Privacy Policy

Effective from

September 30, 2026

This Privacy Policy explains how Erik Pach, trading as WODcomp ("we", "us", or "our"), as the operator of the WODcomp platform (the "Platform"), collects, uses, discloses, retains, and protects personal data when you use our services at wodcomp.app (the "Website") and in related mobile or web applications.

By registering an account or using the Platform, you confirm that you have read and understood this policy.

1. Who We Are and What Our Role Is

The data controller is:

Erik Pach, trading as WODcomp
IČO: 04677102
DIČ: CZ8808191469
Registered office at Na Zlaté stoce 1862/9d, 37005 České Budějovice, Česká republika
Email: support@wodcomp.app

The controller determines the purposes and means of processing personal data to the extent that it operates the Platform, user accounts, registrations, payments, results services, technical security, and related administration.

For individual events, the organizer of that event (the "Organizer") may also act independently, in particular where they determine the content of the registration form, the purpose of collecting additional data, the rules of the event, the sporting categories, the communication with participants, or the way the data is used to organise the event themselves. In such cases the Organizer may be an independent controller in relation to that processing. In relation to the Organizer, WODcomp may act as a provider of a platform tool, or as a processor to the extent set out in the contractual documentation.

2. Legal Framework and Basic Principles of Processing

When processing personal data we proceed in particular under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"), and under Act No. 110/2019 Coll., on Personal Data Processing, as amended (the "Personal Data Processing Act").

We process personal data only in a lawful, fair, and transparent manner, for specified, explicit, and legitimate purposes, to the extent necessary and for the period necessary for the given purpose. We protect personal data with appropriate technical and organisational measures.

Personal data is accessible only to persons who need it to carry out their work or to provide the services of the Platform. Persons who become acquainted with personal data are bound by a contractual or statutory duty of confidentiality, or by corresponding security rules.

The basic concepts relating to the protection of personal data are based on the GDPR and on the Personal Data Processing Act.

Personal data means any information relating to an identified or identifiable natural person (a data subject). An identifiable natural person is a natural person who can be identified, directly or indirectly, in particular by reference to an identifier (for example a name, an identification number, location data, an online identifier) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
A data subject is a natural person to whom the personal data relates. Personal data can exist only in relation to a living natural person. A data subject is not a legal entity.
Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. Processing of personal data must be regarded as the more sophisticated activity that a controller performs with personal data for a particular purpose and, from a certain perspective, does so systematically.
A controller is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
A processor is a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. A processor differs from a controller in that, within its activity for the controller, it may carry out only those processing operations with which the controller entrusts it or which follow from the activity for which the processor was engaged by the controller. It is a processor only in relation to the personal data provided by the controller, and not in relation to personal data it processes for purposes that concern it directly.
A data protection officer is a body whose main task is to inform and advise controllers or processors and the employees who carry out processing of their obligations under the data protection regulation and other legislation; to monitor compliance with the data protection regulation and other data protection legislation and with the policies of the controller or processor in the area of data protection, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits; to provide advice where requested as regards a data protection impact assessment and to monitor its performance; to cooperate with the supervisory authority and to act as the contact point for the supervisory authority on issues relating to processing, including prior consultation, and to consult, where appropriate, with regard to any other matter.
The consent of the data subject is one of the legal grounds on which a controller may process personal data. It is any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of their personal data.
Anonymisation is a process by which all personal data is irreversibly removed, with no possibility of identifying a particular natural person again. An anonymised set not only contains no data about natural persons or identifiers, but also rules out the possibility of linking it again with such data and with a particular person.
Pseudonymisation of the processing of personal data means that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that it is not attributed to an identified or identifiable natural person.

3. What Personal Data We Collect

3.1 Account and Identity Data

When creating and managing an account, we process:

first name and last name,
email address,
password (stored in hashed form; we never store your password in readable form),
gender,
phone number,
country,
username and profile photo, where you provide them,
t-shirt size,
body weight, where you state it, whereby you give consent to its processing (optional, collected on the basis of your consent and used solely for competition category eligibility purposes)
preferred language and timezone.

3.2 Athlete and Competition Data

When participating in events as an athlete or competitor, we process:

competition results, scores, rankings, and positions,
bib number and timing chip number,
video submission links (used to verify competition results),
club or affiliate association,
team name and role within a team,
a participant photograph, where you provide one, whereby you give consent to its publication under Section 6.11 (optional, withdrawable at any time),
a team photograph, where the team leader uploads one (by uploading it, the leader confirms that they have the consent of every person depicted to the publication of their likeness),
judge notes and scoring comments associated with your performance.

3.3 Event Registration Data

Event Organizers may configure their own registration forms for individual events. Depending on the specific event, the following may be processed:

postal addresses,
emergency contact details (collected solely for safety purposes and not used for any other purpose; by providing emergency contact details, you confirm that you have the consent of the individual named to share their data with us for this purpose),
dates of birth,
phone number,
gym or club affiliation,
other data requested by the Organizer (for example experience level, dietary requirements, sponsor information)

Where the custom registration form fields include special categories of personal data (for example dietary requirements that may reveal religious beliefs or health information), such data is processed solely on the basis of your explicit consent given at registration. You may withdraw this consent at any time by contacting us or the relevant Organizer. The withdrawal of consent does not affect the lawfulness of processing before its withdrawal

The specific fields required vary per event and are controlled by the Event Organizer.

3.4 Payment and Billing Data

When making payments and issuing tax documents, we process:

billing name, email, and phone number,
billing address,
business name, company registration number, or tax number (for business invoicing),
transaction identifiers and payment status.

Full card details (card number, CVV) are processed exclusively by Stripe and are never stored on our systems.

3.5 Organizer Data

If you register as an Event Organizer, we additionally process:

organisation or business name,
legal business name,
contact email and phone number,
company registration number and tax number,
website and social media profiles (Facebook, Instagram, Twitter/X, YouTube),
Organizer logo, cover image, and profile media,
Stripe connected account information for payment processing.

3.6 Usage and Technical Data

Certain technical data is collected automatically when you use the Platform:

IP address,
browser type and version,
operating system,
pages visited and time spent on the Platform,
referral URLs,
device identifiers.

This data is used to maintain the security of the Platform, to diagnose technical issues, and to improve our services.

3.7 Cookies and Session Data

We use cookies and similar technologies to:

maintain your login session,
remember your language and regional preferences,
protect against cross-site request forgery (CSRF) attacks.

Session cookies are HTTP-only (not accessible to JavaScript) and use SameSite protection.

4. Purpose and Legal Basis of the Processing of Personal Data

We process personal data only where there is an appropriate legal basis for the specific purpose under Article 6 of the GDPR, or, for special categories of data, also a condition under Article 9 of the GDPR.

We process your personal data on the following legal bases:

Purpose	Legal basis
Creating and managing your account	Performance of a contract and legitimate interest
Processing event registrations	Performance of a contract; for data determined by the Organizer, depending on the circumstances, also legitimate interest, consent, or legal obligation
Processing payments and refunds	Performance of a contract
Communicating with you about events, results, or account matters	Performance of a contract / Legitimate interest
Providing competition results and athlete rankings	Performance of a contract
Publication of a participant photograph	Consent
Fraud prevention and Platform security	Legitimate interest
Improving and maintaining the Platform	Legitimate interest
Complying with legal obligations (tax records, audits)	Legal obligation
Sending marketing communications (with consent)	Consent
Processing special categories of data via custom event fields	Consent

5. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or for the period required by law.

Data type	Retention period
Account data	For the duration of your account, plus up to 2 years after its deletion (to allow resolution of any outstanding disputes or legal claims)
Competition results and rankings	Results and rankings are retained indefinitely as a historical record; personal identifiers (for example email, date of birth) associated with results are anonymised 3 years after the event
Payment records	For the period required by law, generally 10 years for tax and accounting documents
Event registration data	For the duration of the event and up to 3 years afterwards
Participant photographs	Deleted 3 years after the event, together with the other personal identifiers linked to results
Activity logs and audit trails	Up to 2 years
Session data	48 hours of inactivity
IP geolocation data	Up to 30 days

If you request deletion of your account, we will delete or anonymise your personal data unless we are entitled or required to retain it further, in particular for reasons of tax and accounting obligations, the settlement of payments, security incidents, the protection of legal claims, or the long-term retention of results to a reasonably limited extent.

6. Who We Disclose Personal Data To

We do not sell your personal data. We disclose it only to the extent necessary to the categories of recipients listed below:

6.1 Event Organizers

When you register for a specific event, the Organizer of that event gains access to the personal data you provided during registration, including your answers in the custom fields. This is necessary to manage the event, to verify eligibility, and to communicate with participants. Organizers are responsible for handling your data in accordance with applicable law. WODcomp has entered into a Data Processing Addendum with each Organizer governing the processing of participant data.

6.2 Stripe (Payment Processing)

Payments are processed by Stripe, Inc. Stripe collects and processes your payment card details directly. We share billing information (name, email, address) with Stripe to process transactions. Stripe is certified PCI DSS Level 1 compliant.

Stripe's privacy policy: https://stripe.com/privacy

6.3 Email Service Providers

We use Mailgun (Sinch Email), EU region, to send transactional emails such as registration confirmations, result notifications, and account verification. Mailgun acts as a processor and processes only your email address on our behalf. Mailgun's privacy policy: https://www.mailgun.com/privacy-policy/.

6.4 Cloud Infrastructure and Storage

The Platform is hosted on Hetzner Online GmbH servers in Nuremberg, Germany (within the European Economic Area). Uploaded files (profile photos, organizer media, event images) are stored on Cloudflare R2.

We back up uploaded files and the database to Backblaze B2 storage, operated by Backblaze, Inc., in its EU region (Amsterdam, the Netherlands). We use backups solely to restore data after loss or damage. Data deleted from the Platform leaves the backups within 60 days.

These providers do not use your data for their own purposes. Hetzner privacy notice: https://www.hetzner.com/legal/privacy-policy/. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/. Backblaze privacy policy: https://www.backblaze.com/company/policy/privacy.

6.5 Error and Performance Monitoring

We use Sentry to monitor and diagnose technical errors. Error reports may include technical data such as browser type, operating system, and anonymised request data. Sentry's privacy policy: https://sentry.io/privacy/

We also use Laravel Nightwatch (operated by Laravel Holdings Inc.) to monitor application performance and errors across a sample of requests. The telemetry collected may include technical data such as your IP address, the request route, your browser user agent, and an account identifier. Nightwatch processes this data on our behalf so that we can keep the Platform reliable and diagnose problems. Laravel's privacy policy: https://laravel.com/legal/privacy.

6.6 IP Geolocation

We use a locally hosted MaxMind GeoLite2 database to determine the approximate country from your IP address in order to pre-fill the country field and apply regional settings. Lookups are performed entirely on our servers; no IP address or location data is transmitted to MaxMind in real time. IP-based location data is not used for tracking or advertising.

6.7 Third-Party Tracking and Analytics (Event Organizers)

Event Organizers may configure Facebook tracking for their events. This can operate through two channels: the Facebook Pixel, which runs in your browser, and the Facebook Conversions API, through which our servers send event data to Facebook directly. Both channels are activated only after you have given your explicit consent through the cookie consent banner displayed on the Platform. Until consent is given, no tracking data is sent to Facebook through either channel.

When tracking is active and you have consented, the data sent to Facebook may include identifiers such as your email address and name (transmitted only in hashed, pseudonymised form), a hashed account identifier, your IP address, your browser user agent, Facebook cookie identifiers, and, for purchase events, the transaction amount and currency. Facebook uses this data to attribute and measure event registrations on behalf of the organizer.

This tracking is governed by Facebook's privacy policy: https://www.facebook.com/privacy/policy/. You may withdraw your consent at any time through the cookie settings on the Platform.

An Event Organizer may also enable Google Analytics (provided by Google LLC) to measure how visitors use their event pages. Google Analytics runs in your browser and is activated only after you consent to analytics cookies through the cookie consent banner. When active, it stores a randomly generated identifier in a cookie on your device and sends Google information such as the pages you view, your approximate location (derived from your IP address, which Google does not store), and your device and browser type. Google processes this data to provide audience-measurement reports to the organizer. This processing is governed by Google's privacy policy: https://policies.google.com/privacy. You may withdraw your consent at any time through the cookie settings on the Platform.

6.8 Mobile Wallet Passes (Google Wallet and Apple Wallet)

If you add your athlete pass to Google Wallet, we use the Google Wallet API (Google LLC) to generate it. To create the pass, we send Google the information shown on it, namely your name, bib number, competition division, and (where applicable) team name. Google processes this data to issue and display the pass on your device. Google's privacy policy: https://policies.google.com/privacy.

Apple Wallet passes are generated and signed entirely on our own servers, and the information shown on the pass is never sent to Apple. When you add a pass to Apple Wallet and we later update it (for example, when your bib number or division changes), we send a device-specific push token to the Apple Push Notification service (APNs) so that your device knows to fetch the updated pass from us. Only that push token is transmitted to Apple; the pass content is always retrieved directly from our servers. Apple's privacy policy: https://www.apple.com/legal/privacy/.

6.9 Invoicing and Accounting (Organizers)

We use Fakturoid (operated by Fakturoid s.r.o., Prague, Czech Republic, within the EEA) to issue the monthly platform-fee tax documents that we are required to provide to organizers. To produce these documents, we share the organizer's billing identity (business name, address, and where applicable the company registration number and tax number) together with the platform-fee amounts. This applies to organizers only and does not involve athlete data. Fakturoid's privacy notice: https://www.fakturoid.cz/ochrana-osobnich-udaju.

6.10 Public Start Lists and Results

As part of running an event, the following participant data is publicly available without requiring login: name, club or team affiliation, competition division, start time and lane (heat and lane), result, and ranking. This data is accessible to anyone who visits the event pages and is also machine-readable through the Organizer API.

This data remains publicly available for the retention period set out in Section 5 (results and rankings are retained indefinitely as a historical record; personal identifiers linked to results are anonymised 3 years after the event).

Pages that name participants (start lists, results, schedule) are not indexed by search engines.

Publishing this data is necessary for the performance of the contract to participate in the event (providing the results service, Section 4) and cannot be declined during registration.

6.11 Participant Photographs

A participant photograph is not part of the data listed in Section 6.10, and we publish it solely on the basis of your consent. You give that consent by uploading the photograph. You do not have to upload one, and not providing it has no effect whatsoever on your registration or on your participation in the event.

You may withdraw your consent at any time. On withdrawal we delete the photograph and the public pages show the participant's initials in its place. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

Photographs are publicly available on the event pages. Unlike the data listed in Section 6.10, we do not make them machine-readable through the Organizer API. Neither the pages carrying participant photographs nor the photographs themselves are indexed by search engines.

We delete photographs 3 years after the event, together with the other personal identifiers linked to results (Section 5).

A team photograph is uploaded by the team leader. By uploading it, the leader confirms that they have the consent of every person depicted to its publication and, where a minor is among them, the consent of that minor's legal guardian. Any person depicted in a team photograph may object to its publication at support@wodcomp.app. On such an objection we delete the photograph without further assessment and without undue delay, and we delete it in its entirety, because an individual person cannot be removed from a photograph of a group; we inform the team leader of the deletion and its reason. A team member who holds an account on the Platform may delete the photograph themselves from their registration, with the same effect.

6.12 Legal Disclosure

We may disclose your personal data to public authorities, courts, law enforcement bodies, or supervisory authorities where required or permitted to do so by law, or where necessary to protect the rights, property, or safety of WODcomp, our users, Organizers, or the public.

7. Your Rights

As a data subject, you have the right:

to ask whether personal data is being processed and, if so, to request further information about that processing and to request a copy of it;
to request rectification of your personal data where it is inaccurate, or to request completion of incomplete data;
to request erasure of the personal data where:
- it is no longer necessary for the purposes for which it was collected or otherwise processed;
- you object to the processing under Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Article 21(2) of the GDPR;
- the personal data has been unlawfully processed;
- the personal data must be erased for compliance with a legal obligation in European Union or Member State law to which the controller is subject;
- a parent does not consent to the processing of their child's personal data (where the processing is based on consent for information society services);
to request restriction of the processing of the personal data where:
- the accuracy of the personal data is contested, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request instead the restriction of its use;
- the controller no longer needs the personal data for the purposes of the processing, but it is required for the establishment, exercise, or defence of legal claims;
- you have objected to the processing under Article 21(1) of the GDPR, pending verification of whether the legitimate grounds of the controller override yours;
to object;
to withdraw consent to the processing of personal data at any time, where the processing of personal data is based on consent having been given;
to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), IČO 70837627, registered office at Pplk. Sochora 727/27, 170 00 Prague 7, if you believe that the processing of personal data has breached the rules relating to the protection of personal data.

To exercise any of these rights, contact us at support@wodcomp.app or in writing at the address of our registered office.

So that a request can be handled properly, it should contain at least:

identification of the person making the request, in particular first name, last name, and the email address used on the Platform,
an indication of the right you wish to exercise, or a description of what you are seeking,
the data necessary to locate the relevant account, registration, event, or transaction,
contact details for delivery of the response.

If the identity of the applicant cannot be verified, or if there is reasonable doubt that the request is being made by an authorised person, we may ask for additional data or for other reasonable verification of identity. Without verification of identity, personal data cannot be disclosed, nor can certain actions be carried out, in particular erasure or modification of data.

We provide information on the measures taken without undue delay, and in any event within one month of receiving the request. That period may be extended by a further two months, taking into account the complexity and number of requests; we will inform you of any extension and of the reasons for it.

Handling a request is in principle free of charge. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may, in accordance with the GDPR, charge a reasonable fee reflecting the administrative costs, or refuse to act on the request.

8. Cookies

We use the following types of cookies:

Cookie type	Purpose	Duration
Session cookie	Maintains your login session	Session (48 hours of inactivity)
CSRF token	Protects against cross-site request forgery attacks	Session
Preference cookies	Remembers language and regional settings	1 year
Consent cookie	Remembers your cookie and tracking choices	6 months

We do not set third-party advertising or analytics cookies ourselves. If an Event Organizer has enabled the Facebook Pixel or Google Analytics for their event, those tools may place their own cookies in accordance with the relevant provider's cookie policy, and only after you have consented to the corresponding cookie category (marketing for the Facebook Pixel, analytics for Google Analytics).

You can manage cookies through your browser settings. Please note that disabling session cookies may prevent you from logging in or from using certain parts of the Platform.

9. Security of Personal Data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, destruction, disclosure, or other unauthorised action. These measures include in particular:

encrypted storage of passwords (Argon2id hashing),
HTTPS encryption for all data in transit,
HTTP-only and SameSite session cookies,
access controls limiting data access to authorised persons,
regular monitoring of application errors, security events, and anomalies,
backups, operational supervision, and regular assessment of the adequacy of security measures.

If you suspect misuse of your account, unauthorised access, or another security incident, contact us without delay at support@wodcomp.app.

In the event of a personal data breach, we proceed in accordance with the GDPR. Where the breach is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within the statutory period. Where a high risk to rights and freedoms is likely, we will also inform you, unless one of the exceptions under the GDPR applies.

10. Transfers of Personal Data Outside the European Economic Area

Some service providers or their sub-suppliers may process personal data outside the European Economic Area, in particular in the United States of America or in other third countries. Where such a transfer occurs, we ensure that it takes place on the basis of appropriate safeguards under the GDPR, in particular an adequacy decision, standard contractual clauses approved by the European Commission, or another applicable mechanism under Chapter V of the GDPR.

For tools operated by third parties, for example Stripe, Google, Meta, Cloudflare, Sentry, or Apple, separate processing may also take place under their own privacy policies. In such a case, we recommend that you also review the information provided by the relevant provider.

11. Minors

Only persons over 18 years of age may hold their own account on the Platform; a person under 18 may not hold their own account. Where an event participant is under 18 (for example a competitor in a junior or teen division), a legal guardian arranges the registration and manages that participation under their own account and, on the minor's behalf, gives consent to the processing of the minor's personal data. That consent is given at the moment the legal guardian, as the account holder, accepts the Terms of Service and this Privacy Policy.

On that basis we process the minor's data needed for registration for and participation in events, which may include name, gender, date of birth, body weight for division eligibility purposes, and a photograph of the minor, where the legal guardian provides them. Any special categories of data (for example body weight) are processed only with the explicit consent of the legal guardian, given at the moment the data is entered. We do not send marketing communications to minors.

We publish a photograph of a minor solely on the basis of the legal guardian's consent, which is given by uploading it (Section 6.11). Where a minor is depicted in a team photograph uploaded by a team leader, the legal guardian may object at any time under Section 6.11, and on that objection we delete the photograph in its entirety.

If you believe that a minor's personal data has been provided to us without the required consent of a legal guardian, contact us at support@wodcomp.app and we will investigate the matter.

12. Third-Party Links and Services

The Platform may contain links to third-party websites or services (for example Event Organizer websites, social media profiles). We are not responsible for the processing of personal data by third parties outside the environment of the Platform, where we determine neither the purposes nor the means of such processing.

We encourage you to review the privacy policy of any third-party site whose services you use.

13. Changes to This Policy

We may update this Privacy Policy from time to time, in particular where the features of the Platform change, where the law changes, or where the ways in which personal data is processed change. If we make material changes, we will notify you in an appropriate manner, in particular by email or by displaying a notice on the Platform before the change takes effect. The effective date shown at the top of this page reflects the currently published version.

14. Contact

For any questions, requests, or complaints regarding this Privacy Policy or the way we handle your personal data, contact us:

Erik Pach, trading as WODcomp

IČO: 04677102
DIČ: CZ8808191469
Registered office at Na Zlaté stoce 1862/9d, 37005 České Budějovice, Česká republika
Email: support@wodcomp.app