DRAFT — Pending Legal Review
This document has not been reviewed by a solicitor. Do not remove the noindex tag or publish this page until it has been legally approved.
Privacy Policy
Last updated: 14 July 2026
Checkmate Charlie ("we", "us", "our") is a chess education platform for young children, created by Charlize van Zyl. This Privacy Policy explains what personal information we collect, how we use it, and your rights in relation to it.
By using this website you agree to the practices described in this policy.
⚠ Requires legal review before publishing:
Confirm the legal entity name, registered address, and jurisdiction. If you are operating as a sole trader or registered company, those details should appear here as the data controller. Also confirm which country's law governs this policy (South Africa / POPIA, EU / GDPR, or both).
1. Who We Are
The data controller for this website is Charlize van Zyl, trading as Checkmate Charlie. You can contact us at checkmatecharliechess@gmail.com.
⚠ Requires legal review before publishing:
Insert your full registered trading name and physical or postal address, as required by GDPR (Article 13) and POPIA.
2. Children's Privacy
The educational content on Checkmate Charlie is designed for children aged 4+. However, user accounts and newsletter subscriptions are intended solely for parents, guardians, and teachers — not for children. We do not knowingly collect personal information directly from children under the age of 13.
If you believe that a child under 13 has provided us with personal information without parental consent, please contact us immediately at checkmatecharliechess@gmail.com and we will delete it promptly.
COPPA (United States)
This site is directed at parents and guardians of young children, not at children themselves. We do not collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA).
⚠ Requires legal review before publishing:
If any US visitors under 13 could access account or newsletter features, you may need to implement verifiable parental consent mechanisms and register a COPPA-compliant privacy notice. Confirm with a US-qualified attorney whether COPPA applies to your specific situation.
GDPR-K / EU Children's Data
Under Article 8 of the GDPR, processing personal data of children under 16 (or a lower age set by a member state, minimum 13) for information society services requires parental consent. Because accounts and newsletter subscriptions are for parents and guardians, we rely on the account holder being an adult. We do not offer accounts directly to children.
⚠ Requires legal review before publishing:
If EU residents use the site, confirm GDPR applicability to your business, including whether you need to appoint an EU representative (Article 27) and whether your privacy notice meets Article 13 requirements.
3. What Data We Collect
We collect personal data in the following situations:
a) Newsletter subscriptions
When you sign up for our newsletter we collect your email address. We use this to send you chess resources, new content announcements, and updates from Checkmate Charlie. You can unsubscribe at any time.
b) User accounts
When you create an account we collect your email address and a password (stored securely by Firebase Authentication — we never see your plain-text password). Accounts are intended for parents, guardians, and teachers who want to access downloadable content.
c) Contact form
When you submit the contact form on our Parents page we collect your name, email address, and message. We use this only to respond to your enquiry.
d) Usage data
We do not currently run analytics software. Firebase may collect certain technical information (such as IP address and device type) as part of its infrastructure. Please refer to Google's Privacy Policy for details of Firebase's data processing.
⚠ Requires legal review before publishing:
Review Firebase's data processing terms and confirm whether a Data Processing Agreement (DPA) with Google is needed for GDPR compliance. Also confirm whether Firebase Analytics or Crashlytics are enabled, as these affect cookie and tracking disclosures.
4. How We Use Your Data
- Newsletter email: to send you chess resources and content updates (legal basis: consent).
- Account email: to manage your account and provide access to downloadable content (legal basis: contract performance).
- Contact form data: to respond to your message and follow up if needed (legal basis: legitimate interest / consent).
We will never sell your personal data to third parties or use it for advertising.
⚠ Requires legal review before publishing:
Confirm the legal bases above match your actual processing. Under GDPR you must state the correct lawful basis for each processing activity (Article 6). If relying on "legitimate interests", a Legitimate Interests Assessment (LIA) is recommended.
5. Cookies
This website uses the following cookies:
- Authentication cookies — set by Firebase Authentication to keep you logged in. These are strictly necessary for account functionality.
We do not use advertising, marketing, or third-party tracking cookies.
⚠ Requires legal review before publishing:
Under GDPR/PECR, strictly necessary cookies do not require consent, but you must still disclose them. If Firebase or any embedded content (e.g. YouTube embeds via the lite player) sets additional cookies, these must be disclosed and may require a consent banner. Audit all cookies set on the domain using browser DevTools or a cookie scanner before publishing.
6. Data Sharing
We share your data only with the following third-party services that we use to operate the site:
- Google / Firebase — authentication, database, and file storage (Google LLC, USA). Data may be transferred outside the EEA under Google's Standard Contractual Clauses.
- YouTube (Google LLC) — video embeds. When a video player loads, YouTube may set cookies and collect usage data per its own Privacy Policy.
We do not sell, rent, or share your data with any other third parties.
⚠ Requires legal review before publishing:
Confirm all third-party services used (Firebase, YouTube embeds, any email provider for newsletters). For GDPR, international data transfers to the US require a valid transfer mechanism (adequacy decision, SCCs, or BCRs). Verify that Firebase's DPA covers your use case.
7. Data Retention
We retain your personal data for as long as your account is active or as needed to provide you with the services you have requested. Newsletter subscribers' email addresses are retained until you unsubscribe. Contact form submissions are retained for a reasonable period to allow us to follow up on enquiries.
⚠ Requires legal review before publishing:
Define specific retention periods for each data type (e.g. "newsletter emails retained until unsubscribe + 30 days", "contact submissions deleted after 12 months"). Vague retention statements may not satisfy GDPR Article 13(2)(a).
8. Your Rights
Depending on your location, you may have the following rights in relation to your personal data:
- Access — request a copy of the data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — ask us to delete your data.
- Withdrawal of consent — withdraw consent at any time (e.g. unsubscribe from the newsletter).
- Objection — object to certain types of processing.
To exercise any of these rights, email us at checkmatecharliechess@gmail.com. We will respond within 30 days.
⚠ Requires legal review before publishing:
Under GDPR, responses to data subject requests are due within one month (extendable to three in complex cases). Under POPIA (South Africa), the Information Regulator oversees complaints. Add the relevant supervisory authority and complaints procedure for your jurisdiction.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date. For significant changes, we will notify account holders by email where possible.
10. Contact
Questions about this Privacy Policy? Contact us at checkmatecharliechess@gmail.com.