Privacy Notice

Last updated: 30 June 2026

This notice explains how Torq360 ("we", "us") handles personal data. Torq360 is software used by martial-arts clubs ("dojos") to run their membership, grading, attendance, communications and safeguarding records.

Two roles. For the data a dojo enters about its members (including children), the dojo is the data controller and Torq360 acts as its data processor — we process that data only on the dojo's instructions. For your dojo's own account, and for enquiries and survey responses submitted to us directly, Torq360 is the controller.

What we process

Depending on how the dojo uses Torq360, this can include: member names, dates of birth, contact details, guardian details, emergency contacts, grades and attendance, training and quiz activity, membership and licence/insurance details, and — where the dojo records it — safeguarding and medical information such as medical conditions, allergies, medications, first-aid and photo/media consent, authorised collectors, and staff background-check details (e.g. DBS).

Children's and special-category data

Many members are children, and medical and safeguarding information is "special-category" data under UK GDPR. We treat it accordingly: it is visible only to the dojo's own staff, never to other members. Photos are stored privately and are only displayed where photo/media consent has been recorded. Consent and medical details for an under-18 can only be set or changed by a parent/guardian or the dojo's staff, not by the child's own login.

Why we process it (lawful basis)

As processor, we act under the dojo's instructions and their lawful basis (typically the performance of the membership arrangement, the dojo's legitimate interests in running the club, legal/insurance obligations, and consent for photo/media use). For our own processing (your account, enquiries, surveys) our basis is legitimate interests and, where you provide it, consent.

Who we share it with

We do not sell personal data and do not use it to serve advertising. We use a small number of sub-processors to run the service: Supabase (database and authentication), Cloudflare (hosting and content delivery), Stripe (dojo subscription billing), Resend (transactional email), and AI providers used only when a dojo enables AI features (Cloudflare Workers AI and Anthropic). Each processes data on our instructions under their own data-protection terms.

International transfers

Some of these providers process data outside the UK/EU (for example in the United States). Where that happens, transfers are covered by appropriate safeguards such as the providers' standard contractual clauses.

How long we keep it

Member data is retained for as long as the member is active with the dojo and for a reasonable period afterwards, in line with the dojo's retention policy and any legal/insurance requirements. Medical and safeguarding fields for members who have left can be cleared by the dojo, and are not needed once the member is no longer training.

Your rights

You have the right to access your data, correct it, have it erased, restrict or object to processing, and receive a portable copy. Because the dojo is the controller for member data, requests about a member's data should be made to the dojo, which can export or erase that member's record directly within Torq360. For your dojo account or an enquiry/survey you sent us, contact us using the details below. You may also complain to the Information Commissioner's Office (ICO).

Security

Data is isolated per dojo using database row-level security, transmitted over encrypted connections, and member photos are held in private storage accessed only through short-lived signed links. Access to member data is limited to the dojo's own staff.

Contact

For any privacy question or to exercise your rights, contact us at privacy@torq360.com.