Safeguarding Policy — WhiteKnight Academy

Scope — where this applies. This document covers WhiteKnight Academy as a whole: both the public website at whiteknight.academy and the learning platform at analytics.whiteknight.academy. Where it refers to "the Site", "the Service", or "the Platform", it means both unless a specific one is named.

Effective date: 2026-07-02 Classification: Public (this policy) + Internal (operational annexes)

1. Our commitment

WhiteKnight Academy exists to teach chess to children in a safe, kind, and structured environment. The welfare of every child on the platform is the first priority — above commercial outcomes, above coach preferences, above operational convenience.

We commit to:

• Believing children first. Any child who tells us that something has made them feel unsafe will be heard seriously, promptly, and without judgment.
• Transparent rules. Coaches, students, and parents all see the same Safeguarding Policy. No "secret" expectations.
• Proportional, prompt response. We act on concerns quickly. We do not delay while we decide whether the concern is "serious enough".
• No single point of failure. Every safeguarding decision is reviewable; no one person has unchecked authority.
• Zero tolerance for abuse. Any conduct meeting the definitions in § 5 results in immediate suspension pending investigation and, where warranted, referral to law enforcement or a child-protection authority.

2. Who this policy covers

• Students — primarily children aged 6–14, adolescents 16–17, and adult students.
• Parents / guardians — who sign up children and remain the child's primary protector.
• Coaches — adults who teach on the platform under a Contractor Agreement incorporating our Coach Code of Conduct.
• Staff — internal administrative staff of TheBroda sp. z o.o.
• Third-party visitors — anyone who attends a lesson as an observer (e.g., a parent sitting in with their child); they are bound by this policy while on the platform.

3. Legal framework

We are a Polish company (TheBroda sp. z o.o.) operating internationally. We apply this policy uniformly to all users, and additionally comply with local reporting obligations wherever our users are located. Specific statutory anchors:

• Poland — obligation under Ustawa Kodeks karny Art 240 § 1 to report certain categories of crime (incl. crimes against minors) to prosecutor / police. Coaches and staff are subject to this obligation directly; we will cooperate.
• European Union — GDPR Art 6(1)(c)/(d) processing of personal data for compliance with legal obligations and protection of vital interests; Art 9(2)(g) for potential special-category processing during a safeguarding investigation ("reasons of substantial public interest"). Documented in the DPIA.
• United States — federal CSAM reporting obligation under 18 U.S.C. § 2258A for electronic service providers who become aware of child-sexual-abuse material; state-level mandatory-reporter statutes vary and we act conservatively.
• Canada — An Act respecting the mandatory reporting of Internet child pornography, S.C. 2011, c. 4; provincial child-protection statutes.

4. How we build safety into the platform (design-level)

Many safeguards are structural — they are built into the product, not left to human vigilance:

• All communication on-platform. We do not allow coaches to share personal email, phone, social-media handles, or any off-platform contact method with students. Our messaging system is a closed channel between coach and student, visible to parents on request.
• Closed audience. A coach sees only students linked to them; a student sees only the coaches linked to them. Directory-style browsing of users is not available.
• No peer-to-peer messaging between children. Children can only message their own coach and receive system notifications.
• Live lessons recorded only on opt-in with a permanent on-screen REC indicator (see Privacy Policy § 7.3).
• Admin audit trail on sensitive access. Any time an admin views a recording, a student record, or a message thread, the action is logged with a purpose field (see RoPA Activity A10 + A14).
• AI generation filtered — system prompts enforce respectful, age-appropriate tone on child-facing AI chat.
• Account deletion is user-friendly — a parent can close a child's account in one click.

5. Definitions: what counts as a safeguarding concern

A safeguarding concern arises where any of the following is present, suspected, or reported. This list is non-exhaustive.

• Physical abuse or threats directed at or witnessed by a child.
• Emotional abuse — persistent belittling, humiliation, threats, or manipulation.
• Sexual abuse or exploitation — any sexual contact, grooming, request for sexualised images, or display of such material.
• Neglect — failing to meet a child's basic safety needs during a platform-mediated activity (e.g., a coach abandoning a live lesson without any handoff).
• Online-specific harms — doxing, sharing personal information about a child, cyber-bullying, attempts to move a child off-platform to a private communication channel.
• CSAM — receipt, possession, transmission, or discovery of child sexual abuse material. This requires immediate action and authority notification.
• Self-harm disclosures — a child expresses thoughts of self-harm or suicide.
• Peer-to-peer harm — a child describes abuse by a family member, another coach, or another service.

6. Coach standards (summary)

The binding detail is in the Coach Code of Conduct, signed by every coach. Summary of what we require of coaches:

• behaviour respectful at all times;
• communications strictly on-platform;
• no gifts, no personal favours, no private photos or videos;
• no physical-world meet-ups outside sanctioned tournaments/events;
• vigilance for signs of a child's distress and duty to report concerns;
• duty to protect student data (GDPR + platform rules);
• for 1:1 live lessons with a minor: recording available on parental opt-in; no off-camera requests; use only the platform chat.

A coach who breaches the Code is suspended pending review (§ 9). Serious or repeat breaches lead to termination of the Contractor Agreement and, where warranted, a report to the authorities.

7. 1:1 live lessons — operating protocol

1:1 video lessons with a minor are the highest-risk setting on our platform. We apply the following protocol at every such lesson:

1. Open audience by default: the parent/guardian is welcome to sit with the child during any lesson. Coaches must never suggest the parent leave.
2. Camera on for the coach. Visible face, neutral background where practical, no scene that could appear compromising.
3. Clothing appropriate — long sleeves/shirts, no sleepwear, no swimwear — for both coach and student.
4. Lesson topic only. Personal questions unrelated to chess or the platform are out of scope.
5. Recording transparency. If the session is being recorded, the REC indicator is visible; if recording is not enabled, the coach does not imply otherwise.
6. No file transfers outside the platform's homework/attachment feature. Coaches may not send downloads, screen-share personal files, or attach non-PGN files.
7. Prompt end. Lessons start on the scheduled time and end on time. A coach does not extend a lesson unilaterally beyond the booked slot.
8. Emergency stop. If the child leaves the camera or is disrupted, the coach waits a reasonable moment, then stops the session with a polite farewell message and notifies the parent (or platform staff in an emergency).

8. Parents — what you should do

• Supervise age-appropriately. Younger children should be in earshot of a parent; older children benefit from periodic check-ins.
• Read the Children's Privacy Notice with your child. It is short and kid-friendly.
• Know that you can request a copy of your child's messages at any time — privacy@whiteknight.academy.
• Tell us about concerns — use contact@whiteknight.academy. We will respond within 1 business day at the latest; for urgent matters we will respond sooner.
• In an emergency call your local emergency number first (112 in EU, 911 in US, 911 in Canada). Tell us afterwards so we can cooperate with authorities.

9. How to report a concern

9.1. Any user — how to reach us

• In-app: Report a concern button in the lesson room + help menu.
• Email: contact@whiteknight.academy. Mark the subject "Safeguarding" if urgent.
• Post: TheBroda sp. z o.o., ul. Wierna 12, Warszawa, Poland.

9.2. What to include if you can

• Who is involved (usernames are fine — we will look up the rest).
• What happened (as much or as little as you wish to share).
• When it happened (lesson timestamp or date range).
• Whether anyone else has been told.

You can report anonymously; it may limit how fully we can investigate, but we still act on credible anonymous reports.

9.3. What happens after a report

Within 1 business day we:

1. Acknowledge receipt to you.
2. Triage — see § 10.
3. If immediate action is warranted (see § 10), take it before any fuller investigation.
4. Inform the parent (for child-subject reports) unless doing so is likely to put the child at further risk.

10. Triage and response

10.1. Triage categories

10.2. Investigation procedure (internal)

1. Two-person review — no single admin decides outcomes on safeguarding matters. A second admin or director reviews.
2. Evidence preserved — relevant messages, lesson timestamps, any recordings within retention window, audit-log entries. A retention hold overrides the 30-day auto-delete for the specific item, only where preservation is necessary and proportionate for the investigation.
3. Minor's voice — where appropriate and age-appropriate, we ask the minor (through the parent) for their account of events.
4. Decision — (a) unsubstantiated — case closed, notification to reporter; (b) substantiated — proportionate action per § 10.3; (c) unclear — additional measures pending further evidence.
5. Record — every investigation generates an incident file in the Incident Response log, including outcome and rationale.

10.3. Sanctions

• For coaches: verbal reminder → written warning → suspension → termination of Contractor Agreement → report to licensing/professional body where one exists → report to law enforcement.
• For users: reminder → account suspension → account termination.
• For staff: per internal HR policy + applicable labour law.

10.4. External reporting

Where the facts point to a potential criminal offence against a child, we notify the appropriate authority:

• Poland — Policja / prokuratura under Kodeks karny Art 240.
• United States — NCMEC CyberTipline (for CSAM) and local law enforcement.
• Canada — Cybertip.ca (for CSAM) and local law enforcement.
• EU other — local child-protection body; INHOPE hotline for CSAM if immediate reporting channel unclear.

External reporting does not require prior parental consent; we notify the parent as soon as it is safe to do so.

11. Emergency protocol

If information reaches us indicating that a child may be in immediate physical or psychological danger:

1. Any staff member may act alone to notify emergency services in the country of the child.
2. The relevant accounts are suspended immediately.
3. Recordings, messages, and relevant logs are preserved under a retention hold.
4. A "first-hour" record is kept: who acted, what was done, what was said.
5. Parent informed as soon as it is safe and appropriate.
6. Post-incident review within 7 days to learn from the event.

12. Confidentiality

Information about safeguarding matters is shared on a need-to-know basis.

• Within TheBroda: only the admins conducting triage or investigation.
• Externally: only to authorities as required by law, to the reporter (status update, not details), and to the affected parent.

Confidentiality does not override legal reporting duties. A reporter cannot bind us to secrecy that would prevent us from fulfilling a statutory duty or protecting another child.

13. Records and retention

Safeguarding records are held in a restricted Supabase table with service-role-only access; no RLS read for the wider team.

14. Training

• Coaches: must read this Policy and the Code of Conduct before taking any lesson with a minor, and re-read on each material update.
• Staff: annual refresher on triage, escalation, and reporting routes. New staff complete the training before being granted admin access.
• Record of training completion stored in coach_applications / admin_audit_log.

15. Review

This policy is reviewed at least annually and after any substantiated safeguarding incident. Reviewers: CEO (accountable), legal-compliance contact, an independent safeguarding consultant. Material updates trigger re-reading acknowledgement from every active coach.

16. Related documents and contacts

• Privacy Policy — data-handling detail, particularly § 7.3 recordings.
• Children's Privacy Notice — kid-friendly version of relevant privacy rules.
• Coach Code of Conduct — binding behavioural rules for coaches.
• Terms of Service — Parent/Guardian and Adult.
• Incident Response Plan (doc #23, internal — in draft).

Contact

• Safeguarding concerns: contact@whiteknight.academy (mark urgent subjects accordingly)
• Privacy: privacy@whiteknight.academy
• Post: TheBroda sp. z o.o., ul. Wierna 12, Warszawa, Poland

Emergency — in a life-threatening situation, call first:

• EU / UK / Ukraine: 112
• United States / Canada: 911
• CSAM: NCMEC CyberTipline (US) https://report.cybertip.org | Cybertip.ca (CA) | INHOPE (EU)