Privacy Policy | Expert Swimcamp

1. Who we are

ExpertSwimCamp, F. van Dijk (hereinafter: "Expert Swimcamp", "we", "us") is responsible for the processing of personal data as described in this privacy policy.

ExpertSwimCamp, F. van Dijk · Calle Mompou Federico 3, 52A, 29620 Torremolinos ES · Chamber of Commerce: Y9441863D
Email: info@expertswimcamp.com · Phone: +34 951 744670

2. What data do we process?

We process the following categories of personal data. Some of this is requested at registration, the rest via the intake form that is completed after the registration is confirmed.

Parent/guardian (client)

First and last name
Email address and phone number
Billing address (street, house number, postcode, city, country)
Payment details (via Mollie: we do not store any card details ourselves)
Communication history (emails, messages)
Email address for camp-related communication (if different)
Contact phone number during the camp

Forms and unfinished registrations (leads)

Collected as soon as you enter your email address on a form, even if you do not complete the registration

Name, email address and phone number
The camp you showed interest in, the swimmer's name and year of birth and the club (if you filled them in)
How far you got in the registration form and whether you clicked the WhatsApp button
How you found us: campaign and advertising parameters from the link (UTM, click IDs), the first page of your visit and the referring site
A technical link to our visitor statistics (Google Analytics client ID), only if you allowed analytics cookies

We use this to help you complete your registration and to answer your questions. We only send newsletters and offers if you tick the separate box. We keep this data for 7 years, in line with our customer and registration data.

Participant (child): basic data

Collected at registration and/or via the intake form

First name, preferred name and last name
Date of birth and gender
Swimming club (optional)
Passport photo (for identification and promotional purposes, subject to consent)

Participant: sports performance and training profile

Collected via the intake form, for targeted coaching

Swimming level and personal best(s)
Best 100m times per stroke (freestyle, breaststroke, backstroke, butterfly, individual medley)
Favourite stroke and training focus
Points for attention and personal goals for the camp
SwimRankings ID (optional, to link to public competition results)

Participant: equipment and kit

Collected via the intake form, for supplying equipment

T-shirt size
Type and size of swimming trunks or swimsuit (including hip measurement in cm)
Preference for Arena training equipment (optional)

Participant: special category (medical) personal data

Special category: processed solely on the basis of vital interest (Art. 9(2)(c) GDPR) and/or explicit consent

Medication use: name, dosage and circumstances of use
Medical details: conditions, limitations, allergies and intolerances

This data is shared solely with the supervisors and coaches directly involved during the camp, and is deleted no later than 1 year after the camp ends.

Participant: travel data

Only applicable when flight or accommodation extras are booked

Passport details: first and last name as in the passport
Scan/photo of the front and back of the passport or ID document
KLM Flying Blue membership number (optional)
Room preference (e.g. roommate request)

Passport scans are used solely for booking flights and accommodation with external providers. They are kept for as long as needed to deliver the trip, and are actively deleted no later than 3 months after the camp ends.

Emergency contact

Emergency contact name
Relationship to the participant
Emergency contact phone number

Consents

Consent for photo and video material for promotional purposes
Agreement to the privacy policy and terms & conditions (including timestamp)

Technical and analytical data

IP address (stored anonymised for analytics)
Browser type and device information
UTM parameters and marketing source (e.g. which ad someone registered through)
Page visits and interactions (via Google Analytics/GTM)
Session data for login management

3. Why do we process your data?

Purpose	Legal basis
Carrying out the registration and payment process	Performance of the agreement (Art. 6(1)(b) GDPR)
Creating and managing a customer account	Performance of the agreement
Processing medical data (medication, allergies, details)	Vital interest of the participant (Art. 6(1)(d) + Art. 9(2)(c) GDPR)
Supplying equipment (shirt, swimwear, kit)	Performance of the agreement
Travel booking (flights, accommodation): passport details	Performance of the agreement
Tailored training support (times, stroke, goals)	Performance of the agreement
Communication about the camp and programme	Performance of the agreement
Newsletter and marketing communication	Consent (Art. 6(1)(a) GDPR)
Photos/videos for promotional purposes	Consent (Art. 6(1)(a) GDPR)
Legal obligations (accounting, tax)	Legal obligation (Art. 6(1)(c) GDPR)
Improving our services and website	Legitimate interest (Art. 6(1)(f) GDPR)
Measuring the effect of advertising on a booking made while logged in	Legitimate interest (Art. 6(1)(f) GDPR)

3a. Purchase measurement while logged in

When a booking is made while you are logged in to your account, Expert Swimcamp sends the purchase (order number, amount, currency, and the hashed email address and phone number) server-side to Google Analytics and Meta (Conversions API) to measure the effect of advertising. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). You can object by emailing info@expertswimcamp.com. The cookies those parties use for this measurement last 2 years for Google Analytics (_ga and _ga_ followed by the measurement id) and 90 days for Google Ads (_gcl_au, _gcl_aw, _gcl_dc) and Meta (_fbp and _fbc). Those are the vendors' documented defaults. Google Tag Manager can set a different Google period, and that setting is not visible in this website's code. If you book as a guest, without being logged in, we send this purchase to Meta only when you give consent via the cookie banner.

4. With whom do we share your data?

We share your data only with parties that are necessary for the delivery of our services:

Mollie B.V.: payment processing (Dutch payment provider). Mollie is a certified payment institution supervised by DNB. Privacy policy: mollie.com/nl/privacy
Resend / Postmark: sending transactional emails.
ActiveCampaign: email marketing (only with consent for the newsletter).
Cloudflare Inc.: hosting and infrastructure. Data is processed in the EU.
Google (Analytics/GTM): anonymised website analytics.
Meta Platforms (Facebook and Instagram): when you message us on Instagram or Facebook, or comment on one of our posts, we process those messages together with your public profile name and username so that we can answer you. That happens in our own environment; Meta remains a controller for the platform itself. You can request deletion of these messages through your Facebook account settings, after which we delete them automatically and send you a confirmation with a reference number. Privacy policy: facebook.com/privacy/policy
Supervisors and coaches: insofar as necessary to deliver the camp (name, participant's medical details).
Airlines and accommodation providers: when the client has booked a flight or accommodation extra, the necessary personal data is shared for that booking.

We never provide your data to third parties for commercial purposes without your explicit consent.

Section 3a describes the server-side purchase measurement for bookings made while logged in.

5. How long do we keep your data?

Category	Retention period	Reason
Customer data and registrations	7 years after the activity ends	Tax retention obligation
Medical information (medication, details, allergies)	No later than 1 year after the camp ends	Safety; actively deleted afterwards
Passport scans / ID scans	No later than 3 months after the camp ends	Solely for flight/accommodation booking
Sports performance and training data	As long as the account is active	Progress tracking at the parent's request
Participant's passport photo	As long as the account is active, or until consent is withdrawn	Identification and promotion (subject to consent)
Marketing consent and newsletter	Until consent is withdrawn	On the basis of consent
Leads (form submitted, not registered)	7 years after the last contact	Follow-up and administration
Technical logs and session data	Maximum 90 days	Security and debugging
Account data	As long as active + 2 years afterwards	Customer relationship

Once the retention period has expired, data is actively and irreversibly deleted from our systems. You can also submit a deletion request yourself via info@expertswimcamp.com.

6. Your rights

Under the GDPR you have the following rights:

Right of access: you can request an overview of the personal data we process about you.
Right to rectification: you can have incorrect data corrected.
Right to erasure: you can request that your data be deleted (the "right to be forgotten").
Right to restriction: you can request that the processing of your data be restricted.
Right to data portability: you can request your data in a structured, commonly used format.
Right to object: you can object to processing based on legitimate interest.
Withdrawal of consent: you can withdraw consent given at any time.

To exercise your rights, please contact us via info@expertswimcamp.com. We respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority: autoriteitpersoonsgegevens.nl.

7. Cookies

We use cookies for:

Functional cookies: for login and session management (necessary). The login cookie sessie lasts 7 days, or 1 hour on one payment page. The visit cookie _zs lasts 90 days. The campaign cookie ze_h (and the same data in your browser's local storage) lasts 90 days. It records, on your first visit from an advert or link with campaign tags, which campaign you came from (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the page you landed on and the time, plus the click identifier of an advert (fbclid or gclid). We use it only to see which campaigns lead to enquiries and bookings. It contains no name or email address. The cookie _zt lasts 90 days after you log in, and 30 days after an email or newsletter click. On the Dutch site the language cookie taal lasts 1 year. On the English site the language choice taal_sessie lasts until you close the browser. The guest-checkout cookie korte_gast lasts 2 hours. The newsletter cookie _za lasts 30 days. The early-bird countdown cookie ze_earlybird_deadline lasts 24 hours.
Analytical cookies: Google Analytics (_ga and _ga_ followed by the measurement id): 2 years, the documented default, anonymised and without a marketing profile. Google notes that a browser can shorten a first-party cookie if you do not come back (up to 400 days in Chrome and 7 days in Safari). Google Tag Manager can set a different period. That setting is not part of this website's code.
Marketing cookies: only with consent via our cookie banner. Google Ads (_gcl_au, _gcl_aw, _gcl_dc): 90 days. Meta (_fbp and _fbc): 90 days. Our own click and campaign cookies (ze_gclid, ze_gclid_ts, ze_gbraid, ze_wbraid, ze_fbclid, ze_msclkid, ze_ttclid and ze_utm_*): 90 days. If the Meta pixel has not set _fbc, we set it ourselves for 90 days. The affiliate cookie affiliate_code lasts 30 days. ActiveCampaign does not publish a fixed cookie lifetime. It may link an anonymous visit from the past 30 days, and sometimes up to a year if the cookie is still present.

You can change this choice via Cookie preferences at the bottom of every page.

The choice zwe_cookie_consent and keys such as ze_purchase_* stay in the browser's local storage until you clear them. Click ids in session storage last until you close the tab.

You can manage cookies via your browser settings.

A booking made while you are logged in is also measured server-side, without a marketing cookie. See section 3a.

8. Security

We take appropriate technical and organisational measures to protect your data:

SSL/TLS encryption for all data transmissions
Passwords are stored as bcrypt hashes
Payments are handled via the certified payment platform Mollie
Access to personal data is limited to authorised staff
Regular security audits

9. International transfers

Some of our service providers (such as ActiveCampaign, Google) process data outside the EEA. In that case we ensure appropriate safeguards, such as Standard Contractual Clauses (SCCs). Mollie processes data within the EU.

10. Athlete profiles

If your child has joined an Expert Swimcamp camp, they get a public athlete profile at expertswimcamp.com/athletes. The profile shows their full name, a profile photo and their swim times. It does not show which camps they joined.

We do this based on the written consent for publication and for photos and videos that you gave when you registered for the camp. If you chose no for photos and videos, we don't show a profile photo. Swim times come from public competition results.

Have a question about your child's profile? Email us at info@expertswimcamp.com.

Children who haven't joined one of our camps yet don't get a public profile.

11. Changes

We reserve the right to amend this privacy policy. The most current version is always available at expertswimcamp.com/privacy. In the event of substantial changes, we will inform you by email.

12. Contact

For questions about this privacy policy or to exercise your rights:

Data Protection Officer
ExpertSwimCamp, F. van Dijk · Calle Mompou Federico 3, 52A, 29620 Torremolinos ES
Email: info@expertswimcamp.com