Privacy Policy

# DVS Chess Privacy Policy Version 1.0. Effective date: 29 June 2026. ## Introduction DVS Chess provides structured chess learning, live classes, assignments, opening training, coach feedback, progress records, wallets, and guardian visibility. We process personal data lawfully, fairly, transparently, and only for defined chess learning, account, safeguarding, payment, support, and security purposes. ## Who we are DVS Chess is the platform operator for Dr Victor's School of Chess and related academy tenants. For privacy requests, guardians, students, coaches, and admins should use the Privacy Centre or contact platform support. ## Who this policy covers This policy covers adult students, junior learners under 18, parents and legal guardians, coaches, academy admins, platform admins, and visitors. ## Data we collect We may collect names, emails, account role, profile details, date of birth or age information where needed for junior classification, guardian-child relationships, coach/student relationships, class membership, attendance, chat or class participation messages, assignment attempts, puzzle moves, opening explorer progress, PGN/game records, coach feedback, ratings or learning metrics, payment references, wallet ledger records, and support/security logs. ## Junior and child data Children under 18 may not create their own DVS Chess account directly. A parent or legal guardian must create or authorise the junior account and consent to processing. Junior data is used for chess learning, class participation, coach feedback, safeguarding, progress reporting, payments connected to the learning service, support, and platform security. ## Payment and wallet data M-Pesa and wallet records are used for payment processing, receipts, reconciliation, fraud prevention, accounting, and customer support. We do not expose full phone numbers, Daraja secrets, passkeys, service keys, or raw credentials to browser users. ## Affiliate referrals and commission reconciliation If an affiliate referral code is used at signup, DVS Chess records the affiliate attribution, signup date, eligibility period, and commission ledger entries arising from eligible paid student subscriptions. DVS Chess performs the calculation centrally. The affiliate sees only masked referral references, eligible payment dates, gross eligible amounts, commission rates, commission amounts, reversals, and payout status. Affiliates do not receive a guardian's email, phone number, M-Pesa receipt, payment credentials, child identity, chess records, or other learner data. We process this limited information to perform the affiliate agreement, prevent fraud, reconcile payments, meet accounting and tax obligations, and resolve disputes. ## Live classes and communications Live class participation, chat, reactions, hand raises, voice status, attendance, puzzle attempts, questions, answers, and coach review records may be processed to run the class, support learning, resolve disputes, and protect juniors. ## Lawful basis and consent We rely on contract necessity for account and learning services, legitimate interests for security and service improvement, legal obligations for accounting and safeguarding, and consent where required, especially for child data processing, optional marketing, testimonials, and media/publicity use. ## Coach access Coaches may access learner data only for authorised coaching purposes, within their assigned workspace, class, or relationship. Coaches must keep learner data confidential and use approved channels. ## Sharing and processors We may use service providers for hosting, authentication, database, payment processing, email, analytics where enabled, and support. We share only the minimum necessary data and require suitable safeguards. ## International transfers Where service providers process data outside Kenya, DVS Chess will seek appropriate contractual, technical, and organisational safeguards. ## Security and retention We use role-based access, tenant/workspace scoping, audit logs, server-side authorization, and restricted direct database access. Records are retained only as long as needed for learning history, safeguarding, legal, accounting, audit, support, or dispute purposes. ## Rights and requests Users and guardians may request access, correction, restriction, withdrawal of optional consent, deletion review, or information about processing. Some records may be retained where required for legal, accounting, safeguarding, audit, or dispute reasons. ## Optional marketing and media Marketing, testimonials, public images, videos, achievements, and publicity use require separate opt-in consent. These are not bundled into mandatory service consent. ## Cookies Essential cookies and local storage support login, security, preferences, and core platform operation. Optional analytics or marketing cookies require separate notice and consent if enabled. ## Changes Material changes to this policy require a new version. Users may be asked to accept the updated version before continuing. This policy is a strong operational draft and should be reviewed by qualified Kenyan data-protection counsel before production legal reliance.