Privacy policy

Last updated 16 October 2026

Who this is about

Honbu is software that martial arts clubs, regions and federations use to keep a register, run classes, take payments and talk to their members. It is run by Honbu (operated by Richard Benson) (the “operator”).

Two parties are involved, and they have different duties:

The club, region or federation you belong to (the “organisation”) decides what it collects about you and why. For your membership, it is the organisation that is responsible for your information, and the operator looks after it on the organisation’s behalf.
The operator is responsible for your sign-in details and for running the service safely. It does not use members’ information for its own purposes.

If you are not sure which organisation holds your details, ask the one you train with, or write to richardbenson@outlook.co.nz.

What is collected

Who you are: name, member number, date of birth, gender if given, photo.
How to reach you: email, phone numbers, address.
Safety: an emergency contact, and health or medical notes you or your guardian choose to give. Health notes and uploaded documents are encrypted before they are stored.
Your training: grades, gradings and results, attendance, classes and terms you are in, events you enter, forms and waivers you sign.
Money: what you owe and what you have paid, with the method. Card numbers are handled by the payment provider and are never stored here.
Messages sent to you through the service, and what happened to them.
Instructors: the checks a club asks for, such as first aid and police vetting, and the certificates that prove them.
Using the service: sign-in times, the device and address you signed in from, and a record of who changed what.
Enquiries and trial classes: what a person asked and how they heard about the club.

Why it is used

To run your membership: the roll, classes, gradings, events and renewals.
To take and record payments.
To keep people safe, including emergency contacts, health notes and safeguarding checks.
To tell you things you need to know, such as a grading date or a renewal.
To keep the service secure and to find and fix faults.
To meet legal duties, such as tax records.

Information about a member is not sold, rented or used to show advertising, and the service has no advertising or tracking scripts.

Our legal basis, if you are in Europe or the United Kingdom

Where the General Data Protection Regulation (GDPR) or the UK GDPR applies, the organisation relies on these grounds:

Contract: to provide the membership you asked for.
Legitimate interests: to run the club safely and to keep the service secure, balanced against your rights.
Legal obligation: for example keeping financial records.
Consent: for optional things such as photos on a public page or marketing. You can withdraw it at any time, and doing so does not affect what was done before.
Health information is special category data. The organisation asks for the explicit consent of the person or, for a child, their parent or guardian, before it is held.

Who sees it

Access follows the organisation’s own structure, and it is enforced in the database, not only on screen:

Your own club’s instructors, registrars and administrators see the members of that club.
A region or federation above your club sees what it needs to run gradings, events and the register across its clubs.
You see your own record, and a parent or guardian sees their children’s.
The operator can see data only to run, secure and repair the service, and changes are recorded in an audit trail.
Service providers who help run it (see “Who handles data for us”) see it only as far as their job needs.

Information is disclosed to others only when you agree, when the law requires it, or to protect someone’s safety.

Where it is kept, and moving it across borders

The database and the application run in Sydney, Australia. Some providers are in other countries, and the list is on the page called Who handles data for us.

If you are in New Zealand, the Privacy Act 2020 allows information to go to a provider overseas when it is held for the organisation to do the organisation’s work, and the organisation stays responsible. If you are in Europe or the United Kingdom, where information is sent to a country without an adequacy decision, the organisation and operator use contractual safeguards such as standard contractual clauses. Ask for a copy of the arrangement through the address below.

How long it is kept

Your record is kept while you are a member, and afterwards for as long as the organisation has a good reason, such as grading history it is proud to confirm, safeguarding, or a legal duty.
Financial records are kept for seven years, as New Zealand tax law requires.
Sign-in links are removed a day after they expire, and expired sessions after thirty days.
When an organisation closes its account, it can download its data, and the rest is deleted after the period in the terms.

When we are asked to erase information and there is no reason to keep it, it is erased or made anonymous.

Your rights

You can ask to see what is held about you, to correct it, and in many places to have it erased, to limit or object to its use, and to take a copy that another system can read. How to ask, how long it takes and what to do if you disagree are on the page called Your privacy rights.

If you are in other places

Australia: the organisation follows the Privacy Act 1988 and the Australian Privacy Principles where they apply to it.
California: we do not sell personal information, and we do not share it for advertising. You may ask to know, correct or delete what is held about you, and you will not be treated worse for asking.
Canada and elsewhere: the same rights to see, correct and complain apply, and the page called Your privacy rights is how to use them.

Changes and questions

This policy was last updated on 16 October 2026. When it changes in a way that matters to you, the organisation will be told and a notice will be shown in the service.

Questions: richardbenson@outlook.co.nz.