Privacy Policy
Last updated: July 1, 2026
NCF Boulder trains minors, so we wrote this policy with families in mind. It explains what we collect, why we collect it, who we share it with, and the choices you have. If anything here is unclear, ask us. Our contact details are in Section 13.
1. Introduction
NCF Boulder is the registered trade name of Northern Colorado Fencers, Inc., a Colorado corporation. We teach epee fencing to children ages 7 to 17 and to adults 18 and older, and we are a member club of USA Fencing.
This policy covers the data we handle in person at our facility, on our website, through our club-management platform (TeamUp), and through the other online systems we use to run the club. Our website runs on cloud infrastructure, and automated workflows process the forms you submit. We do not name those hosting and automation providers as separate data recipients, because they act on our instructions and do not use your data for their own purposes.
2. Who We Are
Under Colorado privacy law, NCF Boulder is the controller of the personal data described here. That means we decide what to collect, why, and how it is used. We do not sell personal data. We do not use any minor's personal data for targeted advertising, and we do not profile children.
We are not a data broker, an advertising network, or a social media company. We collect what we need to run the club safely and to meet our legal obligations, and nothing more.
3. What Personal Data We Collect
What we collect depends on your relationship with the club.
| Category | What it includes | Applies to |
|---|---|---|
| Registration data | Full name, date of birth, address, phone, email, emergency contacts, and parent or guardian details for minors. Collected through TeamUp at enrollment. | All participants |
| Medical and emergency information | Known conditions, allergies, medications, concussion history, physician contact, and insurance for emergency treatment. Some of this is also collected at summer-camp checkout on our website. | All participants |
| USA Fencing membership data | USA Fencing member number, membership type and status, SafeSport status, competitive ratings, and club affiliation. | USA Fencing members |
| Payment data | Billing name and address, payment method (last four digits only; full card numbers are handled by Stripe and never stored by us), transaction history, and account balances. | Paying members and parents |
| Quiz and inquiry data | When a parent completes the "Is Fencing Right for My Child?" quiz, we store the answers, the child's first name and age, and the parent's email so a coach can follow up. | Website visitors who opt in |
| Photographs and video | Images and video captured during training, competitions, and events for coaching and promotion. | All participants (subject to opt-out) |
| Security camera footage | Video from interior cameras at the facility. Cameras are never placed in locker rooms, changing areas, or restrooms. | Everyone present at the facility |
| Website and analytics data | Form submissions, newsletter signups (via Sender.net), email and text correspondence, TeamUp messages, and the IP address and browser data seen by our analytics (Plausible), our form bot-protection (Turnstile), our email verification (Kickbox), and, for visitors who arrive from an ad, the Meta Pixel. | Website visitors and contacts |
| Competition records | Tournament entries, results, bout scores, and national and regional points standings. | Competitive members |
3.1 Sensitive data
Under the Colorado Privacy Act, some categories count as sensitive data, including health information and data about children under 13. We collect medical information and data about minors, and we handle all of it with extra care, as described in Section 5 and Section 8.
We do not collect biometric identifiers such as fingerprints, facial geometry, or retinal scans. Ordinary photographs and security camera footage are not biometric data under Colorado law unless they are run through biometric identification software, which we do not use.
4. How We Use Your Data
We use personal data only for the purposes below. We do not repurpose it for unrelated uses without notice and, where required, consent.
4.1 Club operations
Registration, payment, and USA Fencing membership data let us manage enrollment, schedule classes, process fees, verify membership and insurance, and keep families informed about club activities. TeamUp is our main system for enrollment and scheduling, and Stripe processes payments.
4.2 Safety and medical response
We use medical information to respond to injuries and emergencies during training and competition, follow concussion protocols, and make return-to-play decisions. We use emergency contacts to reach family when a participant is hurt or ill.
4.3 Facility security
Interior camera footage protects the people and property at the facility. We never use it for marketing or behavioral monitoring, and we never place cameras in locker rooms, changing areas, or restrooms.
4.4 Coaching and instruction
We use video and photographs to review technique and analyze bouts, and we use competition records to track development and plan training.
4.5 Promotion
We may use photographs and video on our website, our Facebook and Instagram accounts, and printed materials to promote the club. This use is subject to the opt-out in Section 9. We do not sell photographs or video of participants to anyone.
4.6 Communications and marketing
We use Sender.net to send email and text updates, including newsletters, schedule changes, event announcements, and club news. You can unsubscribe from marketing at any time using the link in any message or by contacting us. Operational messages, such as class cancellations, safety notices, and account messages sent through TeamUp, are not marketing and may continue regardless of your marketing preferences.
4.7 Legal compliance
We may use personal data to meet legal obligations, including Colorado's mandatory reporting duty for suspected child abuse or neglect (C.R.S. 19-3-304), USA Fencing and SafeSport reporting, and tax and business recordkeeping.
4.8 Defending legal claims
We may keep and use personal data as reasonably necessary to establish, exercise, or defend legal claims, including data about injuries, incidents, and signed agreements.
5. Children's Privacy
Our club trains fencers as young as 7, and every part of our data handling reflects that.
5.1 Children under 13 (COPPA)
The federal Children's Online Privacy Protection Act (COPPA) limits the online collection of personal information from children under 13. Here is how we comply.
Parent-led registration. Our registration runs on TeamUp. A parent or guardian creates their own account first, then adds a profile for any child under 13. Children do not create their own accounts and should not submit personal information through our website or TeamUp without a parent.
Our quiz. When a parent uses the "Is Fencing Right for My Child?" quiz on our website, we collect the child's first name and age along with the parent's email. A parent starts and submits the quiz, and we use the answers only to follow up about programs.
Parental access. Parents and guardians of children under 13 may review the information we hold, request corrections, and request deletion, subject to the retention rules in Section 11. Contact us using Section 13.
No monetization. We do not share a child's personal information with anyone for commercial purposes unrelated to running the club.
Newsletter. We do not knowingly add children under 13 to our Sender.net marketing lists. Marketing goes to adult participants and to the parents or guardians of minors.
5.2 Minors under 18 (Colorado Privacy Act, SB 24-041)
Amendments to the Colorado Privacy Act (SB 24-041), effective October 1, 2025, add requirements for any business that offers online services to consumers it knows are minors. Because we know our members include minors, these provisions apply to our online services regardless of whether we meet the Colorado Privacy Act's general processing thresholds. Here is how we comply.
No targeted advertising to minors. We do not process any minor's personal data for targeted advertising.
No data sales. We do not sell any participant's personal data, minor or adult.
Purpose limitation. We process a minor's personal data only for the purposes in this policy, or as reasonably necessary to provide the services the minor or their parent signed up for.
No manipulative design. Our website and TeamUp instance do not use features meant to increase, sustain, or extend a minor's time on the platform.
No precise geolocation. We do not collect precise geolocation from minors through our website or online services.
5.3 Parental rights
Parents and legal guardians of minors enrolled at NCF Boulder have the right to:
- Review the personal information we hold about their child.
- Request correction of inaccurate information.
- Request deletion, subject to the retention rules in Section 11 and any legal obligation to keep the data.
- Opt out of promotional photography and media use (see Section 9).
- Withdraw consent for any processing that relies on consent.
To use any of these rights, contact us using Section 13.
6. Third-Party Services and Platforms
We use a few outside services to run the club. Each one receives only the data it needs to do its job, and each has its own privacy policy. Below are the services that handle your personal data.
| Service | What it does | Data it receives |
|---|---|---|
| TeamUp | Registration, scheduling, check-ins, and messaging. | Registration data, account credentials, scheduling activity, and messages. |
| Stripe | Payment processing. | Billing details and a card token; full card numbers never reach us. |
| Sender.net | Email and text newsletters. | Name, email, and phone if you provide it. |
| Meta (Pixel and Conversions API) | Measuring Facebook and Instagram ad performance. | Hashed contact details for ad visitors, plus standard event data. |
| Plausible | Privacy-friendly, cookieless website analytics. | Aggregate page views and referrers; no personal profiles. |
| Kickbox | Email-address verification to catch typos. | The email address you submit. |
Form bot-protection (Cloudflare Turnstile). We use Cloudflare Turnstile to protect our forms, such as the quiz, from automated abuse. Turnstile runs invisibly and does not show you a challenge.
Website analytics (Plausible). Plausible is a
privacy-friendly, cookieless analytics tool. Event data is routed
through our own domain (a.ncfboulder.com) before it reaches
Plausible. It does not track you across sites and collects no personal
profiles. We do not use Google Analytics.
Meta Pixel and Conversions API. When you arrive from a Facebook or Instagram ad, the Meta Pixel and our server-side Conversions API record page views and conversion events, such as starting checkout or completing a purchase, so we can measure how the ad performed. Any personally identifying fields are SHA-256 hashed before they are sent. We use this to attribute ad clicks to actions taken by adults, the parents of prospective campers. It does not profile children or under-18 visitors. Lookalike and advertising audiences are seeded from parent contact information only, never from records of minors. You can read Meta's Privacy Policy for details.
Social media. We run accounts on Facebook and Instagram. When we post there, those platforms may collect data about people who view or interact with our content under their own privacy policies, and we do not control that.
7. Other Data Sharing
Beyond the services in Section 6, we share personal data with a small number of recipients.
7.1 USA Fencing
USA Fencing membership requires us to submit a member's name, date of birth, contact information, and club affiliation to the national membership database. USA Fencing uses this to manage memberships, verify insurance, track results, and enforce SafeSport compliance.
7.2 U.S. Center for SafeSport
USA Fencing policy and federal law require us to report suspected abuse or misconduct involving minor athletes. Reports may include the names and contact details of the people involved.
7.3 Legal and safety obligations
We will share personal data when the law or a participant's safety requires it. This includes registering fencers for sanctioned events, handling insurance claims after an injury, reporting to law enforcement or child protective services (including under Colorado's mandatory reporting statute, C.R.S. 19-3-304), and sharing the minimum needed with our own legal, accounting, or insurance advisors.
8. Data Security
We keep reasonable administrative, technical, and physical safeguards to protect personal data from unauthorized access, disclosure, alteration, and destruction.
Physical records such as paper forms and signed agreements are kept in a locked cabinet at the facility, with access limited to authorized staff.
Digital records such as TeamUp data, email, and financial records are stored on password-protected systems and on cloud infrastructure that encrypts data in transit and at rest.
Payment data is processed by Stripe, which is PCI DSS Level 1 certified. We do not store full card numbers on any club system.
Medical and emergency information, including details provided at camp checkout, is available only to staff who need it to keep participants safe.
Security camera footage is stored on a secured local system at the facility with restricted access.
No system is perfectly secure. If we discover a breach involving personal data, we will notify affected individuals as required by Colorado's breach notification law (C.R.S. 6-1-716).
9. Photography and Media
We photograph and record video during training, competitions, and events. These images serve two different purposes with different rules.
9.1 Instructional use
Coaches record video to review technique, analyze bouts, and track development. This is part of the coaching service and is not subject to the promotional opt-out. Instructional footage of minors is stored on secure club systems, shown only to the fencer and their parent or guardian, and deleted within six months unless a coach has a documented reason to keep it longer.
9.2 Promotional use
We may use photographs and video on our website, our Facebook and Instagram accounts, and printed materials to publicize the club. Parents and guardians of minors may opt out of promotional use of their child's image by submitting a written objection at any time. The opt-out mechanism is described in the NCF Boulder Participation Agreement.
An opt-out of promotional use does not affect instructional recording. It means we will not publish, post, or share any image or video in which the opted-out fencer is identifiable for marketing or promotion.
9.3 MAAPP requirements
Consistent with the Minor Athlete Abuse Prevention Policies (MAAPP) enforced by the U.S. Center for SafeSport, recording devices are prohibited in locker rooms and changing areas. Coaches do not send photographs or video of minor fencers directly to the minor; any electronic sharing goes through a parent or guardian.
9.4 Photography by families and others
We cannot control photography by parents, spectators, or independent media. At registration we ask families to avoid publicly posting images in which other families' children are identifiable without permission. We ask for this as a courtesy, and it carries no legal force.
10. Cookies and Website Data
Our website uses a small set of cookies and similar technologies.
Functional cookies. Our hosting and our bot-protection (Cloudflare Turnstile) may set cookies needed for security and performance.
Analytics. We use Plausible to collect anonymous, aggregate usage data such as pages visited, referral source, country, and device type. Plausible is cookieless, does not collect personal data, and does not track individual visitors across sessions.
Advertising cookies (Meta). For visitors who arrive from
a Facebook or Instagram ad, the Meta Pixel sets first-party
_fbp and _fbc cookies, which last up to 90
days, to measure ad performance. See
Section 6 for how this works and how minors are
protected.
A/B test cookie. When we are testing two versions of a
page, such as the summer-camps page, we set a single first-party
functional cookie named ncf_ab_camp. It stores only a short
non-identifying label, such as A or B, so you
keep seeing the same version while the test runs. It holds no personal
data and is never used to track you across sites.
TeamUp cookies. When you use our TeamUp-powered registration and scheduling pages, TeamUp sets functional cookies to manage your login session and provide the service.
11. Data Retention
We keep personal data only as long as we need it for the purposes in this policy or as the law requires.
| Data category | Retention period | Reason |
|---|---|---|
| Registration data | Enrollment plus 3 years | Administration; legal defense |
| Medical information | Enrollment plus 3 years | Safety; legal defense |
| Signed agreements | Enrollment plus 6 years | Colorado statute of limitations |
| Payment records | 7 years from transaction | IRS requirements |
| Incident and injury reports | Enrollment plus 6 years; for minors, until age 21 | Statute of limitations (tolled for minors) |
| Instructional video | 6 months or end of season | Coaching purpose; minimization |
| Security camera footage | 30 days (longer if tied to a reported incident) | Facility security; investigation |
| Promotional media | Indefinite, reviewed each enrollment cycle | Ongoing use; removed on opt-out |
| Photography opt-out records | Enrollment plus 3 years | Compliance documentation |
| Newsletter subscriber data | Until you unsubscribe; deleted from Sender.net within 30 days of the request | Marketing consent |
When data reaches the end of its retention period, we securely delete or destroy it. Paper records are shredded, and digital records are permanently deleted from our systems and backups within a reasonable time. We also ask third-party platforms such as TeamUp and Sender.net to delete data when its retention period ends.
A note about minors. Colorado's statute of limitations for personal injury claims by minors does not start until the minor turns 18. We keep incident reports, signed waivers, and related records for minors until at least three years after they turn 18 (age 21). This protects both the club and the family's ability to pursue or defend a claim.
12. Your Rights Under Colorado Law
12.1 How the Colorado Privacy Act applies to us
Because NCF Boulder knowingly offers online services to minors, the Colorado Privacy Act's minor-specific provisions (SB 24-041) apply to us regardless of our size or processing volume. We comply with them as described in Section 5.
The Colorado Privacy Act also sets general thresholds that bring larger controllers under its full scope, based on the number of consumers whose data they process and whether they sell data. Whether or not a club of our size meets those thresholds, we honor the rights below for everyone, because that is how a club serving families should operate.
12.2 Rights we honor
- Access. You may request a copy of the personal data we hold about you or your child.
- Correction. You may ask us to correct inaccurate personal data.
- Deletion. You may request deletion, subject to the retention rules in Section 11 and any legal basis requiring us to keep the data.
- Opt out of targeted advertising. We use the Meta Pixel and Conversions API to measure Facebook and Instagram ads aimed at adults. You may opt out by emailing info@ncfboulder.com.
- Opt out of data sales. We do not sell data. If that ever changes, we will update this policy and provide a way to opt out.
- Photography opt-out. Parents and guardians of minors may opt out of promotional media use as described in Section 9.
- Marketing opt-out. You may unsubscribe from email and text marketing at any time using the link in any message or by contacting us.
To use any right, contact us using Section 13. We will respond within 30 days, and we will not treat you differently for exercising a privacy right.
13. Contact Information
For questions about this policy, to use a privacy right, to submit or withdraw a photography opt-out, or to report a concern, contact:
NCF Boulder
1949 33rd Street, Boulder, CO 80301
info@ncfboulder.com
303.641.6557
Please include your name, your relationship to the club, and a description of your request. If you are making a request on behalf of a minor, identify the minor by name and your relationship to them.
14. Changes to This Policy
We may update this policy to reflect changes in our practices, Colorado law, federal law, or USA Fencing requirements. When we make a change, we update the "Last updated" date at the top of this page.
For material changes that affect how we handle children's data, we will make reasonable efforts to notify affected families directly, by email or written notice, before the changes take effect. A material change is one that expands the data we collect from minors, introduces new sharing, or reduces a right described here.
The current version of this policy is always available at the front desk and on our website.
15. Governing Law
This policy is governed by the laws of the State of Colorado. If any part of it conflicts with applicable law, the law controls.
Legal name: Northern Colorado Fencers, Inc., a Colorado corporation, operating under the registered trade name NCF Boulder.