Privacy policy

At Competiciones Rítmica we process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Maltese legislation that supplements it (Data Protection Act, Chapter 586 of the Laws of Malta), since FlamaTech Consulting LTD is established in Malta, as well as with any applicable United States state privacy laws. This policy explains what data we process, what for, for how long and what your rights are. The service is also governed by the terms of use, which include the data processing agreement.

1. Data controller and processor

FlamaTech Consulting LTD acts in two different capacities, depending on whose data it is:

• As controller, for the data of the people who use the service on behalf of a club (account, access and contact), for the enquiries you send us and for the technical and analytics data of this website and of the application.
• As processor, for the data of gymnasts, coaches, contact people and any other information that each club enters on the platform. Each club decides what it uses that data for and is responsible for that processing; the organising club, for the registration data it receives from participating clubs. FlamaTech Consulting LTD processes it only to provide the service and on the club’s instructions, in accordance with the terms of use.

FlamaTech Consulting LTD is a company registered under C99332 in the Malta Business Registry, with its registered office at The Penthouse 20, Lyons Range Court, Bisazza Street, Sliema (Malta), VAT MT28308119.

• Identity: FlamaTech Consulting LTD (Competiciones Rítmica)
• Tax ID / VAT: MT28308119
• Registration details: C99332
• Registered office: The Penthouse 20, Lyons Range Court, Bisazza Street, Sliema, Malta
• General contact: soporte@clybo.app
• Data Protection Officer: dpo@clybo.app

2. Data we process

Depending on your relationship with Competiciones Rítmica, we process the following categories of data:

• Club members: name, the email you sign in with (access is by a one-time code, without a password) and contact phone number.
• Club profile: name, town, region and country, postal address and federation or club number (optional) and, if the club provides it, its tax ID, which is stored encrypted.
• Gymnasts: first and last name, date of birth, sex and licence number, as entered by the club in its roster or when registering them; and the data of their participation: category, level, discipline, apparatus, bib number, running order, scores and results. The platform does not ask for medical data or data on their families.
• Coaches and club contact people: first and last name and phone number (encrypted).
• Music for the routines: the audio file uploaded for each routine, its duration, codec and verification fingerprint, with a file name that includes the bib number, the club, the gymnast or group and the apparatus.
• Documents and payments: the documents the organiser requests and the club provides or accepts; the amount and status of each payment and, for bank transfers, the proofs of payment (PDF or image) uploaded by the club. Card details are collected by the payment provider, not by FlamaTech Consulting LTD.
• Technical data: IP address, user agent, audit logs and, with your consent, pages visited, features used, browser, device, approximate location and performance metrics. Sessions are not recorded in the application.

3. Purposes and legal basis

We process the data for the following purposes:

4. Recipients of the data

Within a competition, the organising club receives the registration data, music, documents and payments of the participating clubs, and each participating club sees the running order and results of its gymnasts. The published running order and results are visible to anyone with the link, subject to the restrictions on minors’ names set out above.

We also share data with the providers strictly necessary to deliver the service, under a data processing agreement in accordance with Article 28 GDPR:

• Amazon Web Services (Frankfurt, EU) — hosting of the platform.
• Supabase (Supabase Auth) — authentication, sending of the access code and session management.
• Cloudflare (global network) — DNS, perimeter security, anti-bot protection (Turnstile) on the code request and storage of the music, and technical transit for the managed PostHog proxy.
• Resend (Germany, EU) — sending of transactional email.
• Stripe Payments Europe Ltd. (Dublin, EU) — card payments. Each payment is made on the Stripe account of the organising club, which is the party contracting with Stripe; FlamaTech Consulting LTD does not receive those funds.
• PostHog (EU infrastructure) — analytics consented to in the browser, without session recording in the application.

We do not sell or share the data with third parties for advertising purposes.

5. International transfers

The main servers and the final PostHog ingestion are in the European Union. Network transit may be resolved on the global infrastructure of providers such as Cloudflare, and providers such as Stripe may process data outside the EEA. For these transfers the safeguards provided for in the GDPR apply, such as a valid adequacy decision or standard contractual clauses approved by the European Commission.

6. Retention periods

• Club account: while the club keeps its account.
• A club’s gymnast roster: while the club keeps it; the club may delete a gymnast at any time, which does not affect copies already made in competitions. An inactivity period after which we will notify the club and delete the roster is yet to be defined.
• Copies of gymnasts in a competition: kept while the competition and its archive last. We plan to pseudonymise them 12 months after its end; the final period is pending confirmation.
• Music: up to 7 days after the competition is closed, a period that is extended if the organiser reopens it. It is then deleted.
• Running-order PDFs: deleted 14 days after the competition, because they contain minors’ names.
• Payments and proofs of payment: for as long as the organising club needs them for the reconciliation and accounting of its competition.
• PostHog: 12 months at most.
• Analytics preference: until you change it or clear the site’s local storage.

7. Your rights · GDPR

As a data subject you have the right to:

• Access your personal data.
• Rectification of inaccurate data.
• Erasure when the data is no longer necessary.
• Object to processing based on legitimate interest.
• Restriction of processing.
• Portability in a structured, readable format.
• Withdraw consent at any time, without retroactive effect.

To exercise them, write to dpo@clybo.app stating your name and the right you wish to exercise. We will reply within one month at most.

If you believe the processing does not comply with the regulations, you can lodge a complaint with the controller's lead supervisory authority, the Information and Data Protection Commissioner (IDPC) of Malta, or with the authority of the Member State where you live, work or where the alleged infringement took place (art. 77 GDPR). In Spain, this is the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency).

8. Privacy rights in the United States

Where a United States state law applies, its residents may have the right to know about or access their personal data, correct it, request its deletion, obtain a portable copy and opt out of its sale, sharing for behavioural advertising, targeted advertising or profiling with significant legal effects. They may also exercise these rights without receiving discriminatory treatment.

At Competiciones Rítmica we do not sell or share personal data within the meaning of the California Consumer Privacy Act (CCPA). Even so, this website recognises Global Privacy Control (GPC) as a request to opt out of optional analytics. You can also use Cookie settings in the footer or write to dpo@clybo.app. If a request is refused and your state’s law recognises a right of appeal, you can appeal by replying to our decision through the same channel.

9. Data on minors

Competiciones Rítmica processes data of gymnasts who are minors, entered by the clubs. The club is the controller of that data and FlamaTech Consulting LTD acts as processor, in accordance with the terms of use. Before registering a gymnast, the participating club declares that it has the authorisation of her family or guardians to share with the organising club the data needed for the competition.

The platform does not ask for medical data or data on families, does not record the application session and hides minors’ names by default on the public website. If you are a gymnast, relative or guardian and want to exercise your rights over data entered by a club, please contact that club first; if you write to us at dpo@clybo.app, we will forward your request to the controller club.

10. Security

We apply reasonable technical and organisational measures to protect the data: AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, activity logging, encrypted backups and regular review of providers.

11. Changes to this policy

This policy may be updated to reflect legal or operational changes. The date of the last review appears at the top of the document. If the changes are substantial, we will notify you by email before they take effect.

12. How to contact us

DPO: dpo@clybo.app. General enquiries: soporte@clybo.app.