Privacy Policy

1. Who we are

Sport Portal is operated by Luck Dragon Pty Ltd (ABN 64 697 434 898), a company incorporated in Victoria, Australia. Our services include sportportal.com.au, schoolsportportal.com.au, and carnivaltiming.com (collectively, "Sport Portal" or "the Service").

We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Contact: info@sportportal.com.au

2. What information we collect

School and coordinator accounts

• First name and last name of the account holder
• School name, state, and region
• Work email address
• Role (school coordinator, district coordinator, etc.)

Student records (entered by school coordinators)

• First name and year group (e.g. "Year 5")
• House / team affiliation
• Event entries and results

We do not collect: birthdates, home addresses, parent/guardian details, health or medical information, photos, or any government identifiers (e.g. student IDs).

Usage and technical data

• IP address (retained for 30 days for security purposes only)
• Browser type and device type
• Pages visited and features used (aggregated, not linked to individuals)

Payment data

Payment processing is handled by Stripe, Inc. We do not store credit card numbers. Stripe's privacy policy applies to payment data: stripe.com/au/privacy.

3. How we use your information

• To operate and provide the Sport Portal service
• To manage your account and process payments
• To send transactional emails (event results, account notices) — no marketing without consent
• To generate carnival programs, draw sheets, and results reports for your school
• To improve and develop the Service using aggregated, de-identified analytics
• To meet our legal obligations

We do not use personal information for advertising, profiling, or automated decision-making that affects individuals.

4. Data storage and security

Data is stored in Google Firebase infrastructure located in Singapore (asia-southeast1) — the nearest Google Cloud region to Australia. We use Google Cloud Platform's security controls, including encryption in transit (TLS 1.2+) and encryption at rest. Migration to an Australian region is planned for 2027.

Access controls ensure that:

• School coordinators can only access their own school's data
• District coordinators can only access schools within their district
• Region coordinators can only access divisions within their region
• No cross-school data is visible to other schools

We conduct regular security reviews and maintain access logs. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

5. Who we share data with

We do not sell, rent, or trade personal information. We only share data with:

• Google LLC — cloud infrastructure (Firebase / GCP), subject to Google's Data Processing Addendum
• Stripe, Inc. — payment processing only
• Resend — transactional email delivery (school addresses only, no student data)
• Cloudflare, Inc. — CDN and DDoS protection (no personal data stored by Cloudflare beyond IP logs)

All sub-processors are required to handle data in accordance with applicable privacy laws. We do not engage sub-processors outside Australia, the United States, or the European Economic Area without appropriate safeguards.

6. Your rights under the Privacy Act

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or out-of-date information
• Request deletion of your account and associated data
• Complain about how we have handled your personal information

To exercise any of these rights, email info@sportportal.com.au. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7. Cookies and tracking

We use a small number of functional cookies required for login sessions. We do not use tracking cookies, advertising cookies, or third-party analytics that link to individual users.

You can disable cookies in your browser settings. Doing so may affect login functionality.

8. Children's privacy

Sport Portal collects limited information about students (first name and year group only) as entered by school staff. We do not collect information directly from students, and we do not allow students to create accounts. School coordinators are responsible for ensuring they have appropriate authorisation to enter student data in accordance with their school's privacy policy and any applicable state education department requirements.

9. Retention and deletion

We retain account data for as long as your account is active, plus a 90-day grace period after cancellation to allow for data recovery requests.

Student event records are retained for the duration of the school's active subscription and deleted within 90 days of account closure.

IP and security logs are retained for 30 days. Aggregated analytics (no personal data) may be retained indefinitely.

You may request immediate deletion at any time by emailing info@sportportal.com.au.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to account holders by email at least 14 days before they take effect. The current version will always be available at sportportal.com.au/privacy.