General Privacy Notice
for IJF Services
Privacy Notice
9 October 2023 – version 1
The International Judo Federation (IJF) is committed to protecting your privacy and personal data in compliance with the General Data Protection Regulation (“GDPR”). This Long Form Privacy Notice is intended for athletes and professional sportspersons, recipients of IJF services, and anyone who interacts with our websites and applications and explains in detail how we collect and use personal data from you, as well as how we share that data with other organisations.
Joint Data Controllers
The data controller of your personal data is the International Judo Federation (Fédération Internationale de Judo, registered seat: 1051 Budapest, József Attila Utca 1. II. em./1A., Hungary; court registration number: 01-02-0017346; registered with the Budapest Metropolitan Court, "IJF", "we", "us" or "our"; e-mail: [email protected]). We are the data controller of any personal data we collect about you and we are responsible for the operation of the websites www.ijf.org; www.judobase.org; www.judomanager.com and www.judoTV.com.
Joint control: In the context of certain data processing activities, the IJF, the continental unions and the national judo federations (collectively referred to as "judo associations") also process some personal data as joint controllers within the meaning of Art. 26 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the European Council (hereinafter: GDPR), because the judo associations determine the purposes and means of the data processing they jointly process. This applies to the organisation, holding and management of sporting events, which we always organise jointly with the continental judo unions and national judo federations.
Purposes of processing personal data
In connection with our operations, events and activities, we process personal data for the following purposes:
· Organisation and Management of Sport Events: we organise and manage sport events in partnership with local organising committees, ensure your participation in these sport events; ensure their broadcasting, recording and transmission in any digital format and commercial exploitation and licensing of such events, based on legitimate interests; in connection with this processing activity, we act as joint controllers with the continental judo unions and the national judo federations.
· Issuing and Maintaining Sports Regulations: the IJF is responsible for administering the sport of judo and therefore we are responsible for regulating a competitive system and issuing, enforcing and monitoring sports rules, sportsmanship rules, rules on the use of sports equipment and protective equipment.
· Governance, Operation and Management of Organisational Functions: we operate the IJF and its committees; represent and defend the interests of the IJF, its members and athletes inside and outside the IJF; coordinate and collaborate with national judo associations worldwide.
· Legal Compliance: we ensure the protection of athletes' health, maintain a high level of integrity of judo sports, ensure the safety of sporting activities and the prevention of cheating and doping control, and actively discourage prohibited performance enhancement and conduct disciplinary proceedings for violations.
· Whistleblowing: we operate an internal whistleblowing system, conduct internal investigations and perform related risk management activities.
· Management and Public Disclosure of Sport-Specific Athlete Data: we register and disclose athlete data to promote the sport of judo and to inform the public.
· Dispute Resolution and Arbitration: we provide dispute resolution in sports-related disputes between athletes and sports professionals.
· Reporting and Keeping Sports Statistics: to improve the quality of sports, archiving and research.
· Providing Information Society Services: we provide certain information society services by maintaining certain websites and web applications, including account management and ensuring their security.
· Analytics and Website Measurement: we store and analyse information about your recent visits to our websites and how you move around different sections of the websites for analysis purposes, to understand how people use our website so that it can be made more intuitive.
We process certain special categories of data to protect the health of athletes and the integrity of sport, to prevent prohibited performance-enhancing substances, to ensure the safety of sporting events, to monitor compliance with doping bans, to conduct doping tests.
We do not use automated decision making or profiling.
Source and categories of personal data processed
The source of your personal data is either you directly, continental judo unions or national judo federations being IJF member organisations. As part of our integrity activities, we also gather intelligence from relevant sources actively, including members of the public and publicly available sources. We also collect data from anti-doping organisations (such as the World Anti-Doping Agency and national anti-doping organisations) and our appointed anti-doping service provider. Where you choose to involve a third party, for example, your employer, a representative, lawyer or relative, we will receive and share data with this person or organisation.
We process the following categories of personal data:
● Identification data: this is information that identifies or is identifiable to you, like your name, contact information (e-mail, phone, physical address), date of birth, gender, sport nationality, profile picture.
● Whereabouts information: this indicates where you can be found, which may be either necessary for anti-doping testing (for example, addresses for regular activities like training, work or school and for the location(s) where you will be available for testing) or for immigration and travel purposes. We will notify you if you need to provide us with this information.
● IJF membership data: this includes IJF Academy status, referee licence number, federation function, club function, judo club membership status, information on licence issuance, preferred judo technique, role in the judo community.
● Competition data: this includes height, weight, gender, age category, videos/photos from competition, PCR test status (i.e., positive/negative), vaccination status, requests to participate, flight and hotel data.
● Account data: this includes name, email address, password.
● Analytical data: this includes website interactions, user ID, account ID, account name, account type / plan, data on the use of certain web features.
● Special categories of data: this includes doping testing data (that is created when samples are collected from you for an anti-doping test), health status and medical information, if you need to apply for a therapeutic use exemption, disability information and investigation information if we suspect you may have broken anti-doping rules and need it to be adjudicated. The types of personal information we collect depend on your level as an athlete or your role in sport. It will also depend on how the anti-doping rules apply to you. For example, if you need a therapeutic use exemption, you will need to provide us with medical information. If you are charged with an anti-doping rule violation, you may need to provide us with evidence in your defence.
Unless you are told otherwise, providing personal data is necessary to accomplish the processing purposes identified above. If you do not provide requested information, we may not be able to secure your licence to play sport or to participate in sports events as an athlete.
Legal basis of processing personal data
We are usually required to have a lawful basis on which to process your data. We explain each of these legal bases below. We also set out the purposes for which we process your data. For each purpose, we explain the lawful basis for that processing, the processing operations we carry out and the categories of data we process. We rely on the following legal bases when processing your personal data:
● The consent you provide us with pursuant to Article 6(1)(a) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th 2016, on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).
● To comply with our legal obligatio under Article 6(1)(c) of the GDPR and the Hungarian Act I of 2004 on Sports (“Sports Act”).
● Vital interests under Section 6(1)(d) GDPR – in exceptional circumstances, we may rely on the need to protect your vital interests to process certain data, particularly sharing information as needed with medical professionals for safety purposes.
● For our or third party’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.
We process special categories of personal data either based on your explicit consent (“Explicit Consent”), based on Article 9(2)(a) GDPR; under Article 9(2)(g) GDPR, where processing is necessary for reasons of substantial public interest, based on the law, under Article 4 (1) - (2) of the Sports Act and Hungarian Government Decree 363/2021. (VI. 28.) on the anti-doping activities (“Substantial Public Interest”) or if processing is necessary for the establishment, exercise or defence of legal claims (“Legal Claims Enforcement”).
We process your personal data based on the following legal bases for the following purposes and retain it for the data retention period defined as follows:
Purpose of data processing
Categories of personal data processed
Legal basis
Data retention
Organisation, holding and management of sporting events
Identification data
IJF membership data
Some competition data
Whereabouts information
Legitimate interest
5 years
Issuing and maintaining sports regulations
Identification data
IJF membership data
Some competition data
Legitimate interest
5 years, as a rule.
Competition data is not deleted, being kept for archiving purposes.
Governance, operation and management of organisational functions
Identification data
IJF membership data
Some competition data
Legitimate interest
5 years
Legal compliance
Identification data
IJF membership data
Some competition data
Whereabouts information
Special categories of data
The Hungarian Act I of 2004 on Sports, substantial public interest in case of special categories of data, vital interests
5 years
Whistleblowing
Identification data
IJF membership data
Some competition data
Whereabouts information
Legal obligation under Section 18 to 27 of the Act XXV of 2023 on complaints and public interest disclosure
5 years
Management and public disclosure of sport-specific athlete data
Identification data
Some competition data
Legitimate interest
5 years
Dispute resolution and arbitration
Identification data
IJF membership data
Some competition data
Whereabouts information
Special categories of data
The Hungarian Act I of 2004 on Sports, substantial public interest in case of special categories of data and legal claims enforcement
5 years
Reporting and keepingsSports statistics
Identification data
IJF membership data
Some competition data
Legitimate interests
5 years
Providing information society services
Account data
Analytical data
Legitimate interests
Two years from the date of your most recent visit.
Analytics and website measurement:
Analytical data
Consent
Until withdrawn, but not exceeding one year.
Most of our processing activities are based on a legitimate interest of our federation, a national judo association or a third party. We follow a process to carefully measure our interest against yours in a legitimate interest assessment. As far as the purpose of the processing allows, your data is processed pseudonymised or anonymised.
If you require further information about our legitimate interests, please contact us via our email address [email protected].
Duration of the storage of your personal data
We store your personal data with service providers on behalf of the IJF, but only as long as is necessary for the performance of our obligations and strictly for the time necessary to achieve the purposes for which the information was obtained. We will retain your data until the statute of limitations under civil laws (i.e., 5 years) to the extent data is necessary for legal claims enforcement. Under Hungarian laws, at least eight years statutory data retention obligation applies to personal data in accounting documents. If we rely on your consent, we will process your data until withdrawal of consent or until we cease data processing.
Recipients of data transfer
Within the IJF, your personal data may only be accessed on a ‘need-to-know basis’ by authorised employees, including our officers, administrators, and subject matter experts / specialists within the IJF.
Your data may be shared with a variety of third parties as described above. Personal data is also shared as necessary within the IJF, including with our sporting, legal, privacy and IT functions. It is possible that personal data needs to be transmitted to third parties during the outsourcing process, respecting legal requirements. The transfer is always based on legitimate legal grounds and respects the requirements of the GDPR. We perform checks on third parties chosen for the processing and assess the providers’ compliance with GDPR. Data is also transferred to public authorities and audit firms when required.
We transfer your personal data for the following categories of recipient:
● Our service providers: Your personal data will be shared with the IJF’s third-party service providers who will process it on behalf of the IJF for the purposes identified above. This may include the providers of insurance services, IT and technology services, survey providers and event organisers.
● Other third parties: We also share information with our professional advisers. We may transfer your personal data to external law firms and investigation experts so far as is necessary for the conclusion of the investigation or for the establishment, exercise or defence of legal claims.
● Government authorities: Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.
International data transfers
We may transfer your personal data outside of the country in which you are located. For several purposes set out above, the data sharing described is likely to result in the sharing of your data with third parties located outside your country; in principle, this may be any country in the world. Some recipients are located outside of the European Economic Area (“EEA”), in countries for which the European Commission has issued adequacy decisions. In each case, the transfer is thereby recognised as providing an adequate level of data protection from a European data protection law perspective (based Art. 45 of the GDPR).
By way of entering into appropriate data transfer agreements based on standard contractual clauses as referred to in Art. 46 (5) of the GDPR or other adequate means, which are accessible via the contact details above, we have established that all other recipients located outside the EEA will provide an adequate level of data protection for personal data and that appropriate technical and organisational security measures are in place to protect personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and against all other unlawful forms of processing. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law. In some limited circumstances our transfers may be exempt from adequacy obligations, where transfers are for important reasons of public interest, such as the sharing of data for anti-doping purposes. Where we transfer based on an adequacy mechanism, a copy of the relevant mechanism can be provided for your review on request by contacting us using the details set out below.
If, in relation to data transfers abroad, an adequate level of protection of personal data cannot be ensured, then we either rely on derogations or shall request your explicit consent relating to any such data transfers abroad. Please note that such data transfers may be associated with certain risks, particularly that in the country of the data recipient, unauthorised third parties may also have unreasonable access to said data and you may not be able to exercise the rights of the data subject and/or your right to object against acts that may harm your personal data and your right to privacy.
For more detailed information on the adequacy measures and guarantees we apply, please contact us at [email protected].
Your rights
If the related data processing is based on your (explicit) consent, then you are free to withdraw your consent at any time and we will not continue our data processing activity related to you. The withdrawal of your consent does not affect the lawfulness of prior data processing.
You have the following rights in relation to our data processing:
1. Right to access: You are entitled to receive information from us regarding whether your personal data is being processed or not, and if so, you have the right to access your personal data.
2. Right to rectification: You have the right to rectify your personal data on request.
3. Right to object:
You are entitled to object against processing of your personal data at any time, for reasons related to your special situation; in this case it may be required from us to stop processing your personal data. Should you have the right to object and you exercise it, your personal data will no longer be processed for such purposes. Exercising this right does not entail any costs.
4. Right to restriction of processing: You have the right to request the restriction of processing your personal data.
5. Right to erasure (‘right to be forgotten’): You are entitled to request the erasure of your personal data.
6. Right to data portability: You have the right to receive your personal data provided and available for us, in a structured, commonly used and machine-readable format, furthermore you are entitled to transfer this personal data to another controller without hindrance.
Should you wish to exercise your above-mentioned rights or if you have any enquiries concerning our data processing activities, you may contact our Data Protection Officer at [email protected].
You also have the right to lodge a complaint with the competent supervisory authority in the particular member state of your habitual residence, place of work or the place of alleged infringement of the GDPR.
Data Protection Officer
To ensure compliance with applicable data protection laws, we have appointed a Data Protection Officer who you can contact at the following email address: [email protected].