Privacy Notice

1. Who is responsible for your data

Team Carvalho Göteborg is the academy and public brand responsible for this privacy notice. For legal purposes, Team Carvalho GBG IF, org.nr 802473-8125, is the data controller for membership, class-card, drop-in, member-account and booking data. AC Sports SWE AB, org.nr 559217-0822, is the data controller for private-class and shop purchases made under the Team Carvalho brand. Both operate from Andra Långgatan 48, 413 27 Göteborg, Sweden. Contact: info@teamcarvalho.se.

2. What we collect and why

• Account data (name, email, phone, password credentials) — to create and secure your account. Legal basis: performance of our contract with you.
• Booking and training data (classes booked and attended, class credits, belt and stripe progress) — to run the booking system and follow your progression. Legal basis: contract.
• Purchase records (which plan or class card you hold, its status and period) — to give you the access you paid for. Legal basis: contract and legal obligation (accounting). Card details are never seen or stored by us.
• Free-trial and contact messages — to answer you and arrange your first class. Legal basis: your request / legitimate interest.
• Technical data (IP address, device and browser information, error logs) — for security, fraud prevention and keeping the site working. Legal basis: legitimate interest.
• Marketing messages, if you opt in — legal basis: consent, withdrawable at any time.

3. Who we share it with

• Stripe, Inc., our payment processor, for the sale of memberships and classes, subscription management, payments, fraud prevention and invoicing.
• Service providers (subprocessors) that host the website, database and authentication, and send transactional email on our behalf.
• Professional advisers such as our accountant, and authorities where we are legally required to disclose.

We do not sell your personal data.

4. International transfers

Our providers process data primarily inside the EU/EEA. Where data is transferred outside the EEA, it is protected by an adequacy decision or the EU Standard Contractual Clauses together with appropriate technical safeguards.

5. How long we keep it

Account, booking and progression data is kept while you are a member and for up to 24 months after your last activity, then deleted or anonymised. Accounting records tied to purchases are kept for seven years as Swedish bookkeeping law requires. Trial enquiries are deleted after 12 months.

6. Your rights

Under the GDPR you may request access to your data, rectification, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent at any time. Email info@teamcarvalho.se and we will respond within one month. You may also complain to the Swedish authority Integritetsskyddsmyndigheten (IMY), imy.se.

7. Security

We use appropriate technical and organisational measures — encryption in transit, hashed credentials, row-level access controls in our database, and access limited to staff who need it.

8. Cookies and local storage

We use only essential cookies and local storage: keeping you signed in, remembering your language choice, and the checkout session set by our payment provider Stripe. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will then not work.

9. Children

For kids and juvenile members, the account is created and managed by a parent or guardian, who provides the consent required for the data described above.