Wing Tzun · Escrima
Login

Privacy Policy

This policy explains what personal data ebmas.world processes, why, who can see it, which service providers are involved, and what rights you have. It applies to the public website and to the member portal (school directors, instructors and students).

Controller

The platform ebmas.world is operated by EBMAS; the operator's full contact details are in the imprint. Each affiliated school is responsible for the data of its own members, while EBMAS additionally processes member data for central federation purposes (central membership administration, grading records, federation membership, issuing and verifying membership/grading credentials, and running the central platform). For these shared purposes EBMAS and the respective school act as joint controllers.

Data we process

  • Account data - name, e-mail, phone, preferred language. Only name and e-mail are mandatory to create a member account; everything else is optional.
  • Member data - assigned school, member number, membership (licence) mark validity, and optionally date of birth and postal/passport details you or your school provide.
  • Training & grading data - current Wing Tzun / Escrima grade, examination and grading history, curriculum progress and training attendance (where used) - used to issue verifiable membership cards and certificates and to show your progress.
  • Trial-training and seminar requests - name, e-mail, phone and optional date/message, forwarded to the school director or admin to arrange training.
  • Server logs - IP address and user agent are processed transiently for security and abuse prevention.

Purpose and legal basis

We process this data to administer your membership and licence mark, document your training and grading progress, and provide your private online profile. The legal basis is your consent (Art. 6(1)(a) GDPR) and, where necessary to carry out the membership, Art. 6(1)(b) GDPR. Server logs are processed on the basis of our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Who can see your data

  • You - see and manage only your own profile, including a self-service data export.
  • Your school director / co-managers - see only the members of the school(s) they manage.
  • The EBMAS administrator - has full access across all schools.
  • The public - only via the public members directory, which is opt-in and limited: only members holding an instructor grade whose school is approved and who have actively enabled "show on the public members page" appear there, showing at most an (optionally abbreviated) name, an optional photo, instructor titles, grade codes and the school's city/country. Ordinary students never appear publicly, and e-mail, address and date of birth are never shown.

Public membership verification (QR code)

The QR code on a membership card links to a public verification page that shows only: a valid/expired status, the member's name, the school, the current grade and the valid-until date. No photo, e-mail, address, member number or date of birth is shown. The page is set to noindex, nofollow; an unknown code shows only an "invalid" notice with no personal data.

Service providers (processors)

We use the following providers; where personal data is involved, on the basis of data-processing agreements:

  • Hosting & e-mail: DomainFactory (Germany, EU) - operates the server, database and mail delivery. All portal data is stored here in the EU; system e-mails (name, e-mail address, message content) are sent via DomainFactory.
  • hCaptcha - spam protection on public forms (contact, trial and seminar requests). Only the captcha token and your IP address are transmitted; no member profile data.
  • Anthropic (Claude AI) - used for editorial content, translations and geocoding of school addresses, which do not involve member data. One feature does: when a membership card is uploaded during onboarding, the card image (which contains personal data such as name, date of birth and address) is sent to Claude Vision to read it automatically. This runs only when triggered by a card upload.
  • fal.ai - AI image generation for editorial covers; no member data.
  • OpenStreetMap / Nominatim and, optionally, Google Geocoding - convert school addresses (no member data) into map coordinates, server-side.
  • Map tiles (CARTO / OpenStreetMap) and Bunny Fonts (fonts.bunny.net) - loaded by your browser when you view maps/pages; they receive only your IP address. Bunny Fonts is a GDPR-friendly, EU-operated font service.
  • PayPal - only if you pay for a seminar; PayPal processes the payment data you enter.

How long we keep your data / deletion

We keep your member data for the duration of your membership. There is currently no automatic deletion after a membership ends - data is kept until deletion is requested. You can request deletion at any time from your dashboard; after approval by an admin or your school director, your student profile, curriculum progress, grading history, training diary and photos, and your user account, are permanently deleted. Seminar registrations are anonymised (not deleted) so the organiser's headcount and receipts stay intact. Technical e-mail logs are automatically deleted after 90 days.

Cookies

This site uses only essential cookies (session, CSRF). No third-party tracking, advertising or analytics cookies are set.

Maps

Map tiles are served by CARTO on top of OpenStreetMap data. When you load a map, your browser requests tile images from basemaps.cartocdn.com. CARTO and OSM act as processors and may briefly log the IP address to deliver the tiles. No personal data is shared with Google Maps or other commercial map providers.

Web fonts

This site loads its typefaces from Bunny Fonts (fonts.bunny.net), a GDPR-friendly, EU-operated replacement for Google Fonts. Bunny Fonts does not set cookies and does not log IP addresses or user agents for analytics. No request data is shared with Google.

Your rights

Under GDPR you may request access to, correction of, or deletion of your personal data, as well as restriction, data portability and objection. You can export all data we store about you at any time from your dashboard. Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise these rights, contact the operator listed in the imprint. You also have the right to lodge a complaint with a data-protection supervisory authority.