Privacy Policy

Last updated: 25 September 2026

This policy explains which personal data the Contest Pro platform (contest-pro.com) processes, why, on which legal basis, who receives it, how long it is kept and which rights you have. It applies to everyone whose data is processed on the platform: trainers and school staff, judges, our own staff, and the dancers that schools register for competitions.

1. Controller

Dance Unit
Thomas Jaschinski
Krawehlstr. 44
45130 Essen
Germany
Email: [email protected]

We are not required to appoint a data protection officer. For every data protection question, and to exercise your rights, write to the email address above.

2. Visiting the platform

Hosting and server logs

The platform runs on servers of Railway Corporation (USA) in a data centre in the European Union. Traffic reaches it through the network of Cloudflare, Inc. (USA), which protects the platform against attacks and delivers it quickly. When you open a page, your browser necessarily transmits your IP address, the time, the page requested, the referring page and your browser and operating system. These are processed to deliver the page, keep the platform secure and find faults, and are held in server logs for no longer than 30 days.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working platform.

Cookies and browser storage

We only use what the platform cannot work without. There is no analytics, no advertising and no tracking, and no fonts or scripts are loaded from third-party servers — except the spam check on the sign-up page (section 3).

  • contest-pro-session — keeps you signed in and holds your session. Expires after 120 minutes of inactivity.
  • XSRF-TOKEN — protects forms against cross-site request forgery. Same lifetime as the session.
  • Session storage — remembers, for the current browser tab only, that an opening animation has already played. It contains no personal data.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the service you request) and Art. 6(1)(f) GDPR. No consent is needed and none is asked for.

3. Accounts: trainers and staff

To create an account we process your email address, password (stored only as a cryptographic hash), first and last name. During onboarding we additionally collect your phone number (as the contact on competition days), gender, date of birth and country. We also store when you verified your email, when you completed onboarding, when you were last active, your display preferences and — if you turn it on, and always for administrators — your two-factor authentication secret and recovery codes in encrypted form. Staff accounts are created by invitation; the invitation stores the email address and a single-use link that expires after 14 days.

To protect accounts we briefly record your IP address together with the email address you tried to sign in with, so we can slow down repeated failed attempts. Active sessions record the IP address and browser of the device they belong to, and end when the session expires.

Purpose and legal basis: providing the account and the contract of use, Art. 6(1)(b) GDPR; account security, Art. 6(1)(f) GDPR. Without the required data we cannot create an account.

Spam protection on sign-up (Cloudflare Turnstile)

The sign-up page uses Cloudflare Turnstile to tell people from bots. Turnstile is loaded from Cloudflare's servers and evaluates technical signals from your browser, including your IP address; we send the resulting check token and your IP address to Cloudflare to confirm it. Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping automated fake accounts off the platform; § 25(2) no. 2 TDDDG. See Cloudflare's privacy policy.

4. Schools

For each school we process its name, type, contact email and phone, website, visitor address, billing details (billing name, contact person, billing address and email, VAT ID) and the trainers who belong to it. Where these identify a person — for example a sole trader's school or a named contact — they are personal data.

We check VAT IDs against the European Commission's VIES service. For that we send the school's VAT ID and our own to the European Commission and store the result, the date and the confirmation number, because tax law requires us to prove the check for invoices without VAT.

Legal basis: Art. 6(1)(b) GDPR (registration and invoicing), Art. 6(1)(c) GDPR (tax obligations).

5. Dancers

Dancers do not have their own account. Their data is entered by the school that registers them, so we do not collect it from the dancers themselves. We process only what is needed to run a competition fairly:

  • first and last name
  • date of birth — it decides which age group a dancer may compete in
  • gender and nationality, as part of the registration details a competition requires
  • whether the dancer competes as a professional (ProD)
  • the schools the dancer dances for, and the dances they appear in
  • internal notes by our staff, for example about a resolved age dispute

We deliberately do not collect dancers' email addresses, photos, home addresses, guardians' details or health data.

Many dancers are minors. Before a school can add a dancer, the trainer must confirm that the dancer — or, for a minor, the parents or guardians — has agreed to this processing, that the school can prove this agreement on request, and that the school will tell us if it is withdrawn. We store when and by whom this confirmation was given, separately for each school. Schools are asked to pass this policy on to their dancers and their families.

Legal basis: Art. 6(1)(a) GDPR (consent, given through the school — by the parents or guardians for minors) and Art. 6(1)(f) GDPR (our and the school's legitimate interest in running the competition and checking age groups correctly). A withdrawal of consent does not affect processing that already took place.

6. Registering dances and competing

For each registered dance we process its title, choreographer, discipline, category and age group, the dancers performing it, microphone and headset details, and the music and video files the school uploads. We keep a history of changes to a registration so that questions about what was submitted can be answered.

Music and video files are stored in Cloudflare R2 object storage in the European Union (Cloudflare, Inc., USA). They are not public: playback and downloads only work through links that expire after 20 minutes and are only issued to people allowed to see the file. Uploads go directly from your browser to that storage, so it receives your IP address.

On competition days we build the run order and record the judges' scores, placements and written feedback. Schools see results, feedback and certificates for their own dances and dancers when they are released; judges' names are not shown in the feedback schools receive. Certificates carry the dancer's name. Printed lists for the organisers may contain dancers' dates of birth, to check age groups on site.

Legal basis: Art. 6(1)(b) GDPR towards the registering school, and Art. 6(1)(a) and (f) GDPR for dancers (section 5).

Public live view

For published competitions, anyone can follow the run order live without signing in. It shows the start number, dance title, school name and country, discipline, age group and category — no dancer names, ages or scores. Please do not put personal names in dance titles. Legal basis: Art. 6(1)(f) GDPR — the interest of the audience and the schools in following the event.

7. Judges

Judges do not have a login. We store their name and email address, the competitions they are assigned to, which device they were seated on and when, and the scores and feedback they give. A judge takes their seat with their email address and the competition's PIN; the seat is held in the session of that device. Legal basis: Art. 6(1)(b) GDPR (the judging engagement) and Art. 6(1)(f) GDPR (a traceable, fair scoring process).

8. Invoicing and payment

For fees we issue payment requests and invoices to schools. They contain the school's billing details, the items charged — for annual fees this includes the names of the dancers the fee is for — and the payments received. When you submit a registration we store which version of the registration terms was accepted and when. Invoices, payment requests and reminders are sent by email and stored as PDF files in the storage described in section 6.

Fees are paid online only. Each competition has a payment page that lists what the school still owes for it, and each invoice has one of its own; they open with a link that is not guessable and printed as a QR code on the PDFs. Anyone who has the link can see those payments and pay them without an account, so please only share it with people who should pay or see it.

Legal basis: Art. 6(1)(b) GDPR (the contract), Art. 6(1)(c) GDPR (commercial and tax record-keeping duties).

Online payment (Stripe)

To pay, you are redirected to a payment page run by Stripe. We pass Stripe the amount, the document number, the school and the email address the receipt should go to; Stripe creates a customer record for it. Your payment details (for example card number or IBAN) are entered only with Stripe and never reach us. Stripe notifies us of the outcome; we store that notification, including the payment method type and the last digits of the account or card where Stripe includes them, as part of our payment records. Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe also processes data as its own controller, for example to prevent fraud and meet financial regulations; data may be transferred to Stripe, Inc. in the USA. See Stripe's privacy policy. Legal basis: Art. 6(1)(b) GDPR.

9. Emails

We send emails that are part of the service: address verification, password reset, invitations, registration confirmations, payment requests, invoices, receipts and payment reminders. We do not send newsletters or advertising. Emails are delivered through Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which processes the recipient's address, name and the content of the email on our behalf. Legal basis: Art. 6(1)(b) GDPR.

10. Audit trail

Consequential actions — for example changes to roles, payments, settings and the creation or deletion of dancer records — are recorded with the person who took them, the time and what changed, so that disputes and data protection requests can be answered. The trail stores no IP addresses, and entries for deleted dancers do not contain the dancer's name. Legal basis: Art. 6(1)(f) GDPR and Art. 5(2) GDPR (accountability).

11. Recipients

Data is passed on only as described in this policy:

  • service providers that process data on our behalf under a data processing agreement (Art. 28 GDPR): Railway (hosting), Cloudflare (network, security, file storage) and Brevo (email);
  • Stripe for online payments (section 8), and the European Commission for VAT ID checks (section 4);
  • the organising partner of a competition, where a competition is run on our platform together with a partner organisation, for the data needed to run and invoice that competition;
  • tax advisers and authorities, where the law requires it.

We do not sell personal data and do not use it for advertising.

12. Transfers outside the EU

Railway, Cloudflare and Stripe are companies based in the USA or belong to US groups, so access to data from the USA cannot be ruled out, even though our data is stored in the EU. Transfers are made on the basis of the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.

13. How long we keep data

  • Accounts — for as long as the account exists. When you ask us to delete it, we delete or anonymise it unless we must keep parts of it for the reasons below.
  • Dancer records — for as long as the school keeps the dancer on its roster. A dancer who never took part in a competition can be deleted entirely. Once a dancer has competed, their participation stays part of that competition's results.
  • Competition results, scores and registrations — per season, as the record of the competition. Past seasons are archived and can no longer be changed.
  • Music and video files — until the dance is withdrawn or deleted or the file is replaced.
  • Invoices, payment requests and payment records — for the statutory retention periods of commercial and tax law (§ 147 AO, § 257 HGB): currently 8 years for invoices and accounting records and 10 years for books and annual accounts, counted from the end of the calendar year.
  • Sessions — 120 minutes after the last activity. Password reset links — 60 minutes. Invitations — 14 days.
  • Server logs — no longer than 30 days.

14. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR);
  • have incorrect data corrected (Art. 16 GDPR);
  • have data deleted (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR), unless we are required to keep it;
  • receive data you provided in a common, machine-readable format (Art. 20 GDPR);
  • withdraw consent at any time, with effect for the future (Art. 7(3) GDPR) — for dancers, through their school or directly with us;
  • lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the authority where you live or work.

15. Automated decisions

We make no decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. The platform calculates age groups and adds up judges' scores, but eligibility disputes and results are decided by people.

16. Changes to this policy

We update this policy when the platform or the law changes. The date at the top shows when it last changed.