Privacy Policy — Comp World

1. Introduction

This Privacy Policy explains how Comp World — a product operated by Nexus Solutions NZ Limited (NZBN 9429051283896) ("Comp World", "we", "our", "us") — collects, uses, shares, stores, and protects your personal information when you use our mobile app, our website at compworld.co.nz, and our host portal (together, the "Service").

Comp World is based in New Zealand. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles (IPPs). This policy should be read together with our Terms of Service.

Hosts and Comp World are separate. When you enter a competition, the competition host (the organiser) also receives and controls your information for the purpose of running their event, and is independently responsible for handling it lawfully. This policy covers how Comp World handles your information; a host's own use of your information is their responsibility. A host's access to participant information through the Service is limited to the competitions they operate, is conditional on complying with our Terms of Service, and may be restricted, suspended, or withdrawn where we reasonably consider that necessary to protect participants.

We may also use personal information independently of any host where necessary to operate and protect the platform — for example for security, payment administration, dispute management, participant protection, and legal compliance (see section 4). If Comp World itself operates a replacement event (see section 5), Comp World is the event operator for that separate event and handles its entrants' information in that capacity; entrants will be given an event-specific privacy notice before any information is transferred to a replacement event.

2. Information We Collect

The personal information we collect depends on how you use the Service:

Account & profile information: name, email address, phone number, password (stored securely via our authentication provider), and the competitor or group/school profiles you create, including photos, date of birth, and school or studio affiliation.
Information about minors: where a competitor is under 18, we collect the minor's profile details (such as name, date of birth, school, and performance media) provided by a parent, guardian, or authorised adult. See Children's Privacy below.
Entry & performance content: the sections you enter, performance titles, partners and group members, backing-track audio, uploaded sheet music, and — where captured during an event — images, video, voice recordings, scores, placements, and judge written and audio feedback relating to a performance (including those of minors).
Payment information: entry-fee and optional-extra payments are processed by our payment provider (Stripe). Card details are collected and handled directly by Stripe — we do not store full card numbers on our systems. We retain transaction records such as amounts, dates, billing details you provide for invoices/receipts, and payment status. Hosts also provide bank/payout details to Stripe to receive payouts.
Host & business information: for hosts, the competition details, branding, sponsors, and the business/contact and payout-onboarding information needed to publish competitions and receive funds. If we investigate a concern about a host or a competition, this can also include information the host or others provide in response to our requests (for example evidence that a venue is secured, that insurance is in place, or that refunds have been paid).
Complaints, disputes & compliance information: complaints and reports we receive about a competition, host, or user; refund and chargeback records; and our records of investigations, account restrictions, suspensions, and actions taken to protect participants (see section 5).
Location data: with your permission, approximate device location, used to show competitions nearest to you. You can turn this off in your device settings at any time.
Usage & device data: IP address, device model and operating system, app/browser type, unique device identifiers, push-notification tokens, pages or screens viewed, and timestamps.
Communications & form submissions: messages you send us (e.g. support requests), the contents of contact or data-deletion forms on our website, and notification preferences.

3. How We Collect It

Directly from you — when you create an account or profile, register for a competition, upload content, make a payment, sign a waiver, or contact us.
Automatically — when you use the app or website (usage, device, and approximate-location data as described above).
From other users — for example, when a parent or group manager enters a minor or adds you as a partner or group member, or when a host provides information about a competition you have entered.
From third parties — such as payment confirmations from Stripe and information from the Apple App Store or Google Play Store when you download the app.
From public sources — where we are assessing whether a competition will proceed or investigating a concern about a host, we may collect relevant publicly available information, such as public business registers (for example the New Zealand Companies Office) and a host's own public website or social-media pages. We only use information from public sources where it is relevant and reasonably necessary for that purpose.
From others involved in an event — where reasonably necessary to confirm the status of a competition or to administer a cancellation, refund process, or replacement event, we may collect information from venues, suppliers, judges, contractors, affected participants, or payment providers.

Where we collect a minor's information, we do so on the basis that a parent, guardian, or authorised adult has provided it and consented on the minor's behalf (see Terms of Service). Where we collect personal information from a source other than you, we will give any notice required by the Privacy Act 2020 unless an exception applies.

4. How We Use It

To provide the Service: create and manage accounts, process entries, run competitions, build and update live schedules, play music, capture scoring and judging, and release results and report sheets.
To process payments: take entry-fee and optional-extra payments, issue invoices and receipts, and enable host payouts (via Stripe).
To communicate with you: send essential service messages, schedule and results notifications, host-to-competitor announcements, and respond to your enquiries.
To keep the Service secure: detect, prevent, and investigate fraud, abuse, spam, and unauthorised access (for example, our website forms use Cloudflare Turnstile to block automated spam).
To protect participants: monitor and investigate cancellation, refund, fraud, and event-abandonment risks; verify whether a competition is proceeding and whether refunds owed have been paid; enforce host obligations under our Terms of Service; restrict entries, payouts, or account access where necessary; communicate directly with affected entrants about the status of a competition; preserve evidence and competition records during a dispute or investigation; facilitate cancellations and refunds; and assess, offer, and administer a replacement event (see section 5).
To improve the Service: understand how features are used and fix problems.
For marketing (optional): tell you about events, features, and offers — only where permitted, and you can opt out at any time via the unsubscribe link or your settings.
To meet legal obligations: comply with applicable laws and respond to lawful requests.

5. Disrupted Competitions & Replacement Events

Occasionally a competition is cancelled, abandoned, or put at material risk by its host. If we reasonably believe that has happened, we may use the contact and entry information we already hold to:

Give you factual updates about the competition — for example that it is at risk, suspended, postponed, or cancelled, or that its host's account has been restricted;
Explain your refund options and help administer any refund process; and
Invite you to consider a replacement event — a separate event run by Comp World or by another operator we have approved.

Your entry is never transferred automatically. We will not move your entry information or uploaded content (such as backing tracks, sheet music, photos, or videos) to a replacement event or its operator just because one is offered. A transfer only happens if you — or, for a minor, their parent or guardian — expressly opt in, after being told who the replacement operator is, what information would be transferred, why it is needed, what terms apply, and who to contact about privacy. Only the information reasonably necessary for the replacement event is transferred, and you may instead be asked to re-confirm your details and re-upload content rather than have it transferred.

Declining a replacement event does not affect your access to your own records on the Service, and it does not waive any refund entitlement or legal claim you may have against the original host.

6. Cookies & Local Storage

We use only the cookies and local/on-device storage needed to operate the Service — for example, to keep you signed in, remember your preferences, and (in the on-the-day tools) store competition data on your device so it works even if venue internet drops. Our website forms use Cloudflare Turnstile, which may set a token in your browser to tell humans from bots. We may use analytics tools such as Google Analytics on our host portal to understand how it is used and to improve the experience; where we do, these may set cookies and collect usage data, and you can opt out using your browser's cookie controls or Google's opt-out browser add-on. We do not use third-party advertising or cross-site tracking cookies.

We do not sell your personal information. We share it only as needed to run the Service:

With competition hosts and other participants: when you enter a competition, the host receives the information needed to run it, and certain information (such as your name, entry number, performance details, and released results) may be visible to other participants and spectators — for example on schedules, stage displays, and the public live-schedule page.
With our service providers (sub-processors): trusted third parties who process information on our behalf, under contract, to deliver the Service:
- Stripe — payment processing and host payouts.
- Amazon Web Services (AWS) — secure cloud hosting, databases, and file storage (audio, images, documents).
- Google Firebase — account authentication and push notifications (Firebase Cloud Messaging).
- Twilio SendGrid — transactional and notification emails.
- Google Maps Platform — location and mapping features.
- Cloudflare — bot/spam protection (Turnstile) on our website forms.
- Netlify — hosting of our marketing website.
With professional advisers: our legal, accounting, insurance, and security advisers, under confidentiality obligations, where reasonably necessary — for example in connection with a dispute, investigation, or privacy incident.
With others involved in an event: where reasonably necessary to confirm the status of a competition or to administer a cancellation, refund process, or replacement event, we may share limited information with venues, suppliers, judges, or contractors assisting us.
With a replacement event operator — only if you opt in: your entry information and uploaded content are only shared with a replacement event operator after the express agreement described in section 5. Having contractual continuity rights over a competition does not by itself entitle any operator to your information.
For legal reasons: where required by law or a valid request from an authority (including regulators and law-enforcement bodies), or to protect the rights, safety, or property of users, the public, or Comp World.
In a business transfer: if Comp World is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction (you will be notified of any material change).

In each case we share only what is reasonably necessary for the purpose, and we keep records of material disclosures.

8. Sending Information Overseas

Some of our service providers store or process information outside New Zealand. Our primary cloud storage (AWS) is located in Australia — the Asia Pacific (Sydney) region (ap-southeast-2). Other providers, such as Stripe, Google/Firebase, SendGrid, and Cloudflare, may store or process information in the United States or other countries. Where we disclose personal information to an overseas party, we take reasonable steps to ensure it is protected by comparable safeguards to those under the New Zealand Privacy Act 2020, as required by Information Privacy Principle 12.

9. Children's Privacy

Comp World is used to run dance, singing, music and drama competitions in which many competitors are children. We take the privacy of minors seriously.

Accounts must be created and managed by an adult. A minor's information (including name, date of birth, school, and performance media) should only be provided by a parent, guardian, or authorised adult, who consents on the minor's behalf to its collection and use as described in this policy.
Performance media (such as audio, images, or video) and results relating to a minor may be visible to the host, judges, and — where the host makes results or schedules public — to other participants and spectators, consistent with how live competitions operate.
Hosts are responsible for handling participants' personal information (including minors') lawfully and only for running their competition, as set out in our Terms of Service.
A minor's information and content (including entry details, photographs, audio, video, and sheet music) will never be transferred into a replacement event (see section 5) without the express agreement of their parent or guardian. Accepting this policy is not blanket consent for a minor's information to be given to any future event operator.
A parent or guardian may request access to, correction of, or deletion of a minor's information at any time (see Your Privacy Rights).

10. How We Store & Protect It

We take reasonable technical and organisational measures to protect personal information against loss, misuse, and unauthorised access, disclosure, or alteration. These include encryption of data in transit, storage with a reputable cloud provider (AWS), access controls and authentication, and delegating card payments to Stripe so we do not hold full card numbers. No system can be guaranteed completely secure; you are responsible for keeping your account credentials confidential and notifying us of any suspected unauthorised access.

A host's access to participant information is limited to the competitions that host operates. We may restrict, suspend, or withdraw a host's access to the Service — including participant information — where we reasonably consider that necessary to protect participants, for example during an investigation or where a competition is at risk (see section 5). Hosts must not share their account credentials and must tell us immediately about any suspected unauthorised access.

If we suspect a privacy breach, we will contain and investigate it, assess whether serious harm has occurred or is likely, notify affected people and the Office of the Privacy Commissioner where the Privacy Act 2020 requires it, document our assessment and the remedial steps taken, and review the relevant controls. This can include suspending a compromised account's access and preserving relevant access records while we investigate.

11. How Long We Keep It

How long we keep personal information depends on what it is and why we hold it:

Competition history — entries, scores, placements, results, and report sheets — is kept for up to 10 years or longer while we have a lawful purpose to retain it: performers often compete for a decade or more and rely on the Service as a record of their performance history and progress.
Payment, tax, refund, and accounting records are kept for at least the periods required by law (in New Zealand, generally seven years).
Backing tracks, sheet music, and other event media are kept for as long as needed for the relevant competition and any related dispute or recovery period.
Complaint, dispute, and compliance records (including records of investigations and participant-protection actions) are kept for as long as reasonably needed for risk management and legal claims, including any applicable limitation period.
Usage and device data is kept only as long as needed for security, troubleshooting, and service improvement.
Records connected to an active dispute, investigation, or legal obligation are kept until the matter and any applicable limitation period have ended.

We periodically review the information we hold and, consistent with Information Privacy Principle 9, delete or de-identify personal information when we no longer need it for a lawful purpose.

12. Your Privacy Rights

Under the New Zealand Privacy Act 2020 you have the right to:

Access the personal information we hold about you (IPP 6).
Request correction of information that is inaccurate, out of date, incomplete, or misleading (IPP 7). You can update much of your information directly in the app or host portal.
Opt out of marketing at any time via the unsubscribe link in emails or your notification settings.
Control location access through your device settings.
Request deletion of your personal information by submitting a request at compworld.co.nz/request-to-delete-data or emailing us. We will verify your identity before acting on a request, and will then delete or de-identify your information except where we are required or permitted to retain it — for example competition history and legal, tax, or record-keeping records (see section 11).

In connection with a replacement event (see section 5), you can also:

Decline, or withdraw your agreement to, a proposed transfer of your information at any time before it happens — declining does not affect your access to your own records or any claim against the original host;
Ask what information has been shared with a replacement event operator about you;
Request correction of your information before it is transferred; and
Raise a concern about a host's handling of your information with us — we can investigate and, where appropriate, restrict the host's access to the Service.

To exercise any of these rights, contact us using the details below. We may need to verify your identity, and we will respond within the timeframes required by the Privacy Act 2020.

13. Third-Party Links

The Service may link to third-party websites or services (for example, the App Store, Google Play, or a host's own site). We are not responsible for the privacy practices of those third parties — please review their privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website, update the "Effective" date above, and keep previous versions available with their effective dates. Where changes are material, we will take reasonable steps to notify you before they take effect, with a summary of what has changed. If we want to use personal information we already hold for a materially different purpose, we will give you notice and, where the law or the nature of the new use requires it, seek your express consent — continued use of the Service is not treated as consent to a materially new use. An update to this policy is never itself consent to transfer your information to a replacement event operator; that always requires the separate opt-in described in section 5.

15. Contact & Complaints

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your personal information, please contact us:

Nexus Solutions NZ Limited (Comp World)
14B Percy Road, Papamoa Beach, Bay of Plenty 3118, New Zealand
support@compworld.co.nz

If you are not satisfied with our response, you have the right to complain to the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz.