Legal

Privacy Policy

How Aspire Badminton & Activity Center collects, uses, and protects your personal information on the Aspire Tournament platform.

Effective: May 14, 2026Governing Law: Sri Lanka

Introduction

Aspire Badminton & Activity Center (“we”, “us”, or “our”) operates the Aspire Tournament platform — an online badminton tournament management service accessible at aspiretournament.com. This Privacy Policy describes how we collect, use, share, and protect your personal information when you access or use our platform in any capacity.

By creating an account or using Aspire Tournament, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use the platform.

We may update this policy from time to time. When we do, we will revise the effective date above. Continued use of the platform after any update constitutes acceptance of the revised policy.

Information We Collect

Account Information

When you register on Aspire Tournament we collect your full name, email address, and a password (stored using bcrypt hashing — never in plain text). We also record your account role (Participant, Organization Admin, Referee, or Platform Admin), email verification status, account active/inactive state, and last login timestamp.

Player Profile

Participants complete a profile after registration. We collect:

  • First name and last name
  • Phone number (optional)
  • Date of birth (optional)
  • Gender (optional)
  • Affiliation type — School, Club, or Individual
  • Affiliation name (name of your school or club)
  • SLB (Sri Lanka Badminton) player registry number (optional)
  • Aspire Member ID — automatically generated in AT-XXXX format and permanently assigned upon profile completion; this identifier is reused across all organizations and tournaments on the platform

Tournament Registration Snapshots

When you register for a tournament we capture a snapshot of your profile at that exact point in time — including your name, email, phone, date of birth, gender, affiliation, and Member ID. This snapshot is an immutable record. Changes you make to your profile after registration do not alter past snapshots, ensuring tournament records remain accurate and tamper-proof.

Payment Information

For card payments via Absterco Pay: we do not receive or store your card number, CVV, or cardholder details. Absterco Pay processes all card data under their own PCI-DSS compliant infrastructure. We store only the transaction reference, payment status, and amount (including whether the 4.5% gateway surcharge was applied).

For bank transfer payments: we store the proof-of-payment file you upload (image or PDF), transfer date, reference number, and approval status.

Session & Technical Data

When you use the platform we automatically collect your IP address, browser user agent (type and version), session activity timestamps, and an encrypted server-side session payload used to maintain your logged-in state.

Email & Notification Data

  • Email delivery logs: recipient address, subject, email template, delivery status (queued, sent, failed, bounced), and error messages where applicable
  • Notification preferences: your per-category opt-in or opt-out setting for email notifications

Organization Data

If you create or administer an organization we additionally collect the organization name, contact email, contact phone number, website URL (optional), description, logo (optional), physical location, founding year (optional), and bank account details (account holder name, bank name, branch, and account number) used exclusively to display bank transfer payment instructions to tournament participants.

How We Use Your Information

AuthenticationTo verify your identity, maintain secure sessions, and support OTP-based login verification

Member ID assignmentTo generate and permanently assign your unique Aspire Member ID (AT-XXXX) upon profile completion

Tournament participationTo process your registration, seed you into brackets, and display your name and results in tournament records

Payment processingTo collect entry fees via online gateway or bank transfer, track payment status, and generate PDF receipts

Email notificationsTo send registration confirmations, payment receipts, approval or rejection notices, and account-related notifications

Tournament managementTo enable Organization Admins and Referees to manage brackets, matches, scoring, and registrations within their organization

Financial reportingTo provide Organization Admins with income, expense, and profit-and-loss data for their tournaments

SecurityTo detect and prevent unauthorized access using IP address and session data for platform security monitoring

Platform administrationTo manage organizations, verify organizers, and maintain the integrity of the platform across all tenants

Data Sharing & Third-Party Processors

We do not sell your personal data. We share data only with the following parties and only to the extent necessary to provide the platform:

Absterco PayPayment Gateway

Processes online card payments. We share payment amount and intent. Absterco Pay handles all card data and PCI-DSS compliance. We never receive or store your card details.

Google Cloud StorageFile Storage

Securely stores uploaded files including bank transfer slips, organization logos, and generated PDF receipts. Files are held in access-controlled private storage buckets.

Email Providers (Postmark / Resend / Amazon SES)Transactional Email

Delivers confirmation emails, payment receipts, and account notifications. Your email address and name are passed to the active email provider.

Tournament OrganizationsTournament Administration

When you register for a tournament, the hosting organization's admins can view your registration snapshot (name, email, phone, Member ID, and payment status) for management and CSV reporting purposes.

We may also disclose your data if required by Sri Lankan law, a valid court order, or to protect the rights and safety of our users and the platform.

Public Tournament Data

Tournament brackets, match schedules, and results are publicly accessible without login. Your name, Member ID, and match results may be visible to anyone on the internet once a tournament bracket is published by the hosting organization.

When you participate in a tournament the following becomes part of the public tournament record:

  • Your display name (as entered in your profile)
  • Your Aspire Member ID (AT-XXXX)
  • The event category you are registered in
  • Match results, scores, and your bracket progression

This is standard practice in competitive sports administration. By registering for a tournament you consent to this public display of your participation and results.

Cookies & Session Data

We use cookies only for essential platform functionality. We do not use advertising, analytics, or tracking cookies of any kind.

Your authenticated session is maintained via a server-side session cookie with a 14-day rolling expiry. A CSRF token cookie is also set for request security. Both are technically essential — disabling them will prevent you from logging in or interacting with the platform.

For the complete list of cookies we set, their names, purposes, lifetimes, and browser management instructions, please read our Cookie Policy.

Data Security

We apply reasonable technical and organizational measures to protect your personal data:

  • Passwords stored using bcrypt hashing with salts — never in plain text
  • OTP codes hashed before storage and expire automatically within minutes
  • All platform traffic served exclusively over HTTPS/TLS
  • Session data encrypted in transit and stored server-side (never client-side)
  • Uploaded files stored in access-controlled private Google Cloud Storage buckets
  • Role-based access control enforced via authorization policies on every API endpoint
  • Complete organization data isolation — no cross-organization data leakage
  • SQL injection prevention via parameterized Eloquent ORM queries
  • CSRF protection applied to all state-changing requests

No online service can guarantee absolute security. In the event of a data breach that materially affects your rights or freedoms, we will notify affected users as required by applicable law.

Data Retention

We retain your personal data for as long as necessary to provide the service and meet our legal and business obligations:

Account dataRetained for the lifetime of your account. Deactivated accounts are kept for a reasonable period before permanent deletion.

Tournament registration snapshotsRetained indefinitely as permanent official tournament records.

Payment recordsRetained for a minimum of 7 years to meet financial record-keeping obligations.

Email delivery logsRetained for up to 12 months for delivery tracking and troubleshooting.

Session dataSessions expire after 14 days of inactivity and are purged from the database periodically.

OTP codesExpire within minutes of generation and are invalidated immediately upon use.

To request deletion of your account and personal data, email us at info@aspiretournament.com. Note that tournament registration snapshots may be retained as part of the permanent official tournament record even after account deletion.

Your Rights

You have the following rights with respect to your personal data:

Right to accessRequest a copy of the personal data we hold about you.

Right to correctionUpdate your profile information directly via your account settings. Changes apply to future registrations only — past registration snapshots are immutable.

Right to deletionRequest deletion of your account. We will remove personal data to the extent permitted by our legal and business obligations.

Notification preferencesManage your email notification opt-ins per category at any time via your account settings.

To exercise any of these rights, email us at info@aspiretournament.com. We aim to respond to all privacy-related requests within 30 days.

Contact Us

If you have questions about this Privacy Policy or how we handle your personal data, please contact us:

OrganizationAspire Badminton & Activity Center