Privacy policy

1. Controller and contact details

The controller of the data described in section 3 is Kynologic spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), registered office: ul. Półwiejska 17/26, 61-888 Poznań, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the KRS, under KRS number 0001066149, tax identification number (NIP) 7831890477, REGON 526785413, share capital PLN 5,000.00 ("Kynologic", "we", "us").

For any question about personal data, please e-mail kontakt@flexatiq.pl or write to our registered office. We have not appointed a data protection officer – we are not required to (Article 37 GDPR); please contact us directly about your data.

2. Two roles: controller and processor

• As controller we process the data of website visitors, of people who e-mail us (including demo requests), of the people who register and represent a club (the club account), and billing data relating to clubs.
• Members' data – the data of people who buy memberships, book classes and use the member app – and any other data a club enters into Flexatiq, we process on the club's behalf. The club is the controller of that data and we act as its processor under a data processing agreement (Article 28 GDPR), which we make available to clubs.

If you are a club member and want to exercise your rights (for example to access or erase your data), please contact your club – the club decides why and how your data is processed. If your request reaches us, we will pass it on to the club.

3. Data we process as controller

For each category we state the purpose, the legal basis and how long we keep the data.

• Website visits – IP address, date and time, the page requested and browser information, recorded in server logs. Purpose: operating and securing the website, detecting abuse. Legal basis: our legitimate interests (Article 6(1)(f) GDPR). Retention: 90 days.
• E-mail correspondence, including demo and pricing requests – your e-mail address, name, club name and whatever else you include in your message. The website has no contact form: the “Contact”, “Talk to us” and “Book a demo” buttons open your e-mail program (a mailto link). Purpose: replying to you and preparing an offer. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interests in replying to messages (Article 6(1)(f) GDPR). Retention: until the matter is closed and then for 3 years (the limitation period for claims between businesses under Polish law).
• Club registration and the club account – club name and identifier, type of venue, tax number (optional), the account owner's e-mail address and password (stored only as a cryptographic hash), and details of the people representing the club. Purpose: entering into and performing the contract for the Flexatiq service, including the trial period, and contacting you about the account and the service. Legal basis: contract (Article 6(1)(b) GDPR); for the people representing the club – our legitimate interests in communicating with our customer (Article 6(1)(f) GDPR). Retention: for the term of the contract and then 30 days to export data, then deletion within a further 30 days; invoice data is kept for 5 years from the end of the tax year.
• Billing and invoices – the club's invoicing details (name, address, tax number) and payment history. Invoices to Polish clubs are issued through the Polish National e-Invoicing System (KSeF). Purpose: billing, invoicing, tax and accounting obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR). Retention: 5 years from the end of the calendar year in which the tax payment deadline fell.
• Login and registration protection – the IP address and login (e-mail address) of failed login attempts, and the IP address used to register a club. We store only attempt counters, to block password guessing and mass account creation. Legal basis: our legitimate interests in keeping the service secure (Article 6(1)(f) GDPR). Retention: the failed-login counter expires after 15 minutes (a successful login clears the account counter immediately); the registration counter for an IP address expires after one hour.
• Establishing, exercising or defending legal claims – data from the categories above, to the extent necessary. Legal basis: our legitimate interests (Article 6(1)(f) GDPR). Retention: until the relevant limitation periods expire.

Providing data is voluntary, but a club account cannot be created without an e-mail address and a password, and an invoice cannot be issued without invoicing details.

Our role regarding club staff data (staff accounts created by the club in the dashboard): we process club staff data on the club's behalf as a processor under the data processing agreement; the club is the controller. We are a controller only for the account owner's data needed to conclude the contract and for billing.

4. Members' data (processing on behalf of clubs)

A club using Flexatiq keeps its members' data in it – for example name, contact details, memberships and their history, class bookings, check-ins, payments, invoices and training progress. We process this data only on the club's instructions and to the extent needed to provide the service, and we never use it for our own purposes.

Members' online payments (Tpay, Przelewy24, PayU, Espago, Stripe) go directly to the club's own account with the payment provider the club has chosen, under the club's contract with that provider. Kynologic does not receive, hold or transfer those funds and does not receive payment card details.

The details – scope, security measures, sub-processors and deletion of data after the contract ends – are set out in the data processing agreement with the club. Members are informed about the processing of their data by the club, as controller.

5. Who we share data with

• Hosting and server infrastructure: Xerti Tech Sp. z o.o. (SewNET infrastructure, two data centres in Poland); servers in the European Union (Poland).
• Outgoing e-mail (account messages, invitations, notifications): Xerti Tech Sp. z o.o. – the same provider and infrastructure as hosting.
• The Polish National e-Invoicing System (KSeF), operated by the Minister of Finance – for invoices.
• Kynologic's accountants and legal and tax advisers – for invoice and contract data, under confidentiality agreements.
• Public authorities – only where the law requires it.

We do not sell data, we do not use it for advertising and we do not profile website visitors.

6. Transfers outside the European Economic Area

We process data in the European Union (Poland) and do not transfer it outside the European Economic Area. If a club chooses a payment provider that transfers data outside the EEA (for example Stripe), this happens under the club's contract with that provider and the provider's data protection terms.

7. Cookies and browser storage

We use only the cookies and browser storage that are strictly necessary for the service to work. We do not use analytics or advertising cookies, website statistics tools or third-party tracking scripts, and our fonts are served from our own server. That is why we do not ask for cookie consent.

• Login session (cookies hp_at and hp_rt in the club dashboard, hm_at and hm_rt in the member app) – not readable by page scripts (httpOnly); set only after you log in and removed when you log out; a session expires after 30 days at the latest without renewal.
• Language (cookie flexatiq-locale) – remembers the language you chose in the app for 12 months. On flexatiq.pl and flexatiq.eu the language follows the domain.
• Browser storage (localStorage, never sent to the server): light/dark theme (flexatiq-theme), the club identifier last used on the login screen (flexatiq-club) and the club location selected in the dashboard (flexatiq-location).

You can delete or block cookies in your browser settings, but logging in will then not work.

8. Your rights

You have the right to access your data and obtain a copy of it, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interests. Please send requests to kontakt@flexatiq.pl – we reply within one month.

You also have the right to lodge a complaint with a supervisory authority – in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in the EU/EEA country where you live or work.

9. Security

Connections to the service are encrypted (HTTPS). Passwords are stored only as cryptographic hashes. Each club's data is separated from other clubs' data at database level as well (row-level security).

Backups: taken daily, encrypted and kept in a second data centre in Poland for 35 days, after which they are overwritten.

10. Changes to this policy

We will announce material changes to this policy on this page and, for clubs, also by e-mail. The version date is shown at the top of the document.