KRATAN CLUB

Privacy

Privacy policy

This policy describes how Dolphinn EURL processes personal data in connection with the Kratan Club service (https://www.kratan.club), the coach area and the Kratan Club mobile app. It is drawn up in accordance with Regulation (EU) 2016/679 (the "GDPR"), French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties and, for persons located in Chile, Law No. 19,628 on the protection of private life and Law No. 21,719, which amends it and enters into force on 1 December 2026.

1. Who processes your data

Kratan Club is a service of Dolphinn EURL, 96 rue paradis, 13006 Marseille, SIREN 931086177. Contact for any question about personal data: guillaume@kratan.club.

Dolphinn EURL has not appointed a data protection officer; any request may be sent to guillaume@kratan.club.

Dolphinn EURL acts in two capacities:

  • Controller for the platform's own data: visitors to the presentation website, people who contact it, prospective coaches and client coaches, and the security of the service (sections 2 to 4).
  • Processor (in Chile, "encargado del tratamiento") for the data each coach processes about their students and the visitors to their website: the coach is then the controller, and the coach's own privacy policy, published on their website, applies (section 5).

2. Data processed as controller

Data subjects Data Purposes Legal basis
Website visitors IP address, technical connection data, language Displaying the website, ensuring its security, preventing abuse Legitimate interest
People using the contact form Name, email, telephone (optional), country, message Answering the request and presenting the service Consent given in the form, then pre-contractual measures
Prospective coaches referred by a coach First name, last name, email, telephone, country, discipline, city, referrer's message Contacting the prospect and managing the referral Legitimate interest of Dolphinn EURL (business-to-business prospecting); the referrer warrants that the prospect has agreed to be contacted
Prospective coaches receiving a brochure First name, last name, discipline, language, photos supplied, generated images Creating a personalized presentation brochure Consent of the person, which Dolphinn EURL confirms before any generation
Client coaches Identity, contact details, legal and tax identity (company name, address, SIREN or RUT, VAT status, mediator), settings, fee statements, invoices, referrals Providing the service, calculating and invoicing fees, managing referrals, keeping accounts Performance of the contract; legal obligations (accounting, tax, DAC7 reporting where applicable)
Client coaches who uploaded reference photos Photos of their face and body, date of consent Generating images of the coach at their request Express consent of the coach
All signed-in users Email, sign-in codes and links, sessions, devices, technical logs and audit log Authentication, securing the service, tracing administrative actions Performance of the contract; legitimate interest (security); legal obligation to retain connection data

3. Reference photos and generated images

  • The coach may upload photos of themselves so that the service generates images in their likeness (exercise illustrations, photos for their website). This is optional and subject to their express, time-stamped consent.
  • The photos are used neither to identify nor to authenticate the coach. As a precaution, Dolphinn EURL processes them with the safeguards applicable to sensitive data, including biometric data within the meaning of Chilean Law No. 21,719.
  • They are sent to the image provider (OpenAI) only when the coach requests a generation, and for that sole purpose. They are never shown to students or published, never used for any other purpose, and never used by Dolphinn EURL to train artificial intelligence models. Dolphinn EURL uses the provider's API offering, whose terms exclude by default the use of submitted data to train its models; the provider may however retain it temporarily (in principle for no more than thirty days) to detect abuse.
  • The coach may delete their photos and withdraw their consent at any time from their area; withdrawal entails deletion of the photos. Images already generated remain in their area until the coach deletes them.
  • For presentation brochures intended for prospective coaches, photos and images are automatically deleted thirty days after the brochure is created, or earlier on request. The data subject is informed of the processing at the first contact and may object to it or request deletion at any time.

4. Recipients and processors of Dolphinn EURL

The data is accessible only to authorized staff of Dolphinn EURL. It is entrusted to the following providers, who act on instructions:

  • Hosting of servers and storage: OVH SAS (France), on infrastructure operated by Dolphinn EURL;
  • Sending of emails: Resend (United States);
  • App notifications: Firebase Cloud Messaging, Google (United States);
  • Text and image generation by artificial intelligence: OpenAI (United States) and Anthropic (United States), depending on the provider chosen for the feature.

When a user chooses to sign in with a Google, Microsoft or Apple account, that provider receives the sign-in request under its own terms. The coaches' payment providers (Stripe, Mercado Pago, PayPal) are chosen and contracted by each coach; they process payment data under their own policies, as separate controllers for their own purposes. Data may also be disclosed to authorities where required by law. It is never sold.

5. Processing on behalf of coaches

The following terms constitute the data processing agreement required by article 28 of the GDPR and by Chilean Law No. 21,719 between each coach (controller) and Dolphinn EURL (processor). They form part of the terms of sale.

  • Subject matter and duration: hosting the coach's website, area and their students' app, and providing the features of the service, for the term of the contract with the coach.
  • Data subjects and data: students and visitors to the coach's website; identity and contact details, language, connection data and devices, notification tokens, programs, sessions, results and feedback, fitness or health information the student chooses to share, subscriptions, payments and receipts (without payment card data).
  • Instructions: Dolphinn EURL processes this data only on the coach's documented instructions, consisting of the contract and the coach's use of the service, and informs the coach if an instruction appears to infringe the regulations.
  • Confidentiality and security: authorized persons are bound by a duty of confidentiality; Dolphinn EURL implements the measures described in section 10.
  • Sub-processors: the coach gives general authorization to use the providers listed in section 4 (excluding payment providers, which are chosen by the coach). Dolphinn EURL informs the coach of any addition or replacement at least thirty days in advance; the coach may object on legitimate grounds by terminating the contract. Dolphinn EURL imposes equivalent obligations on its sub-processors.
  • Assistance: Dolphinn EURL helps the coach respond to requests to exercise rights (the service in particular allows a student's data to be exported and their account deleted), ensure security and, where applicable, carry out an impact assessment.
  • Data breach: Dolphinn EURL notifies the coach of any personal data breach without undue delay and no later than 48 hours after becoming aware of it, with the information the coach needs for their own notifications to the supervisory authority and to data subjects.
  • End of contract: at the end of the contract, and after the coach has been given the opportunity to export, Dolphinn EURL deletes the students' data, except for data that the law requires to be retained.
  • Audit: Dolphinn EURL makes available to the coach the information necessary to demonstrate compliance with these obligations and allows reasonable audits, at the coach's expense, with thirty days' notice.
  • App sign-in link: when a student requests a sign-in link for the app, Dolphinn EURL looks up, from their email address, the coaches with whom they have an active coaching relationship, in order to send them a single link; this processing is carried out on behalf of each of those coaches.

6. Transfers outside the European Union and outside Chile

Data is hosted in France. Some providers are established in the United States. These transfers rely on the European Commission's adequacy decision on the EU–US Data Privacy Framework for certified providers and, failing that, on the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. For persons located in Chile, data is transferred to France and the United States with adequate contractual safeguards, in accordance with Law No. 21,719. A copy of the safeguards may be obtained from guillaume@kratan.club.

7. Retention periods

  • Sign-in codes and links: deleted no later than 24 hours after their expiry or use. Sessions: 5 weeks, renewable as long as there are no more than 30 weeks of inactivity.
  • Contact requests and referral pre-registrations: a pre-registration reservation expires after 90 days; the data is kept for no more than three years after the last contact with the person, unless a contract is concluded.
  • Presentation brochures (photos and images): thirty days after creation, or less on request.
  • Reference photos: until deleted by the coach, consent is withdrawn or the coach's area is closed.
  • Coach account data: for the term of the contract, then for the applicable limitation periods. Accounting records (statements, invoices): ten years (article L123-22 of the French Commercial Code); in Chile, for the period required by the Tax Code (Código Tributario, up to six years). Information reported under DAC7: ten years.
  • Technical logs and connection data: no more than one year. Audit log of administrative actions: for the term of the contract and five years thereafter.
  • Students' data: according to the coach's instructions and, at the latest, until the end of the contract with the coach (section 5).

8. Cookies and local storage

The website and the coach area use only strictly necessary cookies and local storage: session and session-renewal cookies (sign-in), a temporary security cookie during sign-in with Google, Microsoft or Apple, and preferences such as language. No advertising cookies, no social network trackers and no audience measurement tools are used. As these cookies are essential to the service, they do not require consent (article 82 of French Law No. 78-17).

To display the web app, the browser may download technical components (rendering engine and fonts) from Google's servers; Google then receives the visitor's IP address, without cookies.

9. Your rights

In France and the European Union, you have the rights of access, rectification, erasure, restriction, objection and data portability, the right to withdraw your consent at any time without affecting the lawfulness of prior processing, and the right to give instructions regarding the fate of your data after your death. You may lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr).

In Chile, you have the rights of access, rectification, erasure and objection ("ARCO" rights) and, from the entry into force of Law No. 21,719, the rights to data portability and to temporary blocking of processing, and the right not to be subject to decisions based solely on automated processing. If your request is not satisfied, you may refer the matter to the Personal Data Protection Agency (Agencia de Protección de Datos Personales) once it is operational or, failing that, to the competent courts.

To exercise your rights, write to guillaume@kratan.club. You will receive a reply within one month (GDPR) or within the period provided for by Chilean law (thirty days), which may be extended under the conditions provided by law. Proof of identity may be requested in case of reasonable doubt.

Students exercise their rights with their coach, who is the controller, or directly from their area (export of their data and deletion of their account). If a student contacts Dolphinn EURL, the request is forwarded to the coach concerned.

10. Security

Dolphinn EURL implements appropriate technical and organizational measures: encryption of communications (HTTPS), passwordless sign-in with one-time codes, encryption of secrets and of access keys to providers, separation of each coach's data, temporary access links to files, access limited to authorized persons, logging of administrative actions and backups. In the event of a data breach presenting a risk, Dolphinn EURL notifies the competent authority and, where applicable, the data subjects under the conditions provided by law.

11. Minors

The presentation website and the coach area are intended for adult professionals. Registering a minor student on a coach's website is the responsibility of the coach, who must obtain the authorization of the student's legal representatives where required by law.

12. Changes to this policy

This policy may be amended, in particular when the service or the regulations change. Coaches are informed by email of any material change. The version in force is the one published on the website.