Athlete licensing platform

Privacy
policy

Last updated 5 August 2026.

Who we are

This athlete licensing platform is operated jointly by two companies, which decide together how your data is used and are therefore joint controllers of it.

• WCT LLC, 5200 E 64th Street, Indianapolis, IN 46220, United States. Runs World Chase Tag® and the licensing programme worldwide.
• Line Media, France. Operates the programme across Europe, the Middle East and Africa, and is your point of contact in the European Union. [ Registered address and company number to be added. ]

Privacy contacts: christian@worldchasetag.com and loic@worldchasetag.com. You may exercise any of your rights against either company, and we will answer whichever one you contact.

Because Line Media is established in the European Union, the GDPR applies to this platform directly. We apply the UK GDPR to athletes in the United Kingdom on the same terms. The arrangement between the two companies under GDPR Article 26 sets out that WCT LLC operates the platform and holds the athlete records, and that Line Media handles athlete relations, gyms and events in its territory. [ A summary of that arrangement will be published here once signed. ]

US law: this platform is operated from Indiana, and questions of United States law are governed by the law of the State of Indiana.

What we collect, and why

Data	Why we need it	Basis
Name, date of birth, place of birth, country	To issue an athlete licence, verify identity and age at events, and place athletes in the correct division	Contract
Email address and password (hashed)	To run your account and send licence, entry and expiry notices	Contract
Gym affiliation and team roster history	To run rosters, transfer windows and competition eligibility	Contract
Payment records (amount, date, status)	To sell licences and event entries, and to keep accounting records	Contract and legal obligation
Parent or guardian name, email and consent record (under-18s only)	To obtain and evidence parental consent	Consent and legal obligation
Licence check log (when a QR code was scanned, by whom, and the result)	To prevent licence fraud at events	Legitimate interests
IP address on registration, consent and licence checks	Security, abuse prevention and consent evidence	Legitimate interests

We do not sell personal data, we do not use it for advertising, and we do not carry out automated decision-making or profiling that produces legal effects.

Children

Athletes under 18 may hold a licence only with verified consent from a parent or legal guardian.

• At registration we collect the guardian's name and email and email them a unique link.
• The account cannot buy a licence or enter any event until the guardian follows that link and confirms.
• The consent record stores the guardian's confirmation time and IP address, not the child's.
• A guardian may withdraw consent and request deletion at any time by contacting us.

The minimum age for an athlete licence is 13. We do not knowingly register anyone younger, and we do not knowingly collect data from children under 13. For athletes aged 13 to 17 we apply GDPR Article 8 in the EU and UK, which is why the guardian consent step above exists. If you believe a child under 13 has registered, contact us and we will delete the account.

Who else sees your data

• Your gym, if you choose to affiliate with one, sees your name, division and whether your licence is valid. It does not see your date of birth, address, email or payment data. You control this in your settings.
• Event organisers scanning your QR code see your name, division, licence number and validity, and nothing else.
• Stripe (payment processing). Stripe collects your card details directly; we never see or store them. See Stripe's privacy policy.
• Resend (transactional email delivery).
• Fly.io (hosting; data stored in Paris, France).
• Squared, the official WCT events software, receives licence validity, team and entry data through a restricted read-only interface. It receives no email addresses, dates of birth or payment data.

We do not otherwise share your data, except where legally required.

International transfers

Application data is stored on servers in Paris, France. Staff at WCT LLC in the United States access it to administer the platform, which is a transfer of data outside the European Economic Area. [ The safeguard for that transfer, either Standard Contractual Clauses or certification under the EU-US Data Privacy Framework, is being put in place and will be named here. ]

How long we keep it

• Account and profile: while your account exists, then deleted on request.
• Licences and payment records: retained after account deletion as an accounting record, with your name and identifying fields destroyed.
• Guardian consent records: retained while the athlete is a minor and for a reasonable period after, as evidence that consent was obtained.
• Licence check logs: 36 months. Competition eligibility and the transfer system look back across at least two seasons, so a disputed result or an eligibility challenge has to remain investigable over that period.
• Email delivery records (that a message was sent, to which address, and whether it was accepted): 24 months, matching the accounting records they support.
• Unaccepted gym invitations: deleted 90 days after they expire. These hold a person's name, email and date of birth entered by a gym, so they are removed promptly once the invitation can no longer be used.
• Notifications: 12 months once read.

These periods are enforced automatically by a daily job, not by hand.

Your rights

You can download everything we hold about you at any time from your account settings, and delete your account from the same place. Deletion destroys your name, date of birth, place of birth, gym and team history; licence and payment records are kept with no personal data attached, as an accounting record.

You also have the right to correct inaccurate data, object to or restrict certain processing, and withdraw consent. Athletes in the EU or UK may lodge a complaint with their national supervisory authority. California residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal information as those terms are defined.

To exercise any right, contact christian@worldchasetag.com or loic@worldchasetag.com. We answer within one month.

Security

Passwords are stored hashed with scrypt and never in plain text. Traffic is encrypted with HTTPS. Licence QR codes expire after five minutes so a screenshot cannot be reused. Access to administrative functions is restricted and every administrative action on an athlete record is logged. Backups are encrypted and automatically restore-tested every day.

Changes

If we change this policy materially we will tell account holders by email before the change takes effect.

Back to the licensing platform