How we care for your data.

Who we are

Club des Champions S.A. is the data controller for the personal information described in this Policy. For any question about your data, contact us using the details in the footer or the address on your welcome documents.

What we collect

Depending on your relationship with the Club (applicant, member, or guest), we may collect:

• Identity, first and last name, date of birth, and photograph where needed for your membership profile.
• Contact, email, phone number, WhatsApp, address, and preferred language.
• Membership information, commitment length, payment history, check-in records, and guest passes used.
• Medical information, such as blood type, allergies, chronic conditions, medications, and emergency contact details, when provided with your consent for safety purposes.
• Application information, including referrer details and your reasons for joining. Applicants only.
• Technical information, such as IP address, device type, and cookies used by our website. See our Cookies Policy.

Why we use it

Your personal data helps us operate and improve your experience at the Club:

• To manage your membership, payments, check-ins, and reservations.
• To help keep you safe, including allowing authorized staff to consult relevant medical information when necessary during an incident.
• To contact you about receipts, renewal reminders, service updates, and events. You can decline optional communications at any time.
• To review and process your application, if you are an applicant.
• To improve our services, maintain security, and prevent fraud.

Legal basis

We process your data on the following bases: your consent where required, including for medical information and optional communications; the performance of a contract for your membership; our legitimate interests, including safety, service improvement, and fraud prevention; and legal obligations, including accounting and regulatory requirements.

Who can see your data

Access to member data inside the Club is limited according to each person's role and responsibilities. Front-desk staff see the information needed for check-in and payment recording. Managers may access operational information, payments, incidents, and reservations. Sensitive information, including medical information, is restricted to authorized personnel and accessed only when necessary. We never share member data with third parties for their own marketing purposes.

Third-party processors

We rely on service providers to operate parts of the Club's systems and services. These providers are expected to protect the data they process on our behalf:

• Supabase, for database, authentication, and secure file storage. Data may be hosted in the United States.
• Resend, for transactional email such as receipts, renewal reminders, and service updates. Data may be processed in the United States.
• Upstash, for caching and scheduling certain services. Personal information is limited to what is necessary for those functions.

International transfers

Some of our service providers may host or process data in the United States or other countries outside Haiti. Where this occurs, we take reasonable steps to ensure that appropriate safeguards are in place, including encryption in transit and at rest where supported.

How long we keep it

We keep your data only for as long as reasonably necessary for the purposes described in this Policy or as required by law:

• Active members, for the duration of your membership and for any additional period required for accounting, legal, or operational purposes.
• Medical information, for as long as reasonably necessary for safety and membership purposes, subject to applicable legal requirements.
• Application information, for as long as reasonably necessary to process and manage the application.
• Security and audit records, for as long as reasonably necessary for security, legal, and regulatory purposes.

Your rights

Depending on applicable law, you may have the right to:

• Access, request access to the personal data we hold about you.
• Correct, update inaccurate or incomplete personal information.
• Delete, request deletion of your personal information where we are not required by law to retain it.
• Portability, request a copy of your data in a machine-readable format where applicable.
• Object, object to certain processing, including optional communications.
• Complain, contact the Club first about a privacy concern and, where applicable, contact the competent authority.

Children's data

For children using the Kids Club, we collect only the information reasonably necessary for their care and safety, such as their name, date of birth, relevant allergies, and an emergency contact. Access is limited to authorized staff who need the information for these purposes.

Security

We use reasonable technical and organizational measures to protect personal information. Data is transmitted over encrypted connections such as HTTPS/TLS, and our service providers may encrypt data at rest. Access is restricted according to role, and authentication credentials are protected using appropriate security measures.

Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated to active members by email, and the effective date at the top of this page will reflect the current version.