its role requires, with optional two-factor authentication
- Rate limiting, account lockout and monitoring to detect and blunt automated attacks
- Automated security testing in our development process, and restricted, logged administrative access
10.2 Security of Photographs, Including Images of Children
How images are stored and who can see them
Images are not stored in our application database. They are held by our image provider, Cloudinary, and served over HTTPS. Each image sits in a folder derived from the account or competitor it belongs to, under a randomly generated filename, so an address cannot be worked out from someone's name. Uploads are checked for genuine file type — the file's actual signature, not just its extension — and are capped at 5 MB.
Every upload and deletion is tied to the authenticated account making it. You can only change your own photograph, and a competitor's photograph can only be set or removed by a linked parent, by an administrator or coach at a club the competitor belongs to, or by us. No page or API that can be reached without signing in returns a photograph.
You can remove an image at any time from your account settings, and we delete it from our image store as well as from the Platform. Closing your account, or deleting a competitor, also destroys the photographs held for them. Copies already cached by a content delivery network or a browser may persist for a short period afterwards, and we cannot recall a copy that someone has already downloaded or screenshotted.
Please be aware of an important limitation: once an image has been served, its web address will display that image to anyone who has the address, without them needing to sign in. We do not publish those addresses publicly, but if one is shared — forwarded, copied out of a page, or pasted into a message — it will work for whoever receives it. Treat an image address like the image itself.
10.3 If Something Goes Wrong
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours where required, and will tell you without undue delay where the risk to you is high.
11. privacy.section12Title
privacy.section12Text1
privacy.section12Text2
Before you upload a photograph of a child
Uploading a photograph of a child is entirely optional and is a decision for that child's parent or legal guardian. Nothing on the Platform requires a photograph in order to register, enter or compete. Please consider carefully whether you want an image of your child on the Platform at all.
Photographs are shown only to signed-in users who have a reason to see them: a competitor's linked parents, and the club administrators, coaches and organisers who need them for identification. If you would rather no photograph existed at all, simply do not upload one — nothing on the Platform requires it.
We do not offer accounts to children. Accounts are held by adults — parents and guardians, club administrators, coaches, organisers, judges and scrutineers — and information about competitors who are minors is provided and managed through those adult accounts. Adult competitors may hold their own account.
Parents and guardians can view, correct and delete the information and photographs held about their child at any time through their account, or by contacting us. We will act on such a request promptly, and we do not require a reason.
12. privacy.section9Title
privacy.section9Intro
- privacy.section9Item1
- privacy.section9Item2
- privacy.section9Item3
- privacy.section9Item4
- privacy.section9Item5
- privacy.section9Item6
- privacy.section9Item7
To exercise any of these rights, contact us at [email protected]. We will respond within one month, and will tell you if we need longer because the request is complex. We do not charge for a request unless it is manifestly unfounded or excessive.
If you are not satisfied with how we have handled your personal data, you can complain to the Information Commissioner's Office (ico.org.uk), or to the supervisory authority in your own country. We would rather you raised it with us first so we can put it right.
13. privacy.section4Title
privacy.section4Text1
privacy.section4Text2 privacy.section4LinkText
15. privacy.section11Title
privacy.section11Text
Competition results are retained indefinitely as part of the historical record of the sport, and are not deleted when an account is closed — a result is a record of a competition that took place, and removing it would falsify that record and any league standing built on it. Where you have a right to object or to erasure, we will consider it on its merits and can often restrict display instead of deleting.
Records of your acceptance of our Terms and Privacy Policy are kept for as long as you hold an account and for six years afterwards, as evidence that consent was given.
16. privacy.section14Title
privacy.section14Text
Where a change to this policy is material, we will ask you to read and accept the updated version the next time you use the Platform, and we will record that acceptance. Until you accept, your access will be limited to reading these documents and signing out.
17. privacy.section13Title
privacy.section13Text
Data Protection Officer
Email: [email protected]
Address: Easy Comp Central Ltd, 203 West Street, Fareham, Hampshire PO16 0EN, United Kingdom