Privacy Policy — Comp World

1. Introduction

This Privacy Policy explains how Comp World — a product operated by Nexus Solutions NZ Limited (NZBN 9429051283896) ("Comp World", "we", "our", "us") — collects, uses, shares, stores, and protects your personal information when you use our mobile app, our website (in each country where we publish it), and our host portal (together, the "Service").

Comp World is based in New Zealand and provides the Service in a number of countries. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles (IPPs), and, where they apply to you, with the privacy laws of the country you are in — including the Australian Privacy Act 1988 and its Australian Privacy Principles, the UK GDPR and Data Protection Act 2018, and applicable United States federal and state privacy laws. This list is illustrative, not exhaustive: as we make the Service available in further countries, the privacy law of each of those countries applies to people in it, and where it gives you a stronger right than this policy describes, that right prevails. This policy should be read together with our Terms of Service.

Hosts and Comp World are separate. When you enter a competition, the competition host (the organiser) also receives and controls your information for the purpose of running their event, and is independently responsible for handling it lawfully. This policy covers how Comp World handles your information; a host's own use of your information is their responsibility. A host's access to participant information through the Service is limited to the competitions they operate, is conditional on complying with our Terms of Service, and may be restricted, suspended, or withdrawn where we reasonably consider that necessary to protect participants.

We may also use personal information independently of any host where necessary to operate and protect the platform — for example for security, payment administration, dispute management, participant protection, and legal compliance (see section 4). If Comp World itself operates a replacement event (see section 5), Comp World is the event operator for that separate event and handles its entrants' information in that capacity; entrants will be given an event-specific privacy notice before any information is transferred to a replacement event.

2. Information We Collect

The personal information we collect depends on how you use the Service:

Account & profile information: name, email address, phone number, password (stored securely via our authentication provider), and the competitor or group/school profiles you create, including photos, date of birth, and school or studio affiliation.
Information about minors: where a competitor is under 18, we collect the minor's profile details (such as name, date of birth, school, and performance media) provided by a parent, guardian, or authorised adult. See Children's Privacy below.
Entry & performance content: the sections you enter, performance titles, partners and group members, backing-track audio, uploaded sheet music, and — where captured during an event — images, video, voice recordings, scores, placements, and judge written and audio feedback relating to a performance (including those of minors).
Payment information: entry-fee, optional-extra, and spectator-ticket payments are processed by our payment provider (Stripe). Card details are collected and handled directly by Stripe — we do not store full card numbers on our systems. We retain transaction records such as amounts, dates, billing details you provide for invoices/receipts, and payment status. Hosts also provide bank/payout details to Stripe to receive payouts.
Spectator ticket purchases: when you buy tickets to attend a competition, we collect your name, email address, and phone number, the tickets purchased, and the name of the person each ticket is for (which you provide, and which may be someone other than you). We generate an order number and issued tickets, and we keep a record of the purchase, including any discount code used and the payment status.
Information about people without a Comp World account: you do not need an account to buy spectator tickets or to be named on one. Where you use the Service without an account, this policy still applies to the information we hold about you, and the rights in section 12 are still available to you.
Records of your acceptance of our terms: when you accept our Terms of Service and this Privacy Policy — when signing in, or at checkout if you are buying without an account — we record which version you accepted, when, and the IP address it was accepted from. We keep this as evidence of agreement.
Door scanning volunteers: where a host invites you to scan tickets at their event, we collect your email address in order to send and manage that invitation, and we link it to your account if you accept.
Host & business information: for hosts, the competition details, branding, sponsors, and the business/contact and payout-onboarding information needed to publish competitions and receive funds. If we investigate a concern about a host or a competition, this can also include information the host or others provide in response to our requests (for example evidence that a venue is secured, that insurance is in place, or that refunds have been paid).
Complaints, disputes & compliance information: complaints and reports we receive about a competition, host, or user; refund and chargeback records; and our records of investigations, account restrictions, suspensions, and actions taken to protect participants (see section 5).
Location data: with your permission, approximate device location, used to show competitions nearest to you. You can turn this off in your device settings at any time.
Usage & device data: IP address, device model and operating system, app/browser type, unique device identifiers, push-notification tokens, pages or screens viewed, and timestamps.
Communications & form submissions: messages you send us (e.g. support requests), the contents of contact or data-deletion forms on our website, and notification preferences.

3. How We Collect It

Directly from you — when you create an account or profile, register for a competition, buy spectator tickets (with or without an account), upload content, make a payment, sign a waiver, or contact us.
Automatically — when you use the app or website (usage, device, and approximate-location data as described above).
From other users — for example, when a parent or group manager enters a minor or adds you as a partner or group member, when someone buys a spectator ticket and names you as the ticket holder, when a host invites you to scan tickets at their event, or when a host provides information about a competition you have entered.
From third parties — such as payment confirmations from Stripe and information from the Apple App Store or Google Play Store when you download the app.
From public sources — where we are assessing whether a competition will proceed or investigating a concern about a host, we may collect relevant publicly available information, such as public business registers (for example a national companies register) and a host's own public website or social-media pages. We only use information from public sources where it is relevant and reasonably necessary for that purpose.
From others involved in an event — where reasonably necessary to confirm the status of a competition or to administer a cancellation, refund process, or replacement event, we may collect information from venues, suppliers, judges, contractors, affected participants, or payment providers.

Where we collect a minor's information, we do so on the basis that a parent, guardian, or authorised adult has provided it and consented on the minor's behalf (see Terms of Service). Where we collect personal information from a source other than you, we will give any notice required by the privacy law that applies to you, unless an exception applies.

4. How We Use It

To provide the Service: create and manage accounts, process entries, run competitions, build and update live schedules, play music, capture scoring and judging, and release results and report sheets.
To process payments: take entry-fee, optional-extra, and spectator-ticket payments, issue invoices and receipts, and enable host payouts (via Stripe).
To issue and check tickets: create and deliver your tickets, let you retrieve them from the link we email you, and allow the host and the volunteers they authorise to check tickets at the door and prevent duplicate or invalid entry.
To communicate with you: send essential service messages, schedule and results notifications, host-to-competitor announcements, and respond to your enquiries.
To keep the Service secure: detect, prevent, and investigate fraud, abuse, spam, and unauthorised access (for example, our website forms and the spectator ticket purchase page use Cloudflare Turnstile to block automated spam).
To protect participants: monitor and investigate cancellation, refund, fraud, and event-abandonment risks; verify whether a competition is proceeding and whether refunds owed have been paid; enforce host obligations under our Terms of Service; restrict entries, payouts, or account access where necessary; communicate directly with affected entrants about the status of a competition; preserve evidence and competition records during a dispute or investigation; facilitate cancellations and refunds; and assess, offer, and administer a replacement event (see section 5).
To improve the Service: understand how features are used and fix problems.
For marketing (optional): tell you about events, features, and offers — only where permitted, and you can opt out at any time via the unsubscribe link or your settings.
To meet legal obligations: comply with applicable laws and respond to lawful requests.

Where the law of your country requires us to identify a legal basis for each use — as the UK GDPR does — we rely on: performance of a contract with you, for creating and running your account, processing entries and payments, issuing tickets, and delivering schedules and results; legitimate interests, for keeping the Service secure, preventing fraud and fee circumvention, investigating concerns about a competition, and improving the Service, where those interests are not overridden by your rights; legal obligation, for tax, accounting, and record-keeping and for responding to lawful requests; consent, for optional marketing, for a minor's information provided by a parent or guardian, and for transferring your entry to a replacement event, which you can withdraw at any time; and vital interests, in the rare case of a medical or safety incident at an event. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

5. Disrupted Competitions & Replacement Events

Occasionally a competition is cancelled, abandoned, or put at material risk by its host. If we reasonably believe that has happened, we may use the contact and entry information we already hold to:

Give you factual updates about the competition — for example that it is at risk, suspended, postponed, or cancelled, or that its host's account has been restricted;
Explain your refund options and help administer any refund process; and
Invite you to consider a replacement event — a separate event run by Comp World or by another operator we have approved.

Your entry is never transferred automatically. We will not move your entry information or uploaded content (such as backing tracks, sheet music, photos, or videos) to a replacement event or its operator just because one is offered. A transfer only happens if you — or, for a minor, their parent or guardian — expressly opt in, after being told who the replacement operator is, what information would be transferred, why it is needed, what terms apply, and who to contact about privacy. Only the information reasonably necessary for the replacement event is transferred, and you may instead be asked to re-confirm your details and re-upload content rather than have it transferred.

Declining a replacement event does not affect your access to your own records on the Service, and it does not waive any refund entitlement or legal claim you may have against the original host.

6. Cookies & Local Storage

We use only the cookies and local/on-device storage needed to operate the Service — for example, to keep you signed in, remember your preferences, and (in the on-the-day tools) store competition data on your device so it works even if venue internet drops. Our website forms use Cloudflare Turnstile, which may set a token in your browser to tell humans from bots. We may use analytics tools such as Google Analytics on our host portal to understand how it is used and to improve the experience; where we do, these may set cookies and collect usage data, and you can opt out using your browser's cookie controls or Google's opt-out browser add-on. We do not use third-party advertising or cross-site tracking cookies.

We do not sell your personal information. We share it only as needed to run the Service:

With competition hosts and other participants: when you enter a competition, the host receives the information needed to run it, and certain information (such as your name, entry number, performance details, and released results) may be visible to other participants and spectators — for example on schedules, stage displays, and the public live-schedule page.
With the host of a competition you buy tickets for: if you buy spectator tickets, that competition's host receives your name, email address, and phone number and the details of your order, so they can manage admission and contact you about the event. The name on each ticket is shown to the host and to the volunteers the host has authorised to scan tickets at the door, at the moment the ticket is scanned. Hosts may only use this information to run their competition, as set out in our Terms of Service.
With the host you are paying, where that host is the merchant of record: for most competitions your entry fee or ticket payment is made into the host's own Stripe account rather than to Comp World, and the host — not Comp World — is the merchant of record for that payment. Stripe processes it on that host's behalf as well as ours, and the host receives the payment and the billing details attached to it, including any billing name and address you give at checkout, so they can issue an invoice or receipt and deal with refunds, chargebacks, and disputes. The host must handle that information only to run their competition, as set out in our Terms of Service, and in line with the privacy law that applies to them.
With our service providers (sub-processors): trusted third parties who process information on our behalf, under contract, to deliver the Service:
- Stripe — payment processing and host payouts. Where the host is the merchant of record, Stripe also acts for that host, as described above.
- Amazon Web Services (AWS) — secure cloud hosting, databases, and file storage (audio, images, documents).
- Google Firebase — account authentication and push notifications (Firebase Cloud Messaging).
- Twilio SendGrid — transactional and notification emails.
- Google Maps Platform — location and mapping features.
- Cloudflare — bot/spam protection (Turnstile) on our website forms and the spectator ticket purchase page.
- Netlify — hosting of our marketing website.
With professional advisers: our legal, accounting, insurance, and security advisers, under confidentiality obligations, where reasonably necessary — for example in connection with a dispute, investigation, or privacy incident.
With others involved in an event: where reasonably necessary to confirm the status of a competition or to administer a cancellation, refund process, or replacement event, we may share limited information with venues, suppliers, judges, or contractors assisting us.
With a replacement event operator — only if you opt in: your entry information and uploaded content are only shared with a replacement event operator after the express agreement described in section 5. Having contractual continuity rights over a competition does not by itself entitle any operator to your information.
For legal reasons: where required by law or a valid request from an authority (including regulators and law-enforcement bodies), or to protect the rights, safety, or property of users, the public, or Comp World.
In a business transfer: if Comp World is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction (you will be notified of any material change).

In each case we share only what is reasonably necessary for the purpose, and we keep records of material disclosures.

8. Sending Information Overseas

Comp World is based in New Zealand, so if you are outside New Zealand your information will be transferred to and processed there. Some of our service providers store or process information in other countries again: our primary cloud storage (AWS) is located in Australia — the Asia Pacific (Sydney) region (ap-southeast-2) — and other providers, such as Stripe, Google/Firebase, SendGrid, and Cloudflare, may store or process information in the United States or elsewhere.

If you enter or buy tickets for a competition held in another country, the host of that competition — and the Stripe account that takes your payment — will usually be in that country, so the information described in clause 7 reaches them there.

Wherever your information goes, we take reasonable steps to ensure it is protected by safeguards comparable to those it has in your own country. Depending on where you are, those safeguards include the requirements of Information Privacy Principle 12 of the New Zealand Privacy Act 2020, Australian Privacy Principle 8, and — for transfers out of the United Kingdom — the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, or another transfer mechanism permitted by UK law. Where the law of your country requires a particular transfer mechanism, we use one that satisfies it.

9. Children's Privacy

Comp World is used to run dance, singing, music and drama competitions in which many competitors are children. We take the privacy of minors seriously.

Accounts must be created and managed by an adult. A minor's information (including name, date of birth, school, and performance media) should only be provided by a parent, guardian, or authorised adult, who consents on the minor's behalf to its collection and use as described in this policy.
Performance media (such as audio, images, or video) and results relating to a minor may be visible to the host, judges, and — where the host makes results or schedules public — to other participants and spectators, consistent with how live competitions operate.
Hosts are responsible for handling participants' personal information (including minors') lawfully and only for running their competition, as set out in our Terms of Service.
A minor's information and content (including entry details, photographs, audio, video, and sheet music) will never be transferred into a replacement event (see section 5) without the express agreement of their parent or guardian. Accepting this policy is not blanket consent for a minor's information to be given to any future event operator.
A parent or guardian may request access to, correction of, or deletion of a minor's information at any time (see Your Privacy Rights).
Where a spectator ticket is bought for a child, the name given for that ticket is shown to the host and to the volunteers the host has authorised to scan tickets at the door, so that the child can be admitted. Only the name is shown. If you would prefer not to give a child's name, you may use any name that identifies the ticket to you.

10. How We Store & Protect It

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, disclosure, or alteration. These include encryption of data in transit, storage with a reputable cloud provider (AWS), access controls and authentication, and delegating card payments to Stripe so we do not hold full card numbers. No system can be guaranteed completely secure; you are responsible for keeping your account credentials confidential and notifying us of any suspected unauthorised access.

A host's access to participant information is limited to the competitions that host operates. We may restrict, suspend, or withdraw a host's access to the Service — including participant information — where we reasonably consider that necessary to protect participants, for example during an investigation or where a competition is at risk (see section 5). Hosts must not share their account credentials and must tell us immediately about any suspected unauthorised access.

If we suspect a privacy breach, we will contain and investigate it, assess whether serious harm has occurred or is likely, notify affected people and the relevant supervisory authority within the time your country's law requires — for example the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner in Australia, or the Information Commissioner's Office in the United Kingdom, and the equivalent authority in any other country where we provide the Service — document our assessment and the remedial steps taken, and review the relevant controls. This can include suspending a compromised account's access and preserving relevant access records while we investigate.

11. How Long We Keep It

How long we keep personal information depends on what it is and why we hold it:

Competition history — entries, scores, placements, results, and report sheets — is kept for up to 10 years or longer while we have a lawful purpose to retain it: performers often compete for a decade or more and rely on the Service as a record of their performance history and progress.
Payment, tax, refund, and accounting records are kept for at least the periods required by law — generally seven years in New Zealand, and for whatever period the tax and accounting law of your own country requires where that is longer.
Spectator ticket orders and issued tickets — including the buyer's contact details, ticket holder names, and scan records — are kept for as long as needed to administer the event and any related refund, dispute, or chargeback, and thereafter as part of the payment and accounting records above (in New Zealand, generally seven years).
Backing tracks, sheet music, and other event media are kept for as long as needed for the relevant competition and any related dispute or recovery period.
Complaint, dispute, and compliance records (including records of investigations and participant-protection actions) are kept for as long as reasonably needed for risk management and legal claims, including any applicable limitation period.
Usage and device data is kept only as long as needed for security, troubleshooting, and service improvement.
Records connected to an active dispute, investigation, or legal obligation are kept until the matter and any applicable limitation period have ended.

We periodically review the information we hold and, consistent with Information Privacy Principle 9, delete or de-identify personal information when we no longer need it for a lawful purpose.

12. Your Privacy Rights

Wherever you are, and whatever privacy law applies to you, you have the right to:

Access the personal information we hold about you (IPP 6).
Request correction of information that is inaccurate, out of date, incomplete, or misleading (IPP 7). You can update much of your information directly in the app or host portal.
Opt out of marketing at any time via the unsubscribe link in emails or your notification settings.
Control location access through your device settings.
Additional rights, where the law of your country gives them to you — including the right to receive a copy of information you gave us in a portable, machine-readable form; to ask us to restrict how we use your information while a dispute about it is resolved; to object to processing we carry out on the basis of our legitimate interests; to withdraw a consent you previously gave; to ask us not to make a decision about you by automated means alone; and, in some United States jurisdictions, to opt out of the "sale" or "sharing" of your information and not to be treated less favourably for exercising a privacy right. We do not sell your personal information.
Request deletion of your personal information by submitting a request at our Request to Delete Data page or emailing us. We will verify your identity before acting on a request, and will then delete or de-identify your information except where we are required or permitted to retain it — for example competition history and legal, tax, or record-keeping records (see section 11).

If you do not have an account — for example, you bought spectator tickets as a guest, or someone named you as a ticket holder — you can still exercise every right above. Submit a request at our Request to Delete Data page or email us at support@compworld.co.nz from the email address used for the order, or quote your order number. We will verify your identity before acting on the request. As above, we may need to retain the underlying transaction record where the law requires it, in which case we will de-identify what we can rather than keep more than we need.

In connection with a replacement event (see section 5), you can also:

Decline, or withdraw your agreement to, a proposed transfer of your information at any time before it happens — declining does not affect your access to your own records or any claim against the original host;
Ask what information has been shared with a replacement event operator about you;
Request correction of your information before it is transferred; and
Raise a concern about a host's handling of your information with us — we can investigate and, where appropriate, restrict the host's access to the Service.

To exercise any of these rights, contact us using the details below. We may need to verify your identity, and we will respond within the timeframes required by the Privacy Act 2020.

13. Third-Party Links

The Service may link to third-party websites or services (for example, the App Store, Google Play, or a host's own site). We are not responsible for the privacy practices of those third parties — please review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website, update the "Effective" date above, and keep previous versions available with their effective dates. Where changes are material, we will take reasonable steps to notify you before they take effect, with a summary of what has changed. If we want to use personal information we already hold for a materially different purpose, we will give you notice and, where the law or the nature of the new use requires it, seek your express consent — continued use of the Service is not treated as consent to a materially new use. An update to this policy is never itself consent to transfer your information to a replacement event operator; that always requires the separate opt-in described in section 5.

15. Contact & Complaints

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your personal information, please contact us:

Nexus Solutions NZ Limited (Comp World)
14B Percy Road, Papamoa Beach, Bay of Plenty 3118, New Zealand
support@compworld.co.nz

If you are not satisfied with our response, you have the right to complain to the privacy regulator in your country. You can always complain to the regulator where we are based, and you can also complain to your own:

New Zealand — Office of the Privacy Commissioner, privacy.org.nz
Australia — Office of the Australian Information Commissioner, oaic.gov.au
United Kingdom — Information Commissioner's Office, ico.org.uk
United States — your State Attorney General, and the Federal Trade Commission at ftc.gov

If you are in a country not listed above, you may complain to that country's privacy or data-protection authority. You do not need to complain to us first, though it usually resolves matters faster.