How we handle personal data

1. Who we are

JomChess Tournament Manager is run by Fitweb Technologies Sdn Bhd (Malaysia), the company behind JomChess ("we", "us"). This policy explains what personal data the platform holds, why, and what you can do about it. We follow Malaysia's Personal Data Protection Act 2010 (PDPA). Questions: hi@jomchess.com.

2. What we collect

Organisers. Name, e-mail address and a password (stored only as a secure hash), the time of the last login, and the events you create.

Account requests. What you type in the request form: name, e-mail, phone (optional), country, organisation and your message.

Players. Organisers enter their players. Depending on the event this can include: name, title, federation, club or school, FIDE ID, FIDE and national ratings, national ID number, sex, birth year and category, plus every pairing and result in the event.

Technical data. To keep accounts safe we record failed logins and limit account requests. For this we store only a scrambled (hashed) form of the IP address and e-mail, never the plain values. Signed-in sessions store the IP address and browser type for as long as the session lasts.

3. What is public

When an organiser makes an event public, anyone can see its players' name, title, federation, club, FIDE ID, rating, pairings, results, standings and each player's card. Results pages are meant to be shared, like the results boards at a venue.

Never public: national ID numbers, sex, birth year, organisers' details and anything in the player database (section 5). Events that are not public are seen only by their organiser and our administrator.

4. How we use it

• To run tournaments: pairings, results, tie-breaks, standings and printouts.
• To create and look after organiser accounts, and to answer requests and questions.
• To keep the service secure and working.
• To support chess development (section 5).

We do not sell personal data, show advertising, or use third-party trackers or analytics.

5. Player database

Our administrator can link a player's entries in different events into one profile (by FIDE ID, national ID, or name and birth year). From the results we work out an internal strength estimate and performance figures, and a report by age group to help find and support promising players, for example for JomChess programmes and school or state selections.

This database is visible only to our administrator. The internal estimate is not an official FIDE or national rating. Before we share any of this outside JomChess, we will ask for consent first. You can ask us not to include you or your child (section 10).

6. Organisers' responsibility

Organisers decide which players' details to enter and whether an event is public. By entering players, an organiser confirms they are allowed to do so, and for players under 18, that a parent or guardian knows the details will be used for the tournament and its public results. Please enter only what the event needs; a national ID number is optional.

7. Cookies and storage

• tm_session: keeps an organiser signed in. Needed for the site to work.
• tm_csrf: protects forms against forgery. Needed for the site to work.
• Offline mode: when an organiser saves an event for offline use, its data (without national ID numbers) is kept in that browser until they remove it.

We do not use advertising or tracking cookies. Fonts and scripts are served from our own site.

8. How we protect it

HTTPS for every page, hashed passwords, login limits, protection against forged forms, a strict content security policy, and checks so each organiser reaches only their own events. Only our administrator can see all events. To help an organiser, our administrator can open their account; each time is recorded. No system is perfectly secure; if a breach affects you, we will tell you.

9. How long we keep it

Tournament results are kept as a record of the event unless the organiser deletes the event or the player. Organiser accounts are kept while they are in use; ask us to close yours. Account requests are kept for up to a year. Records of failed logins are removed after a day, and expired sessions regularly.

10. Your rights

You (or a parent or guardian for a child) can ask to see the data we hold about you, correct it, have it removed from public pages or from the player database, or withdraw consent. E-mail hi@jomchess.com with the event and the player's name. For a wrong result, please ask the event's organiser first. We reply within 21 days.

11. Changes

If we change this policy we will update the date at the top. Important changes will be shown on this site.