Privacy

How your information is handled here, in three parts: the notice from New Zealand Esports Federation, the School Esports platform privacy policy, and the list of service providers involved.

Participant privacy noticeFrom New Zealand Esports Federation, who decides how your information is used.

New Zealand Esports Federation · Version v1 · Published 6 August 2026

Who is responsible for your information

New Zealand Esports Federation is responsible for the personal information held about you in this competition.

You can reach New Zealand Esports Federation at 15D Paul Matthews Road.

New Zealand Esports Federation uses School Esports to run the competition. School Esports handles your information only on New Zealand Esports Federation's instructions.

What information is held about you

Depending on how you were entered into the competition, some or all of the following is held:

Your name and, if you have an account, your email address
Your school or organisation, and the teams you belong to
Your in-game username
Your age when you were registered, and your gender if your school recorded it
Your student ID, if your school uses one
Match results, standings and match chat messages
Any conduct, fair play or safeguarding records that relate to you

Where your information came from

Some of it you gave New Zealand Esports Federation yourself, when you created an account or joined a team.

If a teacher or an administrator entered you into a competition, your name, email address and roster details came from your school or organisation rather than from you.

The rest, match results, standings and competition records, is generated as you take part.

Why your information is used

To organise and run school esports competitions. This includes registering teams and participants, building match schedules and draws, recording results and standings, publishing team and competition information, communicating with participants and their teachers about the competition, and handling fair play, conduct and safeguarding matters.

Permission to take part

Your school or organisation authorises your participation in this competition.

Who else sees your information

Your information may be shared with:

School Esports, which operates this platform on New Zealand Esports Federation's behalf
Other teams you are matched against, who can see your first name, school, team and in-game username, but not your email address or last name
Anyone viewing public results, draws and standings, which show team names and in-game usernames

Where your information is processed

School Esports is based in New Zealand.

The database, sign-in, file storage and realtime services behind this platform are provided by Supabase, with the primary database hosted in Sydney, Australia. The site itself is delivered by Vercel, whose main processing facilities are in the United States.

School Esports uses contractual and other recognised protections for this international processing.

How long your information is kept

Your information is kept only for as long as it is needed to run the competition and the organisation's account on this platform. The periods below are applied automatically. If the organisation stops using the platform, it has 30 days to export its information, after which the information held for it is deleted.

Match and lobby chat messages, and any images shared in them (including time-submission screenshots): deleted 48 hours after the match or round ends.
Notifications shown on your dashboard: deleted after 6 months.
Push notification registrations for your devices: deleted 6 months after a device last checked in.
Activity records used to show who is online during a match: deleted after 400 days.
Support conversations, their messages and any images attached: deleted up to 24 months after the conversation is closed.
Roster details: last name, email address, student ID and gender: identifying details removed 24 months after the competition ends.
Conduct records: bans, warnings, nominations and any evidence files attached to them: identifying details removed 24 months after the ban or warning ends.
Saved copies of reported chat, player reports and registration checks: identifying details removed 24 months after the report is resolved.
Email addresses on accepted invitations and completed team approvals: deleted 12 months after the invitation is accepted or the approval decided.
Accounts with no sign-in and no place on an active roster: identified for review after 24 months. This one is not yet carried out automatically: the platform reports how many qualify and the organisation decides. Ask them if you want yours removed now.
Your sign-in email address and password: deleted at the same time as the account they belong to.

What is deliberately kept for longer

A few records are kept beyond the periods above, because there is a legal reason to keep them. These are the exceptions, and the reason for each:

Records of which privacy notice you were shown, and the permission confirmations a teacher gave: kept for 6 years. This is the evidence that you were told what was being done with your information, and it has to last as long as a claim about it could be brought.
A record of any privacy request you make: who asked, what for, and when it was answered: kept for 6 years. Evidence that the request was answered within the deadline the law sets. The conversation about it is deleted on the support schedule above; only the record of it is kept.
Invoices and billing records held about a school or organisation: kept for 7 years. Tax law requires it, which is one of the recognised exceptions to the right to erasure.

Age requirement

You must be at least 13 years old to hold an account or appear on a roster. Accounts and roster entries for anyone under 13 are blocked by the platform. Dates of birth are never collected, only an age at registration.

Your rights

You can download a copy of your information at any time from your account, under Privacy. You do not need to ask anyone, and you do not need to wait.

You have the right to:

Ask what information is held about you and get a copy of it
Ask for information that is wrong to be corrected
Ask for your information to be deleted
Object to how your information is being used, or ask for its use to be restricted
Ask for a copy of your information in a portable form

How to contact us

Contact New Zealand Esports Federation using the details below. New Zealand Esports Federation will respond as required by the privacy law of New Zealand.

Privacy Officer (privacy@esf.nz)

If something on the platform makes you feel unsafe, tell your teacher or New Zealand Esports Federation straight away. You can also contact School Esports at info@schoolesports.org, which will help New Zealand Esports Federation with anything held on the platform.

Platform privacy policyHow School Esports handles information as the provider of this platform.

School Esports
Last updated: 26 July 2026
Platform operator: Jansen & Loots Limited trading as School Esports, NZBN 9429050054411
Privacy Officer: Jonathan Jansen
Contact: info@schoolesports.org

This Privacy Policy explains how personal information is collected, used, stored and protected on School Esports and any white-labelled version of the platform made available for school esports competitions (the Platform).

In this policy, Customer means the organisation that operates the white-labelled tenant through which you access the Platform. School Esports, we, us or Platform Operator means Jansen & Loots Limited trading as School Esports.

1. Who is responsible for your information

Each Customer decides which competitions it operates, which schools and participants may take part, what information is required and how competition information is used. For information processed through that Customer's tenant, the Customer is normally the organisation primarily responsible for deciding why and how the information is processed.

Under European and United Kingdom privacy law, the Customer will normally be the data controller and School Esports will normally be its data processor. Under New Zealand privacy law, the Customer will normally be the primary privacy agency and School Esports will normally hold and process the information as its service provider or agent.

School Esports separately controls limited information needed for its own contracting, billing, service administration, security, fraud prevention, support and legal compliance.

The Customer responsible for your tenant should be identified through its domain, branding and participant privacy notice.

2. Information processed through the Platform

Account information

We may process:

Name and email address.
User role, such as student, teacher, referee or administrator.
School and organisation affiliation.
Authentication and security information.
Account status and approval history.

Student and roster information

Depending on the competition and the fields enabled by the Customer, we may process:

First and last name.
Email address.
In-game username.
School, team and roster membership.
Age, age band or school year.
Gender where it is genuinely required for a competition.
Registration, approval and participation history.

Student email addresses and last names are not displayed to opponents through standard opponent-facing roster views. Those views normally use limited information such as first name, school, team and in-game username.

Competition information

We may process:

Team registrations and approvals.
Match schedules, reschedules, defaults and results.
Score submissions and disputes.
Referee and administrator decisions.
Standings, leaderboards and tournament history.
Support, moderation, integrity and safeguarding records.

Communications

The Platform may process:

Match chat messages and uploaded match-chat images.
Support messages and attachments.
Notifications and transactional email records.

Teachers, referees and authorised Customer administrators may be able to view match communications where required for administration, moderation or safeguarding.

Technical and security information

We may process:

IP address, browser and device information.
Authentication, session, audit and security logs.
Error and diagnostic records.
Usage events needed to operate, secure and maintain the Platform.

3. Where information comes from

Information may be collected:

Directly from you.
From a teacher, school, parent, caregiver or Customer administrator.
Through your participation in a competition.
Automatically when you use the Platform.
Through support, moderation, safeguarding or security activity.

Where a teacher or Customer gives us information about you, the Customer is responsible for ensuring that you, or your parent or caregiver where appropriate, receive the applicable participant privacy notice. School Esports may deliver that notice through an invitation, registration screen, email or first-login notice on the Customer's behalf.

4. How information is used

Customer Data may be processed to:

Create and administer accounts.
Register schools, teams and participants.
Operate competitions and matches.
Schedule and reschedule matches.
Record scores, standings and results.
Support teacher and school approval processes.
Provide match communication.
Resolve support requests and disputes.
Moderate conduct and support safeguarding.
Investigate misconduct or security incidents.
Protect the integrity, reliability and security of the Platform.
Meet Customer instructions and applicable legal obligations.

The Customer is responsible for identifying its lawful purpose or legal basis. School Esports processes Customer Data on the Customer's documented instructions and as required to provide, secure and support the Platform.

School Esports does not:

Sell Customer Data.
Use student information for behavioural advertising.
Share student information with advertisers.
Use Customer Data to train general-purpose artificial intelligence models.
Use Customer Data for an unrelated commercial purpose.

5. Who may access or receive information

Information may be made available to:

The Customer and its authorised administrators.
Teachers and authorised school staff.
Referees and tournament operators.
Other participants where limited roster, team, match or leaderboard information is required.
School Esports personnel who require access for support, security, safeguarding or maintenance.
Approved service providers listed in our Subprocessor and Data Location Register.
Regulators, law enforcement or safeguarding authorities where disclosure is legally required or reasonably necessary to protect a person.

Teachers and administrators may have broader access than student Users because they are responsible for approvals, administration, supervision and safeguarding.

6. White-labelled tenants and data separation

The Platform is multi-tenant. Customer Data is logically separated by Customer, and access controls are designed to prevent Users from accessing another Customer's private information.

Security measures include organisation-scoped access controls, role-based permissions, database access policies, authentication and session controls, organisation-specific storage paths, restricted administrative access and security logging.

A school or individual may participate in more than one Customer tenant. Information in each tenant remains subject to the Customer responsible for that tenant.

7. Service providers and international processing

The Platform uses third-party service providers.

Supabase Pte. Ltd. provides the primary database, authentication, file storage and realtime services. The primary Supabase project is located in Sydney, Australia.
Vercel, Inc. provides application hosting, server functions, web delivery, performance analytics and related technical services through global infrastructure. Vercel's primary processing facilities are in the United States.
Brevo (Sendinblue SAS) delivers transactional email, including registration, invitation, match and billing messages. Brevo processes recipient email addresses and message content in France, within the European Economic Area.
Stripe group entities may process payment information where payment features are enabled for a Customer.
Browser push services operated by Google, Apple, Mozilla and other browser vendors deliver push notifications to Users who have enabled them. The push subscription is created by the User's own browser.

Our current direct providers and their purposes are listed in the Subprocessor and Data Location Register.

For European Economic Area personal data, transfers to New Zealand may rely on the European Commission's adequacy decision for New Zealand where it applies. Onward processing through Supabase is governed by School Esports' signed Supabase Data Processing Addendum, including the European Commission's Standard Contractual Clauses where required. Where School Esports acts as processor and Supabase acts as subprocessor, Module Three applies. Vercel's Data Processing Addendum applies to our Pro plan and includes relevant international transfer safeguards.

Service providers may process limited information in other locations for support, reliability, security and service delivery, subject to contractual data protection obligations.

8. Retention and deletion

We retain Customer Data while it is required to provide the Customer's tenant, in accordance with Customer instructions, and for periods reasonably required for competition administration, disputes, security, safeguarding and legal obligations.

The periods below are enforced automatically by a scheduled job. They are set in the Platform's code rather than in per-tenant settings, so a Customer cannot shorten or extend a period that has been published here, and a change to a period requires a code change.

Deleted on a schedule

Information	Deleted
Match and lobby chat messages, and any images shared in them (including time-submission screenshots)	48 hours after the match or round ends
Notifications shown on a dashboard	After 6 months
Push notification registrations	6 months after a device last checked in
Activity records used to show who is online during a match	After 400 days
Support conversations, their messages and any images attached	Up to 24 months after the conversation is closed
Email addresses on accepted invitations and completed team approvals	12 months after the invitation is accepted or the approval decided
Sign-in email address and password	At the same time as the account they belong to

Identifying details removed, records kept

Information	Identifiers removed
Roster details: last name, email address, student ID and gender	24 months after the competition ends
Conduct records: bans, warnings, nominations and any evidence files attached to them	24 months after the ban or warning ends
Saved copies of reported chat, player reports and registration checks	24 months after the report is resolved
Accounts with no sign-in and no place on an active roster	Identified for review after 24 months; see below

The dormant-account rule is the one row in this table that is not yet carried out automatically: the platform reports how many accounts qualify and the organisation running the competition decides what to do with them, while the sign-in signal the rule depends on is validated. If your account is one of them and you want it removed now, ask them and they will do it.

Where a ban or warning is still being enforced, its details are kept until it ends. The age recorded at registration is kept when roster details are anonymised, because it is the evidence that the minimum-age rule was applied. Competition results and standings are retained to preserve competition history and integrity; the identifiers behind them are not.

Deliberately kept

Information	Kept	Why
Records of which privacy notice a person was shown, and the permission confirmations a teacher gave	6 years	Evidence that people were told what was being done with their information
A record of any privacy request: who asked, what for, and when it was answered	6 years	Evidence that requests were answered within the statutory deadline
Invoices and billing records held about a school or organisation	7 years	Required by tax law, a recognised exception to the right to erasure

When a Customer Agreement ends. The Customer has 30 days to export Customer Data. Personal data is then deleted or irreversibly anonymised within 60 days of the agreement ending, and School Esports issues the Customer a written certificate recording what was deleted and what was retained. Financial records, anonymised competition history and the notice and request evidence above survive the deletion, for the reasons stated in this section. Backups are overwritten on the provider's own cycle, which is shorter than the 60 days.

Customer exports are controlled by the Customer after they leave the Platform.

9. Security

School Esports maintains reasonable technical and organisational safeguards designed to protect personal information, including:

Encryption in transit and provider encryption at rest.
Tenant-scoped and role-based access controls.
Authentication and session protections.
Restricted Provider access.
Security, audit and diagnostic logging.
Backup and recovery processes.
Incident response procedures.
Contractual controls over service providers.

No online service can guarantee absolute security. Report a suspected vulnerability or incident to info@schoolesports.org.

10. Children and young people

The Platform is intended for supervised school esports activities.

Users and participants whose personal information is entered into the Platform must be at least 13 years old. Customers, teachers and Users must not create accounts or roster records for children under 13 or attempt to bypass the minimum-age controls.

For Users aged 13 to 17:

Privacy information should be explained clearly and in age-appropriate language.
The Customer is responsible for its lawful authority to register and manage the participant.
The Customer is responsible for any parent or caregiver participation permission required by law, school policy or competition rules.
Participation permission is separate from the legal basis used to process personal information.

A parent or caregiver does not automatically receive unrestricted access to all information about a young person. Requests are considered according to the young person's age and capacity, the requester's authority, safety considerations and applicable law.

11. Your privacy rights

You should normally direct a privacy request to the Customer operating your tenant.

Depending on applicable law, you may have rights to:

Request access to your information.
Request correction of inaccurate information.
Ask for a statement of correction to be attached.
Request deletion where applicable.
Request restriction of processing.
Object to certain processing.
Request data portability.
Withdraw consent where a specific optional activity genuinely relies on consent.
Complain to a privacy or data protection regulator.

Not every right applies in every jurisdiction or circumstance.

School Esports will assist the Customer with requests concerning Customer Data. We may verify identity and authority before disclosing or changing information.

Requests may be sent to info@schoolesports.org.

12. Privacy and security incidents

Where an incident affects Customer Data, School Esports will take reasonable steps to contain and investigate it, notify the affected Customer without undue delay, provide available information for the Customer's assessment, and assist with required notifications.

The Customer is normally responsible for deciding whether a breach involving Customer Data must be reported to individuals or a regulator. School Esports remains responsible for notifications concerning information for which it acts independently as the responsible privacy agency or controller.

13. Complaints

Privacy concerns should first be raised with the Customer operating the relevant tenant or with:

Jonathan Jansen
Privacy Officer, School Esports
info@schoolesports.org

New Zealand Users may also complain to the New Zealand Office of the Privacy Commissioner. Users elsewhere may have the right to complain to their local privacy or data protection authority.

14. Changes to this policy

We may update this policy where our services, providers, legal obligations or privacy practices change. We will provide reasonable notice of material changes where appropriate.

A privacy policy explains how information is handled. Continued use of the Platform will not by itself be treated as consent to a materially new purpose that legally requires separate consent or authorisation.

15. Contact

Privacy Officer: Jonathan Jansen
Platform operator: Jansen & Loots Limited trading as School Esports
NZBN: 9429050054411
Email: info@schoolesports.org

Subprocessors and data locationsThe service providers used to run the platform, and the countries information is processed in.

School Esports
Last updated: 26 July 2026
Contact: info@schoolesports.org

This register identifies the direct third-party providers that may process personal information to provide the School Esports Platform. It should be read with the School Esports Privacy Policy and the applicable Customer Agreement.

Core providers

Provider	Purpose and information	Primary or relevant processing location	Contractual protection
Supabase Pte. Ltd.	Managed PostgreSQL database, authentication, file storage, realtime services, backups and support. May process Customer Data, account records, authentication information, uploaded files and technical information.	Primary School Esports project region: Sydney, Australia. Supabase is established in Singapore and uses Amazon Web Services and other approved providers under its DPA.	School Esports has signed the Supabase Data Processing Addendum. It includes the EU Standard Contractual Clauses. Module Three applies where School Esports is processor and Supabase is subprocessor.
Vercel, Inc.	Application hosting, server functions, web and content delivery, request handling, technical logs and security services. Also provides the performance analytics used on the Platform, which processes page, device and connection information.	Global infrastructure. Vercel states that its primary processing facilities are in the United States.	School Esports uses Vercel Pro. Vercel's Data Processing Addendum applies and includes relevant cross-border transfer mechanisms.
Brevo (Sendinblue SAS)	Transactional email delivery. Processes recipient email addresses and first names, together with the competition, team and match details contained in the message and the resulting delivery records.	France, within the European Economic Area.	Brevo's Data Processing Agreement applies. Processing takes place inside the EEA, so no transfer mechanism is required for European personal data.

Feature-specific providers

Provider	When used	Purpose and information	Location and protection
Stripe group entities	Only where payment, registration-fee or connected-account features are enabled.	Payment processing, payer and account information, transaction records, fraud prevention and billing support.	Processing locations depend on the relevant Stripe entity and service. Stripe's contractual privacy and transfer terms apply.
Browser push services (Google, Apple, Mozilla and other browser vendors)	Only where a User has enabled push notifications in their browser.	Delivery of push notifications to the User's own device. Processes the browser-issued push endpoint for that device and the notification content, which may include competition, team and match details.	Determined by the User's browser vendor and device. The push subscription is created by the User's own browser, and School Esports does not select the provider.

Providers used by our subprocessors

Supabase, Vercel, Brevo and Stripe use their own subprocessors to deliver their services. Those providers are governed by the direct provider's data processing agreement and subprocessor programme. School Esports does not separately contract with every underlying provider.

For Supabase, relevant underlying services include Amazon Web Services for hosting and other providers for support, communications, monitoring and service delivery.

Changes to this register

School Esports may add or replace a direct provider as the Platform changes. We will update this register and give affected Customers reasonable advance notice of a material new or replacement direct Subprocessor where required by the Customer Agreement or applicable law.

A Customer may object on reasonable and documented data protection grounds under its Data Processing Addendum.

Contact

Questions about this register may be sent to:

Jonathan Jansen
Privacy Officer, School Esports
info@schoolesports.org

Ask about your information

Ask for a copy of what is held about you, have something corrected or removed, or make a complaint. You do not need an account, and a parent or guardian can ask on a participant's behalf.

Make a privacy request