This portal and its app are offered by Contakt Academy. The club is the data controller; the technical service provider processes data solely on the club's behalf.
Account & membership: name, e-mail, phone, address, date of birth and household composition.
Lessons & programs: enrollments, attendance, and for children their progression and achieved levels.
Photos: profile photos — for children under 16 only with a parent's or guardian's consent, manageable per child on the Family page.
Messages: class chat, the office line, notifications, and — when the club uses the registration channel — subjects, content, and permitted attachments from registration correspondence.
Payments: what you paid and what for. Bank or card details go directly to payment provider Mollie and are never stored by us.
To run your membership and enrollments (contract), club administration (legitimate interest), statutory retention duties (invoices: 7 years), and — with consent only — children's photos and news updates.
For children under 16 we ask a parent/guardian for consent for photos and progress sharing. Parents toggle these per child on the Family page and can withdraw at any time; the photo is then deleted immediately. Every decision is recorded.
Only services needed to run the platform: Render for application hosting, Supabase for the EU-region database and private storage, Resend for transactional and registration email, Mollie (Netherlands) for payments, and Apple for push notifications. We never sell data.
Resend's selected eu-west-1 region controls mail routing and dispatch, not data residency: its primary processing and account-data storage take place in the United States. Resend's published data-processing agreement names the EU Standard Contractual Clauses and participation in the EU-US Data Privacy Framework as transfer safeguards. Resend may retain email data, including sent and received message content and metadata, for up to 30 days.
For the duration of your membership or enrollment, then per our schedule: profiles 2 years; children's progression 1 year after the last enrollment; children's photos at most 6 months after the last enrollment or immediately on consent withdrawal; invoices 7 years (statutory). For registration correspondence, the subject, message content, intake and event details, and attachment content are scrubbed after the ticket has remained closed for 365 days. Contact and routing identifiers plus operational timestamps can remain in the ticket and delivery record for security, audit, thread handling, and privacy-request enforcement until they are no longer needed. A valid privacy request may require earlier action.
Contact the club office to request access, rectification, restriction, objection, erasure, or a portable copy. Erasure does not apply where a statutory retention duty or another valid legal ground requires continued storage. You may also complain to the Dutch DPA (Autoriteit Persoonsgegevens).
Encrypted connections, role-based access, audit logging of administrative actions, and private attachment storage in the EU database environment. Valid privacy requests may require earlier deletion.
Last updated: August 11, 2026