Privacy policy

1. Introduction and scope

Athletis provides all-in-one software for sports coaches, covering client tracking, payments, invoicing, automatic reminders, and a website builder, delivered as a SaaS accessed online. Protecting personal data is a core part of how we run this service, and we process personal data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the French Data Protection Act (loi n°78-17 du 6 janvier 1978, loi Informatique et Libertés).

This policy explains what personal data we collect, why, on what legal basis, how long we keep it, who receives it, and the rights you have. It covers both our marketing website athletis.app and the application my.athletis.app. It applies to visitors, prospects, account holders, and the individuals whose data is processed within the application.

2. Data controller

The data controller for the marketing site, prospect data, account data, and billing data is Athletis, a company being incorporated. Its statutory identification details (legal form, share capital, registered office, SIREN/RCS, and VAT number) are pending and will be published on registration: [to be completed at registration]. The publication director is Aymen Ezzayer, acting as legal representative of Athletis. Full identification and hosting details are set out in our legal notice.

For any question about this policy or to exercise your rights, contact us at hello@athletis.app.

3. Definitions

Personal data: any information relating to an identified or identifiable natural person, such as a name, an email address, or an IP address.
Processing: any operation performed on personal data, such as collection, storage, use, transmission, or deletion.
Data controller: the party that determines the purposes and means of a processing operation.
Processor (sous-traitant): a party that processes personal data on behalf of, and on the documented instructions of, a controller.
Data subject: the identified or identifiable natural person to whom the personal data relates.

4. Data we collect

We collect personal data by category and source:

Navigation and technical data: connection logs, IP address, browser and device characteristics, and pages viewed, processed at the hosting and CDN layer by Cloudflare to deliver and secure the site.
Contact and newsletter form data: the name, email address, and message content you submit, together with the IP address processed by Cloudflare Turnstile for anti-bot protection of the form.
Account data: the name, email address, and authentication credentials used to create and access your Athletis account.
Billing data: the information needed to manage your subscription and issue invoices, such as billing identity, plan, amounts, and payment status.
Business data entered in the application: the content you record to run your coaching activity, including the personal data of your own clients (identity, contact details, sessions, and payments).

5. Roles

Athletis is the data controller for account data, billing data, and prospect and lead data, because we determine why and how these are processed.

For the personal data of a coach's own clients entered inside the application, the coach is the data controller and Athletis acts as processor (sous-traitant). This relationship is governed by a data-processing agreement (DPA) under which Athletis processes that data solely on the coach's documented instructions and for the sole purpose of providing the service.

6. Purposes and legal bases

Each processing purpose relies on a specific legal basis:

Providing and operating the service (account creation, access, coaching features, invoicing tools): performance of the contract with you (art. 6(1)(b) GDPR).
Managing subscriptions and payments: performance of the contract and compliance with our legal obligations.
Security, fraud prevention, and anti-bot protection of forms (including Cloudflare Turnstile): our legitimate interest in keeping the service and the site secure (art. 6(1)(f) GDPR).
Handling contact requests: our legitimate interest in responding to messages you send us.
Sending the newsletter: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.
Keeping accounting and invoicing records: compliance with a legal obligation (art. 6(1)(c) GDPR).

We never sell personal data, and we do not use it for advertising or third-party marketing.

7. Whether data is required

Fields marked as required are necessary to deliver the requested feature. On the contact form, a name, an email address, and a message are needed for us to reply; on the account, an email address and credentials are needed to create and secure your access; billing identity is needed to issue a valid invoice. Without this data we cannot provide the corresponding service.

Other fields, such as newsletter subscription or optional details you choose to add to your records, are optional. Declining them has no effect on your access to the core service, though it may reduce certain conveniences (for example, you will not receive the newsletter).

8. Recipients and processors

Personal data is accessible only to authorised Athletis staff who need it for their duties, and to the external processors listed below. Each processor acts on our documented instructions and under a contract that meets art. 28 GDPR.

Cloudflare, Inc.: hosting, content delivery, and Turnstile anti-bot protection.
Mailjet (a Sinch company): outbound email delivery, with servers in the European Union.
OVHcloud: inbound mailboxes, hosted in France.
Mollie: payment service provider for subscriptions (Netherlands, European Union). Payment and card data is handled by Mollie; Athletis does not store full card details.
Scaleway: application and database hosting (France, European Union).

We may also disclose data where required by law or to competent authorities on a valid request.

9. Transfers outside the EU

Personal data is stored primarily in the European Union (OVHcloud in France and Mailjet in the EU). Because Cloudflare is a United States company, some transit of technical data may leave the European Union. Such transfers are covered by the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, which provide appropriate safeguards under Chapter V of the GDPR.

10. Retention

Prospect and lead data: up to 3 years from the last contact with you.
Account data: for the life of the account, then deleted or anonymised after closure (subject to legal retention below).
Accounting and billing records: 10 years, as required by the French Commercial Code (Code de commerce).
Technical logs: kept for a limited period for security and troubleshooting, then deleted.
Cloudflare Turnstile data: short-lived, retained only as needed to validate the anti-bot check.

Business data entered in the application is retained for as long as the coach's account is active and is handled per the data-processing agreement.

11. Security

We apply technical and organisational measures appropriate to the risk. These include encryption of data in transit and at rest, strict access control on a need-to-know basis, hosting within the European Union, and data minimisation so that we collect only what each purpose requires. Access to production systems is restricted and monitored, and our processors are selected for their own security guarantees. We keep these measures under review and adjust them as the service evolves.

12. Your rights

Under the GDPR and the loi Informatique et Libertés, you have the right to: access your data; rectify inaccurate data; request erasure; restrict processing; data portability; object to processing based on legitimate interest; and withdraw your consent at any time (for example, for the newsletter) without affecting processing already carried out. You also have the right to give directives on the fate of your data after your death (art. 85 of the loi Informatique et Libertés).

To exercise these rights, email hello@athletis.app. We may ask for proof of identity where there is reasonable doubt. We respond within one month of receiving your request, extendable by two further months for complex or numerous requests, in which case we inform you.

Where the data concerns a coach's own clients processed within the application, requests should be addressed to that coach, who is the controller; we assist the coach as processor.

You have the right to lodge a complaint with the supervisory authority: CNIL, Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

13. Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not engage in profiling of that kind within the meaning of art. 22 GDPR.

14. Minors

The service is aimed at professionals (sports coaches) and is not directed at minors. We do not knowingly collect personal data from minors through the marketing site or the account sign-up. If you believe a minor has provided us with personal data, contact us at hello@athletis.app and we will take appropriate action.

15. Cookies

We use no audience-measurement or advertising cookies and no marketing tracking. The only client-side storage is strictly necessary items (your theme and language preferences) and Cloudflare Turnstile for anti-bot protection, all exempt from consent. Full details are set out in our cookie policy.

16. Changes to this policy

We may update this policy to reflect changes in the service, our processors, or applicable law. The "last updated" date shown at the top of this page governs, and the current version is always the one published here. Significant changes affecting your rights will be signalled by appropriate means.

17. Contact and complaint

For any question about this policy or about the processing of your personal data, contact us at hello@athletis.app. You may also visit our contact page.

If you consider that your rights are not respected, you may lodge a complaint with the CNIL, Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.