Operator and scope
- 1.1DF League is the site’s personal data operator. Contact alikhan.ryspay@gmail.com. This policy covers visitors, account holders, teams, participants and their legal representatives.
- 1.2Processing must comply with Kazakhstan’s Law No. 94-V of 21 May 2013 on Personal Data and their Protection, Civil Code, informatization and child-rights legislation. Processing without consent is permitted only where the law expressly allows it.
Data, purposes and grounds
| Category | Examples | Purpose | Grounds | Retention |
|---|---|---|---|---|
| Account | First and last name, email, language, email verification status, WorkOS user ID; acceptance date and document version | Sign-in, profile and evidence of agreement | Consent; service agreement | Until account purposes and necessary evidence requirements are met |
| Team and organization | School/club, region, city, team name, representative/coach associations and roles; optional contact email and phone, logo | Team administration, contact and registration | Consent of the person or legal representative | While needed for team activity and participation; minimum archive information |
| Participant and roster | First and last name, birth date, nickname, organization/team, season, roster role and application snapshots | Age categories, rosters, admission and results | Legal-representative consent for children; own consent for adults | Until participation, checks and related disputes are complete |
| Representative consents | Representative name, authority basis, consent kind, dates, expiry, withdrawal, recording staff member | Evidence of participation, name and photo permissions | Representative consent and the duty to evidence consent | While consent applies and evidence of lawful processing is needed |
| Public material | Team profile, shortened name/nickname, results, rankings, photos and videos in news and media | Competition reporting and league archive | Publication consent; rights-holder permission | While the publication purpose remains or until a justified removal request |
| Security | Session IDs and token hashes, expiry/revocation, encrypted provider session, OAuth state; MFA secret for enrolled accounts, action audit, request IDs, hashed rate-limit keys | Secure sign-in, abuse prevention and change accountability | Consent to secure processing and statutory security duties | Sign-in cookie up to 12 hours; OAuth 10 minutes; Redis rate limit 1 hour; audit as needed for evidence |
| Invitations and correspondence | Recipient email, role, sender/team, token hash, expiry, acceptance/decline; new-owner email, requester and ownership-transfer status; account service notifications, request contents; legacy local sign-in password hashes and verification tokens | Access invitations, replies and local account recovery | Consent, requested actions and legal requirements | Invitation token: 7 days; ownership transfer: 24 hours; records and correspondence as needed to resolve their consequences |
Sources and use
- 3.1We receive data from you, authorized school/club or team representatives, legal representatives, WorkOS and event material supplied by organizers. Technical requests come from your browser. Submitting another person’s data does not remove the submitter’s duty to obtain necessary consent.
- 3.2Data supports sign-in, team and roster management, age checks, moderation, events, results publication, invitations, enquiries and security. We do not use it for advertising profiles, data sales or marketing mailings.
Children’s data
- 4.1Processing data about anyone under 18 requires verifiable consent from their legal representative. An adult manages participation through their own account for children under 14; users aged 14–17 need prior legal-representative consent for an individual account. See the age policy.
- 4.2A parent or other legal representative may request review, correction, removal from publication and deletion where the law permits. A teacher or coach who is not a legal representative must obtain that representative’s consent separately. Do not put a child’s private contact details in public material.
Public information
- 5.1A published team profile displays its organization, city and roster participants’ nicknames or first names with surname initials. Team names, results and rankings are public. People may be identifiable in news and media. Anyone submitting information for publication must first ensure the required permissions are in place.
- 5.2Full birth dates, consent files and representative details, secret tokens and internal audit records are excluded from public projections. Team contacts must not be published without opting in; the current public team response does not include email or phone.
- 5.3Others may view, copy and index public material. Removing it from our site cannot guarantee removal of all external copies; we will take available steps on a justified request.
Storage location and security
- 7.1Article 12(2) of the Law requires personal data to be stored in a database in Kazakhstan. The Operator must confirm the actual location of the production database, backups and provider infrastructure; this policy does not certify a particular data centre’s location. Consent to foreign authentication does not waive local-storage requirements.
- 7.2The application uses role-based access, session revocation, secret-token hashes and encryption of MFA secrets and provider sessions. HTTPS and secure sign-in cookies are specified for production. No system eliminates all risk.
- 7.3The application session table does not store IP addresses or user agents; error logs contain a code and request ID. Servers, reverse proxies, WorkOS and Google may receive IP and browser technical information during network requests. Infrastructure log contents and retention depend on configuration.
Retention and deletion
- 8.1Retention depends on purpose, consent duration and legal duties. There is no single indefinite retention period for all categories. Session or token expiry does not automatically delete its database row; audit and historical records need separate review.
- 8.2Once the purpose is met or a request is justified, data must be erased or anonymized unless another lawful ground requires it. Sporting history should be kept at team level or anonymized where possible. Limited records needed to evidence consent or handle legal disputes are protected separately.
- 8.3Backups follow a separate rotation. The operations plan specifies 30-day backup retention; this is not a guarantee that all production copies are deleted in exactly 30 days. You may ask about actual periods and deletion progress.
Your rights and requests
- 9.1You or your legal representative may ask whether we hold your data, its sources, purposes, processing methods, recipients and retention; access it; request correction, blocking or destruction of unlawfully processed data; withdraw consent; and object to unlawful publication. You may complain to the competent authority or a court.
- 9.2Email alikhan.ryspay@gmail.com with the subject “Personal data”, your account email, request and any relevant material link. Explain your authority when acting for a child. We verify identity only as necessary; do not send a full identity-document copy or password in advance.
- 9.3We respond to general requests within 10 working days, or within a shorter statutory deadline where applicable. The 10-day commitment does not extend special legal deadlines.
- 9.4Withdrawal does not invalidate earlier lawful processing. Where retention is legally required or an obligation remains unfulfilled, we will explain the applicable restriction and grounds; other processing must stop. Without necessary data, some account or competition services may become unavailable.
Policy changes
- 11.1Version 1.0 takes effect on 17 October 2026. Material changes will be published on the site. We seek any required consent before new purposes or publication practices; updating this policy does not itself provide that consent.
Contact
DF League, dronefootball.kz. For data, children’s rights and publications: alikhan.ryspay@gmail.com.