1. Who is responsible
The data controller is Veras Academy Luxembourg, 4-6 Avenue de la Gare, Boulevard de la Pétrusse, L-1610 Luxembourg. For any question about your data, write to verasacademyluxembourg@gmail.com.
2. The data we process
Depending on how you use the website, we process your account and contact details, the profiles of the family members you manage, your profile photo, academy and class preferences, bookings and attendance, memberships and payment references, the documents you sign (waiver, parental consent), your messages to the academy, your phone-notification settings and limited technical error reports.
Card details are handled by Stripe. We never store full card numbers or security codes.
3. Why we use them
- Accounts, bookings and memberships: to perform the membership contract.
- Payments, invoices and accounting records: contract and legal obligations.
- Service e-mails (booking confirmations, cancellations, reminders): contract and legitimate interest.
- Security, fraud prevention and server error diagnosis: legitimate interest.
- Optional browser error reports: your consent, which you can withdraw at any time.
- Phone notifications: only after you switch them on yourself in your account. You can switch them off at any time.
- Photos and videos taken at training: as set out in the waiver.
4. Who helps us
We use Supabase (accounts, database and file storage), Stripe (payments), Resend (e-mails) and Netlify (hosting). They process data on our behalf under their own contractual and security commitments. We do not use advertising or tracking tools, and we do not sell your data.
5. How long we keep them
Account and membership data are kept as long as needed to provide the service and to meet our legal obligations. Payment and accounting records are kept for the period required by law. Error reports are deleted after about 90 days. Data we no longer need are deleted or anonymised.
6. Your rights
Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Withdrawing a consent does not affect what was done before. Write to verasacademyluxembourg@gmail.com. You can also complain to the Luxembourg data protection authority (CNPD).
7. Security
Access to data is restricted by role, the database applies row-level security, connections are encrypted (HTTPS) and error reports are cleaned of e-mail addresses and keys. No system is perfectly secure, so we keep the platform updated and review incidents.
8. Children
Children up to 12 are managed by their parent from the family account. A teenager can have their own login only with a parental consent signed by the parent (parental consent). From 17, the member has a separate account.
9. Cookies
See the cookie policy.
10. Changes
We update this policy when the service or the law changes. The latest version is always published on this page, with its date.