Your data, handled straight.

We only collect what an event needs to run. Depending on what you do on the site, that is:

• Payer and manager details — the name, mobile number and email address of the person making the entry, plus the club or team name for team entries.
• Player details — for each player on a roster: full name, IC number, jersey number, position and whether they are captain. Individual and doubles entries collect the player’s (and partner’s) name, IC number and, where the draw has age categories, date of birth.
• Transaction data — the event and category entered, the fee, the Billplz bill reference, the payment status and the time it was paid. Not your card or bank details (section 05).
• Consent — the time you confirmed the PDPA consent on the entry form, kept with the entry.
• Technical data — standard server logs (IP address, browser type, pages requested) kept by our hosting provider for security and to keep the site running. We do not build profiles from them.
• Organiser accounts — a username, a password hash and a record of which scores and corrections were published under that login.

The record carried over from the original tournamy.com website — past entries and their payer contact details — is held under this same policy.

• To process your entry, take the fee and hold your place in the draw.
• To verify age categories. Under-12 and similar divisions only work if dates of birth can be checked.
• To produce entry lists, team sheets and match cards for the organiser’s officials at the table.
• To publish schedules, brackets, results and standings so players and families can follow the event.
• To contact you about your entry and your event: a roster query, a fixture change, a weather call.
• To reconcile payments with Billplz and arrange a refund if an event is cancelled or moved.
• To record and resolve incidents, disputes and protests fairly.
• To keep the site and the organiser console secure, and to comply with the law.

We do not sell personal data and we do not use entry details for advertising. The platform sends no marketing email; new events are announced on the site. If that ever changes, you will be asked first and every message will carry a one-click opt-out.

Most rosters include people who did not fill in the form themselves, and many include children. The person submitting the entry must be an adult who has permission to share those details — a team manager, coach, teacher, parent or guardian. We do not knowingly accept entries submitted by a child.

Why we ask for IC numbers

The IC number is the only reliable way to settle age and identity at a Malaysian tournament. It is used for age-category checks (an overage protest is the most common dispute at district level, and the IC settles it at the table in minutes), for identity spot-checks against the team sheet, and where a sanctioning body or insurer requires a named participant list. IC numbers are shared only with the event’s organiser through the entry list, are never shown on the public site, and are never used for anything else.

Where an organiser collects copies of ICs or MyKid cards for verification (for example through a registration form), those images are stored separately from the public website, are viewable only by that event’s organiser through a password-protected console, are never published, and are deleted once the event’s verification purpose has passed. Ask the organiser or us to remove a stored copy at any time.

What is public is the sporting record: team names, player names as they appear on team sheets, jersey numbers, results and standings. If a parent or guardian would prefer a child’s name not to appear in published results, tell the organiser or us before the event and it will be listed by jersey number.

We share personal data only with the parties needed to run your event:

• The event’s organiser receives the entry list for their event — payer and manager contact details and the full roster, including IC numbers — as an export from the organiser console. They use it to run the competition: team sheets, eligibility checks, fixture calls. Organisers agree to use it for that event only.
• Billplz, our payment provider, receives the payer’s name, email and mobile number and the amount, so it can present the payment page and send the receipt (section 05).
• Our hosting provider (Cloudflare) stores the site’s data and logs on our behalf under its own security commitments.
• Authorities, where the law requires it — a lawful request from a regulator, court or the police.

Nobody else. We do not pass entry data to sponsors, other organisers or marketing lists. Links to third-party websites (an organiser’s own page, a venue) take you to sites we do not control; their privacy practices are their own.

Entry fees are paid through Billplz, the Malaysian payment gateway, offering FPX online banking, cards and e-wallets. The payment page is Billplz’s: your bank login, card number and e-wallet details are entered there and never reach Tournamy. What we receive back is the bill reference, whether it was paid, when, and the amount — verified server-to-server before an entry is marked paid. Billplz’s handling of your payment details is covered by its own privacy policy.

The public site sets no advertising or analytics cookies and runs no third-party trackers. Your theme choice is saved on your device. Team registration drafts can be restored for up to 24 hours and are cleared after submission; use “Clear saved draft” on a shared device. IC numbers and images are not included in saved drafts. A private entry cookie lets you return from payment and lasts up to 30 days. Keep private checkout links to yourself: anyone holding one can access that entry. Organiser session cookies keep authorised staff signed in; signing out or changing their password revokes access. You can clear stored data through your browser settings. Payment return pages require cookies or your private entry link.

Under the Personal Data Protection Act 2010 you can:

• Ask what we hold about you, and receive a copy of it.
• Correct anything wrong: a misspelled name on a team sheet, a wrong jersey number, an out-of-date mobile number.
• Withdraw consent for any processing that is not needed to complete an event you have already entered.
• Ask us to delete data we no longer have a reason to keep (section 08).
• Complain to us, and to the Personal Data Protection Commissioner if our answer does not satisfy you.

Email info@tournamy.com with your entry reference. We may ask you to confirm who you are before we act, and we answer within a reasonable time — usually a few working days, and faster on a match weekend.

• The sporting record — team names, player names on team sheets, results, standings and champions — is kept permanently as the archive of the competition. That is the point of a record book.
• Entry details and IC numbers are kept as the event’s record for as long as the organiser may need to answer a query, dispute or audit about that event, and for our own payment records. Ask us after the event and any protest window have closed and we will remove personal details the organiser no longer needs.
• Unpaid entries expire after 48 hours and their details are not used for anything further.
• Payment records — the Billplz reference, amount and status — are kept for the period Malaysian accounting and tax rules require.
• Server logs are kept by our hosting provider for a short rolling period and then discarded.

Security

The site is served over HTTPS only. Data is stored with our hosting provider, organiser passwords are stored as salted hashes, and the organiser console is limited to named logins for each event’s technical team. No method of transmission or storage is completely secure, so we cannot promise absolute security — but we keep the amount of data held to the minimum an event needs.

Questions about this policy or how we handle your information: email info@tournamy.com, call or WhatsApp 017-975 4073, or write to Tournamy, Seremban 2, 70300 Seremban, Negeri Sembilan.

Changes to this policy

We update this page when the way we handle data changes. The version and dates at the top move when we do. Significant changes are noted on the site; we encourage you to look this page over from time to time.