Under the Data Privacy Act of 2012 (RA 10173)
Data privacy policy & safeguards for minors
Last Updated: November 2, 2026 (version 2026-11-02) • Compliant with Republic Act No. 10173 (Philippine Data Privacy Act of 2012)
Because The Coliseums processes registrations for youth divisions, school leagues, and grassroots tournaments involving minors (individuals under 18 years of age), express parental or legal guardian consent is strictly mandatory prior to participation, bracket publication, or tournament check-in.
1. Statutory framework & scope
The Coliseums ("we", "us", "our") operates this tournament and venue management platform in strict accordance with Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations (IRR), and issuances by the National Privacy Commission (NPC) of the Philippines.
Anti-fraud measures and IP addresses
When you post a review or create a venue or tournament listing, we record a one-way salted hash of your IP address. We never store or display your actual IP address, and the hash cannot be turned back into it. The hash is used only internally by our platform administrators as one signal, among others, when reviewing a report or an unusual pattern (for example, several accounts reviewing the same venue from one network, or many listings created from one network in a short time). It is never used to remove content automatically; a person always makes the decision.
Sign-in sessions are different. While you are signed in, your session keeps the IP address and the browser you signed in from, so a sign-in you don’t recognise can be spotted and a stolen session ended. They are deleted within a day of the session ending (you sign out, or it expires), and at once when your account is deleted.
Cookies and website analytics
The site uses cookies it needs to work: to keep you signed in, to remember your theme and region, and to remember your cookie choice. These need no consent.
Only if you agree, the site also loads Google Tag Manager and Google Analytics. They set cookies in your browser and send Google which pages you visit, how you got here, your browser and device, and an approximate location worked out from your IP address. We use this only as counts and trends, not to identify you, and we don’t send Google your name, email or anything you enter in a form. Google processes it under its own privacy policy, and may do so outside the Philippines.
You are asked on your first visit, and analytics stays off until you say yes. You can change your answer at any time on Cookie preferences, linked at the bottom of every page. Saying no removes Google’s analytics cookies from this site. Your choice is kept in your browser for 6 months.
2. Protection of minors & parental consent
In compliance with Section 12 and Section 13 of the DPA:
- Guardian-held accounts: Competitors under 18 cannot hold their own account. They are added as a Player Profile under a parent's, legal guardian's or coach's account, and a parent or legal guardian gives consent before they compete (see Terms of Service §1).
- Emergency Contacts: Parental phone numbers and emergency contacts collected during registration are encrypted and strictly restricted to the Tournament Director and on-site medical staff.
- Names on Public Pages: On public brackets, rosters, court screens and rankings, an athlete under 18 appears by first name and last initial. Their full name is shown only to their own parent or guardian account and to that tournament’s organizers and staff.
- Media & Broadcast Opt-Out: Parents retain the legal right to request the withholding of minor full names on public streaming broadcasts or TV scoreboards (opting instead for anonymous gamer tags or seed identifiers).
3. Information we collect
Athlete & Profile Data
Gamer tag / Athlete handle, full legal name, date of birth (for division qualification), profile avatar, and skill rating.
Payment Proof & Receipts
Manual payment receipts (GCash/bank transfer slips), kept in private storage: S3-compatible object storage, or, where the site runs without it, a folder on the site’s own server. Either way they open only through links that expire.
Players booked at a venue’s desk
When a venue’s staff book a court for someone without an account, they type the player’s name and a contact. Only that venue’s team sees them. To have them erased, contact us at https://thecoliseums.com/contact; we confirm it is you and the venue, then remove them.
Role applications and Laya
When you apply to run a venue, organize tournaments or coach, our own decision service, Laya, checks the application and records the signals it used (such as whether a document was attached), linked to your application. A person decides every application. These decision records are kept for 12 months, then deleted. No outside AI service sees your data.
4. Purpose of data processing
Personal data is collected exclusively for fair, legitimate athletic and esports tournament operations:
- Validating age-bracket eligibility (e.g. U-14, U-18, Open divisions).
- Seeding match brackets and publishing live tournament progression.
- Sending critical transactional notices (check-in alerts, payment verification, match calls).
- Verifying buy-in payments and tournament prize pool disbursements.
5. Rights of the data subject under RA 10173
As a registered player or guardian in the Philippines, you are entitled to:
6. A copy of your data, and deleting your account
Both are on the Your data page in your account menu. Each asks you to confirm it is you first: with the code from your authenticator app if you use one, otherwise with your password or a code we email you.
Download my data
One file, readable in any text editor, with your account, athlete profiles (your children’s too) and the guardian consents you signed, your bookings, entries and results, your reviews, votes, messages and reports, your saved venues and notifications, your role applications and the venues, tournaments and coach page you run, your platform-fee balance and history, and a link to each file you uploaded. Links to private files work for 7 days. It holds no one else’s personal data beyond what you already see, such as the names in your own conversations. You can download a copy once an hour.
Delete my account
- First settle anything still open: an upcoming booking or tournament entry (yours or a child’s), a venue of yours with upcoming bookings, a tournament you run that isn’t over, or platform fees owed. The page lists each, with what to do.
- Then, at once: you are signed out everywhere and can’t sign in; your profile, athlete profiles and reviews stop showing; your venues, tournaments and coach page are hidden. We email you that it is done.
- For 30 days nothing is removed, and we can restore your account if you contact us at https://thecoliseums.com/contact.
- After 30 days your personal data is erased: your name, email, phone and photos, your sign-in details, your athlete profiles’ details (your children’s too), your notifications, saved venues, the messages you wrote, your reviews and votes, your role applications’ answers and documents, and the files you uploaded.
What stays, without your name or contact
Other people, and the law, rely on these records, so they stay with your name and contact removed:
- a venue’s record of your past bookings (the time, court, price and how it was paid), shown as “Former player”;
- tournament results and brackets, shown as “Former athlete”, and the record that a guardian’s consent was given, without the signer’s name or signature;
- platform-fee records, and our administrators’ audit log;
- reports you made, without the details you wrote, and the venue’s side of a conversation you had with it.
7. Data protection officer (DPO) inquiries
For inquiries, parental revocation of consent, restoring a deleted account, or anything the Your data page doesn’t cover, contact our designated Data Protection Officer: