Privacy policy — DojoMasterPro

DojoMasterPro is a management solution developed and operated by Codamis Inc., a Canadian company based in Québec, designed specifically for martial arts schools.

The protection of personal information is an integral part of how our platform is designed. This policy explains what personal information may be collected or processed, why it is used, with whom it may be shared, where it may be processed, how long it is kept, and what the rights of the people concerned are.

It applies to the website dojomasterpro.ca, to the application app.dojomasterpro.ca and to related services provided by Codamis Inc.

DojoMasterPro is intended for martial arts schools across Canada. Codamis Inc. applies the Canadian privacy laws that apply to it depending on the circumstances, including the laws of Québec, Alberta and British Columbia, as well as the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

1. Person in charge of the protection of personal information

The role of person in charge of the protection of personal information is held by the President of Codamis Inc.

For any question, complaint or request about your personal information, use our personal information protection form, available from the Contact page of DojoMasterPro.

Person in charge of the protection of personal information: President of Codamis Inc., 6300 avenue Auteuil, Suite 505-176, Brossard, Quebec J4Z 3P2.

Access and correction requests are handled within the time limits set by the applicable legislation.

2. Two roles, depending on the information concerned

It is important to distinguish the information Codamis Inc. collects for its own activities from the information a school entrusts to DojoMasterPro.

Information collected directly by Codamis Inc.

When you visit our site, request a demo, create an account, communicate with us or subscribe to DojoMasterPro, Codamis Inc. determines the purposes for which certain personal information is collected and used. Codamis Inc. is responsible for that information.

Information administered by a school

When a school uses DojoMasterPro to manage its members, families, employees, instructors or other people, the school remains responsible for the records it builds and the information it collects.

DojoMasterPro then acts as a service provider. Codamis Inc. hosts and processes that information to provide the service to the school, in accordance with the school's instructions and settings.

If you are a member, or the parent or guardian of a member, of a school using DojoMasterPro, a request about your record should normally be addressed to that school first. Codamis Inc. works with the school when its technical intervention is needed.

3. Information we may process

DojoMasterPro website

When you use the public site, we may collect, among other things:

your name;
the name of your school or organization;
your contact details;
the information provided in a form;
the content of your requests;
certain technical information needed for the security and operation of the site.

DojoMasterPro accounts

For the managers, employees and instructors authorized by a school, we may process, among other things:

first and last name;
sign-in address;
language;
role and permissions;
authentication information;
technical information about sign-ins and security.

Passwords are protected with a cryptographic hashing mechanism and are never stored in clear text.

Member portal

Depending on the features enabled by the school, a parent or guardian may have an account allowing them to view registrations, documents, payments, receipts, communications or information about the members of their family.

Information entrusted by schools

Depending on the features used, a school may manage in DojoMasterPro, among other things:

identity and contact details;
date of birth;
parents, guardians and responsible persons;
emergency contacts;
relevant medical information;
classes and registrations;
attendance, including the technical identifier of an access badge when the school uses that feature;
progression;
grades and belts;
exams and promotions;
events: competitions, camps, tournaments, galas;
consents and authorizations;
documents;
invoices;
payments;
credits and refunds;
receipts;
communications.

The school determines which information is necessary for its activities and remains responsible for meeting the legal requirements that apply to its collection and use.

4. Information about minors

DojoMasterPro is designed for organizations that may manage a large number of children and teenagers.

The rules on consent for minors may vary by province, by the nature of the information and by the reason it is collected or used.

DojoMasterPro therefore allows schools to record, among other things:

the parent or guardian;
the responsible person;
the person who gave a consent;
the date of the consent;
the type of consent;
the version of the text accepted;
the source of the consent (online, signed document, collected in person) and, for a consent given online, the IP address and browser used;
the withdrawal or modification of a consent.

Specific rule in Québec

In Québec, when a consent covered by privacy legislation is required, specific rules apply to minors under 14.

From age 14, certain consents relating to personal information may be given by the minor themselves, by the holder of parental authority or by the guardian.

This rule concerns the protection of personal information and does not mean that a 14-year-old is considered an adult for contracts, payments or other legal commitments. Contractual and financial rules are handled separately by DojoMasterPro.

5. Purposes for which information is used

Information may be used, among other things, to:

provide the DojoMasterPro service;
create and secure accounts;
manage members and families;
manage classes and registrations;
record attendance;
track progression;
administer exams and promotions;
manage activities and events;
produce invoices and receipts;
manage payments;
record consents;
send communications;
provide support;
prevent unauthorized access;
detect and analyze security incidents;
meet legal obligations;
respond to requests received through the site and present DojoMasterPro to schools that ask for it;
maintain and improve the technical operation of the service.

Codamis Inc. does not sell the personal information of users, members or families to advertisers.

6. Technical and audit logs

DojoMasterPro may keep certain technical or administrative traces, including:

date and time;
user;
type of operation;
modification of a record;
certain technical sign-in information;
security events;
acceptance or withdrawal of a consent.

This information serves to protect the platform, detect abnormal activity, diagnose problems and ensure the traceability of certain sensitive operations.

In each school, an activity history records who viewed or changed a record, and who deleted or exported information, with the date, the time and the IP address of the device used. Only the people the school authorizes can consult it, and no one can modify it. Each entry is kept for two years from its date, then deleted automatically.

7. Data hosting

Codamis Inc. favours Canadian infrastructure for DojoMasterPro.

Production application data, the database, documents and backups are hosted in a data centre located in Québec, Canada.

Some DojoMasterPro features nevertheless rely on specialized providers that may process certain information outside Québec or outside Canada.

Codamis Inc. assesses transfers of personal information outside Québec where the law requires it and puts in place appropriate contractual, organizational and technical measures.

8. Service providers

Codamis Inc. neither sells nor rents personal information.

Codamis Inc. relies on specialized providers to operate DojoMasterPro, in particular for cloud hosting, email delivery, payment processing, security, domain names and support communications.

The contact form and school sign-up use an anti-bot verification service. It examines technical information, such as the IP address and certain browser characteristics, only to tell a person from a robot, with no advertising or profiling.

These providers receive only the information needed to deliver their services and are bound by the applicable contractual and protection measures. Some may process information outside Quebec or Canada. Where the law requires it, Codamis Inc. assesses these transfers before sharing personal information with them.

9. Electronic communications

DojoMasterPro may send communications necessary to the operation of the service, for example:

account confirmation;
password reset;
security notices;
invoices;
receipts;
confirmations;
administrative reminders.

When the feature is enabled, DojoMasterPro may receive technical information indicating that an email was sent, delivered, opened, or that a link was clicked. An open detection is not necessarily proof that the person actually read the message.

So that the school can review what a person received, a copy of the emails sent from DojoMasterPro is kept, with links disabled: 12 months for announcements and newsletters, 30 days for invoices, reminders, receipts and statements. It is then deleted automatically, or sooner when the person's information is removed. Messages that Codamis Inc. sends to school directors — account notices, news and offers — are kept the same way, for 12 months. Account-related emails, such as password resets, and automatic product notices are not kept.

Commercial and promotional communications are handled separately from communications necessary to the service and are subject to the applicable Canadian rules, in particular on consent and unsubscribing.

A school that uses DojoMasterPro's communication features remains responsible for the content and recipients of its own communications.

10. Payments

When electronic payments are enabled, they are processed by the chosen payment provider. DojoMasterPro is designed not to keep full credit or debit card numbers or security codes.

The system may however keep information needed to administer the payment, such as:

provider used;
transaction identifier;
amount;
currency;
status;
date;
associated invoice;
refund or cancellation.

Each school remains the merchant responsible for the payments it collects from its own members, unless otherwise stated in a specific agreement.

11. Retention of information

Codamis Inc. keeps information only for as long as necessary for the purposes for which it is processed, or for as long as the law requires.

Requests from the site

Information from a contact request may be kept for as long as needed to handle and follow up on the request, then for a reasonable period.

Accounts on trial

At the end of a trial period, the school has 10 days to activate a subscription or request a copy of its data. After that period expires, active data may be deleted in accordance with the notices sent to the school. Some copies may remain temporarily in backups until the normal end of the backup cycle.

End of a subscription

After a subscription ends, data may be kept for 90 days to allow the school to retrieve it or reactivate its account. It is then deleted from active systems, subject to:

legal obligations;
information that must be kept longer;
the normal backup deletion cycle.

Member records

The school remains responsible for setting the retention periods that apply to its members' records. DojoMasterPro may provide default values and tools allowing the school to manage retention and deletion.

Accounting records of Codamis Inc.

Financial documents and supporting records concerning the activities of Codamis Inc. itself are kept for the period required by the applicable tax laws.

Accounting records of schools

Invoices and payments concerning a school's members are processed on behalf of that school and are subject to its own retention obligations.

12. Security

Codamis Inc. applies administrative, technical and organizational measures intended to protect personal information according to its sensitivity, among other factors. These measures may include:

communications encrypted with HTTPS;
encryption provided by the hosting infrastructure;
cryptographic hashing of passwords;
role-based access controls;
the principle of least privilege;
logical isolation between schools;
logging of certain sensitive operations;
backup mechanisms;
separate management of secrets and technical keys;
monitoring and analysis of security events;
measures intended to limit access to sensitive information.

No computer system can, however, guarantee the total absence of risk.

13. Cookies and similar technologies

DojoMasterPro uses the cookies or storage technologies strictly necessary to the operation of the application, in particular for:

authentication;
security;
keeping a session;
certain preferences such as language or theme.

DojoMasterPro does not use advertising or profiling cookies, unless such a feature is explicitly added later. If technologies requiring consent are added, the required information and consent mechanisms will be put in place before they are activated.

14. Rights of individuals

The applicable rights may vary by province or applicable legislation. Depending on the circumstances, a person may have the right, among other things:

to know what information is held about them;
to access it;
to request its correction;
to withdraw certain consents;
to know about certain uses or disclosures;
to file a complaint;
to request a copy of certain information in an appropriate technological format where the law provides for it;
to exercise any other right provided by the applicable legislation.

To exercise a right concerning information held directly by Codamis Inc., use the personal information protection form available on our site.

For information contained in the record of a member of a client school, the request must normally be addressed first to the school concerned. DojoMasterPro works with the school when its technical intervention is needed.

15. Complaints to privacy authorities

A person may also contact the competent privacy authority. Depending on the situation, this may include:

the Commission d'accès à l'information du Québec;
the Office of the Information and Privacy Commissioner of Alberta;
the Office of the Information and Privacy Commissioner for British Columbia;
the Office of the Privacy Commissioner of Canada;
or another competent provincial or territorial authority.

16. Privacy incidents

Codamis Inc. maintains procedures intended to detect, analyze, document and manage privacy incidents.

When Codamis Inc. is responsible for the information affected, we take appropriate measures to reduce the risks and apply the reporting and notification obligations provided by law.

When DojoMasterPro processes information on behalf of a school, Codamis Inc. informs the school concerned in accordance with its obligations and works with it so that it can fulfil its own responsibilities.

17. Transfers outside the province or Canada

Some technology providers may process information in other Canadian provinces or outside Canada.

Codamis Inc. assesses these situations according to the applicable legislation, the nature of the information, its sensitivity, the reasons for the transfer and the protection measures offered.

Where Québec legislation requires it, a privacy impact assessment is carried out before personal information is communicated outside Québec. Contracts with the providers concerned must provide for appropriate protection measures.

18. Changes to the policy

Codamis Inc. may amend this policy to reflect the evolution of DojoMasterPro, changes to our providers, the evolution of our practices or legislative changes.

The date of the last update appears at the top of the policy. When an important change affects the way personal information is processed, the people or organizations concerned are informed appropriately.

The French version of this policy prevails, subject to the rights provided by the applicable legislation.

19. Contact us

Codamis Inc.
6300 avenue Auteuil, Suite 505-176
Brossard, Quebec J4Z 3P2
DojoMasterPro, a solution developed and operated by Codamis Inc.

Person in charge of the protection of personal information: President of Codamis Inc.

To reach the person in charge, use our personal information protection form: Contact → Personal information protection.