Privacy Policy

VF CUP International Mental Arithmetic Olympiad

Effective Date: 1 October 2026

This Privacy Policy (“Privacy Policy”, “Policy”) explains what personal data is collected and processed in connection with the website and online platform of the VF CUP International Mental Arithmetic Olympiad (“VF CUP”, “Olympiad”), the purposes for which such data is used, the parties with whom it may be shared, and the rights available to users and participants.

The data controller is:

VF Private Education LTD
Company Registration No.: HE 385788
Registered office: Marathonos 3, MALI HOUSE, 8011 Paphos, Cyprus
Email: vfcup.helpdesk@gmail.com
Website: https://the-olympic.world/

hereinafter referred to as “VF”, the “Organiser”, “we”, “us” or “our”.

1. Scope

1.1. This Policy applies to personal data processed in connection with:

• visiting the VF CUP website;
• participant registration;
• creation and use of a user account;
• purchase of tickets;
• use of invitation codes;
• participation in the Olympiad;
• completion of training and competition tasks;
• creation of rankings;
• anti-fraud review;
• issuance of certificates and diplomas;
• determination and payment of prizes;
• communications with technical support;
• other interactions with VF CUP.

1.2. This Policy applies to adult participants, parents, legal representatives and minor participants.

1.3. Additional rules relating specifically to children’s personal data are set out in the Children & Parental Consent Policy.

2. Data Protection Principles

2.1. We process personal data in accordance with applicable data protection law, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).

2.2. We seek to comply with the principles of:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

2.3. We do not seek to collect personal data that is not reasonably necessary for conducting the Olympiad, providing the service, maintaining security, performing contractual obligations or complying with applicable law.

2.4. Personal data relating to children requires a particularly high level of protection.

3. Personal Data We May Collect

Depending on how VF CUP is used, we may process the following categories of personal data.

3.1. Participant Data

This may include:

• first name;
• surname;
• country;
• date of birth or age, where required for a particular function;
• school or educational centre;
• teacher or educational centre, where provided;
• selected Olympiad level;
• language;
• participation results;
• points earned;
• ranking position;
• certificates, diplomas and awards.

3.2. Parent or Legal Representative Data

Where the participant is a minor, we may process:

• first name and surname of the parent or legal representative;
• email address;
• contact information;
• records of parental confirmation or consent;
• registration and payment information;
• communications with support;
• information required for payment of a child’s prize.

3.3. Adult Participant Data

Where the participant is an adult, the participant may provide:

• first name and surname;
• email address;
• country;
• registration information;
• payment-related information;
• information required to receive a prize.

4. Payment Data

4.1. When a ticket is purchased, we may process:

• payment amount;
• currency;
• date and time of payment;
• transaction identifier;
• payment status;
• payment method used;
• payer’s name;
• information required for a refund or payment verification.

4.2. Payments may be processed by independent payment providers, including, depending on availability:

• Stripe;
• Revolut;
• banks;
• other licensed payment institutions.

4.3. Where payment is processed by an external payment provider, VF Private Education LTD generally does not receive or store the full payment card number, CVV code or comparable protected card information.

4.4. The payment provider’s own processing of personal data is also governed by its own privacy policy.

5. Technical Data

When the website or platform is used, we may automatically receive technical information, including:

• IP address;
• date and time of connection;
• device type;
• browser type and version;
• operating system;
• browser language;
• session identifiers;
• pages and platform functions used;
• technical events and errors;
• account login information;
• security logs.

Such data may be used to operate the platform, diagnose errors, protect against misuse and preserve the integrity of the Olympiad.

6. Olympiad Performance Data

6.1. To calculate results and verify the integrity of the competition, we process data relating to competition activity.

6.2. This may include:

• selected competition level;
• selected speed;
• number digit length;
• sequence of tasks;
• answers submitted;
• correct and incorrect attempts;
• response times;
• duration of attempts;
• number of errors;
• training results;
• competition points;
• technical events occurring during task completion.

6.3. This information is necessary to determine results in accordance with the Olympiad Rules.

7. Anti-Fraud and Competition Integrity

7.1. After the Olympiad, results may be subject to an anti-fraud review.

7.2. For this purpose, we may analyse:

• response speed;
• sequence of actions;
• unusual statistical patterns;
• repeated attempts;
• technical logs;
• sessions;
• IP addresses;
• device information;
• indications of automation;
• other technical indications of possible violations of the Olympiad Rules.

7.3. Such processing is used to:

• maintain fair conditions for participants;
• prevent fraud;
• detect the use of bots, scripts or other prohibited tools;
• protect other participants;
• verify prize-winning results.

7.4. We do not make a disqualification decision solely on the basis of one automated indicator without a reasonable review of the available information.

8. Communications and Technical Support

When a user contacts vfcup.helpdesk@gmail.com, we may process:

• email address;
• sender’s name;
• participant’s name;
• content of the communication;
• attached screenshots or videos;
• payment information;
• information about a technical issue;
• communication history.

Such information is used to process the request, identify the user, resolve technical and payment-related matters, and protect the legitimate interests of the parties.

9. Winner and Prize Recipient Data

9.1. Additional information may be required in order to pay a cash prize.

9.2. Such information may include:

• winner’s full name;
• country of residence;
• date of birth, where necessary;
• name of the parent or legal representative;
• proof of the recipient’s identity;
• proof of parental or representative authority;
• bank details;
• payment account information;
• tax residence;
• other information required by a bank, payment provider or applicable law.

9.3. Such information is requested only where it is reasonably necessary.

9.4. Information collected for prize payment purposes is not used for advertising purposes without a separate lawful basis.

10. Purposes of Processing

We may process personal data for the following purposes:

• user and participant registration;
• creation and maintenance of accounts;
• provision of access to the Olympiad;
• processing payments;
• use of invitation codes;
• provision of training tasks;
• provision of competition tasks;
• calculation of points;
• creation of rankings;
• anti-fraud review;
• determination of final results;
• issuance of certificates and diplomas;
• payment of cash prizes;
• customer support;
• handling complaints and requests;
• prevention of abuse;
• information security;
• accounting and tax compliance;
• compliance with applicable law;
• protection of the rights and legitimate interests of VF and participants.

11. Legal Bases for Processing

Depending on the particular processing activity, we rely on one or more lawful bases under the GDPR.

11.1. Performance of a Contract

Processing may be necessary for registration, ticket provision, operation of the Olympiad, calculation of results and delivery of the service.

GDPR Article 6(1)(b).

11.2. Compliance with Legal Obligations

Certain data may need to be processed for:

• accounting;
• tax compliance;
• requirements imposed by banks and payment providers;
• compliance with applicable law.

GDPR Article 6(1)(c).

11.3. Legitimate Interests

VF may process personal data where necessary for legitimate interests, including:

• platform security;
• fraud prevention;
• protection of competition integrity;
• investigation of rule violations;
• protection of legal rights;
• improvement of technical stability,

provided that such interests are not overridden by the rights and freedoms of the relevant individual.

GDPR Article 6(1)(f).

11.4. Consent

In certain cases, processing may be based on consent, for example:

• certain non-essential cookies;
• marketing communications;
• use of photographs or videos;
• certain forms of public presentation of personal data where consent is the appropriate legal basis.

GDPR Article 6(1)(a).

Consent may be withdrawn at any time where processing is based on consent.

12. Personal Data of Minors

12.1. A significant proportion of VF CUP participants may be minors.

12.2. We do not assume that a young child independently enters into the participation contract.

12.3. Where the participant is a minor, registration and purchase of participation are completed by the parent or legal representative.

12.4. The parent or legal representative acts on behalf of the child in matters relating to:

• registration;
• payment;
• consent to participation;
• receipt of necessary communications;
• receipt of cash prizes;
• exercise of the child’s data protection rights where appropriate.

12.5. Where the processing of a child’s personal data in connection with an online service is based on consent, VF applies the GDPR and applicable national rules concerning the child’s age and parental authorisation.

12.6. Different age thresholds may apply in different countries. VF may therefore request parental confirmation regardless of the minimum age applicable in a particular jurisdiction where this is reasonably appropriate for the operation of the Olympiad.

13. Data Minimisation for Children

13.1. We seek not to request more information from a minor than is reasonably necessary for participation in the Olympiad.

13.2. In ordinary circumstances, a child is not required to provide:

• passport details;
• bank details;
• home address;
• payment card number;
• other excessive identification information.

13.3. Where a child wins a cash prize, necessary payment and identification information is requested from the parent or legal representative.

14. Rankings and Publication of Results

14.1. Comparing participant results is one of the functions of the Olympiad.

14.2. Results may therefore be displayed in rankings.

14.3. Depending on the Olympiad format, a ranking may include:

• participant’s name;
• country;
• school or educational centre;
• competition level;
• points;
• official position;
• winner or prize recipient status.

14.4. For minors, we seek to limit publicly displayed information to what is reasonably necessary for the purposes of the Olympiad.

14.5. We do not publish the following information in public rankings:

• child’s email address;
• date of birth;
• telephone number;
• payment information;
• home address.

14.6. More detailed rules concerning publication of children’s information are set out in the Children & Parental Consent Policy.

15. Certificates and Diplomas

15.1. The following information may be used to generate certificates and diplomas:

• participant’s name;
• country;
• school or educational centre;
• competition level;
• result;
• official position;
• date of the Olympiad.

15.2. Users are responsible for checking that registration information is accurate.

15.3. Certificates and diplomas may be made available through the participant account or by another electronic method.

16. Photographs and Videos

16.1. Providing a photograph or video of a child is not required for ordinary participation in VF CUP unless the Organiser separately announces such a requirement.

16.2. Where VF wishes to use a participant’s photograph, video, testimonial or likeness for advertising, public relations or marketing purposes, an appropriate separate lawful basis will be used and, where required, separate consent will be obtained.

16.3. Where the participant is a minor, such use is subject to applicable requirements concerning parental consent.

17. Sharing of Personal Data

We may provide personal data only to the extent reasonably necessary to the relevant recipient.

Recipients may include:

• cloud infrastructure and hosting providers;
• software providers;
• email service providers;
• technical support providers;
• payment providers;
• banks;
• accountants;
• auditors;
• legal and tax advisers;
• analytics and security providers;
• public authorities where disclosure is required by law.

18. Data Processors

18.1. Certain service providers may act on behalf of VF Private Education LTD as processors or sub-processors within the meaning of the GDPR.

18.2. We seek to use providers that offer appropriate contractual and technical safeguards for personal data.

18.3. Certain providers, including banks and some payment institutions, may act as independent controllers in relation to their own regulated activities.

19. International Data Transfers

19.1. VF CUP is an international service, and certain technical providers may be located or process personal data outside the European Economic Area (“EEA”).

19.2. Where personal data is transferred to a country for which the European Commission has not adopted an adequacy decision, VF uses an appropriate GDPR transfer mechanism where required.

19.3. Such mechanisms may include:

• Standard Contractual Clauses;
• other contractual safeguards;
• other lawful GDPR mechanisms for international transfers.

19.4. We seek to limit international transfers to the personal data reasonably necessary for the relevant service.

20. Data Retention

20.1. Personal data is retained no longer than reasonably necessary for the purposes for which it was collected and for compliance with legal obligations.

20.2. The retention period depends on the category of data.

20.3. For example:

• registration information may be retained while an account remains active and for a reasonable period afterwards;
• Olympiad results may be retained to preserve competition history and verify issued certificates and diplomas;
• anti-fraud logs may be retained for the period reasonably necessary to verify results and resolve disputes;
• financial records are retained for the period required by accounting and tax law;
• support communications may be retained for a reasonable period after a request has been resolved.

20.4. At the end of the applicable retention period, data is deleted, anonymised or archived where continued retention is required by law.

21. Security

21.1. VF implements reasonable technical and organisational measures designed to protect personal data.

21.2. Such measures may include:

• access controls;
• role-based permissions;
• secure connections;
• logging;
• backups;
• security monitoring;
• use of reputable payment providers;
• restriction of staff access to personal data.

21.3. Despite these measures, no internet-based service can guarantee absolute security.

22. Personal Data Breaches

22.1. Where VF becomes aware of a personal data breach, it assesses the nature, scale and potential risks of the incident.

22.2. Where required by the GDPR, VF notifies the competent supervisory authority.

22.3. Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, such individuals will also be notified where required by law.

23. Data Subject Rights

Subject to the conditions and limitations set out in the GDPR and other applicable law, an individual may have the right to:

• receive information about the processing of their personal data;
• access their personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive personal data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data protection authority.

23.2. Certain rights are not absolute and may be restricted under applicable law.

For example, VF may be required to retain a financial record even after an account deletion request.

24. Rights of Minors

24.1. Data protection rights belong to the child whose personal data is processed.

24.2. Depending on the child’s age and applicable law, such rights may be exercised:

• by the minor;
• by the parent;
• by the legal representative.

24.3. VF may take reasonable steps to verify the identity of the person making a request and their authority to act on behalf of the child.

25. Requests for Access, Correction or Deletion

25.1. Requests relating to personal data rights may be submitted to:

vfcup.helpdesk@gmail.com

25.2. The request should preferably include:

• name;
• account email address;
• participant’s name;
• description of the requested action.

25.3. VF may request additional information where reasonably necessary to identify the requester.

25.4. We will not request more information than is reasonably necessary for such verification.

26. Deletion Requests and Olympiad Results

26.1. The right to erasure does not mean that VF must delete all information immediately in every case.

26.2. Certain information may be retained where necessary:

• to comply with a legal obligation;
• for accounting or tax purposes;
• for the establishment, exercise or defence of legal claims;
• to preserve the integrity and historical accuracy of Olympiad results;
• to resolve disputes.

26.3. Where appropriate, certain historical information may be anonymised instead of being fully deleted.

27. Automated Processing

27.1. The platform automatically:

• generates competition tasks;
• verifies submitted answers;
• calculates points;
• creates preliminary rankings.

27.2. Such automated operations are a necessary part of the Olympiad.

27.3. Significant decisions relating to suspected fraud or disqualification should not be based solely on one automated indicator without reasonable review.

27.4. A user may contact support to request clarification regarding a final decision.

28. Cookies and Similar Technologies

28.1. The VF CUP website may use cookies and similar technologies.

28.2. Certain cookies are necessary for:

• account login;
• security;
• session management;
• operation of essential platform functions.

28.3. Non-essential analytics or marketing cookies are used in accordance with applicable consent requirements.

28.4. Further information is provided in the Cookie Policy.

29. Marketing Communications

29.1. Registration for the Olympiad does not itself constitute consent to receive optional marketing communications where such consent is required by law.

29.2. Service communications necessary for performance of the contract are not considered marketing communications.

Such communications may include:

• registration confirmation;
• payment confirmation;
• reminders concerning the Olympiad date;
• information about technical changes;
• results;
• prize notifications.

29.3. Users may unsubscribe from optional marketing communications using the method provided in the relevant message.

30. Third-Party Websites and Services

30.1. The VF CUP website may contain links to third-party websites or services.

30.2. VF does not control the privacy practices of independent third-party services.

30.3. Users are encouraged to review the privacy policy of the relevant third-party service.

31. Changes to This Privacy Policy

31.1. VF may update this Privacy Policy from time to time.

31.2. The current version will be published on the official website.

31.3. The effective date of the relevant version is stated at the top of this document.

31.4. Where processing practices change materially, VF may also notify registered users where such notification is required by law or reasonably appropriate.

32. Supervisory Authority

32.1. As VF Private Education LTD is established in Cyprus, the competent supervisory authority may be the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus.

32.2. An individual has the right to lodge a complaint with a competent data protection authority in accordance with the GDPR.

32.3. An individual may also have the right to lodge a complaint with a supervisory authority in the EU Member State of their habitual residence, place of work or place of the alleged infringement.

33. Privacy Contact

For questions concerning personal data processing, exercise of data protection rights or this Privacy Policy, please contact:

vfcup.helpdesk@gmail.com

Data Controller:

VF Private Education LTD
Company Registration No.: HE 385788
Registered office: Marathonos 3, MALI HOUSE, 8011 Paphos, Cyprus
Website: https://the-olympic.world/
Email: vfcup.helpdesk@gmail.com

VF CUP International Mental Arithmetic Olympiad is organised by VF Private Education LTD, Cyprus.