Privacy Policy

1. Who we are (the Controller)

A13 Academy — Athlete Thirteen. Email: info@athlete13.org. Phone: 55549913. Contact us using these details for any privacy request.

2. Notice about children’s data (Article 17)

Whenever a participant is under 18, in any program (including one open to adults), we collect the child’s data only with the explicit consent of the child’s parent or guardian, obtained electronically at registration. A child’s participation is never conditional on providing more data than is necessary for the program (for example, photography consent is optional and may be declined).

3. What we collect

• Registrant (the person completing the form: the participant, or a parent/guardian registering a child): full name, mobile number, email.
• Emergency contact: name and phone number. When a participant under 18 registers themselves, this is the parent or guardian who gives consent.
• Each participant: full name, date of birth, school, nationality, gender, swimming level, optional t-shirt size, and optional medical notes / allergies.
• Consents: liability waiver, your photography (yes/no) choice and, when a participant under 18 registers themselves, the parent’s or guardian’s consent.
• Payment: the order amount and payment status. Card details are entered on SADAD’s secure gateway — we never see or store them.
• Technical: limited data such as IP address used only for security, fraud/abuse prevention, and rate limiting.

4. Special-nature data (Article 16)

Children’s data and any medical/health information you provide are “personal data of a special nature” under the PDPPL. We process them only to run the program safely (for example, so coaches are aware of allergies or medical needs), apply additional safeguards, and limit access strictly to authorized staff.

5. Why we use your data and our lawful basis (Articles 4 & 9)

Our lawful basis is the consent given at registration — the participant’s own or, for a child, the parent’s or guardian’s — and the legitimate purpose of providing the program you registered for.

Academy offers. Families who have registered with us may occasionally receive academy offers by email, such as a personal discount code. Every such email has a “Stop academy offers” link; using it stops further offers to that address. Opting out does not affect your registration or the service messages we send about it (confirmations, receipts and program updates).

• To register the participant and create your order.
• To take payment securely through SADAD.
• To care for participants’ safety and respond to medical or emergency situations.
• To send you a confirmation and important program communications.
• To keep financial and registration records and comply with the law.

6. Who we share it with

We do not sell your data. We share it only as needed to deliver the program: with our payment provider (SADAD) to process payment, with the service providers that host our database and send our email (acting as Processors under our instructions), and with the AI service providers described below. We may disclose data where required by law. Some providers may store data outside Qatar (cross-border transfer); we only allow this consistent with the PDPPL and with appropriate safeguards.

AI service providers. OpenAI powers the assistant on our website and the AI tools our staff use: it receives what you type into the website assistant, and our staff’s requests together with program information and aggregate statistics; we do not send it registration or participant records. Anthropic (Claude) processes the personal data that authorized A13 staff look up through the academy’s Claude connector — such as registrations, participants’ names, family contact details and attendance, but never medical notes or payment amounts — and every such lookup is logged. Both act as Processors under our instructions and may process data outside Qatar.

7. How long we keep it (Article 10)

We keep personal data only for as long as necessary for the program and for the financial/legal records we are required to retain, after which it is deleted or anonymized.

8. How we protect it (Articles 8 & 13)

We apply administrative and technical safeguards: encryption in transit (HTTPS/TLS), strict database access controls, server-side processing of payments with signature verification, passwordless and access-controlled admin entry, and least-privilege access to children’s data.

9. Your rights (Articles 5, 6 & 17)

To exercise any right, email info@athlete13.org. We may verify your identity before acting.

• Be informed about how your and your child’s data are processed.
• Access your data and obtain a copy.
• Correct inaccurate data.
• Object to or withdraw consent for processing.
• Request deletion of your or your child’s data when the purpose has ended.
• As a guardian: request a description of the child’s data we hold, a copy, and its deletion or suspension of processing (after we verify your identity).

10. Data breaches (Article 14)

If a breach occurs that may cause serious harm to personal data or privacy, we will notify the affected individuals and the Competent Department as required by the PDPPL.

11. Changes to this policy

We may update this policy and will post the revised version here with a new “last updated” date.

12. Complaints

If you have a concern, contact us first at info@athlete13.org. You also have the right to raise it with the competent data-protection authority in Qatar (the Compliance and Data Protection Department at the Ministry of Communications and Information Technology).