Data Privacy Policy

1. Who is responsible for your data

Action Sport ASBL, a non-profit association with company number 0451.260.925 and its registered office at Rue Bruyn 105, 1120 Bruxelles, is responsible for the personal data processed on the MYA platform. For any question about your data, contact us at info@actionsport.be or +3227349416.

2. Personal data we collect

We collect the following data when you use the platform:

• Last name, first name
• Date of birth and gender
• Email address
• Phone number
• Nationality and national register number
• Postal address
• Payment information (processed by our payment provider; we never see or store your card number)
• Information related to your activity reservations
• For the participants you register (for example your children): name, date of birth, gender, national register number when needed for the tax certificate, and the health information you choose to share (such as allergies) so that the supervisors can take care of them
• When you sign in with itsme®: the data itsme sends us (see section 4)
• Technical data: device and browser information, and the cookies described in section 7

3. Why we use your data, and on what legal basis

We use your data to:

• Create and manage your account and sign you in (performance of our contract with you)
• Manage your reservations, payments and invoices, and keep you informed about them (performance of our contract with you)
• Issue the tax certificate for childcare costs (certificate 281.86), which mentions the national register number of the parent and of the child (legal obligation)
• Keep our customer file accurate and avoid duplicate accounts, including by checking the national register number (our legitimate interest in a reliable customer file)
• Take care of the participants during the activities, using the health information you shared (your explicit consent, which you can withdraw at any time)
• Measure how the platform is used in order to improve it (your consent, see section 7)
• Send you news and offers (your consent, which you can withdraw at any time)

We also keep accounting and tax records, because the law requires it.

4. Signing in with itsme®

You can create your account or sign in with itsme®, the digital identity app of Belgian Mobile ID SA/NV. When you choose itsme, the itsme app asks for your consent and then sends us your last name, first name, date of birth, gender, nationality, email address, mobile phone number, legal address and Belgian national register number, together with a technical identifier that itsme assigns to you for MYA. We use this data to:

• create your account or link itsme to your existing account. Before anything is created or linked, we send a code to the email address to confirm that it is yours;
• sign you in;
• keep your profile accurate: each time you sign in with itsme, your last name, first name, date of birth, gender, nationality, address and phone number are updated with the data from itsme. You receive a notification listing what was updated, and the change is recorded in your account history;
• check, with your national register number, that one person holds one account. Your national register number is not added to your profile automatically; you decide whether to add it, for example to receive the tax certificate.

The temporary data of an itsme sign-in and the copy of your last itsme sign-in are stored encrypted. Temporary sign-in data is deleted automatically within 48 hours. The link with itsme and the data from your last itsme sign-in are kept as long as itsme is linked to your account, and you can ask us to unlink it at any time. itsme processes your data as a separate controller, under its own privacy policy.

5. Sharing of personal data

We are committed to not selling, exchanging or renting your personal data to third parties. Your data may only be shared with:

• Service providers who process it on our behalf: payments (Stripe), sending emails (SendGrid), hosting and storage (Microsoft Azure), mobile app notifications (Google Firebase), error monitoring (Bugfender) and, if you accept them, measurement tools (Google Tag Manager, Microsoft Clarity)
• The sign-in service you choose to use: itsme, Google or Apple
• The partners and supervisors who run the activities you book, for what they need to supervise the participants
• Competent authorities when required by law

Some of these providers are established outside the European Economic Area. Such transfers are covered by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses.

6. How long we keep your data

We keep your data only as long as needed for the purposes above:

• Your account and profile: as long as your account is open. When you close it, we keep only what the law requires us to keep
• Invoices, payments, accounting records and tax certificates: for the period required by Belgian accounting and tax law
• Temporary data of an itsme sign-in: deleted automatically within 48 hours
• Marketing communications: until you withdraw your consent
• Measurement cookies: 13 months at most

7. Cookies and measurement

The platform uses cookies that are needed for it to work, for example to keep you signed in and to remember your basket and your language. Measurement tools (Google Tag Manager, Microsoft Clarity) only run if you have accepted them.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data against any loss, unauthorised access, alteration or disclosure. The temporary itsme sign-in data and the copy of your last itsme sign-in are stored encrypted, and access to personal data is limited to the staff who need it for their work.

9. Your rights

You have the following rights regarding your personal data:

• Right of access
• Right of rectification
• Right of deletion
• Right to restriction of processing
• Right to object
• Right to data portability
• Right to withdraw your consent at any time, without affecting the processing carried out before

To exercise these rights, contact us at info@actionsport.be. We may ask you to prove your identity. You can also file a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).

10. Modifications to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any modification will be published on this page with an updated revision date.

11. General terms and conditions

Bookings are subject to the general terms and conditions of Action Sport ASBL, which also contain a chapter on personal data: read the general terms and conditions. This Privacy Policy describes in more detail how the MYA platform handles your data.