Privacy Policy (GDPR) — CombatFlow ID

Last updated: August 2026 · Version 5.0. This Policy explains how CombatFlow ID processes personal data in connection with digital passports, tournaments, the Club Store, subscriptions and related services, in compliance with Regulation (EU) 2016/679 (GDPR).

Privacy Policy and GDPR

Companion document to General Terms v5.0 (GENERAL_TERMS). Applies to Athletes, Fans/Spectators, Coaches, Clubs, Promoters, Referees and Staff.

CombatFlow ID is committed to protecting the personal data of athletes, coaches, clubs, promoters and other users, in strict compliance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and applicable Portuguese data-protection law.

1. Data Processing

We process the following categories of personal data to operate the Digital Athlete Passport, tournament ecosystem, store and platform communications:

Identification and Contact: name, email address, date of birth and profile photograph.
Sporting History and Affiliation: discipline, rank/belt, fight record, federation licence and sports medical examination documents (where required for eligibility).
Payment Data: processed by Stripe; CombatFlow ID does not store full card details.
Technical / Account Data: authentication credentials (hashed), device and session identifiers reasonably necessary for security, fraud prevention and service delivery.
Purpose: providing the digital passport service; validating eligibility and age/weight divisions in tournaments; sending event alerts; managing ticketing and registrations; operating Club Store fulfilment; and enforcing community safety (including AI-assisted moderation of user-generated content).

Special-category data (e.g. sports medical fitness evidence) is processed only where necessary for competition eligibility or legal/federation obligations, with appropriate safeguards and access limited to authorised roles.

2. Digital Athlete Passport

The Digital Athlete Passport is the official repository of your sporting history on the platform (record book / caderneta, licences, exams and fight history). This data is processed to:

perform the contracted service;
validate eligibility and divisions in tournaments;
comply with legal and federation regulatory obligations, where applicable.

Structured sporting results may appear in contexts configured by event organisers or public scoreboards. Original identity documents, medical/sports clearance files and vault scans remain subject to the Document Verification Vault Privacy Notice.

3. Legal Basis for Processing (GDPR Article 6)

Your data is processed on the following legal bases under Article 6 GDPR:

Performance of a Contract (Art. 6(1)(b)): necessary to provide CombatFlow ID services, account management and tournament registration.
Compliance with Legal and Regulatory Obligations (Art. 6(1)(c)): validation of medical fitness and combat federation regulations where legally required.
Consent (Art. 6(1)(a)): for sending certain notifications and alerts about new events in your area, and other optional processing clearly presented at the point of collection. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Legitimate Interests (Art. 6(1)(f)): where applicable and balanced against your rights — e.g. platform security, fraud prevention, service improvement and community moderation — unless overridden by your interests or fundamental rights.

4. User Rights (Access, Deletion / Right to be Forgotten, Portability)

Under the GDPR, you have the right to:

Access and Rectification: view and update your data in real time in your profile, and request a copy of personal data we hold about you.
Deletion / Erasure (“Right to be Forgotten”): request deletion of your account and removal of personal data via the Settings section of the application, subject to legal retention exceptions (e.g. accounting, dispute resolution or federation obligations).
Portability: request export of your sporting history and other personal data you provided, in a structured, commonly used and machine-readable format where the GDPR portability right applies.
Restriction and Objection: request restriction of processing or object to processing based on legitimate interests, including profiling-related community tools where applicable.
Complaint: lodge a complaint with the competent supervisory authority (in Portugal: Comissão Nacional de Proteção de Dados — CNPD).

5. Data Protection Officer (DPO) Contact

To exercise your rights or clarify any question about the privacy of your data, you may contact our Data Protection Officer (DPO) via the support email configured on the platform or directly through the in-app help menu.

Please include sufficient information to verify your identity and describe the request (access, erasure, portability, etc.). We will respond within the timeframes required by the GDPR.

6. Controllers, processors and international transfers

Controller: CombatFlow ID (platform operator), for core account, passport and community processing.
Processors / sub-processors: include payment processing (Stripe), shipping rate calculation (EasyPost), hosting/infrastructure providers and, where enabled, AI moderation vendors — each bound by appropriate data-processing terms.
Where personal data is transferred outside the EEA, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) as required by Chapter V GDPR.

7. Retention

Personal data is retained for as long as necessary to provide the service and thereafter for the periods required by law (including tax and dispute-related retention) or until a valid erasure request is fulfilled where no overriding legal ground applies.

Auxiliary Privacy Notices

Role-specific notices displayed at registration or document upload. They supplement — and do not replace — this Privacy Policy v5.0.

Messaging and interaction (invite-only)

Initial message invites: To protect users' privacy and reduce spam and harassment, the platform operates an invite-only model. A user may send only one (1) initial conversation invite or request message to another user.
Chat unlock: Additional messages and an ongoing conversation become available only after the recipient explicitly accepts the invite request.
Removal of earlier restrictions: Messaging is governed solely by the invite approval state (accepted or pending). It is not conditioned on a mutual-follow relationship, or on the purchase of tickets or passes.

Profile types and account privacy

Public Member / Athlete profile: Accounts registered as Athletes or Members have a public profile by default, so their sporting record, fight history and achievements in their discipline can be displayed.
Private account option: Every user keeps full control of their visibility and may switch their account to Private at any time in their profile settings.

Processing for ticketing, merchandising and follow relationships remains subject to the legal bases described in §3 above and the General Terms.

Document Verification Vault Privacy Notice

Private Vault — 100% private medical / sports clearance & verification files Identity and affiliation documents (federation card, official licence, ID logbook), logbook page scans used for bout OCR, and medical / sports clearance files (annual sports medical examination evidence and related fitness documents) are stored in the athlete Private Vault. These files are 100% private: they are never published on the public profile, feed, scoreboard or any social surface. Access is restricted to the athlete and to authorised event Promoters, official Referees and Staff solely for weigh-in / eligibility / in-person verification audit. Temporary staff access may be provided via signed URLs with a short expiry window.

Purpose: identity and affiliation verification; in-person event checks; OCR of bout records into the structured Digital Athlete Passport table (public-facing history shows structured data only, not the original scan); and validation of sports medical clearance where required for competition.
Confidentiality (medical / sports clearance): sports medical examination evidence and clearance documents are confidential under the GDPR (including, where applicable, special-category health-related data). Only you and authorised organisers/staff may access them when strictly necessary for competition fitness or federation rules. They are not shared with other athletes, fans or the general public.
User control: you may replace vault documents from your profile. Deletion requests follow the rights in §4 (Access, Deletion / Right to be Forgotten, Portability), subject to ongoing competition or legal retention needs.