Privacy policyPrivacy
policy
Last updated 24 August 2026.
Who we are
This athlete licensing platform is operated jointly by two companies, which decide together how your data is used and are therefore joint controllers of it.
- WCT LLC, 5200 E 64th Street, Indianapolis, IN 46220, United States. Runs World Chase Tag® and the licensing programme worldwide.
- Line, a French société par actions simplifiée trading as Line Media (SIRET 920 988 367 00016, RCS Lyon 920 988 367), 26 Rue Pierre Robin, 69007 Lyon, France. Line Media is your point of contact in the European Union.
Privacy contacts: christian@worldchasetag.com and loic@worldchasetag.com. You may exercise any of your rights against either company, and we will answer whichever one you contact.
Because Line Media is established in the European Union, the GDPR applies to this platform directly. We apply the UK GDPR to athletes in the United Kingdom on the same terms. The arrangement between the two companies under GDPR Article 26 sets out that WCT LLC operates the platform and holds the athlete records, and that Line Media handles athlete relations, gyms and events in its territory. A summary of that arrangement will be published here once it is signed.
US law: this platform is operated from Indiana, and questions of United States law are governed by the law of the State of Indiana.
What we collect, and why
| Data | Why we need it | Basis |
|---|---|---|
| Name, date of birth, place of birth, country | To issue an athlete license, verify identity and age at events, and place athletes in the correct division | Contract |
| Home city | To understand and map where WCT athletes come from | Contract |
| Email address and password (hashed) | To run your account and send license, entry and expiry notices | Contract |
| Gym affiliation and team roster history | To run rosters, transfer windows and competition eligibility | Contract |
| Payment records (amount, date, status) | To sell licenses and event entries, and to keep accounting records | Contract and legal obligation |
| Parent or guardian name, email and consent record (under-18s only) | To obtain and evidence parental consent | Consent and legal obligation |
| Age declaration record: that you were shown the declaration about your date of birth, when, from which IP address, and which version of the wording | To evidence what you declared about your age, and to enforce the WCT Code of Conduct if it was false | Legitimate interests and legal obligation |
| Who established your date of birth (you, your club, or WCT) | To know whether a club verified it in person, which is what allows an under-16 to hold an account | Contract and legal obligation |
| License check log (when a QR code was scanned, by whom, and the result) | To prevent license fraud at events | Legitimate interests |
| IP address on registration, consent and license checks | Security, abuse prevention and consent evidence | Legitimate interests |
We do not sell personal data, we do not use it for advertising, and we do not carry out automated decision-making or profiling that produces legal effects.
Children
The minimum age for a WCT athlete license is 13. We do not knowingly register anyone younger, and we do not knowingly collect data from children under 13. If you believe a child under 13 has an account, contact us and we will delete it.
Who may create an account
Below the age of 16, an athlete cannot create their own account. Only an affiliated WCT club can, by registering the athlete through its member import, having checked the athlete's date of birth in person. This is deliberate: it means a child's date of birth has been seen by an adult who knows them, rather than typed into a public form by whoever is at the keyboard.
- Under 16: the club registers the athlete and enters their date of birth. The invitation is sent to the athlete's email address, and the account exists only once that invitation is accepted.
- 16 and 17: the athlete may register themselves, and is shown a declaration that a false statement of age may be penalized, that no refund is given for a license fee or an event entry fee if the declared age is found to be false, and that identity is checked at the first event. We record that the declaration was shown, when, and which version of it.
- Everyone: the date of birth cannot be changed from the athlete's own account after registration. Corrections are requested from the account settings and made by WCT, and every correction is logged against the administrator who made it.
Parental consent, for every athlete under 18
Athletes under 18 may hold a license only with verified consent from a parent or legal guardian. This applies to every under-18 athlete, including 16 and 17 year olds who registered themselves.
- At registration, or when a club registers the athlete, we collect the guardian's name and email and email them a unique link.
- The account cannot buy a license, enter any event, or be placed on a professional team roster until the guardian follows that link and confirms.
- The consent record stores the guardian's confirmation time and IP address, not the child's.
- Once given, consent cannot be edited from the athlete's own account. It stands until the athlete turns 18, or until it is withdrawn.
- A guardian may withdraw consent and request deletion at any time by contacting us.
For athletes aged 13 to 17 we apply GDPR Article 8 in the EU and UK, which is why the guardian consent step above exists.
Who else sees your data
- Your gym, if you choose to affiliate with one, sees your name, division and whether your license is valid. It does not see your date of birth, address, email or payment data. You control this in your settings.
- Event organisers scanning your QR code see your name, division, license number and validity, and nothing else.
- Stripe (payment processing). Stripe collects your card details directly; we never see or store them. See Stripe's privacy policy.
- Resend (transactional email delivery).
- Fly.io (hosting; data stored in Paris, France).
- Squared™, the platform developed by Line Media to run WCT events. Receives license validity, team and entry data through a restricted read-only interface. It receives no email addresses, dates of birth or payment data.
We do not otherwise share your data, except where legally required.
International transfers
Application data is stored on servers in Paris, France. Staff at WCT LLC in the United States access it to administer the platform, which is a transfer of data outside the European Economic Area.
How long we keep it
- Account and profile: while your account exists, then deleted on request.
- Licenses and payment records: retained after account deletion as an accounting record, with your name and identifying fields destroyed.
- If WCT has suspended your license: while a suspension is in force we keep your name, date of birth, country and the email address you sign in with, even if you delete your account, and we destroy everything else. This is GDPR Article 17(3)(e) - data needed to establish, exercise or defend a legal claim - and a disciplinary sanction is one. It is limited to those four fields, it lasts only as long as the suspension, and it is released automatically the day the suspension expires. While it lasts, that email address cannot be used to open a new account. You can still ask us to delete your account at any time and we will: WCT records what happens to the suspension first, which is a separate decision from your privacy request.
- Guardian consent records: retained while the athlete is a minor and for a reasonable period after, as evidence that consent was obtained. They are not destroyed by the athlete turning 18, nor by any change the athlete makes to their own profile.
- Age declaration and date of birth correction records: retained for the life of the account, as evidence of what was declared and of every correction WCT made to it.
- License check logs: 36 months. Competition eligibility and the transfer system look back across at least two seasons, so a disputed result or an eligibility challenge has to remain investigable over that period.
- Email delivery records (that a message was sent, to which address, and whether it was accepted): 24 months, matching the accounting records they support.
- Unaccepted gym invitations: deleted 90 days after they expire. These hold a person's name, email and date of birth entered by a gym, so they are removed promptly once the invitation can no longer be used.
- Notifications: 12 months once read.
These periods are enforced automatically by a daily job, not by hand.
Your rights
You can download everything we hold about you at any time from your account settings, and delete your account from the same place. Deletion destroys your name, date of birth, place of birth, gym and team history; license and payment records are kept with no personal data attached, as an accounting record. The one exception is a license suspension that is still in force, described under "How long we keep it" above: we keep four fields for as long as the suspension lasts and no longer.
You also have the right to correct inaccurate data, object to or restrict certain processing, and withdraw consent. Athletes in the EU or UK may lodge a complaint with their national supervisory authority. California residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal information as those terms are defined.
To exercise any right, contact christian@worldchasetag.com or loic@worldchasetag.com. We answer within one month.
Security
Passwords are stored hashed with scrypt and never in plain text. Traffic is encrypted with HTTPS. License QR codes expire after five minutes so a screenshot cannot be reused. Access to administrative functions is restricted and every administrative action on an athlete record is logged. Backups are encrypted and automatically restore-tested every day.
Changes
If we change this policy materially we will tell account holders by email before the change takes effect.