School Esports
Last updated: 14 August 2026
Platform operator: Jansen & Loots Limited trading as School Esports, NZBN 9429050054411
Privacy Officer: Jonathan Jansen
Contact: info@schoolesports.org

This Privacy Policy explains how personal information is collected, used, stored and protected on School Esports and any white-labelled version of the platform made available for school and community esports competitions (the Platform).

In this policy, Customer means the organisation that operates the white-labelled tenant through which you access the Platform. School Esports, we, us or Platform Operator means Jansen & Loots Limited trading as School Esports.

1. Who is responsible for your information

Each Customer decides which competitions it operates, which schools and participants may take part, what information is required and how competition information is used. For information processed through that Customer's tenant, the Customer is normally the organisation primarily responsible for deciding why and how the information is processed.

Under European and United Kingdom privacy law, the Customer will normally be the data controller and School Esports will normally be its data processor. Under New Zealand privacy law, the Customer will normally be the primary privacy agency and School Esports will normally hold and process the information as its service provider or agent.

School Esports separately controls limited information needed for its own contracting, billing, service administration, security, fraud prevention, support and legal compliance.

The Customer responsible for your tenant should be identified through its domain, branding and participant privacy notice.

2. Information processed through the Platform

Account information

We may process:

• Name and email address.
• User role, such as student, teacher, referee or administrator.
• School and organisation affiliation.
• Authentication and security information.
• Account status and approval history.

Student and roster information

Depending on the competition and the fields enabled by the Customer, we may process:

• First and last name.
• Email address.
• In-game username.
• School, team and roster membership.
• Age, age band or school year.
• Gender where it is genuinely required for a competition.
• Registration, approval and participation history.

Student email addresses and last names are not displayed to opponents through standard opponent-facing roster views. Those views normally use limited information such as first name, school, team and in-game username.

Competition information

We may process:

• Team registrations and approvals.
• Match schedules, reschedules, defaults and results.
• Score submissions and disputes.
• Referee and administrator decisions.
• Standings, leaderboards and tournament history.
• Support, moderation, integrity and safeguarding records.

Communications

The Platform may process:

• Match chat messages and uploaded match-chat images.
• Support messages and attachments.
• Notifications and transactional email records.

Teachers, referees and authorised Customer administrators may be able to view match communications where required for administration, moderation or safeguarding.

Technical and security information

We may process:

• IP address, browser and device information.
• Authentication, session, audit and security logs.
• Error and diagnostic records.
• Usage events needed to operate, secure and maintain the Platform.

Cookies and device storage

The Platform uses cookies and similar browser storage for limited purposes:

• Essential storage keeps Users signed in, connects each visit to the correct Customer tenant, supports security and fraud prevention, carries a requested reward claim through sign-in, remembers choices made in the interface and saves unfinished registration forms on the User's own device.
• Optional performance storage and collection measures public-page performance and records limited signed-in Platform activity so School Esports can understand and improve how the service is used. This is enabled only when the User selects Allow performance.
• Payment security technology may be used by Stripe when a User chooses to set up a payment method. Stripe processes device and activity signals for payment security and fraud prevention.

The Platform does not use cookies or device storage for behavioural advertising. A privacy choice is saved in the browser so the notice is not shown automatically on every visit. Users can change that choice through Privacy settings in the page footer. Clearing browser storage will remove the saved choice and any unfinished registration drafts stored on that device.

3. Where information comes from

Information may be collected:

• Directly from you.
• From a teacher, school, parent, caregiver or Customer administrator.
• Through your participation in a competition.
• Automatically when you use the Platform.
• Through support, moderation, safeguarding or security activity.

Where a teacher or Customer gives us information about you, the Customer is responsible for ensuring that you, or your parent or caregiver where appropriate, receive the applicable participant privacy notice. School Esports may deliver that notice through an invitation, registration screen, email or first-login notice on the Customer's behalf.

4. How information is used

Customer Data may be processed to:

• Create and administer accounts.
• Register schools, teams and participants.
• Operate competitions and matches.
• Schedule and reschedule matches.
• Record scores, standings and results.
• Support teacher and school approval processes.
• Provide match communication.
• Resolve support requests and disputes.
• Moderate conduct and support safeguarding.
• Investigate misconduct or security incidents.
• Protect the integrity, reliability and security of the Platform.
• Meet Customer instructions and applicable legal obligations.

The Customer is responsible for identifying its lawful purpose or legal basis. School Esports processes Customer Data on the Customer's documented instructions and as required to provide, secure and support the Platform.

School Esports does not:

• Sell Customer Data.
• Use student information for behavioural advertising.
• Share student information with advertisers.
• Use Customer Data to train general-purpose artificial intelligence models.
• Use Customer Data for an unrelated commercial purpose.

5. Who may access or receive information

Information may be made available to:

• The Customer and its authorised administrators.
• Teachers and authorised school staff.
• Referees and tournament operators.
• Other participants where limited roster, team, match or leaderboard information is required.
• School Esports personnel who require access for support, security, safeguarding or maintenance.
• Approved service providers listed in our Subprocessor and Data Location Register.
• Regulators, law enforcement or safeguarding authorities where disclosure is legally required or reasonably necessary to protect a person.

Teachers and administrators may have broader access than student Users because they are responsible for approvals, administration, supervision and safeguarding.

6. White-labelled tenants and data separation

The Platform is multi-tenant. Customer Data is logically separated by Customer, and access controls are designed to prevent Users from accessing another Customer's private information.

Security measures include organisation-scoped access controls, role-based permissions, database access policies, authentication and session controls, organisation-specific storage paths, restricted administrative access and security logging.

A school or individual may participate in more than one Customer tenant. Information in each tenant remains subject to the Customer responsible for that tenant.

7. Service providers and international processing

The Platform uses third-party service providers.

• Supabase Pte. Ltd. provides the primary database, authentication, file storage and realtime services. The primary Supabase project is located in Sydney, Australia.
• Vercel, Inc. provides application hosting, server functions, web delivery, performance analytics and related technical services through global infrastructure. Vercel's primary processing facilities are in the United States.
• Brevo (Sendinblue SAS) delivers transactional email, including registration, invitation, match and billing messages. Brevo processes recipient email addresses and message content in France, within the European Economic Area.
• Stripe group entities may process payment information where payment features are enabled for a Customer.
• Browser push services operated by Google, Apple, Mozilla and other browser vendors deliver push notifications to Users who have enabled them. The push subscription is created by the User's own browser.

Our current direct providers and their purposes are listed in the Subprocessor and Data Location Register.

For European Economic Area personal data, transfers to New Zealand may rely on the European Commission's adequacy decision for New Zealand where it applies. Onward processing through Supabase is governed by School Esports' signed Supabase Data Processing Addendum, including the European Commission's Standard Contractual Clauses where required. Where School Esports acts as processor and Supabase acts as subprocessor, Module Three applies. Vercel's Data Processing Addendum applies to our Pro plan and includes relevant international transfer safeguards.

Service providers may process limited information in other locations for support, reliability, security and service delivery, subject to contractual data protection obligations.

8. Retention and deletion

We retain Customer Data while it is required to provide the Customer's tenant, in accordance with Customer instructions, and for periods reasonably required for competition administration, disputes, security, safeguarding and legal obligations.

The periods below are enforced automatically by a scheduled job. They are set in the Platform's code rather than in per-tenant settings, so a Customer cannot shorten or extend a period that has been published here, and a change to a period requires a code change.

Deleted on a schedule

Identifying details removed, records kept

The dormant-account rule is the one row in this table that is not yet carried out automatically: the platform reports how many accounts qualify and the organisation running the competition decides what to do with them, while the sign-in signal the rule depends on is validated. If your account is one of them and you want it removed now, ask them and they will do it.

Where a ban or warning is still being enforced, its details are kept until it ends. The age recorded at registration is kept when roster details are anonymised, because it is the evidence that the minimum-age rule was applied. Competition results and standings are retained to preserve competition history and integrity; the identifiers behind them are not.

Deliberately kept

When a Customer Agreement ends. The Customer has 30 days to export Customer Data. Personal data is then deleted or irreversibly anonymised within 60 days of the agreement ending, and School Esports issues the Customer a written certificate recording what was deleted and what was retained. Financial records, anonymised competition history and the notice and request evidence above survive the deletion, for the reasons stated in this section. Backups are overwritten on the provider's own cycle, which is shorter than the 60 days.

Customer exports are controlled by the Customer after they leave the Platform.

9. Security

School Esports maintains reasonable technical and organisational safeguards designed to protect personal information, including:

• Encryption in transit and provider encryption at rest.
• Tenant-scoped and role-based access controls.
• Authentication and session protections.
• Restricted Provider access.
• Security, audit and diagnostic logging.
• Backup and recovery processes.
• Incident response procedures.
• Contractual controls over service providers.

No online service can guarantee absolute security. Report a suspected vulnerability or incident to info@schoolesports.org.

10. Children and young people

The Platform supports supervised school esports and open-registration community esports for players aged 13 and above. Community sites do not use schools, teachers or school permission flows.

Users and participants whose personal information is entered into the Platform must be at least 13 years old. Customers, teachers and Users must not create accounts or roster records for children under 13 or attempt to bypass the minimum-age controls.

For Users aged 13 to 17:

• Privacy information should be explained clearly and in age-appropriate language.
• The Customer is responsible for its lawful authority to register and manage the participant.
• The Customer is responsible for any parent or caregiver participation permission required by law, school policy or competition rules.
• Participation permission is separate from the legal basis used to process personal information.

A parent or caregiver does not automatically receive unrestricted access to all information about a young person. Requests are considered according to the young person's age and capacity, the requester's authority, safety considerations and applicable law.

11. Your privacy rights

You should normally direct a privacy request to the Customer operating your tenant.

Depending on applicable law, you may have rights to:

• Request access to your information.
• Request correction of inaccurate information.
• Ask for a statement of correction to be attached.
• Request deletion where applicable.
• Request restriction of processing.
• Object to certain processing.
• Request data portability.
• Withdraw consent where a specific optional activity genuinely relies on consent.
• Complain to a privacy or data protection regulator.

Not every right applies in every jurisdiction or circumstance.

School Esports will assist the Customer with requests concerning Customer Data. We may verify identity and authority before disclosing or changing information.

Requests may be sent to info@schoolesports.org.

12. Privacy and security incidents

Where an incident affects Customer Data, School Esports will take reasonable steps to contain and investigate it, notify the affected Customer without undue delay, provide available information for the Customer's assessment, and assist with required notifications.

The Customer is normally responsible for deciding whether a breach involving Customer Data must be reported to individuals or a regulator. School Esports remains responsible for notifications concerning information for which it acts independently as the responsible privacy agency or controller.

13. Complaints

Privacy concerns should first be raised with the Customer operating the relevant tenant or with:

Jonathan Jansen
Privacy Officer, School Esports
info@schoolesports.org

New Zealand Users may also complain to the New Zealand Office of the Privacy Commissioner. Users elsewhere may have the right to complain to their local privacy or data protection authority.

14. Changes to this policy

We may update this policy where our services, providers, legal obligations or privacy practices change. We will provide reasonable notice of material changes where appropriate.

A privacy policy explains how information is handled. Continued use of the Platform will not by itself be treated as consent to a materially new purpose that legally requires separate consent or authorisation.

15. Contact

Privacy Officer: Jonathan Jansen
Platform operator: Jansen & Loots Limited trading as School Esports
NZBN: 9429050054411
Email: info@schoolesports.org

Community sites and optional Gamer Profiles

School and community sites may belong to the same operator family. Your account credentials work across sites, while sign-in sessions remain separate per domain. Community competitions are free at launch and require participants to be at least 13.

A Gamer Profile is public only after you claim a gamer handle. Use a handle rather than a real name, school, email or date of birth. The profile appears on current and later sibling sites operated by the same family, never another family. It can show your handle, optional picture and bio, player availability, games and usernames you add, joined month, competition history, results, earned badges and game ratings. Private names, email, school, team names, age, date of birth and account identifiers are not added to the profile. Only add information you want to share publicly to your picture and bio.

Game usernames are checked for duplicates across accounts on the platform. An account uses the same game username on each site where it adds that game. Previous game usernames and gamer handles are kept in a private change history for account safety, not on the public profile. Removing a game stops sharing it in that operator family. Family profile erasure removes that family's game selections and change history; a username still used in another family remains associated with the account there. Profile pictures are resized and re-encoded without the original image metadata and are removed with the profile.

Account-linked career history is retained for the lifetime of the group profile until erasure, or removal of its source site or tournament. Email-only career records are retained for 24 calendar months after tournament completion; email-only ratings are retained for 24 calendar months after last participation. Retries do not renew retention. Players can hide their profile across the family, download their data, and request erasure. A processing restriction in any sibling site hides the family profile. Platform moderation may hide profiles and players cannot override moderation. Account merging and cross-family history sharing are not provided.

School Esports
Last updated: 26 July 2026
Contact: info@schoolesports.org

This register identifies the direct third-party providers that may process personal information to provide the School Esports Platform. It should be read with the School Esports Privacy Policy and the applicable Customer Agreement.

Core providers

Feature-specific providers

Providers used by our subprocessors

Supabase, Vercel, Brevo and Stripe use their own subprocessors to deliver their services. Those providers are governed by the direct provider's data processing agreement and subprocessor programme. School Esports does not separately contract with every underlying provider.

For Supabase, relevant underlying services include Amazon Web Services for hosting and other providers for support, communications, monitoring and service delivery.

Changes to this register

School Esports may add or replace a direct provider as the Platform changes. We will update this register and give affected Customers reasonable advance notice of a material new or replacement direct Subprocessor where required by the Customer Agreement or applicable law.

A Customer may object on reasonable and documented data protection grounds under its Data Processing Addendum.

Contact

Questions about this register may be sent to:

Jonathan Jansen
Privacy Officer, School Esports
info@schoolesports.org