Privacy policy

1. Scope of this policy

This document explains privacy for the current Go Fight website and proposes a framework for app data processing before launch. Go Fight is the project name provided. The identity of the entity responsible for processing, its address and privacy email must be completed before app user data is collected.

App-specific sections describe proposed processing that must be checked against the operational product and service providers. They do not confirm technical infrastructure or practices that have not been inspected.

2. The current informational website

The current version has no account registration, contact form or payment facility. Its code includes no analytics, advertising, cookies or local storage of visitor data. Fonts and images are served locally. After deployment, the hosting server may record technical connection information such as IP address, request time and browser for operations and security. The host and its log policy must be identified before publication.

Following a link to Tocaan or to an app store once links are enabled is subject to that external party's policy. A link does not automatically give that party access to your Go Fight account data.

3. Proposed app data and purposes

• Account: Name, phone number, email if requested, and authentication data needed to create and recover an account.
• Preferences: Selected sport, category, area and favorites, to display suitable options. Precise geolocation is unnecessary when a selected area is sufficient.
• Subscriptions: Academy, package, subscription dates, payment reference and status, and invoices, to manage orders, refunds and legally required records.
• Support and security: Messages you send and necessary error and usage logs, to handle requests and prevent misuse.

This is a proposed list, not authorization to collect every item automatically. Identity document images, health information and contacts must not be collected merely for browsing. Any exceptional need requires a specific purpose, disclosure and additional safeguards before collection.

4. Processing grounds and consent

Each processing purpose and the information needed to deliver the service must be explained before collection, with consent obtained where required by law. Optional permissions, such as marketing or precise location, are separate from subscription terms and can be withdrawn without disabling functions that do not depend on them. Some records may be retained to meet legal obligations or resolve claims to the extent legitimately necessary.

Optional tracking or marketing tools must not be activated without disclosure and an appropriate choice mechanism. A phone operating system permission alone does not replace an explanation of the processing purpose.

5. Sharing and external parties

When subscriptions are enabled, the selected academy receives only information needed to deliver training and confirm the subscription. Hosting, support, notification and payment providers must have defined roles and contractually and technically restricted access. Personal data must not be sold or shared for independent marketing without a lawful basis and consent where required.

The payment gateway, hosting and messaging providers have not been specified. The proposed design sends card details directly to the payment provider without Go Fight storing full card numbers or security codes. Implementation must be verified before adopting that description. Specific information may also be disclosed in response to a valid legal request from a competent authority.

6. Children and health information

A guardian or legal representative manages a child's subscription and data requests. Collection is limited to what is necessary for the suitable program, with appropriate verification of consent before processing. If child data is found to have been collected without the necessary authorization, processing must be restricted and correction or deletion undertaken according to legal requirements.

The platform is not intended to create health profiles. If an academy needs health information for safety, it must explain the purpose, protect the information and define its processing responsibilities. Such information is not automatically sent to the platform.

7. Retention, deletion and international transfers

Separate retention periods must be defined for accounts, transactions, complaints and technical logs according to their purpose and legal obligations. Data must then be deleted or appropriately anonymized. Account deletion does not remove records that must legally be retained; the user must be told the reason and retention period or criteria. Backups must follow a documented, limited deletion cycle.

Hosting countries and final retention periods have not been specified. They must be disclosed before launch. Applicable requirements and safeguards for transfers outside Kuwait must be verified before any transfer. This policy does not provide blanket consent to transfer data to any country.

8. Your rights and information security

Subject to applicable law, you may request information about processing, access and correction, deletion or restriction, and withdrawal of consent where applicable. Identity verification must be proportionate. Reasons for any refusal or exception and complaint options must be explained. Do not send a password or verification code to exercise these rights.

Before launch, appropriate safeguards for transmission, storage, permissions, account protection and incident monitoring must be implemented and periodically reviewed. A breach requires containment, assessment and notification to users and competent authorities in the circumstances and within the deadlines required by law. These are implementation requirements, not certification that the app has passed a security audit.

9. Contact and updates

A privacy email and account deletion request channel have not yet been provided. They must be made available and operational before accounts are opened. The website currently has no published channel for these requests. The right to complain to the competent Kuwaiti authority remains unaffected.

This policy must be reviewed when the technical architecture is defined or a new processing purpose or party is added. Material changes must be announced and consent obtained where required. The draft preparation date is not an effective date for an unlaunched service.