Privacy Policy

Introduction#

Marrocco Simone (VAT no. 622010 - IT consulting activity) is committed to protecting your privacy and your personal data in the context of the IT consulting services provided. This policy describes what data we collect, how we use it and what your rights are. We process all data in compliance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the applicable Italian laws.

What data we collect#

Athletes' data:

Personal details: first name, last name, date of birth, sex
Competition data: weight, weight category, belt, club
Sports results: matches fought, wins, losses, rankings
Documents: medical certificates, federation licences

Coaches' and Clubs' data:

Identification data: first name, last name, club name, club code, region
Contact data: email address, phone number
Login credentials: email and password (encrypted)
Payment data: bank transfers for registration fees, medical certificates and federation licences (uploaded voluntarily)

Organizers' data:

Identification and contact data provided during registration
Information about the organized competition
Administrative data related to the management of the event

Parents' data (Judo in Cloud Pro):

Identification and contact data of the parent/guardian: first name, last name, tax code, email, phone
Data of the children entered through the parents' area or the club's links

Content of the club websites (Judo in Cloud Pro):

Texts and images that the club chooses to publish on its own public website

Browsing data:

Technical session data (technical cookies for authentication only)
Anonymized usage statistics (not linked to the account; we do not store IP addresses in our systems)

How we use your data#

Your personal data is used exclusively for the following purposes:

Provision of the IT consulting service: use of the proprietary software Judo in Cloud to manage competitions (athlete registration, bracket creation, match management, publication of results)
User account management: authentication, communications related to the consulting service
Online registrations: technical support for collecting and managing competition registrations
Payments: verification of the registration fee payments (payments are managed directly by the organizer, not by the consultant)
Additional consulting services (Judo in Cloud Pro): management of courses, attendance, athlete documents (only for clubs that request additional consulting)
Competition history: retention of sports results for statistical and historical purposes
Club websites: publication of the club's public website with the content chosen by the club
Automatic document analysis: extraction of data from uploaded PDFs (competition schedules, licences, training camps, bank transfers) through AI services, at the user's request
Content moderation: automatic check of the texts and images of the club websites before publication
Technical support: support to users in case of problems

Legal basis for the processing#

The processing of data is based on:

Performance of the consulting contract: necessary to provide the requested IT consulting service (Art. 6.1.b GDPR)
Consent of the data subject: for optional additional consulting services such as Judo in Cloud Pro (Art. 6.1.a GDPR)
Legal obligation: retention of data for tax and accounting purposes (Art. 6.1.c GDPR)
Legitimate interest: system security, fraud prevention (Art. 6.1.f GDPR)

Your data may be shared with the following third parties exclusively for the purposes indicated:

Google Cloud Platform: hosting of the service (servers in Finland and/or Belgium - hubs europe-north1 and/or europe-west1)
MongoDB Atlas: database for data storage (servers in Belgium - hub europe-west1)
Fireworks AI: AI analysis of documents and content moderation — zero data retention: the data sent exists only in memory for the duration of the request, and it is not stored or used to train models (transient processing in the USA with Standard Contractual Clauses — trust.fireworks.ai)
Resend: sending of the service emails (servers in Ireland - EU region eu-west-1)
Cloudflare: distribution and protection network for the service domains — transit only, no storage of content
Competition organizers: access to the data of the athletes registered for their competitions
Sports clubs: access to the data of their own athletes

All service providers comply with GDPR security standards. We do not sell or share your data with third parties for commercial or advertising purposes.

Publication of data#

The following data is made publicly accessible on the competition pages:

First and last name of the athletes
Club
Competition category
Match results and rankings

This publication is necessary due to the very nature of sports competitions and complies with the practices of the sector.

The texts and images that a club chooses to publish on its own website are visible to anyone who visits the website. The club decides independently what to publish and can remove the content at any time.

Data security#

We adopt appropriate technical and organizational measures to protect your data:

Encryption: encrypted passwords, secure HTTPS connections
Access control: JWT authentication, role-based permissions
Regular backups: backup copies of the data
Secure servers: certified cloud infrastructure (Google Cloud, MongoDB Atlas)
Monitoring: anomaly detection systems to ensure security

Data retention#

Data is retained for the following periods:

Athletes' data and competition results: permanent retention for sports history purposes (you can request deletion at any time)
User account data: until the account deletion is requested
Payment data: 10 years for tax and accounting obligations
Texts and images of the club websites: as long as the club keeps them published or uploaded, or until deletion is requested
Usage logs of the AI services: metadata only (token counts and costs) — never the analyzed content

For a complete deletion, write to [email protected]: every request is fulfilled. If part of the data is subject to retention obligations (for example tax documents or medical certificates), we first provide you with the data export and then delete everything that is not subject to such obligations.

Your rights#

Under the GDPR, you have the right to:

Access: obtain confirmation that we are processing your data and receive a copy of it
Rectification: correct inaccurate or incomplete data
Erasure: request the erasure of your data ("right to be forgotten")
Restriction: restrict the processing in certain circumstances
Portability: receive your data in a structured and readable format
Objection: object to the processing on legitimate grounds
Withdrawal of consent: withdraw the consent given at any time

To exercise your rights, contact [email protected]. We will reply within 30 days.

Changes to this policy#

We reserve the right to change this policy. Substantial changes will be communicated by email to registered users. We invite you to consult this page periodically for any updates.

Last updated: August 2026

Contacts#

For any question about privacy or your personal data:

Email: [email protected]
Data controller: Marrocco Simone
Supervisory authority: Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) - www.garanteprivacy.it

For more technical details on the processing of data, see the section Full GDPR notice.