1Who is responsible
The controller of personal data processed on nOxyApp is nOxygen Apnea Club Kft. (company reg. no. 01-09-419251, tax number 32344990-1-41), 1037 Budapest, Flóra utca 7. fszt. 1., Hungary ("we"). Privacy contact: hello@noxygen.hu. We have not appointed a Data Protection Officer, as none is required at our scale; the privacy contact above handles all data-protection matters.
When you enter a specific competition, its organizer also determines part of the processing — most visibly any custom questions on their entry waiver. For those organizer-defined questions, the organizer is responsible together with us.
2Who this covers
This notice covers everyone whose data appears on nOxyApp: account holders, competing athletes, competition staff and applicants, spectators who pay for someone's registration — and athletes whose public federation data was imported before they created an account (see: Data we receive from federations).
3What we collect and why
| Data | Where you give it | Why we process it |
|---|---|---|
| Name, gender, date of birth, nationality | Account registration | Your identity as an account holder and, if you compete, as an athlete; age categories and rankings |
| Email, phone | Registration; profile; staff application | Sign-in, essential service messages, organizer contact |
| Password | Registration | Securing your account (stored only as a cryptographic hash) |
| Club, biography, profile photo, federation profile links | Your profile | Your public athlete presence on startlists, results, and live pages |
| Competition entry data (disciplines, announced and personal-best performances) | Competition registration | Running the competition: startlists, judging, results, records |
| Medical certificates | Profile or competition registration | Verifying fitness to dive where the competition requires it — health data, held in a restricted private store |
| Signed waiver, including your signature and the organizer's custom questions | Competition registration | The competition's legal record of your declarations |
| Check-in photograph | Check-in at the venue | Identifying you on broadcast overlays and the live datastream |
| Payment confirmation (amount, receipt, payer email) | Stripe checkout | Registration fee accounting — card details never reach us |
| Technical records (audit trail, API access logs including IP) | Automatic | Security, abuse prevention, integrity of results |
| Usage statistics (pages viewed, visitor country, device and browser type — aggregate and identifier-free) | Automatic while the app is used | Understanding which features are used and planning capacity. Processed entirely on our own servers; your IP is used only transiently to distinguish same-day visits and is never stored with the statistics; no profile of you exists |
| Marketing preference (optional) | The opt-in checkbox at registration, or My Profile | Emailing you nOxygen's own competition news and offers — only if you opted in |
We collect nothing beyond what the table shows: no behavioural tracking, no advertising profiles (see the Cookie & Local Storage Policy).
About email: we always send the service emails your account and entries need (confirmations, receipts, reminders, password resets) — these never contain advertising. Marketing email — news and offers about nOxygen's own running and upcoming competitions — is sent only with your separate, freely-given opt-in (default off), and never on behalf of other organizers. You can unsubscribe at any time in My Profile → Email preferences, or by writing to us; withdrawal takes effect immediately for future email.
4The legal bases we rely on
- Contract — operating your account and the competitions you enter (identity, entries, results, payments).
- Explicit consent — health data: you actively attach your medical certificate; you can withhold it (the organizer then decides your eligibility under their rules).
- Consent — marketing email about nOxygen's own competitions and offers: entirely optional, default off, and withdrawable at any time in My Profile (see: What we collect and why).
- Consent of a parent or guardian — for registrants below the digital-consent age (see: Minors).
- Legitimate interest — the integrity and permanence of competition records (see: Results are a permanent public record), platform security, defence of legal claims, and identifier-free aggregate usage statistics processed on our own servers (see: What we collect and why — you can object at any time, see: Your rights).
- Legal obligation — accounting and tax retention of payment records.
5Results are a permanent public record
Competitive freediving results are sporting history — like race times, they identify the athlete permanently. When you compete:
- Your name, nationality, gender, age category, club, and performances appear on public startlists, live pages, rankings, and results.
- These entries remain published even if your account is later deleted (deletion is available on request — see: Your rights). Deleting your account removes your login, contact details, photos, documents, and profile — but the competition record itself is retained and stays attributed to your name, on the basis of our and the sport's legitimate interest in complete, truthful historical results (GDPR Art 17(3)).
- You acknowledge this expressly at registration; it is the deliberate, stated design of the platform.
Your profile page visibility is separate — the "public profile" toggle controls whether people can find your profile; it does not affect the competition record.
6Data we receive from federations
For athletes on the international circuit we import name, nationality, and profile photograph from AIDA International's public athlete database — sometimes before the athlete has a nOxyApp account — so organizers can prepare startlists and check-in. Such pre-created entries are inert: they cannot log in, and when you register with the same identity you take ownership of yours. If you want an imported record corrected or removed before you ever register, contact us (see: Your rights). Conversely, when a competition is sanctioned by a federation, we transmit startlists and results to that federation.
7Who receives personal data
| Recipient | What | Why |
|---|---|---|
| Stripe | Payment and payer details you enter on their checkout | Payment processing (their own privacy policy applies) |
| Email delivery provider (Amazon Web Services — Amazon SES (EU, Stockholm region)) | Your email address and message content | Delivering essential service email |
| AIDA International (and equivalent sanctioning federations) | Startlists and results of sanctioned competitions | Federation record-keeping and rankings |
| Competition organizers and staff | The entry data of their own competition | Running that competition (role-limited access) |
| Hosting provider (DigitalOcean, LLC, Netherlands (EU)) | All stored data at rest | Running the servers |
We do not sell or share personal data for advertising or data-brokering — with anyone, ever. Our usage statistics have no recipient at all: they are produced and stored on our own servers by self-hosted software, and no analytics provider — Google or otherwise — receives anything. Where a recipient is outside the EEA (for example Stripe in the United States), transfers rest on the European Commission's adequacy decisions or standard contractual clauses (for Stripe, the EU-U.S. Data Privacy Framework, supplemented by the European Commission's Standard Contractual Clauses).
8How long we keep things
| Data | Kept |
|---|---|
| Account and profile | Until we honour your deletion request |
| Competition record (results, startlists, rankings) | Permanently (see: Results are a permanent public record) |
| Medical certificates | Until you replace/remove them or your account is deleted; entry copies live with the entry |
| Signed waivers | For the legal life of the competition's liability record (5 years after the competition, matching the general limitation period for claims) |
| Payment records | As required by accounting law (8 years under the Hungarian Accounting Act) |
| Consent ledger | For as long as we must demonstrate consent |
| Security and audit logs | 12 months, then deleted or anonymised |
| Passport/ID images used for identity verification | Never stored — processed and deleted immediately |
9Minors
nOxyApp is open to registrants aged 15 and over. Below the applicable digital-consent age (16, unless the law of your country sets it lower), registration additionally requires the name and email address of a parent or legal guardian, who consents to the registration; we record that attestation. Youth-category athletes' competition data is handled exactly like adults' — including the permanence of results.
10Security
Passwords are stored only as cryptographic hashes. Health documents live in a private store that is never publicly served, with access limited to you, platform administrators, and the organizer of the competition concerned. Access inside a competition is role-based. All traffic is encrypted in transit (TLS). Profile and check-in photographs, startlists, and results are — by design — public.
11Your rights
You have the right to access, correct, export, and delete your personal data; to restrict or object to processing based on legitimate interest; and to withdraw consent (for the future) where processing rests on consent. We honour these rights for every user worldwide, not only where the GDPR applies. The one qualification is the competition record (see: Results are a permanent public record): erasure removes your account data but not published results.
To exercise any right — including deletion of your account, which is handled as a request rather than an in-app control — write to hello@noxygen.hu. If you believe we have not resolved your concern, you can complain to your data-protection authority; ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, www.naih.hu).
12Changes to this notice
When this notice materially changes we publish the new version here, raise its version number, and ask you to review and accept it the next time you use the app. Earlier versions are available on request.