Last updated: August 25, 2026

This policy explains what Path2Membership does with personal information, and what you can ask us to do about it.

1. Who is responsible

Your federation decides what is collected about you and why. In data protection terms it is the controller. Path2Membership operates the software and acts on its instructions — a processor.

In practice: ask your federation to correct a rank, change a club, delete a record, or stop emailing you. Ask us about the software, security, or if your federation will not respond.

We do not decide what your federation does with its members' information, and we do not send marketing of our own. Where a federation uses its own tools or its own staff to contact you, those are its decisions and its responsibility.

2. What is collected

• About members: name, date of birth, gender, contact details, address, club, rank and grading history, attendance, certifications and their expiry, membership and payment history.
• About guardians: name and contact details, the relationship to the child, and the record of consent given.
• Sensitive information, only where your federation asks for it: medical notes such as an allergy or an epi-pen, background-check and safeguarding status, and demographic information for equality reporting. These are visible only to people whose role requires them.
• Payment information: handled by Stripe. We store the amount, the date and the last four digits — never the full card number.
• Technical information: your IP address and browser type in server logs, kept for security and troubleshooting.

3. Why, and on what basis

• To run your membership — registration, grading, rosters, cards, invoices. Necessary to perform the agreement between you and your federation.
• Safeguarding and compliance — background checks, certification expiry, incident records. A legal obligation, or the legitimate interest of protecting children.
• Communication — about your membership, gradings and events, sent by your federation.
• Medical and demographic information — explicit consent, or the vital interests of the person, in the case of an emergency.

We do not sell personal information. We do not use it for advertising. We do not use it to train machine learning models.

4. Who it is shared with

• Within your federation — your instructor, your club's administrator and federation staff, each seeing only what their role allows.
• Other federations you join — only what you choose to share when you join them.
• Service providers — Stripe for payments, Brevo for email, CDYNE for text messages, and our hosting provider. Each is bound to use the information only to provide that service.
• Mobile numbers and text messages. Mobile information will not be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. Your number goes only to the carrier that delivers our messages to you. See the SMS Terms.
• Your federation's own tools. A federation may connect its own email or marketing account and export its members' email addresses into it (never mobile numbers or text-message consent). When it does, that information is in the federation's system, under the federation's control, and its own privacy notice and marketing choices apply. Ask your federation what it uses and how to opt out of its mailings; every marketing email it sends should carry an unsubscribe link.
• Publicly, only where you or your club chose it — a club that opts into the public directory appears there, and only the fields it ticked.
• Where the law requires it.

5. How long it is kept

Membership and grading records are kept for as long as your federation needs them — a rank certificate is a lifelong record and federations generally keep them permanently. Payment records are kept for the period tax law requires. Server logs are kept for a short period for security. Your federation sets its own retention periods and can tell you what they are.

6. Your rights

Depending on where you live you may have the right to:

• see a copy of your information, and get it in a portable format;
• have inaccurate information corrected;
• have information erased, where there is no overriding reason to keep it;
• restrict or object to certain processing;
• withdraw consent at any time, where consent is the basis;
• not be subject to a decision made solely by automated means. We do not make any.

Ask your federation first, or write to privacy@path2membership.com and we will route it. There is no charge, and we aim to answer within one month.

If you are in the EU or UK and are not satisfied, you may complain to your national data protection authority.

7. Children

This platform holds information about children by design. An account for a child under 18 is created and managed by a parent or guardian, who gives consent on the child's behalf. A child under 18 does not sign in. A guardian may see, correct or ask for the deletion of their child's information at any time.

8. Security

Passwords are hashed and never stored in a readable form. Two-factor authentication is available. Access is limited by role, so people see only what their job requires. Traffic is encrypted in transit. No system is perfectly secure, and we do not claim otherwise — but if a breach affects you, we will tell you and your federation.

9. Where information is held

Our servers are in the United States. If you are in the EU or UK, your information is transferred there and protected by the appropriate safeguards for that transfer.

10. Changes

We will post any change here and update the date at the top. If a change materially affects you, we will tell account holders by email rather than relying on you noticing.

11. Contact

privacy@path2membership.com