Skip to content
Start for free
Data

Privacy policy

Version 1.0 · Effective 10 November 2026

Are you a parent? The Parents and data page sums it up in a few minutes.

1. Introduction

This Privacy Policy describes how personal data is processed in the LigaPass service (the “Service”), operated by AZWAUL LP, a limited partnership (LP) registered in Ontario, Canada, with its registered office at 1025 King Street East, Unit 107 #1697, Cambridge, ON N3H 3P5 (the “Company”, “we”).

LigaPass lets team-sport leagues and clubs manage player files and digital licences. Most of the data in the Service is about players, many of them minors, and is entered by clubs and leagues. This Policy is written for them, for the staff who use the Service and for the parents.

2. Roles

2.1 The League is the controller of Player Data

For the files of players, the League is the data controller. It decides which data is collected and why, informs the players and their parents, and answers their requests. The Club enters files under the League’s rules.

2.2 We are the processor

For that data, the Company is the processor: we process it on behalf of the League, to provide the Service and on its instructions, as set out in the Terms of Service (Section 8).

2.3 We are the controller of account data

For the account of the League’s and Clubs’ users (name, email, credentials, usage and security logs, billing), the Company is the controller.

3. Data Collected

3.1 About players (entered by Clubs)

  • identity: first name, last name, date of birth, sex;
  • the identity document and the photo of the player;
  • the club, the category and the season of the file, the history of its validation (sent, corrected, approved, refused) and the comments of the League;
  • the licence: number, validity, status (active, suspended, revoked) and its QR code.

3.2 About parents (online authorization)

When a parental authorization is signed online: the parent’s name and email address, the relationship to the player, the date and time of the signature, the IP address and the browser used to sign, the text signed and its fingerprint. This is the proof of the authorization. The parent’s email is also used to send the copy of the authorization and to answer the parent’s requests.

3.3 About users

Name, email address, role and function in the League or Club, authentication data, and technical data (IP address, browser, logs of actions on files).

3.4 Data collected automatically

Technical logs and error reports, to secure and operate the Service. LigaPass uses only cookies and storage that are strictly necessary (session, language, theme); there is no advertising tracking.

  • Registering a player and issuing a licence: the League’s legitimate interest, or the contract with the player, as the League determines;
  • Minors: the authorization of a parent or guardian, online or on paper;
  • Verifying a licence: the League’s legitimate interest in checking that a player is entitled to play;
  • Account, security and support: our contract with the user and our legitimate interest;
  • Billing: our contract and legal obligations.

5. Who Sees What

  • The public QR code of a licence shows only the status of the licence (and the end date of a suspension, if any), the licence number, the category, the club, the league and the season. It does not show the name, the photo or the date of birth of the player.
  • Officials of the League who verify a licence see the photo of the player, to check the identity of the person in front of them.
  • The League’s validators see the documents of the files they validate; the League’s team and Clubs see the files according to their role. A club sees only its own players.
  • Parents see their child’s file name and their own requests through their personal link, nothing else.

6. Sharing and Sub-processors

We do not sell personal data. We use sub-processors, bound by contract, to provide the Service:

  • hosting and storage of the database and of the documents (restricted storage, never publicly listed);
  • email delivery: to send invitations, notifications and the copy of the parent’s authorization;
  • AI reading of documents, only when the League has enabled it (Section 7): OpenRouter, which routes the request to Google Gemini;
  • payment: the reseller that collects the subscription, for billing data only.

We may also disclose data where the law requires. The list of sub-processors is available on request at privacy@ligapass.app.

7. AI Reading of Identity Documents (optional)

When the League enables it, a document that a club uploads may be read by an AI service to pre-fill the identity of the player. The image is sent to OpenRouter, which routes it to Google Gemini, for this purpose only; we ask that it is not kept nor used to train models. The result is a proposal: the club checks it and nothing is validated automatically. When this reading is enabled, the parent is told so before signing. Readings are deleted after a few days if no file keeps them, and with the file at the end of the retention period.

8. Data Retention

  • Player files (identity, documents, photo, parental authorization, licence, history and requests): until one year after the end of the season, then deleted automatically. The season, its categories and competitions stay, without personal data.
  • Earlier deletion: at the request of a parent, the League may delete a file at once.
  • AI readings: a few days if no file keeps them.
  • Account data: while the account is active, then deleted or anonymized, except what the law obliges us to keep (billing).
  • Logs: a limited time, for security.

9. Security

We apply measures adapted to the risk: encrypted connections, restricted storage for documents, access by role and by League, hashed tokens for personal links, rate limiting, and logs of sensitive actions. In case of a breach affecting personal data, we notify the League without undue delay so that it can meet its own obligations.

10. Rights of Players and Parents

Players and parents may ask for access to, correction or deletion of the data in the file, and may object or withdraw consent, as the law of their country provides.

  • Parents who signed online use the personal link in the copy of the authorization they received: they ask for a correction or the deletion of their child’s file, and the League answers within one month.
  • Parents who gave a paper authorization, and players, contact their club or their league, which is the controller.
  • Anyone may also write to privacy@ligapass.app: we forward the request to the League concerned, which decides.

11. Children’s Data

Players may be minors. Their registration requires the authorization of a parent or guardian. We process their data only for the Service and the League’s purposes, never for advertising or profiling.

12. International Transfers

The Company is established in Canada and our sub-processors may process data outside the country of the League. Where data protection law requires it, we rely on appropriate safeguards.

13. Changes to This Policy

We may update this Policy. Material changes are notified at least thirty (30) days in advance by email or in the Service.

14. Contact and Supervisory Authorities

Questions and requests: privacy@ligapass.app or legal@ligapass.app, or by phone at +230 54 81 00 52. You may also lodge a complaint with the data protection authority of your country.

15. The ligapass.app website

For the LigaPass presentation website (ligapass.app), the Company is the controller.

15.1 Contact form

The form on the Contact page collects your name, organisation, role and email address and, if you provide them, your sport, country, a licence range and a message. This information is used only to answer your request, with your consent (checkbox). It reaches us by email through our email provider, Brevo (Sendinblue SAS, France). We keep it for three years after our last exchange.

15.2 Hosting

The website is hosted by Cloudflare, Inc. (United States), which serves it from its global network. Like any web server, it processes visitors' IP address and browser to deliver pages and protect the site.

15.3 Cookies and local storage

The website sets no cookies and does not measure its audience. When you arrive through a campaign link, its parameters (utm_…) are kept in the browser's session storage, cleared when the tab is closed, to be passed on to the sign-up page.

To exercise your rights over this data: privacy@ligapass.app.