RefereeMatch Privacy Policy

REVIEW DRAFT — 24 September 2026. Proposed operating commitments must be checked against production settings and actual procedures before publication.

Version: RM-privacy-2026-09-draft1. Effective date: [PUBLICATION DATE].

1. Accountability and contact

[OPERATOR LEGAL NAME], an individual operating RefereeMatch (not incorporated), carrying on business as RefereeMatch, is responsible for personal information under its control. Our privacy contact is [PRIVACY OFFICER NAME OR ROLE], refereematch@proton.me, [BUSINESS MAILING ADDRESS — TO BE ADDED]. This policy covers our website and platform services. It does not govern an organizer's independent records or another website's practices; we remain responsible for our own disclosures and service-provider arrangements.

2. The key points

We use account and referee information to run accounts, review qualifications, help organizers find suitable officials and record game activity. Guardian and youth information supports restricted application, onboarding and permission reviews. In the current youth stage, profiles are hidden and bookings are blocked. Optional email-alert choices are separate from permission to consider a child for a game.

Information is processed by hosting, database, security and email providers and may be processed outside Canada. We limit collection to information needed for identified purposes. We do not sell personal information or use private youth information for targeted advertising. [CONFIRM THESE BUSINESS COMMITMENTS AND THE PROVIDER INVENTORY BEFORE PUBLICATION.]

3. Information, sources and purposes

Account information: name, email, role, phone and city where requested, account identifiers and authentication records. We receive it from you and our authentication service to create and protect accounts, verify email, route role-specific features and respond to requests. Password authentication is handled through our authentication provider; do not send passwords to support.

Referee information: biography, sports, travel radius, availability, certification details and documents, qualification review results, dates of birth used for age review, and game history. We receive this from the referee, authorized reviewers and relevant game records to assess eligibility and operate the directory and invitation process. Dates of birth are not directory information. Do not upload identity documents into certification fields or email them to us; contact support to arrange an appropriate verification method.

Organizer and game information: organizer identity and contact details, tournament and game information, venue, schedules, offered pay, invitations, acceptance/decline records, cancellations, attendance or completion records, ratings and feedback. Participants and platform activity supply these records to coordinate events, document responses and resolve issues.

Guardian and youth information: guardian and child names, dates of birth where requested, verified guardian email, phone, relationship and authority information, emergency contacts, application decisions, private signup links, linked youth account information, specific game reviews and consent/withdrawal records. These come from the guardian, the linked youth, authorized administrators and associated game activity. They support age and authority assessment, restricted onboarding and permission review. A guardian must have authority to provide the child's information and permission to provide another adult's emergency contact details. An emergency contact field does not mean we monitor emergencies or provide a dispatch service.

Support and safety information: messages, relevant screenshots, reports and investigation records that you or another participant supply to resolve support, eligibility, conduct and privacy concerns. Provide only relevant information; we may need to contact involved people or appropriate authorities.

Technical information: IP address, browser/device information, request times, authentication/session data, security challenge results and error or delivery logs generated through operating the service. These support sign-in, abuse prevention, troubleshooting and message delivery. [CONFIRM EXACT LOG FIELDS AND ANY ADDITIONAL ANALYTICS; DO NOT DESCRIBE THIS INVENTORY AS COMPLETE UNTIL AUDITED.]

4. What other users can see

Signed-in users using the referee directory can see eligible adult referee profile information, qualification summaries and the history/review information that the relevant feature makes visible. Written review visibility depends on participation and sharing settings; a private written review does not necessarily hide an aggregate rating or related game statistics. Screenshots or copies made by another viewer cannot always be recalled.

Participants see the game and invitation information needed for their involvement. Raw certification and age/guardian-review records are intended for the person concerned and authorized administrators, not the public directory. Private youth records are restricted to authorized guardian/youth functions and administrators during the current stage. [VERIFY PRODUCTION DATABASE AND STORAGE POLICIES, DIRECT LINKS, ROLE ACCESS AND CONTACT-FIELD VISIBILITY BEFORE MAKING THESE ASSURANCES PUBLIC.]

We do not give organizers a general entitlement to private youth records or emergency contacts through these terms. Any future disclosure needed for an enabled youth activity must first be explained and supported by appropriate authority and consent.

5. Service providers and international processing

Our intended provider inventory is: Supabase for authentication, database and file storage; Vercel for website hosting and delivery; Cloudflare Turnstile for security challenges; Resend for platform email delivery; and Proton for support correspondence. These providers receive information needed for their functions, which can include account information, message recipients and content, uploaded files, technical data and support communications. [CONFIRM THE LIVE AUTHENTICATION EMAIL PROVIDER, ALL SUBPROCESSORS AND ANY ADDITIONAL SERVICES.]

Information may be stored or accessed in Canada and other countries, including the United States, depending on the service and configuration. It may be subject to lawful access by authorities in those countries. [INSERT VERIFIED REGIONS AND MATERIAL CROSS-BORDER DETAILS.] We use contractual and other appropriate measures to protect information entrusted to processors and assess these arrangements. Our responsibility does not end when a provider processes the information.

6. Cookies and similar technologies

The website uses authentication/session storage and security technology for sign-in, account protection and abuse prevention. Blocking necessary storage or scripts can prevent these features from working. Cloudflare security checks process technical information as part of verification.

[COMPLETE A LIVE COOKIE/STORAGE/NETWORK INVENTORY: name or category, provider, purpose, duration and whether optional.] This draft does not assert that the site is cookie-free or that every deployed technology is strictly necessary. Optional analytics, advertising or other non-essential tracking must be disclosed and supported by an appropriate choice mechanism before activation. A decorative cookie banner does not establish compliance.

7. Consent and choices

We explain important purposes when collecting information. Required information must be reasonably necessary for the feature requested; if you decline it, we explain what cannot be provided. We seek express consent where appropriate for sensitive information and separate optional uses from account access. Terms acceptance is not blanket privacy consent.

Guardians control separate application, private youth-account, game-permission and optional email choices. Withdrawing one choice has the effect described beside that control; it does not necessarily withdraw every other choice. You may also contact the privacy contact. We explain consequences and any lawful limits before implementing a withdrawal where practicable. Withdrawal does not undo completed lawful processing, but it stops future processing based on that consent, subject to lawful restrictions.

We communicate privacy information to young people in a way they can understand and consider their capacity and rights, as well as guardian authority. Guardian authority is not presumed to cover every future disclosure or use.

8. Email communications

Account confirmation, password reset and necessary security/service messages support your account. Separate optional guardian permission alerts give a brief notice and portal link; they are designed to omit child names, dates of birth, venues and game details. Guardian booking-update consent is a different setting and may cover more detailed information described in its notice. Saving consent does not mean a disabled delivery feature is active.

Withdraw optional alerts in the guardian portal or contact support for help if you cannot sign in. A message already dispatched cannot be recalled. We do not treat service-email consent as consent to advertising. If commercial promotional messages are introduced, we will use an applicable lawful consent basis, required sender/contact details and a functioning unsubscribe method. [COMPLETE THE CASL CLASSIFICATION AND MESSAGE-TEMPLATE REVIEW BEFORE ENABLING PRODUCTION SENDS.]

9. Other disclosures

We may disclose limited information with your authorization, where required or permitted by law, to address fraud or serious safety concerns where a lawful basis exists, or to obtain professional advice subject to confidentiality. We assess the basis and scope rather than treating every request as sufficient authority. We may share relevant information with a person responding to a complaint while protecting unnecessary third-party details. We do not promise absolute confidentiality where disclosure is required to protect a child or comply with law.

Any proposed business transfer involving personal information must satisfy applicable legal requirements, confidentiality restrictions and required notices. This paragraph is not permission to sell data for unrelated purposes.

10. Retention and deletion

We keep personal information only as long as reasonably necessary for the identified purposes and applicable obligations, then securely delete or de-identify it. Relevant factors include account activity, unresolved games or complaints, consent evidence, legal preservation requirements and the sensitivity of youth records. Restricted backups may take longer to expire than live records; they must not become an indefinite archive for routine use.

[INSERT AN APPROVED AND IMPLEMENTED CATEGORY-BY-CATEGORY SCHEDULE, INCLUDING WITHDRAWN/REJECTED APPLICATIONS, CERTIFICATION FILES, AGE EVIDENCE, CONSENTS, GAME RECORDS, EMAIL LOGS, SUPPORT FILES AND BACKUPS.] We have not promised a specific automatic deletion period in this draft because the source review did not establish one. On a deletion request, we will explain what can be removed, what must temporarily remain and why. Withdrawing a game permission is not itself a request to erase every underlying record.

11. Safeguards and incidents

We use safeguards appropriate to the information and risks, including restricted administrative access, role-based data controls and security measures provided by our hosting/authentication services. These measures require ongoing review; no service is perfectly secure. [VERIFY CURRENT ADMINISTRATOR MFA, STORAGE ACCESS, LOGGING, BACKUP ACCESS, STAFF TRAINING AND INCIDENT PROCEDURES.]

We assess suspected privacy incidents, act to contain them and provide reports and notifications required by applicable law. We retain required breach records. This statement does not replace an incident-response procedure or imply an independent security certification.

12. Access, correction, complaints and account closure

Contact refereematch@proton.me to request access, correction, withdrawal of consent, account closure or deletion, or to challenge our handling of information. We verify identity and authority proportionately; do not email identity documents unsolicited. Guardian requests about a child are assessed with regard to authority, the child's rights and applicable law.

Where PIPEDA applies, access requests are generally answered within 30 calendar days, subject to its permitted extensions and exceptions. We explain any lawful refusal or extension and applicable complaint rights. Access is generally provided at no or minimal cost, with notice of any permissible cost. Where appropriate, a correction is communicated to recipients or an unresolved accuracy concern is recorded. Deletion rights are subject to legitimate legal retention needs and are not represented as an unconditional right to erase all history.

You may complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca/ or another regulator with jurisdiction. You do not have to waive a complaint right or first complete an internal appeal to contact a regulator.

13. Changes

We publish the current version and effective date, preserve relevant prior versions and give notice of material changes. A revised policy alone does not authorize a new use of previously collected information; we seek additional consent where required. Contact our privacy contact for accessible explanations or questions.