1. Who controls what
| Data | Controller | iFency's role |
|---|
| User accounts, Athlete Passport, equipment cabinet, iFency ID card, Fency Academy, If Found reports | TMVIC Group Ltd | Controller |
| Competition entries, accreditation numbers, declarations, inspections, defects, signatures, custody, collection, Call Room records | The organiser or federation running the competition | Processor, acting only on documented instructions |
2. Data Processing Agreement (DPA-1.0)
- Accepted electronically by an authorised organisation administrator in the iFency Compliance hub. Organisation, signer, role, version and timestamp are recorded in an append-only log.
- Processing only on the organiser's documented instructions; personnel are bound by confidentiality.
- Assistance with data-subject requests, impact assessments and regulator enquiries.
- Personal data breaches notified to the organiser without undue delay and in any event within 48 hours of confirmation.
- 30 days' advance notice of any new service provider, with a right to object.
- At the end of the engagement: data export on request, then deletion or anonymisation within 30 days, except where law requires retention.
- Transfers outside the UK/EEA without an adequacy decision are covered by the EU Standard Contractual Clauses and/or the UK International Data Transfer Addendum.
Federations requiring a countersigned agreement may request one at [email protected].
3. Retention schedule
| Record | Retention |
|---|
| Competition records, inspection results, signatures and custody logs | 24 months after the competition ends (sporting dispute and audit window), then deleted or anonymised unless the organiser instructs otherwise |
| Athlete Passport, equipment cabinet and iFency ID card | While the account is active; reviewed after 24 months of inactivity |
| If Found reports | 30 days after resolution; maximum 6 months |
| Security and operational logs | 90 days |
| Academy attempts and certificates | While the account is active; certificate verification records kept so issued certificates remain verifiable |
| DPA acceptances and privacy-request records | 5 years, as evidence of compliance |
4. Service providers (sub-processors)
| Category | Purpose | Data involved |
|---|
| Managed cloud infrastructure | Database, authentication and private file storage | Account, Passport, competition data, photos, signatures |
| Edge network and content delivery | Site delivery, server-side code and attack protection | Requests, IP addresses, data in transit |
| Transactional email service | Account, invitation and notification emails | Name, email address, competition or organisation name |
| Enterprise AI inference service | Academy assistant Vera only | Academy question text (no equipment decisions) |
No payment, analytics, advertising or data-broker providers are used. A named list of current providers is available to organisers under the DPA on request.
5. Security measures
- Role- and organisation-level access control enforced in the database, not only in the interface.
- Encrypted transport (TLS); private storage for evidence photos and signatures.
- Append-only inspection results with version snapshots; audit logs for administrative actions.
- Technical equipment decisions restricted to appointed armoury roles — no organiser or administrator override.
- QR codes contain only random tokens — never names, ages or predictable identifiers.
- Personal staff accounts only; no shared PINs or token logins.
