This Privacy Policy (the “Policy”) sets out how personal data is processed and protected by Sole Proprietor Sergei Sergeevich Tikhomirov (the “Operator”, “we”). It is published pursuant to Article 18.1(2) of Russian Federal Law No. 152-FZ “On Personal Data” (“Law 152-FZ”).
The Policy applies to all personal data the Operator obtains about visitors and users of the ZenFencing platform — the zenfencing.ru website, the competition-running services live.zenfencing.ru and fencing.ru (operated by the same Operator) and the related services for the fencing community (the “Platform”). The Policy is drawn up in Russian; this translation is provided for convenience and the Russian text prevails in case of discrepancy. The current version is always available on this page, linked from the footer of every page and from every data-collection form. By using the Platform you confirm that you have read the Policy.
The Constitution of the Russian Federation; the Civil Code; Federal Law No. 152-FZ “On Personal Data”; Federal Law No. 149-FZ “On Information, Information Technologies and Protection of Information”; Federal Law No. 329-FZ “On Physical Culture and Sport in the Russian Federation”; Roskomnadzor Order No. 18 of 24 February 2021; other personal-data regulations; the Terms of Use (contract with the user); contracts and instructions of competition organizers, clubs, federations and coaches; consents of data subjects and their legal representatives.
The Operator processes personal data only for the purposes listed below and to the stated extent. Account and athlete-record data is processed on the basis of the contract with the subject (Art. 6(1)(5) of Law 152-FZ) — the Terms of Use or a competition entry; no separate consent to such processing is required by law or requested. Publication of data to an unlimited number of persons takes place only under a separate consent to dissemination (Art. 10.1 of Law 152-FZ).
| Purpose | Subjects | Data | Legal basis | Retention |
|---|---|---|---|---|
| Creating and keeping an account, login, access recovery, service notifications | account holders (14+) | e-mail, password hash, full name, date of birth, gender, country, region, language, time zone, profile photo, notification settings, service tokens | contract (Art. 6(1)(5)) | life of the account |
| Keeping an athlete, coach or referee record and sports profile | users; persons without an account — children under a representative, coaches' students, club members, participants entered without registration | full name, date of birth, gender, country and region, weapon, rank or title, refereeing category, club, coach, fencing hand | contract; for a child under 14 — the legal representative's consent; for persons entered by a club, coach or organizer — the subject's or representative's consent obtained by them, and instructions (Appendix 1 to the Terms) | while the record is kept; afterwards — as part of competition protocols |
| Entry intake, eligibility, start lists, running the competition, recording results and protocols, organizer's print forms | participants, persons who submitted the entry, legal representatives | entry data (including the club, region, coach, rank and division refined for the competition), contact e-mail, bout results, placements, participation statuses, source and converted protocols | participation contract concluded at the subject's request (Art. 6(1)(5)); for the organizer — instructions (Appendix 1) | while the competition exists on the Platform (results have archival value) |
| Venue passes | accompanying persons, vehicle owners | full name; vehicle registration plate | participation contract; the organizer's legitimate interest in venue access control (Art. 6(1)(7)); warranties of the person entering the data (Terms, section 7) | until the end of the competition and 30 days after |
| Publication of entrants, progress and results, rankings and the public profile | participants, referees, coaches, organizers, officials | the list set out in the consent to dissemination (full name, date of birth, gender, region, club, coach, weapon, rank, category, results, points, profile photo) | consent to dissemination (Art. 10.1) — the subject's own, the legal representative's, or one obtained by a club or coach and attested | until consent is withdrawn or a request to stop dissemination is received |
| Calculating season and rolling rankings of federations | participants of competitions in a federation's calendar | results, category, points, positions | contract; publication — consent to dissemination | while the ranking is kept |
| Club and federation membership, training groups, schedule, attendance, licences, a coach's list of students | club and federation members, students, federation staff | membership role and status, group, attendance marks and reason for absence, licence dates, invitation e-mail addresses | instructions of the club, federation or coach as controller (Art. 6(3); Appendix 1 to the Terms); invitations — contract | duration of membership and 3 years after it ends (history) |
| Running competitions live and exchanging results with the competition-running service | participants, referees | full name, date of birth, gender, region, club, coach, rank, category, seeding, record identifier; for referees — category | participation contract (part of the service) | for the duration of the competition; results — as part of the protocol |
| Search for people by organizers (including via the competition-running service), club owners, federations and coaches to add them to a competition, club or student list | users with a public profile | full name, date of birth, gender, club, region, rank, whether an account exists | contract (a Platform feature); disabled by hiding the profile | — |
| Keeping the consent journal and proving consent | all subjects who gave consent, legal representatives, attesting persons | document type and version, date and time, IP address, browser details, representative's details, metadata | the Operator's duty to prove consent (Art. 9(3); Art. 6(1)(2)) | for the duration of processing and 3 years after it ends |
| Security, abuse prevention, audit log of significant actions, image moderation, data correction and merging of duplicates | all visitors and users | IP address, browser details, action records, images under moderation, data snapshots taken on merge and deletion | the Operator's legitimate interest (Art. 6(1)(7)); duties under Art. 19 and 21 of Law 152-FZ (Art. 6(1)(2)) | IP addresses — 12 months; action records and snapshots — 3 years |
| Handling data-subject requests | requesters | full name, contact details, content of the request | legal obligation (Art. 14, 20, 21 of Law 152-FZ) | 3 years |
| Traffic measurement and improving the Platform | visitors | anonymised visit data (section 9) | legitimate interest; data is anonymised | — |
Actions: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), dissemination — only under consent, anonymisation, blocking, deletion, destruction. Methods: mixed processing — with and without automation. We do not profile users, do not take decisions with legal effects solely by automated means, do not process data for advertising, do not send advertising and do not sell personal data.
5.1. Subjects: website visitors; account holders; athletes, coaches and referees (including those without an account); minors and their legal representatives; competition organizers and officials; club and federation members and staff; accompanying persons and vehicle owners; requesters.
5.2. Special categories and biometrics. We do not collect health data, data on racial or ethnic origin, political or religious views or other special categories of personal data, nor biometric data. A medical withdrawal from a bout is recorded only as a sporting status without health details. Training attendance marks are kept by the club as controller; the list of reasons for absence on the Platform is neutral (excused absence, competition, holiday, personal circumstances, other) and contains no health details; users are prohibited from entering such information or diagnoses in free-text fields (Appendix 1 to the Terms). Profile photos are used for display only and not for identification.
5.3. Data not obtained from the subject. Data of participants, members, students, accompanying persons and vehicle owners is entered by organizers, clubs, federations, coaches, legal representatives and other users. The person entering the data must have a lawful basis, inform the subject and obtain the required consents (Terms, sections 7–8). For competition entry data the exception of Art. 18(4)(2) of Law 152-FZ applies (the data is obtained under the participation agreement to which the subject is a party); beyond that, the Operator informs the subject about the processing on first contact — in the e-mail sent to the address given in the entry and on the Platform pages.
Personal data is shared only with:
Data listed in the consent to dissemination is published on the Platform publicly — this is the essence of the service. No advertising networks, third-party analytics, external CDNs or captchas are used; no data is shared with third parties for marketing.
No cross-border transfer of personal data takes place. The Platform's servers and databases are located in the Russian Federation. E-mails are delivered to the address given by the subject, including where their mail provider is located outside Russia.
Each consent is a separate, never pre-ticked box linking to its own document. Consents are not combined with each other or with acceptance of the Terms. The Operator records every box in the consent journal: date and time, IP address, browser details, the account of the person who ticked it, the representative's details, and the version and checksum of the document. Journal records are never altered or deleted; a withdrawal is a new record.
The consent to dissemination may also be given through the information system of Roskomnadzor where the authority has made this possible. Information about the conditions and prohibitions on processing data permitted for dissemination is published on the “Conditions and prohibitions” page.
Recording, systematisation, accumulation, storage, updating and retrieval of personal data of Russian citizens are carried out using databases located in the Russian Federation (Art. 18(5) of Law 152-FZ). Retention periods per purpose are listed in section 4. Database backups are kept for no more than 90 days.
Processing ends when its purposes are achieved, on expiry of the retention periods, on withdrawal of consent (absent another legal basis), at the subject's request in the cases provided by law, or where unlawful processing is found — within the time limits of Art. 21 of Law 152-FZ. At the end of processing the data is destroyed or anonymised. Destruction is confirmed by a destruction act and an extract from the information system's event log (Roskomnadzor Order No. 179 of 28 October 2022); the act and the extract are kept for three years from the date of destruction. Sporting results in published protocols are not destroyed on withdrawal of the consent to dissemination but anonymised (the name is replaced with a marker).
The Platform uses only strictly necessary cookies: refreshToken — an HttpOnly cookie valid for 7 days that keeps you logged in; hasSession — a session flag; NEXT_LOCALE — the chosen language. No advertising, tracking or third-party cookies are used; the access token is held in browser memory only. For traffic measurement we use our own self-hosted analytics (Umami) on the Operator's servers: it works without cookies, does not store the IP address in its original form, does not identify visitors and shares nothing with third parties. You can delete or block cookies in your browser; login and language selection will then stop working.
You may: obtain information about the processing of your data (Art. 14 of Law 152-FZ); demand its correction, blocking or destruction if it is incomplete, outdated, inaccurate, unlawfully obtained or not necessary for the stated purpose; withdraw consents; demand that dissemination be stopped; lodge a complaint with Roskomnadzor (rkn.gov.ru) or a court. The rights of a child under 14 are exercised by their legal representative.
How to contact us. Send your request to info@zenfencing.ru (preferably from the account e-mail address) stating your full name, information that confirms your relationship with the Operator (account e-mail, date of birth, competition), the substance of the request and a contact for the reply. We respond within 10 business days; the period may be extended by no more than 5 business days with a reasoned notice (Art. 20 of Law 152-FZ). Incomplete, inaccurate or outdated data is corrected, and unlawfully obtained data destroyed, within 7 business days (Art. 20(3)); unlawful processing is stopped within 3 business days (Art. 21(3)). Where a request cannot be verified as coming from the subject or their representative, we may ask for proof of identity and authority (Art. 14(3)). For data entered by an organizer, club, federation or coach we either fulfil the request ourselves or forward it to that controller and tell you so.
Withdrawing consent to processing. A withdrawal is sent the same way. We stop processing and destroy the data within 30 days unless another lawful basis exists (for example, published competition results, the consent journal, legal obligations).
A request to stop dissemination (Art. 10.1(12) of Law 152-FZ) must state your full name, contact information (phone, e-mail or postal address) and the list of data whose dissemination is to be stopped. Within three business days we stop showing the data on our resources: the subject's name in start lists, protocols, rankings, registries and the profile is replaced with an anonymised marker, the photo is hidden, and no new entries on the subject's behalf are accepted until consent is given again. The withdrawal is recorded in the consent journal; the consent to dissemination ceases to have effect from the moment the request is received (Art. 10.1(13) of Law 152-FZ). Requests concerning organizers' resources are addressed to them.
In your account you can edit profile data, delete the photo, close and open the public profile, and withdraw or re-give consent to dissemination of a child's data. A closed profile is closed everywhere: the profile page is unavailable and start lists, protocols, rankings and registries show an anonymised marker instead of your data; organizers of competitions you enter still see the data to run them. This is equivalent to a request to stop dissemination and takes effect immediately; results in protocols are kept. An account created to keep children's records (without the “I am an athlete” mark) has its profile closed by default; it opens when a public role is enabled, with a notice in the interface. Account deletion is performed on request: access, the e-mail address and credentials are deleted, and the sporting history remains part of the protocols (Terms, section 4).
We apply the legal, organisational and technical measures required by Art. 18.1 and 19 of Law 152-FZ: the protection level of the personal data has been determined and the corresponding measures implemented; a responsible person is appointed; records and internal control are kept; access to data is role-based, and actions of authorised staff are logged with step-up authorisation by one-time code; connections are encrypted (HTTPS); passwords are stored only as irreversible hashes; session cookies are protected (HttpOnly, SameSite); rate limiting, lockout after repeated failed logins, strict input validation, image moderation and removal of metadata from uploaded photos are applied; backups are made.
If an unlawful or accidental transfer (provision, dissemination, access) of personal data is detected, we notify Roskomnadzor within 24 hours, submit the results of the internal investigation within 72 hours (Art. 21(3.1) of Law 152-FZ) and inform the affected subjects where the incident poses a risk to them.
Many fencing competitors are minors. An account can only be created by a person aged 14 or older; a user aged 14 to 18 gives consents and manages the account personally; their legal representative may contact the Operator about the processing of the user's data and withdrawal of consents on a par with the user. Data of a child under 14 is entered by their legal representative — a parent (including an adoptive parent) or a guardian — from their own account, giving the consents on the child's behalf, or by a coach or club with an attestation that such consents exist on paper. Age is checked against the date of birth; an account created by a person under 14 is suspended until the record is handed over to a representative.
A child's data is published only under the representative's consent to dissemination, which the representative may withdraw in the account at any time. At 14 the child may obtain their own account and give their own consents. We do not request or store documents proving the relationship — they are provided only on request when authority is verified.
We may update this Policy. The new version takes effect when published on this page with its date; material changes are announced in the Platform interface or by e-mail, and where the content of a consent changes the Platform asks for it again. Matters not covered here are governed by the laws of the Russian Federation.