Information

Data protection

What data the club processes, why, who it shares it with, how long it keeps it — and your rights.

Automatic translation: only the French version is legally binding.

Policy drawn up under the Swiss Federal Act on Data Protection (FADP). Last updated: 14 October 2026.

1. Controller

World Bricpol Sport Academy
Route du Léman 33
1907 SAXON
SUISSE
contact@worldbricpol.com

For any question about your data: Contact page (subject “My personal data”), or by email.

2. Data processed

Member account: surname, first name, email, phone, date of birth, alias (T-shirt), price category, password (stored encrypted, never readable), preferences (email reminders), answer on image rights.
Child profiles (family account): first name, surname, date of birth, alias and image rights, entered by the legal guardian.
Public profile (optional): only what you choose to show — name (full, first name and initial, first name or alias), photo, introduction, disciplines, age or year of birth, length of membership, Instagram. It is only visible once you have published it, and it is not indexed by search engines. If you are also a club athlete, your athlete page may link to it while it is published (you are told about this in “My public profile”). A parent can also create one for each of their children, from “My family”, choosing what is shown.
Reduced rates: proof submitted (law enforcement card, student card or IPA certificate) and the club's decision.
Criminal record: the date on which you certified on your honour that you have a clean record. No criminal record extract is stored on the website.
Memberships, bookings and attendance: memberships, group classes booked, attendance recorded (QR code on the membership card), private lessons, seminars, massages, birthday parties, room hire, trial classes and trial week, progress in the training videos.
Competitions: name, sex, date of birth, weight, disciplines and combat mode, licence number and copy, medical certificate if required, results.
Payments and shop: amounts, items, delivery address, payment reference. Bank card or PayPal account details are entered with PayPal or Stripe: they never pass through the club's servers.
Contact page: name, email, phone (optional) and message.
Applications (instructor training, placement with a construction company): contact details, date of birth, municipality, desired trade and placement period, message, CV and other attachments; for an applicant under 18, the name and contact details of a parent.
Staff requests from companies (pathway): company, contact person, contact details and request.
Files for seminars and events “by application”: introduction and documents sent, viewed by the team that manages registrations.
Referral programme: personal code, link between referrer and referred friend, rewards.
Technical data: log of logins and actions in the member area and the administration (date, account, IP address, browser), and anti-abuse counters per IP address.

3. Why

Managing members, memberships and prices. The category (Child, Teen, Adult) is calculated automatically from the date of birth; the club corrects it on request.
Organising classes, attendance, seminars, competitions (age and weight categories, safety) and bookings.
Collecting payments, preparing and delivering orders, issuing receipts and invoices.
Writing to you: confirmations, reminders the day before (can be turned off in your profile), a follow-up after a long absence, replies to your messages.
Publishing, only with your consent: your public member profile, photos and videos of classes and events, athlete profiles; and competition results (name, club, ranking).
Showing the staff of classes, seminars and competitions (monitors, instructors, coaches and team members): on public pages, the name of anyone with a public profile at the club, otherwise the first name and the initial of the surname.
Protecting the website against abuse and meeting legal obligations (accounting).

The club does no targeted advertising or profiling, and neither sells nor rents any data.

4. Sensitive data and minors

Health: a medical certificate is only required for certain competitions. Only the competitions team can view it, and it is deleted 30 days after the competition.
Proofs (law enforcement, student, IPA): viewed only by the membership team to grant the reduced rate.
Minors: a child's account is created by their legal guardian, who answers for them on image rights and exercises their rights. A minor's public profile (their own, or one a parent creates for their child) is only published with the parents' consent, and only after it has been checked by the club team (then after every change).
Image rights: your answer is requested when you sign up and can be changed at any time in your profile.

5. Who has access

The club team: each person only has access to the sections assigned to them by a super administrator (members, competitions, applications, messages…). Every time a private document is viewed, it is logged.
OVHcloud (France): hosting of the website and database, sending of emails; and, if a video is played through its player, OVHcloud Video Center.
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and Stripe (Stripe Payments Europe, Ltd., Ireland): amount and description of the payment (and your email for Stripe). They process your payment data under their own privacy rules.
Shop suppliers (for example Combat Corner): name, delivery address and phone number, only when they ship an order directly to you.
Swiss Post: name and address on parcels sent.
Your referrer: your first name, when you create your account with their code.
The authorities: only if required by law.

6. Data abroad

The website is hosted in the European Union, whose data protection the Federal Council recognises as equivalent. PayPal and Stripe may process some data outside Switzerland and the European Union (in particular in the United States), with the safeguards required by law described in their own privacy policies.

7. Retention periods

Account and profile	As long as the account exists; deleted at your request.
Public profile	As long as you keep it: it disappears from the website as soon as you unpublish it, and it is deleted with the account.
Payments, orders, invoices	10 years (accounting obligation), including after the account is deleted, without the rest of the profile.
Proof for reduced rates	As long as the reduced rate applies; erased immediately if refused.
Medical certificates	30 days after the competition.
Licence copies	12 months after the competition (reusable for the next one until then).
Applications and attachments, staff requests from companies	12 months.
Files for seminars and events (introduction, documents)	12 months after the event.
Messages from the Contact page	12 months.
Log of logins and actions	12 months.
Anti-abuse counters	24 hours.
Confirmation and password links	Deleted 30 days after they expire.
Backups	The 30 most recent, one a day, then replaced.

8. Cookies and storage

The website uses a single cookie, wbsa_session, which is needed to stay logged in and to protect forms (30 days at most). The club's three websites (worldbricpol.ch, .shop and .com) each have their own; so that one login works on all three, moving from one site to another uses a one-time code valid for one minute (single sign-on), without any outside service. No advertising or tracking cookies, no external analytics tool (no Google Analytics), and no resources loaded from third parties (fonts, scripts). The club measures traffic on its websites itself, without cookies: for each page viewed, the page address, the site the visitor came from (for example “google.com”), the type of device (phone, tablet, computer), the browser language and an encrypted fingerprint of the IP address, which cannot be used to recover it and is only used to count visitors. This data is kept for 13 months, on our servers only. The club team's devices may receive a technical cookie that excludes them from these statistics. If you install the website on your phone, the “offline” page and your membership card are stored there so they can be shown without a network connection; the card is erased when you log out.

9. Security

Encrypted connection (HTTPS), passwords stored encrypted, private documents (CVs, proofs, licences, certificates) stored outside the public area and accessible only to the authorised team, access rights person by person, protection against bots and repeated attempts, daily backups.

10. Your rights

Access: obtain a copy of the data about you, in a common format.
Correction: directly in My profile; the email address and date of birth (after a first membership) are corrected by the club.
Deletion: your account, your child profiles and their history are deleted; only accounting records are kept for the legal period.
Withdrawing consent: image rights and email reminders, at any time in your profile.
Objection to any processing that is not necessary for your membership.

Make your request via the Contact page (subject “My personal data”) or to contact@worldbricpol.com. The club replies within 30 days and may ask you to confirm your identity. You can also contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you live in the European Union, you also have the rights provided by the GDPR, including the right to lodge a complaint with the data protection authority of your country.

Changes

This page may change along with the website; the date of the last update is shown at the top. See also the legal notice and club rules.