Privacy Notice
Controller and scope
The controller and system operator is Kerecsényi László Íjász és Szabadidős Sportegyesület (KLÍE). Registered address: Budapest krt. 15., 5700 Gyula, Hungary. Contact and privacy requests: klie.gyula@gmail.com. This notice covers the KLÍE central competition app, club app, public entry form and related competition, membership, payment and invoicing processing. Ownership of the system does not confer ownership of personal data.
Competition entry and administration
Data processed as required by the event: name, email, club, country, licence number, gender, age group, category, date of birth, bow/arrow maker, sponsor, entry and payment status, and additional information genuinely needed for the competition. Purposes: accepting entries, checking eligibility, confirmations, communication, group allocation, running and scoring the competition. Processing objectively necessary for the participation service relies on GDPR Article 6(1)(b). Additional processing to ensure the integrity and orderly conduct of the official competition relies on legitimate interests under Article 6(1)(f). Required fields are identified on the form; missing information may prevent entry. Optional fields may be left blank. Do not enter health or other special-category information in general free-text fields.
Results and public lists
Information necessary for transparency, verification, official results and sports records may appear in entry lists, group allocations, live and final results, downloadable documents and result certificates. This includes name, club, country, event gender category, category/age group, team or bib number, score, placing and status necessary for administering the event. An optionally supplied sponsor or bow/arrow maker may also be displayed. Email, home address, full date of birth, payment identifiers and health information are excluded from public lists. Legal basis: GDPR Article 6(1)(f), the legitimate interest in reliable public sports results. You may object; the Association assesses requests individually. Online lists are accessible worldwide and may be downloaded by others; KLÍE cannot ensure deletion of every independent copy.
Disclosure to federations
For competitions held within the MISZ and/or HDH-IAA framework, official results and necessary group allocation information are disclosed to the federation relevant to that event. Recipients: Magyar Íjász Szövetség (Hungarian Archery Association, MISZ; misz.hu) and/or HDH-IAA International Archery Association (hdhiaa.net). Purposes: validating and recording results, rankings, classifications, records, sports statistics and official publication. Only information necessary for that purpose is disclosed. Federations are responsible as separate controllers for their own recordkeeping and publication; their privacy notices apply to those activities. Disclosure by the Association relies on the legitimate interest in reliable official results under GDPR Article 6(1)(f). The applicable federation is identified in the event announcement. Federation rules do not replace a lawful basis under the GDPR.
Club membership and communication
Membership administration processes necessary identity and contact information, membership status, dues and performance credits, payment records, requests and messages sent to administrators. Purposes: administering membership rights and obligations, accounting and responding to requests. Depending on the operation, the legal basis is performance of the membership relationship (Article 6(1)(b)), legitimate interests in running the Association (f), or a specific accounting obligation (c). Access to private member, message and payment information is limited to persons authorised for their tasks. Publication of club sporting results follows the rules for public results above.
Payments and invoicing
Online payments use SimplePay (SimplePay Zrt.) and invoices use Számlázz.hu (KBOSS.hu Kft.). Necessary order, payment, transaction, billing and contact information is disclosed according to the service used. Payment performance relies on Article 6(1)(b); accounting documents rely on Article 6(1)(c) and Hungarian Act C of 2000 on Accounting. Providers may act as contractual processors or separate controllers for their respective activities. Do not enter card numbers or CVC codes in the Association system; card information is entered on the payment provider’s interface.
Hosting, email and international processing
Hosting is provided by Contabo; the system server location is Lauterbourg, France. Confirmation and administrative emails use Gmail, provided by Google. The hosting provider may access stored information necessary for delivering the service; the email provider may access addressing, message content and related technical information. The system also uses backups to prevent data loss and enable recovery. Providers’ applicable contractual terms and privacy notices also govern their processing. Hosting in France does not mean every other provider processes information exclusively within the EEA: Google services in particular may involve processing outside the EEA. Such transfers require safeguards under GDPR Chapter V. Information about applicable safeguards and access to them may be requested from the Association; Google’s privacy notice is available among the related documents.
App use, cookies and local storage
Apps may use technically necessary cookies, language preferences, random device identifiers, access tokens and local caches. Offline scoring may store unsent data on the device and synchronise after reconnection. Other users of a shared device may access locally stored information; sign out after use and remove synchronised local data where that feature is available. Acknowledgement is recorded using a random identifier per app, notice version, time and language. The remembering cookies last at most 365 days and a new notice version requires a new acknowledgement. This is not advertising tracking. Optional analytics or marketing tools require a separate appropriate choice; this acknowledgement does not authorise them.
Camera, notifications and external content
The camera may be used to read QR codes with device permission. Camera permission is not consent to publication of recordings. Push notifications require separate browser/device permission; subscription endpoints and technical keys are used for delivery. Permission can be withdrawn in the app or device settings. External live streams, embedded content, photographs or video may involve separate processing; the information provided for the particular feature applies. This acknowledgement is not blanket consent to portrait, advertising or video use.
Minors and entries for another person
Entries for minors must be submitted with the necessary legal representation and parental declaration required by the event. A person entering someone else must ensure the athlete or legal representative can read this notice and must act with appropriate authority. The entry checkbox alone does not establish authority to represent another person. Information collected indirectly is also subject to the information requirements of GDPR Article 14. Particular attention must be paid to data minimisation and the protection of minors’ rights.
Retention schedule
Retention is determined by the purpose of the information and applicable legislation; there is no single period for all data. Entry contact information and temporary organisational information may be processed for the time needed to run the event, finalise results, address corrections and close related administration. Retention of minimal official results is determined by the continuing need for the relevant ranking, classification, record or result certification; this does not itself justify retaining the entire entry form. Membership records are needed during membership; afterwards only information necessary for settlement, legal claims or statutory obligations may be retained. Accounting documents and records supporting bookkeeping must be retained for at least eight years under Section 169 of the Hungarian Accounting Act. Technical logs may be processed for the time necessary to investigate the specific operational fault or security incident. App cookies remembering acknowledgement are valid for at most 365 days; related receipts and entry acknowledgements may be retained for the time needed to evidence that acknowledgement or address a specific legal claim. Pending litigation or regulatory proceedings may extend retention only for information needed for that matter. Erasure is not necessarily automatic; removal or anonymisation of unnecessary information must also be addressed in the active system, exports and backup management.
Erasure and security
Information may be used by organisers, judges, scorers and administrators authorised for their tasks and the relevant purpose. Restricted access, secure transmission and backups support data protection. When a purpose ends, information no longer needed must be erased or irreversibly anonymised, except where justified statutory retention or legal claims require preservation. Archiving is not itself anonymisation. Restoration from backups must also account for previously due deletions. Do not share QR codes, token-bearing links or devices providing access to personal information with unauthorised persons.
Your rights and remedies
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and, where applicable, portability. You may object to legitimate-interest processing; the controller must then assess overriding lawful grounds. Consent for a separate consent-based operation may be withdrawn at any time without affecting prior lawful processing. Erasure may not apply where statutory retention or necessary legal claims require continued processing. Send requests to klie.gyula@gmail.com or the registered address. Replies are normally provided within one month; an extension of up to two further months is possible where justified, with notification within the first month. Proportionate identity verification may be requested. Complaints may be made to Hungary’s National Authority for Data Protection and Freedom of Information (NAIH), naih.hu; judicial remedies and GDPR compensation are also available. Requests relating to a federation’s separate processing may also be addressed to that federation.
Meaning of acknowledgement and updates
The statement “I have read and acknowledge the Privacy Notice” records receipt of information. It is not a waiver of rights, blanket consent or a replacement for a valid legal basis for each operation. App use requires acknowledgement of the current notice; the notice itself can be read without acknowledgement. Each entry submission requires its own acknowledgement. Material changes are identified by a new version. There is no solely automated decision-making producing legal or similarly significant effects within GDPR Article 22; automated sports calculations remain subject to judge/organiser review and the possibility of challenge.