1. Data controller
AT FOOSBALL ACADEMY, whose registered office is at 61 avenue de la Cholière, 44700 Orvault, France, is the controller for the processing described on this page. For any question or request concerning your data, email contact@at-foosball.fr.
2. Data, purposes and legal bases
| Situation | Data concerned | Purpose | Legal basis |
|---|---|---|---|
| Member account | Name, email address, account identifier, session and security data. Your password is managed by Clerk and cannot be accessed by AT Foosball Academy. | Create, secure and administer your account. | Performance of the requested service and legitimate security interests. |
| Enquiries and support | Name, email address, optional phone number, situation, message content and correspondence history. | Reply to and follow up your request. | Consent where requested by the form; steps taken before entering a contract or legitimate interests, depending on the request. |
| Online Academy | Plan, available content, progress, video position, quiz answers and results. | Provide the learning path, save your progress and manage access. | Performance of the contract once the service opens. |
| Purchases and legacy contracts | Offer, purchased modules, quote, verified discounts, status, Stripe session and payment references, refunds, disputes and available invoices; period and subscription references for legacy contracts. Stripe collects full card details directly. | Process purchases, establish module access rights, track refunds and disputes, handle invoicing and manage legacy contracts. | Performance of the contract and accounting obligations. |
| Commercial relationships and CRM | Professional contact details, organisation, role, interests, correspondence, consent, objections and email activity. | Manage prospects, customers, clubs and partners, and send relevant communications. | Legitimate interests for B2B relationships; consent where required; compliance with objections. |
| AT Foosball news | Email, first and last name, the choice made in the “Receive AT Foosball news” box with its date and origin (sign-up, purchase or profile), unsubscriptions and email activity. | Send news, events and offers by email only to people who ticked the box. | Consent, given through a box that is unticked by default and can be withdrawn at any time from the profile or the unsubscribe link in every email. |
| Operation and security | IP address, technical logs, device, browser, security events and strictly local preferences. | Operate, diagnose and protect the service. | Legitimate interests in security and continuity. |
| Audience measurement | Address of the page viewed (without parameters or tokens), referring page, date and time, approximate location, device type, browser and operating system. No cookies (see section 7). | Understand how the site is visited and improve its content using aggregated statistics. | Legitimate interest in measuring how the site is used. |
| Map on the Trouver page | IP address and technical data of the tile requests (browser, time, tiles requested, which match the area displayed), sent by your browser to IGN; town or area entered in the search. | Display the base map and place players and venues approximately at the official centre of their town. | Legitimate interest in offering the search for players and places to play. |
| Player directory (Find page) | Nickname (otherwise first name and last-name initial), city, playing style and Leagues of the player, published only if they ticked “Appear in the player directory”. No email, phone number or date of birth. | Let players find each other near where they live. Consent is given at sign-up or from the profile, never by default, and can be withdrawn at any time from the profile: the listing then disappears from the directory. | Consent. |
| Messages between players | Message text, sender’s nickname and email address, recipient’s email address as confirmed by Clerk, date sent. | Forward by email a player’s message to a player in the directory who accepts messages. The recipient’s address is never shown to the sender. The sender’s address is passed on to the recipient, with the consent the sender gives for each message, so the recipient can reply. A log (sender, recipient, date, without the text) is used to limit sending. Each player can turn off “Receive messages from players” in their profile. | Sender’s consent for sharing their address; performance of the requested service and legitimate interest in preventing abuse. |
| “Complete your profile” reminder | First name, email address confirmed by Clerk, account language. | Invite each registered member once to complete their profile and, if they wish, to join the directory. It is not sent to members who objected to reminders and includes a link to stop receiving them. | Legitimate interest in making the service known to registered members, respecting their objection. |
Required fields are identified when data is collected. Without them, we cannot create the account, process the request or provide the relevant service. We do not carry out automated commercial profiling or make solely automated decisions that produce legal effects.
3. Data sources
Most data comes directly from you through your account, forms, correspondence, use of the platform or purchases. In relationships with clubs, companies, campuses and partners, professional contact details may also come from their organisation, an authorised partner or publicly available professional sources. The source and right to object are then stated no later than our first contact.
4. Recipients and processors
Data is available only to authorised people at AT FOOSBALL ACADEMY and, where necessary, to the following service providers:
- Clerk, account authentication and security ;
- Convex, database and application functions ;
- Vercel, website hosting and delivery, anonymous audience measurement ;
- Stripe, purchase payments and management of legacy contracts when sales open ;
- Resend, delivery of service emails and authorised communications ;
- IGN, French National Institute of Geographic and Forest Information, which serves the Plan IGN base maps of the Trouver page through its Géoplateforme.
To display the map on the Trouver page, your browser sends tile requests directly to IGN, which include your IP address and the technical data needed to deliver them. IGN receives this data to provide its service, under its terms of use.
The search by town and radius relies on the official centre of each town: our servers obtain it from the API Découpage administratif (geo.api.gouv.fr) using town names, with no request from your browser. Your device is never geolocated and no precise address is requested or calculated.
We do not sell or rent your data. It may be disclosed to an authority only where we are legally required to do so.
5. Retention periods
- Account and progress: for the life of the account, then deleted or anonymised after closure, except for data needed as evidence of a contract or to comply with an obligation.
- Enquiries and prospects: up to three years after the last active contact, then deleted or archived where justified by law.
- Contracts and complaints: for the duration of the relationship and up to five years afterwards for evidential purposes.
- Invoices and accounting records: ten years.
- Marketing objections: the minimum information needed is retained to respect your choice over time.
- Technical and security logs: up to twelve months, unless an incident requires longer retention.
- Messages between players: the sending log and the copy of the message kept with the email history are deleted 90 days after sending.
6. Transfers outside the European Economic Area
Some providers are based in the United States or use subprocessors there. Where processing involves a transfer outside the European Economic Area, it is covered by a recognised safeguard: an applicable adequacy decision, the Data Privacy Framework for certified organisations, the European Commission's standard contractual clauses and, where necessary, supplementary measures.
You can review the safeguards published by each provider in the data processing agreements of Clerk, Convex, Vercel, Stripe and Resend.
8. Your rights
Depending on the processing concerned, you may request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interests, and withdraw your consent at any time for the future.
Email contact@at-foosball.fr with details of your request. We will ask for proof of identity only where there is reasonable doubt. We normally reply within one month. You may also lodge a complaint with the CNIL.
9. Security and updates
Appropriate technical and organisational measures are used to limit unauthorised access, loss, alteration or disclosure. No system is entirely risk-free; any confirmed incident is handled in accordance with the applicable obligations.
This policy may change as our services or providers evolve. The effective date appears at the top of the page; any material change will be brought to your attention through an appropriate channel.