WCA Privacy Statement

In this privacy statement we explain how we collect and use your personal data. The statement applies to all the personal data that we use for the services that we provide.

Who is the WCA?

We are the World Cube Association. We govern competitions for mechanical puzzles that are operated by twisting groups of pieces, commonly known as 'twisty puzzles'.

We work together with Regional Organizations and local organizers to organize twisty puzzle competitions worldwide.

We are a non-profit organization, based in California, USA.

Website	https://www.worldcubeassociation.org
Mailing Address	World Cube Association 5042 Wilshire Blvd #43206 Los Angeles, CA 90036
Email Address	communication@worldcubeassociation.org

Which personal data do we process?

We register data from you that is relevant for the services that we provide, and no other data.

• Identifying data, contact data, and account data:
  When you create an account on the WCA website or participate in a WCA Competition, we may collect the following personal data:
  Your name, nationality, date-of-birth, gender, personal WCA ID (provided by us), email address, password (hashed), profile picture (managed by you).
• Data related to your registration for WCA Competitions:
  When you register for a WCA Competition, we may collect the following personal data:
  Your name, nationality, date-of-birth, gender, personal WCA ID, email address, account name, selected events for participation, number/names of guests, specific additional registration information per competition, comments made in registration form, payment data (we never store your bank or card details).
• Results and rankings for WCA Competitions:
  When you compete in a WCA Competition we register all your results for all events.
  After the competition we include your results in the rankings of the WCA.
  Your competition results are not considered personal data.
• Communication with the WCA:
  When you communicate with us via email, chat, our website, social media, or other media, we register your communication with us.
• Incidents and disciplinary information:
  When you are involved in incidents at WCA Competitions or in disciplinary processes of the WCA, we register the relevant information regarding these incidents and disciplinary processes.
• Usage of WCA website:
  When you visit the WCA website, we register your use of the WCA website in our databases. This registration may include your IP address, browser type, operating system, and referring website.
  We are using an external web analytics tool (Google Analytics). When you visit the WCA website, Google sets some standard Google Analytics cookies that help us to evaluate how our sites are used.

How do we collect your data?

We collect your data in the following ways:

• When you make an account on the WCA website, you provide us your data online, and you explicitly consent that we use it.
• When you register online for a competition on the WCA website, you provide us your data online and you explicitly consent that we use it.
• When you register online for a competition on an external competition website, you provide your data online to the organizers of the competition. You explicitly consent that the WCA can use your data. After the competition the WCA Delegate will send your data to the WCA.
• When you register on-site for a competition, you provide your data in person to the organizers of the competition. You explicitly consent that the WCA can use your data. After the competition the WCA Delegate will send your data to the WCA.
• During WCA Competitions we register your competition results and information on incidents that you are involved in. After the competition the WCA Delegate will send your data to the WCA.
• In case of disciplinary processes we collect data from you and other involved parties.
• When you browse through our website we collect information on your usage of our website.
• When you communicate with us via email, chat, our website, social media, or other media, we may register your communication with us.

We explicitly do not buy and/or use information on you from other parties, like social media, web trackers, or marketing companies.

What is your data used for?

We use your data to provide services to you, to the Registered Speedcubers, to other users of our services, and for internal use of the WCA. For each service we only use relevant data. We use this data in compliance with the GDPR policy and applicable other legislations and regulations.

• Participate at WCA Competitions:
  In order to participate at WCA competitions we collect data from you during the registration process and during the competition.
  With this information we:
  • Reserve your place for participation at the competition.
  • Communicate with you regarding information related to the competition.
  • Identify you during the competition.
  • Register your results for the competition.
  • Determine the complete competition results and competition rankings.
  • Determine honors and prizes for the competition.

• Link your competition results to your profile:
  After a WCA Competition that you participated in, we will upload your results to the WCA database and link your results to your profile.
  With this information you and other users of the WCA services can:
  • Get an overview of all your competition results.
  • Follow your personal developments in WCA Competitions.
  • You can: create a user account, link this user account to your profile, and upload a profile picture to your account that is displayed on your profile.

• Provide national, continental, and world rankings:
  As the world governing organization for twisty puzzle competitions we register, maintain, and publish official records and rankings for all official events:
  • World records, continental records, national records, and personal records.
  • World rankings, continental rankings, and national rankings.
  • Statistical rankings.

• Communicate with you:
  We use your contact details to communicate with you in relation to our services, to answer your questions, or to handle your complaints.
• Manage disciplinary processes:
  As the world governing organization for twisty puzzle competitions we have disciplinary processes to take action in case of alleged violations of our Mission, Spirit, Bylaws, Motions, Ethical code, or Regulations.
• Improve our services:
  We use the data that we collect to improve our services: for example we may improve our Regulations and training of staff based on incidents during WCA Competitions.

Do we disclose your data to other parties?

We do not disclose your data to other parties without your explicit consent.

• Competition Organization teams:
  When you register online for a competition on the WCA website, you provide us your data and you consent that we use it for the competition.
  The organization team of the competition may involve individuals who are not WCA Staff or External Staff. These individuals may get access to data that is relevant for your participation at the competition.
  With Competition Organization teams we have service agreements on the use of personal data. We will enforce these agreements to protect your personal data.
• Export of the WCA Competition results:
  On our website we provide a function which enables individuals to download an export of the WCA database. This export includes the WCA ID, name, nationality, gender, and competition results of all Registered Speedcubers. The export does not include your date-of-birth and account information.
  This export needs to be used according to our service agreement, see https://www.worldcubeassociation.org/export/results

How secure is your data at the WCA?

The WCA will handle your personal data with care and attention. Only persons with the need to have access to your data have access to your data, only access to the relevant data, and only for the period that this access is necessary.

• The WCA will take appropriate technical and organizational measures to protect your personal data against loss or unlawful use.
• Your personal data will be retained for as long as required for the services described in this privacy statement.

How is your data used internationally?

The WCA is based in the United States of America. But since the WCA is a worldwide organization, your data may also be processed by the WCA in other countries.

• The WCA may transfer your personal data from one country to another country
  to provide the services of the WCA. In all cases we will follow the GDPR policy and applicable local legislation and regulations.

What are your rights?

The WCA has a Data Protection Officer that will monitor if the WCA is following the data protection laws. and take action where necessary. You may contact our Data Protection Officer to exercise any of the rights you are granted under applicable data protection laws. Some of your rights you may directly exercise on our website through functions available in your account.

• Right to access:
  You may ask us whether or not we process any of your personal data and, if so, receive access to that data in the form of a copy.
• Right to rectification:
  You have the right to have your data rectified in case of inaccuracy or incompleteness.
• Right to be forgotten:
  You have the right to have your personal data (or parts of it) to be removed. If you exercise your right, we will remove your data within the WCA and order parties with copies of your data to remove your data as well. There are cases in which we cannot or will not remove (parts of) your data, for example if you have pending dues or if you are a party in a disciplinary process or measure. Your rights in such cases are described in article 17 of the GDPR.
• Right to restriction of processing:
  You have the right to obtain the restriction of the processing of your personal data, which means that we suspend the processing of your data for a certain period of time.
• Right to data portability:
  You have the right to request us to provide you with your personal data in a structured, commonly used, and machine-readable format.
• Right to object:
  You have the right to object to the processing of your personal data, which means you may request us to no longer process your personal data. We will follow the GDPR and applicable legislation and regulations in such cases.
• Withdrawal of your consent:
  You may withdraw your consent to use your personal data at any time.