Privacy Policy

[ACADEMY LEGAL NAME] (commercial registration [CR NUMBER]) is the controller of the personal data described here. Contact: [CONTACT EMAIL], [PHONE], [ADDRESS]. [Data protection contact / DPO, if appointed: NAME, EMAIL].

• Student data: name, date of birth, gender, photo (if provided), level, class, attendance, skill assessments, progress reports and certificates.
• Health information: medical notes, allergies and conditions you choose to share so coaches can keep your child safe in and around the water.
• Identity documents: copies of civil ID, passport or birth certificate, and signed agreements, where needed for registration, age verification or insurance.
• Parent / guardian data: name, mobile number, email, relationship to the student, and emergency contacts.
• Payment data: invoices, amounts, payment status and references. Card details are entered on the payment provider's page; we do not store full card numbers.
• Communications: WhatsApp, email and in-app messages with the Academy, including messages with our booking assistant (which may be processed by an AI service).
• Technical data: sign-in records, IP address, device/browser information and security logs used to protect the service (including anti-bot checks).
• We do not operate CCTV through this app. [Update if CCTV is used at the venue.]

• Booking assessments, enrolment, class placement and scheduling.
• Running classes safely: attendance, coaching, skill tracking, medical awareness.
• Billing, payments, receipts and refunds.
• Contacting you about classes, changes, reminders and your child's progress (WhatsApp, email, SMS).
• Security, fraud and abuse prevention, and keeping the service working.
• Meeting legal, accounting and insurance obligations.
• [Marketing — only with your separate consent; you can opt out at any time.]

We process children's data only with the consent of a parent or legal guardian, and to perform our agreement with you. Health information and identity documents are processed with your explicit consent and only for the purposes above. By registering a child you confirm that you are their parent or legal guardian. You may withdraw consent at any time (see section 8); some services may then no longer be possible. [Confirm the legal bases with counsel under applicable Kuwaiti regulation.]

We never sell personal data. We share it only with service providers acting for us:

• Supabase — database, file storage and sign-in hosting ([HOSTING REGION]).
• Cloudflare — website hosting, security and anti-bot checks (Turnstile).
• WhatsApp (Meta Platforms) — messages and verification codes you receive on WhatsApp.
• [EMAIL PROVIDER] — sending emails such as confirmations and receipts.
• [PAYMENT GATEWAY, e.g. KNET / Bookypay] — processing payments.
• [AI PROVIDER] — the optional booking assistant and document reading (OCR).
• Authorities, insurers or professional advisers where required by law or to protect safety.

Some providers process data outside Kuwait. Where this happens we rely on appropriate safeguards. [Describe transfer safeguards / regulator approvals as required.]

• Active student and guardian records: while the student is enrolled, plus [X] years.
• Identity documents and medical notes: until [X months] after the student leaves, then deleted.
• Invoices and payment records: [X] years, as required for accounting.
• Assessment bookings that do not lead to enrolment: [X months].
• Messages and chat transcripts: [X months].
• Security logs: [X days].

Access is limited by role (for example, coaches only see their own classes), data is encrypted in transit, identity documents are stored privately and opened through short-lived links, and activity is logged. No system is perfectly secure; we will notify you and the relevant authority of a serious breach as required by law.

As a parent/guardian (or an adult student) you can ask us to:

• access a copy of the personal data we hold;
• correct inaccurate data;
• delete data we no longer need, or withdraw consent;
• stop marketing messages at any time.

Email [CONTACT EMAIL] to make a request. We will reply within [30] days. You may also complain to [RELEVANT KUWAITI AUTHORITY, e.g. CITRA].

We use only what is needed to sign you in, remember your preferences and keep the service secure. We do not use advertising trackers. [Update if analytics are added.]

We may update this policy and will show the new date above; significant changes will be communicated to registered parents. Questions: [CONTACT EMAIL], [PHONE], [ADDRESS].