Privacy Policy - KZN Chess

This Privacy Policy explains how Core Axis Development (Pty) Ltd, trading as KZN Chess ("we", "us", "our"), collects, uses, shares and protects personal information when you use kznchess.co.za. It is written to meet the requirements of the Protection of Personal Information Act 4 of 2013 (POPIA).

The short version:

We collect only what we need to run accounts, tournaments, the store and the training tools.
Tournament results are public, as they are throughout chess. Player names, ratings, clubs or schools and results are visible to everyone.
We don't sell personal information, we don't send marketing, and we don't use analytics or tracking tools.
Our website and database are hosted outside South Africa.
You can ask to see, correct or delete your information by emailing keagangilmore@gmail.com.

1. Who is responsible for your information

Core Axis Development (Pty) Ltd is the responsible party for personal information processed through KZN Chess.

Address: 3 Syringa Road, Pennington, KwaZulu-Natal, South Africa
Information Officer: Keagan Gilmore
Email: keagangilmore@gmail.com

2. What this policy covers

This policy covers everything on kznchess.co.za: accounts, tournament listings and management, the store, the gallery and feed, the Learn tools (including the FIDE Arbiter Trainer), and messages you send us. It doesn't cover other websites or services we link to, such as organisers' websites, WhatsApp or Google; their own privacy policies apply.

3. Information we collect

Information you give us

Account: your name, email address and password. We store passwords only as a one-way hash, so we can never see them.
Store orders: your name, email address, phone number, delivery address or chosen collection point, the items you order, amounts, and any note you add. You can order without an account.
Payments: we don't collect card details. When you pay by EFT, our bank shows us the amount, the reference and the payer name that your bank provides.
Tournament submissions: event details, the contact name, phone number and email you enter for the event, and any poster image.
Photos, captions, comments and likes that you post.
Training data: puzzle attempts and ratings, opening repertoires and notes, and review schedules.
Messages: emails or WhatsApp messages you send us.

Giving us information is voluntary, but some of it is required. Without a name, email address and password we can't create an account, and without contact and delivery details we can't fulfil an order.

Information other people give us about you

Tournament player records: organisers and arbiters enter details about players in their events. These are name, FIDE ID, Chess South Africa ID, FIDE and national ratings, club or school, district, sex, age category (such as U12), section, starting rank, pairings, results, withdrawals and bye requests. We don't collect players' dates of birth or ID numbers.
Tutor records: tutors who use our tutor tools may record a student's name, skill level, session notes and rating estimates.
Photos that other users post may show you.
Account settings set by our administrators, such as your district and whether you have organiser or tutor access.
District coordinators: we publish each district coordinator's name, email address and phone number so that players can contact them.

Information collected automatically

Cookies that keep you signed in (see section 10).
Browser storage that keeps your shopping cart and your FIDE Arbiter Trainer progress on your own device.
Server logs: our hosting provider records technical information such as your IP address, browser type and the pages requested, for security and troubleshooting.
Advertising: where we show Google ads, Google may collect device and browsing information using cookies (see section 10).

We don't use analytics or tracking tools.

4. Why we use your information

POPIA allows us to process personal information when you consent, when it's needed to perform a contract with you, when the law requires it, or when it serves a legitimate interest of yours, ours or a third party's. We use your information:

to create, secure and run your account, which is needed to provide the service you signed up for;
to process, deliver and support your orders, contact you about them, and handle cancellations, returns and refunds, which is needed to perform our contract with you;
to keep financial records, as tax and company law require;
to list, run and publish tournaments, including pairings, results, standings, crosstables and exports for rating bodies. This rests on the legitimate interest of players, organisers and the chess community in fair, transparent competition, and on the consent organisers obtain from players (and from parents or guardians for under-18s);
to display photos, comments and likes you choose to post, with your consent;
to provide the training tools you use;
to keep the site secure and prevent abuse, including logging what our administrators do, which is in our legitimate interest and yours;
to respond to your messages and requests;
to show advertising that helps keep the site free, which is in our legitimate interest. How Google personalises ads is explained in section 10.

We don't make automated decisions about you that have legal or similarly significant effects. Puzzle ratings are calculated automatically, but only for training.

We don't sell personal information and we don't send direct marketing. If we ever want to send you marketing, we'll ask for your consent first, as section 69 of POPIA requires.

5. Children

POPIA treats anyone under 18 as a child. Many of the players in KwaZulu-Natal chess are juniors, so we take particular care with their information.

A child may have a KZN Chess account only with the consent of a parent or guardian, who accepts our Terms and this policy on the child's behalf.
Junior players' tournament details are entered by organisers, who must first obtain a parent or guardian's consent (see section 6 of our Terms). We publish only what competition needs: name, ratings, FIDE and Chess South Africa IDs, club or school, district, sex, age category and results. We don't collect dates of birth or ID numbers.
Photos of identifiable children may be posted only with their parent or guardian's permission. We remove such photos on request.
Parents and guardians may ask to see, correct or remove their child's information, or withdraw consent, by emailing keagangilmore@gmail.com. If you'd like a child's name removed from past results, we can replace it with initials so that the event's results stay intact.

6. What's public

Anyone, including search engines, can see:

tournament pages: event details, the organiser's contact name, phone number and email, and the poster. Tournaments are visible, marked as pending, while we review them;
player lists, pairings, results, standings and crosstables (including printable versions): player name, ratings, FIDE ID, Chess South Africa ID, club or school, district, sex, age category, section and results;
photos with their captions and the uploader's name, comments with the commenter's name, and like counts;
district coordinators' names and contact details.

The following are not public: your account email address, your orders, your training data and tutor records. Contact details you choose to publish for a tournament are the exception.

Railway (railway.com) hosts our website, database and uploaded files.
Google serves advertising where ads are shown, and collects information through its own cookies (see section 10).
Couriers receive your name, phone number and delivery address so they can deliver your order.
Our bank processes EFT payments and refunds.
Tournament organisers, directors and arbiters see and manage player details for their own events. They can export them (as TRF and CSV files) to run the event and to submit results to rating bodies such as FIDE and Chess South Africa.
WhatsApp (Meta) receives information only if you choose to share or message through WhatsApp. The pre-filled message (which may include your order link or a tournament's pairings) is then handled under WhatsApp's own privacy policy.
Authorities or other parties receive information where the law, a court order or the protection of someone's rights or safety requires it, or to prevent fraud.
A new operator: if KZN Chess is transferred to another entity, personal information may be transferred with it and will remain protected by this policy.

People we authorise to administer the site access personal information only as needed to run it, and their actions are logged.

8. Information stored outside South Africa

Our hosting provider stores and processes information on servers outside South Africa. We transfer personal information across borders only as section 72 of POPIA allows. The transfer is necessary to provide the service you've asked for, and we use providers that commit to protecting personal information under their data processing terms.

9. How we protect your information

Passwords are stored only as bcrypt hashes.
The site is served over an encrypted (HTTPS) connection.
Access to admin, organiser and tutor tools is restricted by role, and admin actions are logged.
We never handle payment card details.
Order pages are protected by a private, hard-to-guess link.
When a photo is uploaded, we remove the location and camera information (EXIF metadata) stored in it.

No system is completely secure. If a security compromise affects your personal information, we'll notify you and the Information Regulator as section 22 of POPIA requires. You can help by keeping your password private and not sharing private order links.

10. Cookies and similar technologies

We use only the cookies and browser storage needed to run the site, plus Google's advertising cookies where ads are shown.

Sign-in session cookie (next-auth.session-token): keeps you signed in. It's essential and lasts up to 30 days.
Security cookie (next-auth.csrf-token): protects forms against cross-site request forgery. It's essential and lasts for your browser session.
Sign-in redirect cookie (next-auth.callback-url): returns you to the right page after you sign in. It's essential and lasts for your browser session.
Cart (browser storage, kznchess.cart.v1): remembers the items in your cart. It stays on your device until you clear it or place your order.
FIDE Arbiter Trainer progress (browser storage, kzn.arbiter.v1): saves your progress. It stays on your device only.
Google advertising cookies (set by Google where ads are shown): used to serve and measure ads, and possibly to personalise them. You can manage ad personalisation at myadcenter.google.com, and Google explains its practices at policies.google.com/technologies/partner-sites.

On secure connections the cookie names start with __Secure- or __Host-. You can block or delete cookies in your browser settings, but you won't be able to sign in without the essential ones.

11. How long we keep it

Account: while your account is open. If you ask us to close it, we delete your account and training data (puzzle history, repertoires, review schedules and any tutor records). We also delete your photos and comments, or remove your name from them.
Orders: for as long as tax and company law requires us to keep financial records (currently up to seven years), even if you close your account.
Tournament records: kept as the historical record of the event, because ratings, titles and later events depend on them. A player, or a parent or guardian, may ask us to replace a name with initials.
Photos and comments: until you or we delete them, or your account is closed.
Server logs: kept by our hosting provider for a limited period.
Records of admin actions: kept for as long as needed for security and accountability.
Messages: kept for as long as needed to deal with your request.

12. Your rights

Under POPIA you may:

ask whether we hold personal information about you, and ask for a copy of it;
ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
object to processing that is based on legitimate interest, including the publication of your tournament details;
withdraw your consent at any time (this doesn't affect processing that has already happened);
refuse direct marketing;
complain to the Information Regulator.

To make a request, email keagangilmore@gmail.com with the subject "Privacy request" and tell us what you'd like us to do. We may ask you to confirm your identity, and we'll respond within 30 days. We don't charge for correction or deletion requests. For copies of records, we may charge the fee prescribed under the Promotion of Access to Information Act, and we'll tell you before we do.

Sometimes we can't delete information, for example order records the law requires us to keep. If so, we'll explain why.

13. Changes to this policy

We may update this policy as the site or the law changes. We'll publish the new version on this page with a new effective date, and we'll let users know on the site about any material change.

14. Contact us

For questions, requests or complaints about your personal information, contact our Information Officer, Keagan Gilmore:

Email: keagangilmore@gmail.com
Post: Core Axis Development (Pty) Ltd, 3 Syringa Road, Pennington, KwaZulu-Natal, South Africa

If you're not satisfied with our response, you may complain to the Information Regulator (South Africa):

Website: inforegulator.org.za
Complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za