1. Who we are
ChalkItUp is a gymnastics competition scoring platform operated by Neil Winter trading as ChalkItUp.
Contact us: hello@chalkitup.co.uk
2. What data we collect and why
Organisation account data
When an organisation account is created we collect:
- Organisation name and contact email address
- Administrator name and login credentials (password stored as a one-way hash)
- Correspondence relating to account setup and support
This data is necessary to provide the service under our contract with you (Art. 6(1)(b) UK GDPR).
Competition and gymnast data
Organisations enter data about competitions and competing gymnasts into ChalkItUp. This may include:
- Gymnast first name and date of birth (for age-group categorisation)
- Club name and coach name
- Competition scores and results
This data is entered by the organisation and processed on their behalf. The organisation is the data controller for gymnast personal data; we process it as a data processor acting on their instructions.
Judge access data
Judges log in using a PIN code. We store the hashed PIN and a session token scoped to a specific competition panel. No additional personal data is collected from judges beyond a display name entered by the organisation administrator.
Usage and technical data
We collect standard server logs including IP addresses, browser type, and pages accessed. These are used solely for security monitoring, debugging, and platform improvement. Logs are retained for 30 days.
3. Legal basis for processing
- Contract (Art. 6(1)(b)): processing necessary to provide the service to your organisation.
- Legitimate interests (Art. 6(1)(f)): server logs and security monitoring to protect the platform and users.
- Legal obligation (Art. 6(1)(c)): retaining records where required by law.
4. How we store and protect your data
All data is stored on a dedicated server located within the European Economic Area. Data is encrypted in transit using TLS 1.2 or higher. Access to the server is restricted by SSH key authentication. Daily automated backups are encrypted and retained for 30 days.
We do not sell, rent, or share personal data with third parties for marketing purposes.
5. Third-party services
- Stripe — payment processing. Stripe is the data controller for payment card data. We do not store card numbers. See stripe.com/privacy.
- Cloudflare — DNS and DDoS protection. Cloudflare processes request metadata (IP addresses) as a processor. See cloudflare.com/privacypolicy.
6. Data retention
We retain account and competition data for as long as the organisation account is active and for a reasonable period afterwards to allow access to historical results. If an organisation account is deleted, all associated data is permanently deleted from our systems within 30 days.
Server access logs are retained for 30 days. Backup copies are retained for 30 days on a rolling basis.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data (subject to legal obligations)
- Object to processing based on legitimate interests
- Data portability
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, contact us at hello@chalkitup.co.uk.
8. Gymnast data — note for organisations
Organisations using ChalkItUp are responsible for obtaining appropriate consent or other lawful basis before entering gymnast personal data into the platform. Gymnast data (name, date of birth) constitutes personal data under UK GDPR. Organisations should include reference to ChalkItUp in their own privacy notices.
9. Public leaderboards
ChalkItUp publishes live competition results at a public web address (e.g. chalkitup.co.uk/results/[code]) that anyone can view without logging in. Because we determine what is shown and how it is made public, ChalkItUp — not the organisation — is the data controller for this specific processing activity, distinct from our processor role described in Section 2.
What is shown
A public leaderboard may display a gymnast's name, bib number, club name, age group, and scores or rankings. By default, names are shown as first name plus surname initial (e.g. "Emma S") rather than full name; an organisation can switch a competition to full names in its settings if it has an appropriate basis to do so. Date of birth is never shown publicly; it is used only internally for age-group categorisation. An organisation can mark a competition as a draft, in which case gymnasts appear by bib number only (e.g. "Gymnast #014") until results are formally released, and can hold rankings back until an admin chooses to publish them.
Legal basis and consent
Publishing a gymnast's name and results publicly is a separate, more sensitive purpose than storing that data to run a competition, and requires its own lawful basis. Organisations must obtain specific, informed consent to public display — from the gymnast, or a parent/guardian where the gymnast is under 18 — before publishing a leaderboard, or otherwise establish and document an appropriate lawful basis. General consent to take part in a competition does not, by itself, cover public online publication of a child's name and results.
Reducing exposure and opting out
Organisations can reduce what is public by using draft/bib-number mode, holding rankings until release, or leaving the name display setting at its default of first name plus surname initial rather than switching to full names. Organisations should give gymnasts and parents/guardians a way to request that an individual be excluded from a public leaderboard, and should action such requests promptly. Contact hello@chalkitup.co.uk if you need our help removing an individual's data from a published leaderboard.
Search engine visibility
Leaderboard pages are excluded from search indexing via our robots.txt file, which asks compliant search engines not to crawl them, and via an X-Robots-Tag: noindex, nofollow HTTP header sent on every leaderboard page. The header applies even if a crawler ignores robots.txt or reaches the page via a direct or shared link, so leaderboard pages should not appear in search results.
Retention
Public leaderboards expire automatically 90 days after the competition date by default. Organisations can shorten or extend this window, and archiving a competition removes the leaderboard from public view immediately.
10. ICO registration
We are in the process of registering with the Information Commissioner's Office as required under UK data protection law. Our ICO registration number will be published here upon completion.
11. Cookies
ChalkItUp uses essential session cookies only. These are necessary for login sessions to function and do not track you across other websites. No analytics or advertising cookies are used.
12. Changes to this policy
We may update this policy from time to time. We will notify active organisations by email before any material changes take effect. The current version is always available at this URL.
13. Contact
Email: hello@chalkitup.co.uk
Website: www.chalkitup.co.uk