Last updated: 2 October 2026
TKOLab is operated by TKO Software Ltd, a company registered in Cyprus under number [REG. NUMBER], with its registered office at [REGISTERED ADDRESS]. For any question about this policy or your personal data, contact us by email.
For student records inside an academy's account, the academy is the controller and we are its processor — it decides what to collect, we only act on its instructions. If you are a student or a parent and want records changed or deleted, contact your academy. We offer academies a Data Processing Agreement under Article 28 of the GDPR on request.
We are the controller for staff accounts and for people who contact us directly.
| Data | Purpose | Legal basis |
|---|---|---|
| Student name, email, address, phone numbers, date of birth, parent or guardian name | Running the academy's membership records | Contract |
| Emergency doctor name and phone number | So the academy can act in an emergency on the mats | Vital interests / contract |
| Belts, stripes and promotion dates | Grading history | Contract |
| Charges, payments, balances, expenses | Billing and accounting | Contract and legal obligation |
| SMS messages sent and when | Payment reminders and notices, on the academy's instructions | Contract |
| Staff email, encrypted password, role | Account access | Contract |
| Enquiry name, email, phone, message | Replying to you | Legitimate interests |
Academies commonly teach children, so these records often relate to minors. The academy is responsible for any consent required. We never use this data for marketing, profiling or automated decision-making.
Each receives only what it needs — an SMS provider gets a phone number and message text, not a student's grading history. We do not sell personal data or share it for advertising. Where a sub-processor transfers data outside the EEA, that transfer relies on the European Commission's Standard Contractual Clauses.
Student records are kept for as long as the academy's account remains open. We do not currently delete records automatically once an account closes — if you want data erased, contact us or your academy and we will action it. Financial records are retained as long as accounting and tax law requires. Login codes expire within minutes.
You can ask for access, correction, deletion, restriction or portability of your data, or object to its use. Email us; where we hold it for an academy we will pass your request on. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or the authority where you live.
Traffic is encrypted with TLS, passwords are stored hashed, and access is restricted by role. Student portal access uses short-lived one-time codes rather than passwords. We use only cookies needed to run the site and keep you signed in — no advertising or tracking cookies.
We will update the date above when this policy changes.