Privacy Policy

This policy explains how the Tunisian Kendo League ("the League", "we") collects, uses, shares and protects personal data through the kendo.tn website and the activities of the League. We are committed to handling your data lawfully, transparently, and with respect for your rights.

The League is the data controller for the processing described here. Two legal regimes apply: the Tunisian Loi organique n° 2004-63, supervised by the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), and the EU General Data Protection Regulation (GDPR) and ePrivacy rules, which apply because the site is reachable from the EU and because we submit athlete data to the European Kendo Federation, an EU-based body.

Who we are

Controller: Tunisian Kendo League (Ligue Tunisienne de Kendo), the governing body for kendo in Tunisia.
Registered address: 49 rue de Marseille, Tunis, Tunisia.
General contact: [email protected].
Data-protection contact: Marouene Jarraya (Vice-President) — [email protected].
INPDP declaration / authorization number: declaration pending — to be filed.

This page is information about our data practices, not legal advice.

What & why

What we collect & why

We collect only the data we need for each activity below, and we rely on a specific lawful basis in each case.

Contact form

When you write to us through the website contact form, we process your name, email address and the message you send, in order to receive and respond to your enquiry. Our lawful basis is our legitimate interest in answering you (GDPR Art. 6(1)(f)); in Tunisia we rely on your consent and our processing declaration. Please do not send sensitive information (for example health details) in the message.

Analytics

We measure how the site is used so we can improve it. Google Analytics 4 runs only if you consent (with IP address anonymized); Cloudflare Web Analytics is cookieless and aggregate. See Cookies & analytics below.

Published content

We publish bios of board members, senseis and staff (name, photo, role, grade, club) and competition results and event photos (name, club, placement, images). For officers acting in a representative capacity and for the reporting of sporting results, our basis is legitimate / public interest (GDPR Art. 6(1)(f)), with an objection and erasure route available at any time. Image publication relies on consent, and minors' images require parental consent (see Minors).

EKF championship registration

To register national-team athletes with the European Kendo Federation (EKF), we process an athlete's name, date of birth, nationality and kendo grade only. We do not send passport/ID numbers or medical data, so no special-category data is involved. Our basis is the athlete's (or guardian's) consent together with the registration relationship. See International transfers.

Cookies & analytics

We keep cookies to a minimum and never use them for advertising.

Google Analytics 4 (consent-gated). Analytics cookies load only after you accept them. IP addresses are anonymized. If you decline, GA4 does not run.
Cloudflare Web Analytics (cookieless). A privacy-preserving, aggregate beacon that sets no cookies and stores no cross-site identifier — so it needs no consent.
YouTube embeds. Homepage videos use the privacy-enhanced no-cookie domain and set no cookies unless you play a video.

For the full list of cookies and how to change your choice, see our Cookie Policy.

Recipients

Who we share data with

We do not sell your data. We share it only with the service providers that operate the site on our behalf (our processors), and with the European Kendo Federation as described under International transfers.

Formspree (United States) — delivers contact-form submissions.
Google (United States) — Google Analytics 4, when you consent.
Cloudflare (global edge) — content delivery and cookieless analytics.
Hostinger (Hostinger International Ltd; server region EU) — hosts the website and its published content.

Each provider acts under our instructions for the purposes above. Hosting and CDN providers also keep short-lived access logs (IP address, user-agent, request metadata) to deliver and secure the site, on the basis of our legitimate interest.

Transfers

International transfers

Some of our processing involves transferring data outside Tunisia. Under Tunisian Loi 2004-63, any transfer abroad additionally requires an INPDP authorization under Article 52, alongside the GDPR-side safeguard.

Contact form → United States (Formspree). Safeguarded by Standard Contractual Clauses or, where applicable, by the transfer being necessary to deliver your enquiry, plus an INPDP Art. 52 authorization.
Analytics → United States (Google), when you consent — safeguarded by Google's data-processing terms and Standard Contractual Clauses, plus an INPDP Art. 52 authorization.

Athlete data → European Kendo Federation (EU)

To enter athletes in European and international competitions, we transfer an athlete's name, date of birth, nationality and kendo grade from Tunisia to the European Kendo Federation (EKF), an independent controller based in Brussels, Belgium. The safeguards for this Tunisia → EU transfer are the athlete's (or guardian's) consent, a controller-to-controller data-sharing agreement with the EKF, and an INPDP Art. 52 transfer-abroad authorization. As an independent controller, the EKF handles the data under its own privacy notice, which may include onward disclosure to the European and international kendo federations.

Children

Minors

We take particular care with the data of minors, which can arise in competition results, event photos, and EKF registration.

Parental consent. Publishing a minor's image, and registering a minor with the EKF, require the consent of a parent or guardian. Already-published photos of minors are reviewed and removed where no parental consent exists.
Image rights. A request to remove a minor's photo is actioned promptly and by default, ahead of the standard response time.
Tunisian law is stricter. Under Article 28 of Loi 2004-63, processing a minor's data requires the consent of the guardian and the authorization of the family judge — a stricter standard than the GDPR alone.

A parent or guardian may exercise any of the rights below on a minor's behalf by writing to [email protected].

Retention

How long we keep data

We keep personal data only as long as we need it for the purpose it was collected.

Contact-form messages: up to 24 months after our last contact, or until you ask us to delete them.
Analytics: Google Analytics data is retained for 14 months; your consent choice is stored in your browser and cleared on withdrawal.
Published bios: for the duration of the person's role, then removed on departure; objection and erasure are honoured at any time.
Competition results & event photos: kept long-term for their archival / public-interest value, with an objection and erasure route; minors' photos are reviewed regularly.
EKF registration: our working copy is deleted after the competition cycle; we retain the consent record for up to 8 years after an athlete's last registration. The EKF applies its own retention as an independent controller.
Hosting / CDN logs: kept for the providers' default short rolling window.

Your rights

Under the GDPR and Tunisian Loi 2004-63, you have the right to:

Access a copy of the personal data we hold about you.
Rectify data that is inaccurate or incomplete.
Erase your data ("right to be forgotten").
Restrict our processing of your data.
Object to processing based on our legitimate interest — including the publication of a bio, result or photo.
Portability — receive your data in a usable format.
Withdraw consent at any time, where consent is the basis (as easy as giving it).

To exercise any right, email [email protected] with the subject "Data request". You do not need to cite the law or name the right. We respond within one month (extendable by up to two further months for complex requests, with notice). There is normally no charge.

Complaints

Complaints & contact

If you have a question or concern about how we handle your data, please contact us first at [email protected] (data-protection contact: Marouene Jarraya, Vice-President). We will do our best to resolve it.

You also have the right to lodge a complaint with a supervisory authority. In Tunisia, this is the Instance Nationale de Protection des Données à Caractère Personnel (INPDP). EU data subjects may also complain to their national supervisory authority.

Updates

Changes to this policy

We may update this policy as our practices or the law evolve. Material changes will be reflected on this page.

Last updated: 19 June 2026.