Privacy policy

The data controller is Mathilda Metanila, a sole trader operating under the trading name Aguanilé (RIDET 1 622 281.001), who can be reached at 5, rue Victor Hugo, Orphelinat, 98800 Nouméa, New Caledonia, and at [email protected] (hereinafter “the school”).

The school has not appointed a data protection officer, as this is not mandatory given the nature and volume of its processing. Any question about your data can be sent to [email protected].

Processing is carried out in accordance with French Law no. 78-17 of 6 January 1978 on information technology, data files and civil liberties (loi Informatique et Libertés), which applies in New Caledonia, and with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) to which that law refers. Where the GDPR applies directly, in particular to people located in the European Union, the school also complies with it. The competent supervisory authority is the French data protection authority (CNIL).

Each processing operation is described below: data concerned, purpose, legal basis and retention period. Mandatory form fields are marked; without them, the request cannot be handled. The school only collects the data needed for each purpose.

3.1. Contact requests

Data

first name, email address, phone number (optional), subject and content of the message.

Purpose

replying to your request and following up on the exchange.

Legal basis

your consent, given by ticking the box on the form, which you may withdraw at any time.

Retention

for as long as it takes to handle the request, then no more than three years after the last exchange. If you become a student, the relevant data is added to your registration file.

3.2. Registrations and student follow-up

Data

first name, last name, email address, WhatsApp number, preferred language, option and slots chosen, declared profile (under 25, couple), partner's first name for a couple registration, payment method and number of cheques, any message, date and time of acceptance of the terms of sale and version accepted, registration status and internal notes related to its follow-up.

Purpose

managing your registration, organising classes (slots, bookings, practical information, timetable changes), providing teaching follow-up and managing our relationship with you, applying price benefits.

Legal basis

performance of the contract with you or steps taken at your request before entering into it.

Retention

for the duration of the relationship, then three years after the end of the last season attended. The elements needed to prove the contract (option, price, date of acceptance of the terms, payments) are then archived, with restricted access, for five years after the end of the contract.

The “under 25” profile is based on your own statement: the school does not collect your date of birth and may only ask to see proof of age, without keeping it. If you give your partner's first name, please let them know.

3.3. Registration-related communications

Data

email address, WhatsApp number, content of messages, technical log of sent messages (recipient, subject, date, delivery status).

Purpose

sending you the summary of your registration, confirmations and practical information, by email and, where applicable, on WhatsApp.

Legal basis

performance of the contract.

Retention

messages: for the duration of the relationship; sending log: twelve months.

3.4. Payments

Data

payment method, amount, date, reference and status of the payment, instalment schedule, payment incidents and refunds; for an online payment, the transaction identifier and result sent by Mobupay. The school neither receives nor stores any card data: the card is entered on Mobupay's page and, for payment in instalments, stored by Mobupay alone.

Purpose

collecting the price, monitoring instalments and unpaid amounts, making refunds, preventing payment fraud and handling payment disputes.

Legal basis

performance of the contract; for fraud prevention and the handling of disputes, the school's legitimate interest in securing its payments.

Retention

for the duration of the relationship; supporting documents are then kept for accounting purposes (section 3.5).

3.5. Accounting

Data

student's identity, option, amounts, discounts, payment dates and methods.

Purpose

keeping the school's accounts and supporting its income.

Legal basis

compliance with legal accounting and tax obligations.

Retention

ten years from the end of the financial year.

3.6. Photographs and videos

Data

image and, where applicable, voice of students and participants.

Purpose

illustrating and promoting the school's activities on the website and its social networks.

Legal basis

your consent for images in which you are recognisable and singled out; the school's legitimate interest in reporting on its events for general shots, subject to your right to object (Article 13 of the terms of sale).

Retention

until you withdraw your consent or object, and no more than five years from the date the image was taken.

3.7. Social media posts displayed on the website

Data

public posts from the school's Instagram, TikTok and Facebook accounts (caption, image, thumbnail, date, counters), which may show people.

Source

posts are retrieved through third-party programming interfaces (RapidAPI); their thumbnails are copied to the website's servers. No visitor data is sent to these services.

Purpose

showing on the website the news published by the school on its social networks.

Legal basis

the school's legitimate interest.

Retention

for as long as the post is online on the original network and displayed on the website. Any post can be hidden on request to [email protected].

3.8. Website security and abuse prevention

Data

IP address, date and time, page requested, browser and technical request data, technical signals analysed by the anti-bot service, number of form submissions.

Purpose

keeping the website secure and available, detecting and blocking bots, abusive submissions and intrusion attempts.

Legal basis

the school's legitimate interest in protecting its website and its users.

Retention

no more than twelve months for server logs.

3.9. Website administration

Data

name, email address, password hash, role and permissions, authentication factors, log of logins and operations performed.

Purpose

managing access for the people authorised to administer the website and keeping a record of operations.

Legal basis

the school's legitimate interest in securing the administration of the website.

Retention

for as long as the authorisation lasts; logs: twelve months.

3.10. Audience measurement

Data

identifier set by a cookie, pages viewed, visit duration, referring website, device and browser type, approximate location derived from the IP address.

Purpose

measuring website traffic and improving its content, using Google Analytics.

Legal basis

your consent, given through the cookie banner, which you may withdraw at any time (section 8).

Retention

cookies: no more than thirteen months; statistical data: no more than fourteen months.

No decision producing legal effects concerning you is taken solely on the basis of automated processing. Your data is never sold or rented, and is not used for marketing without your prior consent.

Your data is only accessible to the school's authorised people, within the limits of their duties. It is disclosed, solely for the purposes described, to the following providers, who act on the school's instructions as processors unless otherwise stated:

• OVH Australia Pty Ltd (OVHcloud), hosting of the website and its database, on a dedicated server located in Sydney (Australia);
• Cloudflare, Inc., delivery and protection of the website, Turnstile anti-bot service: United States, with a network of servers around the world;
• Postmark, a service of ActiveCampaign, LLC, sending of transactional emails: United States;
• Scaleway SAS, storage of encrypted backups: France;
• Mobupay, online card payment: New Caledonia; Mobupay receives the reference, content and amount of the order, the payer's email address and language, and the card details entered on its page, in order to carry out the payment, store the card for payment in instalments and prevent fraud; it processes payment data as a payment provider and acts as data controller for its own legal obligations;
• Meta Platforms (WhatsApp), when you communicate with the school on WhatsApp or receive the summary of your registration that way: European Union and United States;
• ERIS SARL, design, maintenance and technical support of the website, which only accesses data as needed for its work;
• ERIS SARL, under the name Dolipro, hosting of the school's invoicing software (Dolibarr), which receives the student's name, email address and phone number, plan and payments, to issue invoices and credit notes: server located in Sydney (Australia), with OVH Australia Pty Ltd;
• where applicable, the school's accountant, the bank that collects cheques and transfers, and administrative or judicial authorities, in the cases provided for by law.

Where you have accepted audience measurement, Google Ireland Limited and Google LLC (United States) receive the data described in section 3.10.

Some third-party services are contacted directly by your browser and act under their own responsibility: OpenFreeMap, which provides the background and fonts of the map of the studios; Google Maps, when you click a “Directions” link; Instagram and TikTok, when you choose to play one of their posts. Their privacy policies then apply.

Some providers process your data outside New Caledonia and the European Union. These transfers are safeguarded as follows:

• Australia (hosting, OVHcloud): Australia is not covered by an adequacy decision of the European Commission; the transfer relies on the standard contractual clauses adopted by the European Commission, included in the host's data processing agreement;
• United States (Cloudflare, Postmark, Meta and, where applicable, Google): these providers participate in the EU-US Data Privacy Framework, recognised as adequate by the European Commission's decision of 10 July 2023, and also offer the standard contractual clauses;
• France (Scaleway): no transfer outside the European Union.

A copy of the applicable safeguards can be obtained by writing to [email protected].

Retention periods are given for each processing operation in section 3. They are limited to the time needed for the purposes pursued, plus, where applicable, limitation periods and legal archiving obligations. When they expire, the data is deleted or anonymised.

Deleted data may remain in encrypted backups until their rotation cycle ends, that is, for no more than two years, without being used. In the event of a dispute, the relevant data may be kept until it is finally settled.

The school implements technical and organisational measures appropriate to the risks: encrypted connection (HTTPS), request filtering by Cloudflare, back-office access restricted to authorised people with personal credentials and role-based permissions, logging of operations, daily encrypted backups stored in France. Card payments are handled exclusively on Mobupay's secure page.

In the event of a data breach likely to result in a risk to your rights, the school notifies the CNIL and, where required by law, informs you.

A cookie is a small file placed in your browser. Local storage is a space in your browser where the website saves information that stays on your device and is not sent to the server.

Strictly necessary cookies, set without prior consent:

• the website's session cookie, which keeps your browsing continuous and allows forms to be sent; it expires after two hours of inactivity;
• the security cookie (XSRF-TOKEN), which protects forms against fraudulent requests, for the same period;
• Cloudflare's technical cookies, which protect the website against bots and attacks (for example __cf_bm, thirty minutes), and, where applicable, those of the Turnstile anti-bot service on forms.

Audience measurement cookies, set only with your consent: a banner lets you accept or refuse, just as easily either way, Google Analytics cookies (_ga and _ga_*, no more than thirteen months). Until you accept, no Google script is loaded. Your choice is stored for six months in a cookie (aguanile_consentement), after which you are asked again. You can change it at any time using the cookie settings link at the bottom of every page; withdrawing your consent ends audience measurement.

Local storage, not sent to the server:

• the draft of the registration form (option, slots, first name, last name, contact details, payment method), so you can pick up where you left off; it is deleted when the registration is sent and, at the latest, after seven days. On a shared device, you can delete it by clearing your browsing data;
• your display preference (light or dark theme);
• the best score and tutorial display of the game on the error page.

Instagram and TikTok posts are only loaded after you click; these platforms may then set their own cookies, under their own responsibility. The map of the studios is displayed from OpenFreeMap's servers (map background and fonts), to which your browser sends your IP address, without the website setting any cookie. The “Directions” link opens Google Maps, whose privacy policy applies.

You can also set your browser to refuse cookies. Refusing strictly necessary cookies may, however, prevent forms from being sent.

You have the right to access, rectify and erase your data and, where applicable, the right to restrict processing and to data portability. You may object at any time, on grounds relating to your particular situation, to processing based on the school's legitimate interest, and to any marketing without giving a reason. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before. You may also set instructions regarding what happens to your data after your death.

To exercise these rights, write to [email protected]. You will receive a reply within one month of receipt of your request; this period may be extended by two months given the complexity or number of requests, in which case you will be informed. Proof of identity may only be requested if there is reasonable doubt about your identity.

If, after contacting the school, you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or online at cnil.fr.

10.1. Anyone who appears in a photo or video published by the school (website, social media, communication materials) can ask for it to be removed, without having to give a reason, whether or not they had given their consent. For a minor, the request is made by their legal representative.

10.2. Requests are sent by email to [email protected], by WhatsApp on +687 70.80.50 or directly to the teacher. They identify the image concerned (website page, link to the post or screenshot) and, if needed, the person to look for in the image.

10.3. The school acknowledges receipt of the request and removes the image from the website (including the posts from its social media shown there) and from the accounts it manages, as soon as possible and at the latest within the one-month period set out in Article 9. It then stops using it. It cannot, however, guarantee the removal of copies made or shared by third parties, or of posts on other accounts: if it knows of them, it tells you whom to contact.

The website is not aimed at children. A minor is registered for classes by their legal guardian, who provides the necessary data and may exercise the rights described above on the minor's behalf. A minor under fifteen may only use the contact form with the consent of their legal guardian. The image of a minor is only published with the written consent of their legal guardian.

This policy may be updated, in particular when the website's services or the regulations change. The date of the last update appears at the top of this page. In the event of a substantial change, such as a new purpose, you will be informed by appropriate means.

This policy is written in French; in the event of any discrepancy with its English and Spanish translations, the French version prevails.