Atemi ("we", "us", "our") makes club management software for martial arts schools, gyms and studios. This policy covers our website at atemi.app, the Atemi platform (the admin console, the club websites and member portals we host, and our iOS and Android apps) and the emails and messages sent through it. It is written to meet the UK GDPR, the Data Protection Act 2018, the EU GDPR and the Privacy and Electronic Communications Regulations.

1. Our two roles

Where we are the controller. We decide how and why personal data is used for our own website, demo requests and sales enquiries, the accounts of clubs that buy Atemi and the people who manage them, billing clubs for Atemi, and keeping the platform secure.

Where the club is the controller. When a club runs its members on Atemi, the club decides what it collects about its members, prospects, parents and staff, and what it does with it. We process that data only on the club's instructions, as its processor, under the data processing terms in our Terms of Service.

2. If you are a member of a club

If you train at a club that uses Atemi, your club is responsible for your data: your membership, bookings, payments, health questionnaire answers and messages. Its own privacy notice explains how it uses them. Please send requests to see, correct or delete your data to your club first. If you contact us instead, we will pass your request to the club and help it respond.

Your sign in (email address, password and any two step verification you set up) is one Atemi login. If you belong to more than one club on Atemi you can use the same login at each, but each club only sees its own records about you.

3. What we collect as controller

Demo requests and enquiries. Your name, club name, email address, phone number, club size and anything you write in your message. We email it to our sales inbox, send you an acknowledgement, and add it to our own leads list so we can follow up.
Unfinished demo forms. Only if you allow Marketing in our cookie banner: once you have typed a valid email address into the demo form, we keep the email, name, club and phone you have entered so far, even if you do not press send. If you do not allow Marketing, nothing is kept until you send the form.
Club accounts. The names, email addresses and roles of the people who run a club's Atemi account, the club's billing contact, its plan and contract, and its invoices and payment status with us.
Sign in and security data. Email address or phone number, a scrambled (hashed) password, two step verification settings, the IP address and browser of each signed in session, the devices you sign in from (so we can alert you to a new one), and failed sign in attempts.
Audit and service logs. A record of changes made in the platform (who did what, when, from which IP address and browser), and technical request logs, which never contain passwords and mask access tokens that appear in web addresses.
Website analytics. Only if you allow Analytics: the pages you visit on atemi.app and the buttons you click, sent to Google Analytics.

4. What we process for clubs

Depending on the features a club uses, the platform holds on the club's behalf:

names, dates of birth, gender, contact details, postcodes and emergency contacts;
parent and guardian links for children, and children's records managed by their parent or guardian;
health questionnaire answers, health notes and body composition readings (weight, body fat and similar), which are special category health data;
memberships, bookings, class attendance, gradings and door check ins, including the QR code used to get in;
payments, invoices, orders and Direct Debit mandate references, with the bank name and last digits of an account but never full card numbers or full bank account numbers;
emails, texts and other messages, staff notes, and the club's marketing consent records;
signed documents and waivers, including the signer's name, signature and IP address;
photos, videos and files the club or its members upload.

Card and bank details are entered directly with the club's payment provider. We never see or store a full card number.

5. Why we use it and our legal bases

Answering enquiries and arranging demos: our legitimate interest in replying to people who contact us, and taking steps at your request before a contract.
Keeping unfinished demo forms and running analytics: your consent, which you can withdraw at any time through Cookie settings.
Providing the platform to clubs and billing them: performance of our contract with the club.
Processing member data: the club's instructions; the club chooses its own legal basis, including any condition it relies on for health data.
Security, fraud prevention, audit logs and service emails: our legitimate interest in keeping the platform and everyone's data safe.
Accounting and tax records: legal obligation.

We send product news to club contacts only where they have agreed to it or where the law allows it for an existing customer, and every marketing email has an unsubscribe link that works straight away.

6. Who we share it with

We do not sell personal data, and we do not use it to train artificial intelligence models. We share it only with the service providers that run the platform for us, each under a contract that requires it to protect the data and use it only for that service:

Railway: application hosting and the database.
Cloudflare: content delivery, domains, security and bot checks (Turnstile), email routing and file storage.
Resend: sending email.
Bird: sending text, WhatsApp, RCS and Apple Messages for Business messages, where a club uses them.
Stripe: billing clubs for Atemi, and card payments on a club's own Stripe account.
GoCardless: Direct Debit on a club's own GoCardless account.
Global Payments: in person card terminals, where a club uses them.
Google: Analytics (only with consent), Sign in with Google (only if you choose it), and address lookup and reviews through Google Places.
Loqate: address lookup on forms.

A club can also send its own form submissions to a web address it chooses, and embed YouTube or Vimeo videos on its pages; those transfers are the club's. We may disclose data where the law requires it, to protect people's safety, or to a buyer if our business is ever sold, in which case this policy would continue to apply.

7. International transfers

Some of these providers are based in, or reach data from, the United States and other countries outside the UK and the European Economic Area. Where they do, we rely on UK and EU adequacy regulations (including the UK and US data bridge where a provider is certified under it), or the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses.

8. How long we keep it

Enquiries and leads: for as long as we are in conversation and it is useful to follow up. You can ask us to delete them at any time.
Club account and billing records: for as long as the club is a customer, then invoices and payment records for six years to meet tax and accounting rules.
Failed sign in attempts on our API: seven days.
Club platform data: for as long as the club is a customer and as the club decides. When a club leaves, its site and data are taken offline but kept, so it can export them or come back. When the club asks us to delete them, we do so within 30 days, except records the law requires us to keep.
Member erasure: when a club erases a member, their name, contact details, health information, staff notes about them and their messages are removed or blanked. The club's payment, booking and attendance records stay, attached to an anonymous record instead of their name, because clubs must keep financial records for six years.

9. How we protect it

All traffic to atemi.app, club sites and our apps is encrypted in transit. Passwords are stored only as salted scrypt hashes, sign in sessions rotate their tokens and end if a token is reused, members can turn on two step verification from their account security page, and its secrets are encrypted at rest. Staff see only what their role allows, every change is recorded in an audit log, and sign in attempts are rate limited. No system is perfectly secure, but if a breach affects your data we will tell the club (and, where we are controller, you and the Information Commissioner's Office) without undue delay.

10. Cookies and browser storage

On atemi.app. We set no cookies of our own on the marketing pages. Your browser keeps two essential settings: your cookie choices (atemi.consent) and your light or dark theme (atemi-theme). Google Analytics runs, and sets its own cookies such as _ga, only if you allow Analytics. Marketing, if you allow it, lets us keep an unfinished demo form as described above. The banner offers Accept all, Reject non-essential and Choose, and you can change your mind at any time through the Cookie settings link at the bottom of every page.

When you sign in. We set an essential cookie that keeps you signed in and, when you choose a club, one that remembers your choice (atemi_club, kept for a year). These are needed for the service to work and do not require consent.

On club websites. Each club's site shows its own cookie banner. Analytics there runs only if you allow it, using the club's own Google Analytics account.

11. Your rights

You have the right to be told how your data is used, to get a copy of it, to have it corrected, to have it deleted, to restrict or object to how it is used, to take it to another provider in a portable format, and to withdraw consent at any time. To use any of these rights where we are controller, email us at the address below. We will reply within one month. For club data, contact your club; clubs can download a member's personal data file and erase a member directly in Atemi.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live. We would be grateful for the chance to put things right first.

12. Children

atemi.app is meant for adults running clubs and is not aimed at children. Clubs often hold records of children who train with them; those records are linked to and managed by a parent or guardian, and the club is responsible for them.

13. Changes to this policy

We will update this page when our practices or the law change, and change the date at the top. If a change materially affects how we use data, we will tell clubs by email before it takes effect.

14. Contact

Questions about this policy or your data? Email [email protected] and put "Privacy" in the subject.

Privacy Policy