Privacy Policy

Global Taekwondo Federation (hereinafter "GTF", "we") respects your privacy and is committed to protecting the personal data you provide when using gtf.global, the websites of national and regional federations, the GTF ID single sign-on (id.gtf.global) and the GTF mobile app for iOS and Android (together, the "Platform"). Records of athletes, coaches, judges and guardians are maintained by the national federation they belong to; GTF provides the Platform and processes the data on the federation's behalf. This Policy describes what data we collect and how we use, store and delete it.

• Identification data: full name, date of birth, gender, photo • Contact data: phone number, email address, Telegram • Sports data: belt/rank, club, coach, group, training attendance, gradings, competition entries and results, rating, weight and height (for weight categories), medical clearance status, experience points (XP) and Ki points • Documents: photos of medical certificates, consents and signatures, receipts for bank transfers • Payments: purpose, amount and status of a payment. We do not receive bank card details — they are entered on the page of the bank or payment provider • Sign-in data: phone number or email for one-time code sign-in (SMS, Telegram, WhatsApp, email) • Technical data: IP address and approximate location derived from it (country, city), device and browser type, cookies • Mobile app data: installation identifier, push notification tokens, device model, OS and app version, language and time zone • Biometric data — only with separate consent (section 5) • Video recordings of bouts at tournaments where the organiser enabled recording (section 6) • Activity data from Health Connect or Apple Health — only if you connect it (section 7) The Platform does not collect precise (GPS) location. The app contains no advertising, no advertising identifiers and no third-party analytics SDKs, and data is not used to track you across other companies' apps and websites.

• Registration, sign-in and account security • Maintaining records of athletes, coaches, judges and guardians, clubs and groups • Training schedules and attendance • Belt gradings, competition registration and management, judging and results • Federation membership and payment for its services (membership fees, training, tournaments, gradings) • Venue access and check-in by face — with consent • Notifications about training, competitions, results and federation news • Ratings, statistics and the rewards programme (XP, medals, Ki) • Issuing digital membership cards (Apple Wallet / Google Wallet) • Security: sign-in and activity logs, investigating abuse • Improving the Platform, including training the GTF Vision judging AI assistant (section 6)

• Installation identifier — a random value the app creates on first launch and keeps in the device's secure storage. It lets us tell your devices apart, show your sign-ins and disconnect a lost device. • Push notification tokens (Apple Push Notification service, Firebase Cloud Messaging, Expo) — for notifications about training, bout calls, results and payments; Live Activity tokens for the iPhone Lock Screen. Signing out disconnects the device; removing the device from the list or deleting the account deletes the tokens. • At sign-in we store the IP address, app version, device model and OS in the session log. • Camera — QR codes for check-in and venue access, athlete and document photos, Face Pass and Dojang camera. Photos — choosing a photo and saving award cards. Calendar — the app only adds trainings and tournaments to the calendar on your device; nothing is read from it and sent to us. Local network — connection to the GTF Kalys judging software at the venue. The microphone is not used. • Face ID / fingerprint unlock of the app is performed by the device's operating system; we do not receive this data. • Crash reports: when an error occurs in the app, it sends a technical report (what broke, the screen, app version, device model and OS, your account identifier) to our own error-tracking server. Your name, phone number and email are not included. Reports are used only to fix errors and are kept for up to 90 days.

This feature is optional and works only with your separate consent (for a child under 18 — the guardian's consent). All other features are available without it. • What we collect: when you record your face, the app (or the website in your browser) computes numerical face templates on your device — 128 numbers per angle, up to 5 angles — and checks that a live person is in front of the camera. The templates and one frontal photo are sent to the server. • Why: entry to tournament areas, training check-in, identity checks at weigh-in and document checks, and account recovery with "Sign in with face" (not used for children under 14). • Where it is stored: templates in the Platform database, the frontal photo in private storage accessible only through temporary signed links. For venue access, templates of that tournament's participants are downloaded in encrypted form to the devices of staff with scanning rights and are deleted from them one day after the tournament ends or when the right is withdrawn; a coach receives the templates of their group for check-in only while the screen is open. Matching for face sign-in and at weigh-in is done by the server; frames sent for it are not stored. • Templates are not shared with third parties and are not used for advertising or any other purpose. • If a federation uses face recognition at a tournament, a template may also be computed from the profile photo on the athlete's record; a match on it is confirmed by tournament staff and it is never used to sign in. Such a template is deleted when the profile photo is changed or removed. • Retention: until you delete the recording or withdraw consent. • How to delete: in the app, Profile → Face Pass → Delete, or on the website in the athlete account. The templates and photo are deleted and consent is withdrawn (a record of the consent and its withdrawal is kept as proof). Your face data is also deleted when you delete your account.

At tournaments where the organiser has enabled video recording, bouts on the dojang are filmed by phones on tripods ("Dojang camera" in the GTF app) — only by judges, federation staff and tournament video operators. Only video is recorded, without sound. This is announced on the tournament page, at registration and in the regulations; taking part in such a tournament means agreeing to video recording. • Purposes: judging and instant replay, training GTF artificial intelligence systems (GTF Vision — an AI assistant for judges). • Where it is stored: in the federation's private storage; when GTF Kalys is used, video is also sent over the local network to the judging computer at the venue. • Access: only GTF judging and ML teams using personal keys; every export is logged. Recordings are not published without separate consent and are not shared with third parties. • Retention: as long as the recordings are needed for these purposes. Recordings featuring an athlete can be deleted on request to the federation or info@gtf.global.

Connecting is optional and happens only with your permission in the system settings. For children under 13, the guardian's consent is required. • What we read (read-only; the app writes nothing to Health): daily step count, activity and workout minutes including martial arts, weight and height. • What we send to the server: daily totals of steps and activity minutes for recent days — for weekly rings and for awarding experience (XP) and Ki. Weight is sent to the coach only after you confirm it. Height stays on the device. • Health data is not used for advertising or marketing, is not sold and is not shared with third parties. • How to delete: in the app, in the Health section — disconnect and delete the data (experience already earned is kept). Access can also be revoked in Health Connect or Health settings.

If you add a membership card to Wallet, it shows your full name, photo, belt, athlete ID, federation, membership expiry and a QR code. To update the card, Wallet sends us a device identifier and a Wallet push token; they are deleted when you remove the card from Wallet. The card stops being valid when membership expires or is revoked.

• SMS — sign-in codes and important notifications • Telegram — sign-in codes and notifications (if linked) • WhatsApp — sign-in codes and notifications • Push notifications — in the browser and the mobile app • Apple/Google Wallet — membership card updates • Email — notifications and newsletters (if an address is provided) Channels and notification types can be configured in your profile and in the app.

The Platform's servers and database are hosted in a Hetzner data centre (Finland, EU); files are stored in Cloudflare R2, database backups are kept for 30 days. Data in transit is encrypted (HTTPS); private files (face photos, video recordings) are served only through temporary links. Mobile app sign-in tokens are stored in the database only as hashes. Data is accessible only to authorised federation and GTF staff within their duties; administrator actions are logged.

We do not sell personal data. Data is shared only to the extent necessary to operate the Platform: • National and regional federations, clubs and coaches — to manage athletes, training and competitions; tournament organisers — participant data • Hosting and infrastructure: Hetzner (servers), Cloudflare (network, file storage, real-time data exchange), Pusher (real-time updates) • Payments: Finik, FlashPay and banks — when you pay on their page • Messaging: SMS providers (Nikita, SMSC), Telegram, WhatsApp (Meta Platforms), email services • Push notifications: Apple, Google, Expo • Determining country and city from the IP address for the security log: ip-api.com • Government authorities — upon request in accordance with applicable law

Account data is kept as long as the account exists. Sports records (competition results, gradings, belts, payments) are kept by the federation as part of its sports register and reporting. Sign-in and activity logs are kept for security. Biometrics, video and health data are kept as described in sections 5–7. Backups are overwritten within 30 days.

• In the GTF app: Profile → About → Delete account. Sign-in is disabled on all devices right away and the account is frozen for 30 days — signing in again during this time restores it; after 30 days it is deleted for good. • By email: write to info@gtf.global from the account's phone number or email (or include them in the message) with the subject "Account deletion" — we will delete the account within 30 days. What is deleted: sign-in and all sessions on all devices; profile name, sign-in phone and email, Telegram, account photo and signature; recorded face and the consent for it; devices, push tokens and in-app messages. What is kept: athlete, coach and guardian records are maintained by the federation — results, gradings, belts, payments, activity data and the membership card remain in its register but are detached from the account; the security log keeps a record of the deletion. To have these records anonymised as well, contact your federation or info@gtf.global. Accounts of federation officials, secretaries and judges are deleted through the federation after the role is handed over. More: gtf.global/en/account-deletion

You have the right to: • Access your data and get a copy (the account on the website offers a "My data" export) • Correct inaccurate data • Delete your account and request deletion of data (subject to mandatory retention of sports records) • Withdraw consent to biometrics, access to health data and notifications • Opt out of newsletters To exercise your rights, contact your federation administrator or write to info@gtf.global.

Children's accounts and records are managed by parents (guardians), the club and the federation. Consent for a child under 18 to biometrics and document processing is given by the guardian; health data of a child under 13 is connected only with the guardian's consent; face sign-in is not used for children under 14. A child may use the app through a parent's account.

We use cookies to operate the Platform and to remember your sign-in, language and settings. If a federation has enabled web analytics on its website, it uses its own cookies. You can manage cookies in your browser settings.

We may update this Policy. The current version is always available on this page, with the update date shown above. We will notify you of significant changes through the Platform.

For questions about personal data processing: Global Taekwondo Federation Email: info@gtf.global Website: gtf.global