Privacy Policy

Data controller

The club you have a relationship with (as a member, or registered for an event) is the controller of your personal data — they decide how it's used.

BudoDesk (Moises Puerta Reyes, self-employed, NIF 08922774Q) acts as the data processor: we provide the software the club uses to manage its members and events, and we only process data on the club's instructions. Contact: soporte@budodesk.app.

What data we process and why

Depending on the form you filled in, this may include:

• Name, email, and phone number — to manage your membership or event registration, and to contact you about it.
• Date of birth, discipline, and grade — for sports and federation management (licenses, exams).
• Bank details (IBAN) — only if you expressly authorize direct-debit dues collection.
• Documents you upload yourself (ID, medical certificate, federation license) — only if the club requests them.

Legal basis

The contractual or membership relationship with the club (managing members, dues, events) and, where applicable, your explicit consent (for example, a SEPA direct-debit mandate or an event registration).

Who we share your data with

With the technology providers that make the service possible, all bound by a data processing agreement:

• Supabase — database and authentication (hosted in the European Union).
• Resend — sending transactional emails (invitations, notifications, documents).
• Stripe — only if the club has enabled online payment of dues or services.
• Cloudflare Turnstile — anti-bot verification on sign-in and registration forms, running in the background with no visible challenge. It processes your IP, TLS fingerprint, User-Agent header, and the domain it's used from, solely to distinguish people from bots — see the Turnstile privacy addendum.

We don't sell or share your data with third parties for advertising purposes.

Retention

For as long as your relationship with the club lasts, and afterwards for the periods required by applicable law (tax, sports regulations) to address any potential liability.

If the club stops using BudoDesk, access to its data (including yours) is blocked for a maximum of 90 days from the end of the subscription, solely so the club can reactivate the service or download it, and it is then permanently deleted. Our hosting provider's technical backups are overwritten on a separate, shorter schedule.

Your rights

You can access, rectify, or request erasure of your data, object to its processing, or request portability or restriction, by writing to the club or to soporte@budodesk.app. You can also file a complaint with the Spanish Data Protection Agency (aepd.es) if you feel your request wasn't properly handled.

Platform usage analytics

Separately from the above, BudoDesk (Moises Puerta Reyes) processes, as its own controller and not as the club's processor, an internal log of which pages and features of the platform are used, how often, and real sign-ins — solely to analyse and improve the service. This processing is based on our legitimate interest (Art. 6.1.f GDPR) in maintaining and improving the platform, is never shared with third parties, and is never used for advertising. You can object by writing to soporte@budodesk.app.

The commercial website (budodesk.app) and access to the public demo also record, in aggregate form and without cookies or any identifier, the number of visits they receive — this data cannot identify anyone.

Cookies

This platform uses strictly necessary cookies — see details in our cookie policy.