Privacy notice

Budopass — pilot version (beta) · Last updated: 5 August 2026

This notice describes the processing of personal data carried out through the Budopass application (Android/iOS app) and the WebAdmin web management area, in their pilot version intended for testing, pursuant to Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

iLogic Software di Panero Fulvio
Via San Giovanni, 43 — 14014 Capriglio (AT), Italy
Email: info@ilogic-software.com · Tel. 348 8638120
Contact for privacy and data deletion: support@budopass.app

Deleting your account and data

You can delete your account yourself, at any time: in the app from Settings › Delete account, on the web from User settings › Delete account (budopass.app/io/impostazioni). You only need your password. Deletion is immediate.

If you can't sign in, write to support@budopass.app from the email address you registered with (so we can verify your identity): we will delete the account within 30 days of the request.

Data deleted: account data (email, password), preferences, notifications and device tokens, profile photo, grades and seminars you declared yourself together with their supporting evidence, pending ratification requests, roles in organisations.

Data kept by your dojo: if you are or have been a member of a dojo on Budopass, the dojo keeps in its own register your record (name, date of birth, contacts, attendance, fees, grades it issued or ratified for you), detached from your account: this is data of which the dojo is the controller, as it would be in a paper register. To exercise your rights over that data, contact the dojo.

Data that may be retained: for the strictly necessary time only, some data may be kept in minimised form to fulfil legal obligations or for security (e.g. technical logs for up to 6 months); once those periods have elapsed they are deleted or anonymised.

2. What Budopass is

Budopass is a digital martial arts passport: it lets a practitioner keep their own profile and grades (declared by the athlete, issued or ratified by an organisation), be affiliated with one or more organisations/dojos and, for those with a management role, administer members, grades and events.

3. Personal data processed

Account data: first name, last name, email address, password (encrypted), preferred language.
Date of birth of the athlete, for maintaining the passport and verifying age.
Profile photo, if uploaded by the user.
Sporting data: grades (declared, issued, ratified), disciplines, events and lessons, attendance/registrations, affiliations with organisations/dojos and role (student, manager, teacher).
Images of stamps/seals uploaded by organisations: public in the app and subject to moderation.
Technical data: application logs, IP addresses, timestamps, for security and diagnostics.
Push notifications: if enabled, a device identifier (token) to deliver them.

We do not process special categories of data (Art. 9 GDPR) or precise geolocation data.

4. Purposes and legal bases

Provision of the service (account, passport, grades, affiliations, events): Art. 6.1.b.
Security, abuse prevention and diagnostics: legitimate interest — Art. 6.1.f.
Service communications (confirmation/password recovery, notifications): Art. 6.1.b; for optional ones, consent — Art. 6.1.a.
Legal obligations, where applicable: Art. 6.1.c.

5. Minors

The app is intended for users aged at least 16. We do not knowingly collect data from children under 16. If a minor uses it within their own dojo, the profile is managed under the responsibility of the organisation and/or of whoever holds parental responsibility.

6. Retention

Account and passport: while the account is active and for the legal periods; then deleted or anonymised.
Technical logs: normally 6 months, unless security needs require otherwise.
Images: for as long as necessary for the stated purposes.

7. Processors

Data may be processed, on our behalf, by technical service providers (Art. 28 GDPR), in particular for hosting and cloud infrastructure (Microsoft Azure, data centres in the EU). Data is not sold and is not used for advertising or profiling. The app does not use cookies or advertising trackers.

8. Transfers outside the EU

Data is processed in the European Union. Any transfers to third countries will take place in compliance with the GDPR, by means of standard contractual clauses (SCCs) or other adequate safeguards.

9. Your rights

You can exercise the rights of access, rectification, erasure, restriction, objection and portability (Arts. 15–22 GDPR) by writing to support@budopass.app; you may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

10. Security

We adopt appropriate technical and organisational measures, including encryption of communications in transit (HTTPS) and encrypted storage of credentials.

11. Changes

This notice may be updated; the current version is always available at this address, with the date at the top.