Draft for legal review. Prepared to be checked by a lawyer or DPO familiar with the GDPR and the French loi Informatique et Libertés before Aura takes its first member. Items in [square brackets] need confirming.
We collect your name, email, phone number, one emergency contact, and optionally an Instagram handle. We use them to run your membership and to keep you safe at events. We do not sell your data and we do not profile you. You can ask for a copy, a correction or a deletion at any time by emailing hello@aura.club.
The data controller is [legal name], [address, Lille], registration number [SIREN / RNA]. For anything about your data, write to hello@aura.club or to [dedicated privacy address, e.g. privacy@aura.club].
[Confirm whether a Data Protection Officer is required. For a club of this size it usually is not, but if one is appointed their contact details belong here.]
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| First name, surname, email, phone | To create and run your membership, confirm bookings, and reach you if a session changes | Performance of the contract | While you are a member, then 3 years |
| Instagram handle, or another profile, if you give one | To put a face to a name when we read your application, and to recognise you at your first event | Our legitimate interest in knowing who joins a private club. Giving it is optional and membership does not depend on it | While you are a member, then deleted |
| Emergency contact name and phone | So the person hosting a physical session can call someone if you are hurt | Legitimate interest in member safety, and your vital interests | While you are a member, then deleted |
| Record of what you agreed to, and when | To show which version of the terms, privacy notice and member code you accepted | Legal obligation, and our legitimate interest in being able to prove consent | 5 years after membership ends |
| Bookings, what you paid and attendance | To run your bookings, take payment for a place and know who is expected at an event | Performance of the contract | While you are a member, then 3 years |
| Payment records (amount, date, last 4 digits, Stripe reference) | Accounting and tax, and to answer billing questions | Legal obligation | 10 years, as French accounting law requires |
| Photographs of you at events | Our Instagram and website | Your consent, which is optional and can be withdrawn | Until you withdraw consent |
| Email address for the monthly letter | To send you what is coming up | Your consent, which is optional | Until you unsubscribe |
We deliberately do not collect health data. When you join you confirm that you are fit to take part, and you tell the instructor on the day about anything relevant. That conversation stays between you and them, and we do not record it. Health data is a special category under article 9 of the GDPR, and the safest way to handle it is not to hold it.
If you give us an Instagram handle we look at it once, when we read your application, and then it sits in the member list. We do not follow you from the club account, we do not scrape or store your posts, we do not share the handle with other members, and we do not use it to advertise to you. Leaving it blank makes no difference to whether you are accepted.
That person's details are personal data about someone who is not our member, which is why we ask you to check with them first. If they contact us we will tell them we hold their name and number, why, and delete it on request.
Only the people and services we need to run the club:
We do not sell your data, rent it, or share it for anyone else's advertising.
We aim to keep everything inside the European Economic Area. Where a provider transfers data outside it, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision. [Confirm the position for each provider listed above and keep the paperwork on file.]
Under the GDPR you can ask us to:
Email hello@aura.club and we will reply within one month. If you are not satisfied you can complain to the French supervisory authority, the CNIL, 3 place de Fontenoy, 75007 Paris.
This site sets no advertising or analytics cookies. Fonts are loaded from Google Fonts, which means your browser makes a request to Google and Google sees your IP address. [If you would rather avoid that, the two font files can be self-hosted, and then this paragraph goes away. Recommended.]
If analytics or any tracking is added later, this notice must be updated and a proper consent banner added first, because under French rules consent is required before any non-essential cookie is set.
Access to the member list is limited to the founders. Accounts use two-factor authentication. Payment data never reaches us. [Write down who has access, review it once a year, and note here what happens in the event of a breach: the CNIL must be notified within 72 hours.]
If we change this notice we will date the new version and, for anything significant, email members. The version in force when you joined is stored with your consent record.
