Privacy Policy

1. Who we are

JudoHQ is a free, open-source club management platform for voluntary judo clubs in the United Kingdom. We are the data controller for personal data processed through the JudoHQ platform.

For the purposes of UK GDPR, the data controller is the individual club administrator who registers the club. JudoHQ acts as a data processor on behalf of each club.

2. Data we collect

We collect and process the following categories of personal data:

• Club administrator data: name, email address, and password provided during club registration.
• Member data: name, email, date of birth, grade/belt level, BJA membership number, address, emergency contact information, and attendance records — added by club administrators or provided by members during sign-up.
• Account data: login credentials, session tokens, and activity logs.
• Payment and billing data: transaction amounts, payment status, Stripe payment identifiers (we never store card numbers), refund request reasons, and membership billing history. Processed to fulfil your club membership and event fees.
• Usage data: anonymised analytics about how the platform is used, collected via cookies where consent is given.

3. How we use your data

We use personal data to:

• Provide and operate the JudoHQ club management platform
• Manage club memberships, gradings, competitions, and attendance
• Send notifications that club administrators or members have opted into
• Maintain platform security and prevent fraud
• Comply with legal obligations

4. Legal basis for processing

We process your personal data under the following legal bases as defined by UK GDPR:

• Contractual necessity: to provide the services you signed up for (club management, membership tracking).
• Legitimate interests: to improve the platform, communicate important updates, and maintain security.
• Consent: for non-essential cookies and optional marketing communications. You can withdraw consent at any time.
• Legal obligation: to comply with applicable laws and regulations.

5. Data sharing

We do not sell or rent personal data to third parties. We may share data with:

• Service providers: hosting and infrastructure providers necessary to operate the platform.
• Stripe (payment processing) for membership, grading, competition, and shop payments. We do not store card numbers — payments are completed on Stripe-hosted checkout pages. See section 6 for Stripe Connect and international transfers.
• Club administrators: member data is visible to the administrators of the club the member belongs to, including refund requests and reasons you submit.
• Legal authorities: if required by law, regulation, or legal process.

6. Payments and Stripe Connect

JudoHQ uses Stripe to process payments. Your club may receive payouts in two ways:

• Stripe Connect (recommended):your club connects a bank account via Stripe Express onboarding in Dashboard → Settings → Payments. Members pay your club directly; Stripe handles identity verification, card processing, and payouts to your club's bank account. JudoHQ stores only a Stripe account identifier and payment status flags — not bank details.
• Legacy platform billing: until Connect is complete, some clubs may process payments via the JudoHQ platform Stripe account. Payout arrangements for legacy clubs are managed by the platform operator.

Payment-related data we process includes transaction amounts, payment status, Stripe payment identifiers, refund request reasons, and membership billing history. We retain payment audit records for as long as needed to operate the service, resolve disputes, and meet legal obligations.

Stripe is an independent data controller for payment processing. Payment data may be transferred outside the UK/EEA (including to the United States) under Stripe's safeguards. See Stripe's Privacy Policy for details. Club administrators who enable Connect also accept Stripe's Connected Account Agreement during onboarding.

7. Data storage and security

Data is stored on secure servers within the United Kingdom and European Economic Area. We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and regular security reviews.

8. Your rights

Under UK GDPR, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Erasure:request deletion of your personal data (“right to be forgotten”)
• Restriction: limit how we process your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact your club administrator or email us at the address below.

9. Cookies

We use essential cookies to keep you logged in and remember your preferences. We use non-essential analytics cookies only with your consent. See our Cookie Policy for full details.

10. Children's data

JudoHQ is used by clubs with junior members. Data for children under 13 is added and managed by club administrators (and parents/guardians) — children do not create their own accounts. We process children's data with the same safeguards and in accordance with the UK GDPR and the UK Data Protection Act 2018.

11. Changes to this policy

We may update this policy from time to time. We will notify registered club administrators by email of any material changes. Continued use of the platform after changes constitutes acceptance of the updated policy.

12. Contact us

If you have questions about this privacy policy or wish to exercise your data rights, please contact your club administrator or email us at [email protected].