1.Who we are
The International Luta Livre Federation is the data controller for the personal data processed through lutalivrefederation.com, the federation portal, the event-day competition console and the emails we send.
For any question about this policy or to exercise your rights, write to contact@lutalivrefederation.com.
2.Our approach to the GDPR
We process personal data in accordance with Regulation (EU) 2016/679 (the GDPR). Concretely, that means:
- we only collect data we actually need to run the Federation, and we do not collect it "just in case";
- every purpose has an identified legal basis, set out in the table below;
- access is limited by role — a club sees its own members, a regional coach sees the clubs in its territory, and nobody sees more than their function requires;
- every external provider we use is bound by a GDPR-compliant data processing agreement and acts only on our documented instructions;
- data is hosted in the European Union wherever the provider offers it;
- we do not sell personal data, we do not rent it, and we do not share it with advertisers.
3.What we collect
| Category | What it contains |
|---|---|
| Account and identity | Surname, first name, email address, password (stored hashed, never in clear), role, interface language, profile photograph. |
| Athlete profile | Date of birth, gender, nationality, telephone number, postal address, city, country, discipline, weight class, belt grade and date obtained, licence number and period of validity, club and affiliation status. |
| Parent or guardian (minors) | Surname and first name of the parent or legal guardian, and their identity document. |
| Supporting documents | Proof of identity, medical clearance, belt certificate, and for clubs the registration document and the identity document of the legal representative — together with their verification status and, where applicable, the reason for rejection. |
| Signed documents | The responsibility charter and the club agreement, with the name signed, the version of the document, the signed PDF, the date, the IP address and the browser used at the time of signature. |
| Payments | Amount, currency, season or period covered, status, transaction reference from our payment provider, email address of the payer. We never receive your card number. |
| Shop orders | Email address, delivery address, items ordered, amounts, order status and tracking number. |
| Competitions | Entries, chosen category and weight class, grade declared for the competition, weigh-in and check-in status, match results, brackets, rankings and medals. |
| Event photographs | Photographs taken at events, and a record of the downloads made by each member. |
| Contact and support | Messages sent through the contact form, support chat conversations, newsletter subscription and its status. |
| Technical data | Session identifier, IP address, browser and device information, and the technical diagnostics collected when an error occurs. |
4.Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, issuing and renewing your licence | Performance of the contract between you and the Federation |
| Verifying identity, age and medical fitness before a licence is issued | Performance of the contract, and substantial public interest in organising sport safely |
| Managing club affiliation, coach certification, grades and promotions | Performance of the contract, and our legitimate interest in keeping an accurate sporting register |
| Taking payments, issuing receipts and keeping accounts | Performance of the contract, and our legal accounting obligations |
| Organising competitions, running brackets, publishing entry lists, results and rankings | Performance of the contract, and our legitimate interest in the public record of the sport |
| Making event photo galleries available to licensed members | Our legitimate interest in documenting and promoting the discipline, subject to your right to object |
| Sending service emails and portal notifications | Performance of the contract |
| Sending the newsletter | Your consent, given by double opt-in and withdrawable at any time |
| Informing members, clubs and coaches about the Federation's competitions — announcements, entry deadlines and reminders, sent to adults only | Our legitimate interest in making the Federation's competitions known to its own members, clubs and coaches. You can object at any time, without giving a reason, through the opt-out at the foot of each of these emails (an unsubscribe link, or replying STOP) or by writing to us |
| Answering the contact form and the support chat | Our legitimate interest in answering the people who write to us |
| Securing the service: authentication, rate limiting, fraud prevention, error monitoring | Our legitimate interest in protecting the Platform and its users |
| Keeping proof of the documents you signed | Our legal obligations and our legitimate interest in being able to prove consent |
5.Health data
The medical clearance you upload is health data, which the GDPR treats as a special category. We collect it for one reason only: to confirm that you are medically fit to train and compete, which the Federation is required to check before issuing a licence.
It is processed on the basis of your explicit consent, given when you submit it, and of the substantial public interest in organising sport safely. It is stored in a private bucket that has no public address, is never served by a direct link, and is only accessible to the federation staff responsible for validating applications.
We do not read the medical content beyond what is needed to confirm validity, we do not share it with your club, and we do not use it for any other purpose.
6.Minors
A member under 18 is registered with the authorisation of a parent or legal guardian, whose surname, first name and identity document are recorded. The parent or guardian signs the responsibility charter and exercises the minor's rights.
We do not send commercial messages to minors, and we do not use their data for any purpose other than managing their licence and their participation in competitions.
A parent or guardian may ask at any time, at contact@lutalivrefederation.com, to access, correct or delete their child's data.
7.Who can see your data
Inside the Federation, access depends on role:
- your club sees the information it needs to manage its roster — identity, grade, licence status, document status — but not your payment details;
- the regional coach responsible for your territory sees the members of the clubs they oversee, for the purposes of certification and promotions;
- federation administrators have the broadest access, limited to what is needed to run the Federation, and every administrative action is traceable;
- the officials running an event see the entries and results for that event.
Outside the Federation, your data is only accessible to the service providers listed below, and to public authorities where the law requires it.
Entry lists, results and rankings for a competition are public: they show the athlete's name, club, category, weight class, grade, whether the entry is paid, and the result — and, for an athlete aged 18 or over on the day of the competition, a nationality flag. They never show an age or a photograph. Your contact details, documents and payments are never public.
8.Our service providers
We use the following providers to operate the service. Each of them is bound by a GDPR-compliant data processing agreement, acts only on our instructions, and applies appropriate safeguards to any transfer outside the European Economic Area.
| Provider | What it does for us | Status |
|---|---|---|
| Vercel | Hosting of the website and the federation portal | GDPR-compliant, EU-served infrastructure |
| Neon | Managed PostgreSQL database holding the federation register | GDPR-compliant, European region |
| Cloudflare R2 | Storage of documents, photographs and files | GDPR-compliant |
| Stripe | Payment processing for licences, entries and shop orders | GDPR-compliant, PCI-DSS certified |
| Resend | Delivery of service emails and notifications | GDPR-compliant |
| Upstash | Rate limiting | GDPR-compliant |
| Crisp | Support chat inside the portal | GDPR-compliant, European hosting |
| OpenAI | Translation of federation content into the site languages, editorial assistance for administrators, and an assistant that answers administrators' questions about the federation register, to which the member, club and coach records concerned are sent — contact details and dates of birth included | GDPR-compliant; the data sent is not used to train models |
| Mapbox | Display of club and event maps | GDPR-compliant |
| Google Maps Platform | Address suggestions and geocoding on registration forms | GDPR-compliant |
| Managed European server | Live scoreboard relay used on competition days | GDPR-compliant, hosted in the European Union |
None of these providers is authorised to use your data for its own purposes. We do not use advertising networks and we run no third-party tracking on this website.
9.Transfers outside the European Union
Our data is hosted in the European Union wherever the provider offers it, which is the case for the database and the application hosting.
Where a provider processes data outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission or by the European Commission's standard contractual clauses, together with the additional technical measures needed to protect the data.
10.How long we keep it
| Data | Retention |
|---|---|
| Account and licence record | For as long as you are a member, then three years after your last active season, after which the account is deleted or anonymised. |
| Identity documents | Until the end of the season for which they were required, and at most twelve months afterwards. |
| Medical clearance | For its period of validity, and at most twelve months afterwards. |
| Signed charters and agreements | Five years from signature, as evidence of consent. |
| Payment and accounting records | Ten years, as required by accounting law. |
| Shop orders | Ten years for the accounting record; delivery details three years. |
| Competition entries, results, rankings and belt history | Kept without time limit, as the sporting record of the Federation. |
| Event photographs | Kept for the archive of the event, subject to your right to object. |
| Support conversations and contact messages | Twenty-four months from the last exchange. |
| Newsletter | Until you unsubscribe. The unsubscribe record itself is kept so that we can honour it. |
| Opt-out from news and competition emails | Your email address, language and the date you opted out — or, if you opted out by replying STOP, your email address alone — kept for as long as the Federation sends such emails, so that we keep honouring it. |
| Sessions and technical logs | Between thirty days and twelve months depending on the log. |
Results already recorded are the historical record of a competition that took place. They remain in the Federation's archive even after an account is deleted — a result cannot be erased from the record of an event that was held.
11.Your rights
Under the GDPR you have the right to:
- access the data we hold about you and obtain a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, within the limits set out above;
- restrict processing while a request is being examined;
- receive the data you provided in a portable, machine-readable format;
- object to processing based on our legitimate interest, including the use of your image in event galleries;
- withdraw your consent at any time, without affecting what was done before, in particular for the newsletter;
- lodge a complaint with a supervisory authority — in France, the CNIL, or the authority of your country of residence.
Write to contact@lutalivrefederation.com to exercise any of these rights. We answer within one month. If your request is complex we may extend that period, and we will tell you why. We may ask for proof of identity if there is reasonable doubt about who is making the request.
Much of your data can be corrected directly in your account settings, which is the fastest route.
12.Automated decisions
We do not take decisions producing legal effects concerning you by automated means alone, and we do not carry out profiling.
Some checks are automated — whether the minimum time in grade has elapsed, whether the required documents are present, whether a payment has been received — but the decision that follows is always confirmed by a certified coach, a regional coach or a federation administrator.
13.Security
We apply the technical and organisational measures appropriate to the sensitivity of the data we hold:
- all traffic is encrypted in transit, and data is encrypted at rest by our providers;
- passwords are stored hashed and are never accessible to us in clear;
- identity documents and medical clearances are stored in a private bucket with no public address, and are only served through short-lived, authenticated links;
- every action in the portal is behind an authorisation check on the user's role;
- sensitive endpoints are rate-limited to prevent brute-force and abuse;
- errors are monitored so that failures are detected and corrected quickly;
- the database is backed up regularly.
If a personal data breach were to occur and were likely to result in a risk to your rights, we would notify the supervisory authority within seventy-two hours and inform you where the regulation requires it.
14.Cookies
Cookies and similar technologies used on this website are described in the Cookie Policy. We use no advertising cookies and no third-party analytics.
15.Changes to this policy
This policy may change as the Federation's activities and tools evolve. The version in force is the one published on this page, with its date of last update. If a change materially affects the way your data is used, we will inform account holders by email or by a notice in the portal.
Other legal documents
A question about this document? contact@lutalivrefederation.com