Personal data protection

The association processes members' data to manage memberships, licences and the safety of everyone training. This page sets out exactly what is collected, why, and how to exercise your rights.

What we collect and why

Managing your membership: Name, date of birth, address, email and phone number. Needed to set up the membership and the federation licence.; Legal basis: Performance of the membership contract
Parental authorisation for minors: The legal guardians' identity and contact details, and their electronic signature on the parental authorisation. Where a teenager registers on their own, a link is sent to their guardian to collect that signature.; Legal basis: Legal obligation and performance of the contract
Medical information: A medical certificate and, if you choose to provide it, information that matters in an emergency (allergies, medication). Visible only to the committee and the relevant coaches, never published.; Legal basis: Vital interests and the legal requirements of sport
Membership payment: Amount due, payment method, reference and date received. The club stores no bank details belonging to members.; Legal basis: Performance of the contract and accounting obligations
Profile photo: Required. Every member file carries a photo so that coaches can identify practitioners on the mat. Stored in a private area, never publicly accessible and never passed to third parties. You may ask for it to be replaced or deleted, and you may object to this processing at any time.; Legal basis: Legitimate interest of the association (identifying practitioners)
Image rights: Your choice about publishing photos taken at training and competitions: allowed, refused, or allowed with your face blurred. Changeable at any time.; Legal basis: Consent
Training attendance: Attendance history, used to follow groups, to know who was present if there is an accident, and to count sessions on the pay-per-session option.; Legal basis: Legitimate interests of the association

No biometric data

The club collects no biometric data today: no facial recognition, no fingerprints. A check-in terminal is under consideration for later; if it goes ahead it will come with specific information, separate explicit consent, and an equivalent alternative (badge or code) for anyone who would rather not use it.

How long we keep data

Membership data is kept for the season and then three years, so re-registration and licence obligations can be handled. Accounting records are kept for ten years, as the law requires. Medical certificates and photos are deleted when membership ends, or on request.

Who can see the data

Only committee members and, for the information they need, the coaches. Data is hosted with Vercel Inc. and stored with Supabase (AWS eu-west-3, Paris). Club emails (parental authorisation, registration confirmation) are delivered by Brevo (Sendinblue SAS, Paris), which receives your name and email address for that purpose. To recognise an address as you type it into the form, and to place it on a map only the committee can open, your street, postcode and town — never your name — are sent to Base Adresse Nationale (data.geopf.fr, IGN/DINUM) for French addresses and to Photon (komoot GmbH, OpenStreetMap) for Swiss, German, Belgian and Luxembourgish ones; the answer is stored so the request is not repeated every time the map is opened. The federation receives only what is strictly necessary to issue licences. If you play a video on a discipline's page, YouTube or Vimeo then receives your IP address as the host of that video; that transfer happens only after your click. No data is sold or transferred for commercial purposes.

The site carries no advertising trackers. The only cookies used are technical ones: keeping you signed in when you log in, remembering your language, and — for the duration of a sign-in through Google or Microsoft — remembering which step of the form you were on. That last one expires after ten minutes. There is one exception: a discipline's own page may carry a video hosted by YouTube or Vimeo. The player loads only if you press play, and until you do, no request is made to those services — not even for a thumbnail. From that click on, the service receives your IP address and your browser details, and may set its own cookies, over which the club has no control.

Audience measurement

We use Vercel Web Analytics to count visits and see which pages are read — so the committee can tell whether the Forum des associations poster worked, for instance. It sets no cookie and stores no identifier on your device, so it cannot follow you across sites or recognise you on a later visit. What is collected is limited to the page viewed, the country, the device type and the referring page, in aggregate. The parental consent link sent to families is redacted before anything is sent: the token it contains never leaves the browser. Audience measurement strictly limited to this purpose and not shared is exempt from prior consent under CNIL's guidelines.

Your rights

See the data the club holds about you or your child
Have inaccurate information corrected
Ask for your data to be deleted, subject to accounting and legal obligations
Ask for processing to be restricted
Receive your data in a readable format
Withdraw your consent for image publication, or object to your photo being used in the internal roster, without this affecting your membership

To exercise these rights, email the committee: mma.saintlouis.fr@gmail.com

If the club's answer does not satisfy you, you can complain to the CNIL (www.cnil.fr).