1. Data controller
AT FOOSBALL ACADEMY, whose registered office is at 61 avenue de la Cholière, 44700 Orvault, France, is the controller for the processing described on this page. For any question or request concerning your data, email contact@at-foosball.fr.
2. Data, purposes and legal bases
| Situation | Data concerned | Purpose | Legal basis |
|---|---|---|---|
| Member account | Name, email address, account identifier, session and security data. Your password is managed by Clerk and cannot be accessed by AT Foosball Academy. | Create, secure and administer your account. | Performance of the requested service and legitimate security interests. |
| Enquiries and support | Name, email address, optional phone number, situation, message content and correspondence history. | Reply to and follow up your request. | Consent where requested by the form; steps taken before entering a contract or legitimate interests, depending on the request. |
| Online Academy | Plan, available content, progress, video position, quiz answers and results. | Provide the learning path, save your progress and manage access. | Performance of the contract once the service opens. |
| Membership and payment | Plan, billing period, status, Stripe customer and subscription references, and billing history. Full card details are collected directly by Stripe. | Take payment, issue invoices, manage and cancel memberships. | Performance of the contract and accounting obligations. |
| Commercial relationships and CRM | Professional contact details, organisation, role, interests, correspondence, consent, objections and email activity. | Manage prospects, customers, clubs and partners, and send relevant communications. | Legitimate interests for B2B relationships; consent where required; compliance with objections. |
| Operation and security | IP address, technical logs, device, browser, security events and strictly local preferences. | Operate, diagnose and protect the service. | Legitimate interests in security and continuity. |
Required fields are identified when data is collected. Without them, we cannot create the account, process the request or provide the relevant service. We do not carry out automated commercial profiling or make solely automated decisions that produce legal effects.
3. Data sources
Most data comes directly from you through your account, forms, correspondence, use of the platform or purchases. In relationships with clubs, companies, campuses and partners, professional contact details may also come from their organisation, an authorised partner or publicly available professional sources. The source and right to object are then stated no later than our first contact.
4. Recipients and processors
Data is available only to authorised people at AT FOOSBALL ACADEMY and, where necessary, to the following service providers:
- Clerk, account authentication and security ;
- Convex, database and application functions ;
- Vercel, website hosting and delivery ;
- Stripe, payments and membership management once sales open ;
- Resend, delivery of service emails and authorised communications.
We do not sell or rent your data. It may be disclosed to an authority only where we are legally required to do so.
5. Retention periods
- Account and progress: for the life of the account, then deleted or anonymised after closure, except for data needed as evidence of a contract or to comply with an obligation.
- Enquiries and prospects: up to three years after the last active contact, then deleted or archived where justified by law.
- Contracts and complaints: for the duration of the relationship and up to five years afterwards for evidential purposes.
- Invoices and accounting records: ten years.
- Marketing objections: the minimum information needed is retained to respect your choice over time.
- Technical and security logs: up to twelve months, unless an incident requires longer retention.
6. Transfers outside the European Economic Area
Some providers are based in the United States or use subprocessors there. Where processing involves a transfer outside the European Economic Area, it is covered by a recognised safeguard: an applicable adequacy decision, the Data Privacy Framework for certified organisations, the European Commission's standard contractual clauses and, where necessary, supplementary measures.
You can review the safeguards published by each provider in the data processing agreements of Clerk, Convex, Vercel, Stripe and Resend.
8. Your rights
Depending on the processing concerned, you may request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interests, and withdraw your consent at any time for the future.
Email contact@at-foosball.fr with details of your request. We will ask for proof of identity only where there is reasonable doubt. We normally reply within one month. You may also lodge a complaint with the CNIL.
9. Security and updates
Appropriate technical and organisational measures are used to limit unauthorised access, loss, alteration or disclosure. No system is entirely risk-free; any confirmed incident is handled in accordance with the applicable obligations.
This policy may change as our services or providers evolve. The effective date appears at the top of the page; any material change will be brought to your attention through an appropriate channel.