Privacy Policy

1. Introduction

Buhurt Arena ("we", "our", "us") operates the website buhurtarena.app and related services, including the Buhurt Companion mobile application (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Finnish data protection law.

By using the Service you agree to the collection and use of information in accordance with this policy.

2. Data Controller

The data controller responsible for your personal data is the operator of Buhurt Arena. For any privacy-related enquiries please contact us at: [email protected]

3. What Data We Collect

When you sign in through a third-party identity provider (Authentik / OAuth), we receive your email address and display name. We store only the minimum information required to identify your account and control access to the Service.

If you or an administrator creates a fighter or marshal profile in the system, the following data may be stored: first name, last name, nationality, weight class, and club affiliation. This data is used to manage tournament registrations and display competition results.

Club profiles may include the club name, country, location, and a logo image uploaded by an authorised administrator.

We store event schedules, match results, scores, and standings. Fighter names may appear in publicly visible match results and league tables.

We may collect standard server log data (IP address, browser type, pages visited, timestamps) for security and operational purposes. This data is not used for profiling or marketing.

The Buhurt Companion mobile app stores training logs, fighter profiles, and session data locally on your device. This data is not transmitted to our servers. GPS location data recorded during endurance sessions is stored locally only and is never uploaded. The camera is used solely to scan QR codes and does not store images.

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Legitimate interest — operating the tournament management platform, displaying competition results, and maintaining system security.
• Consent — where you have provided explicit consent, for example by creating or approving your fighter profile.
• Contract performance — where processing is necessary to deliver the Service to you or your organisation.

5. How We Use Your Data

• Authenticate and manage user accounts
• Display tournament schedules, results, and league standings
• Manage fighter and club registrations
• Ensure security and prevent abuse of the Service
• Improve and maintain the platform

We do not sell, rent, or share your personal data with third parties for marketing purposes.

6. Data Retention

We retain personal data for as long as necessary to provide the Service and comply with legal obligations. Fighter profiles and competition records are kept as part of the historical record of the sport. You may request deletion of your account data at any time (see Section 8).

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data in transit is encrypted using TLS. Access to administrative functions requires authenticated credentials.

8. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

9. Cookies

The Service uses session cookies necessary for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics services.

10. Third-Party Services

Authentication is handled via an Authentik identity provider. Your login credentials are managed by that provider and are not stored directly by Buhurt Arena. Please review the privacy policy of your identity provider for further details.

The Buhurt Companion mobile app uses Sentry (Functional Software, Inc.) for crash reporting. Sentry may collect device model, operating system version, app version, and anonymised stack traces when a crash occurs. No personally identifiable information is included. 20% of app sessions are sampled for performance monitoring. Data is processed on Sentry's EU infrastructure. Sentry's privacy policy: sentry.io/privacy

The app uses Google Maps via the react-native-maps library to display route maps during endurance sessions. Google may collect usage data in accordance with Google's Privacy Policy: policies.google.com/privacy

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.