Privacy Notice

This notice explains how personal data is handled when you visit the FlexCademy website or use the FlexCademy platform. It covers visitors, academy owners and personnel, trainers, students and their parents or guardians, applicants, account users, purchasers, payers and people who contact us or an academy.

An academy may provide additional privacy information for processing it determines. This notice does not replace an academy’s own notice. It provides data-protection information, does not alter any contract and does not limit rights or remedies available under applicable law.

1. Who is responsible and how to contact us

FlexCademy is operated by:

The academy normally determines why and how student, guardian, trainer, application, lesson, attendance, invoice, product and academy-communication data is used. For that processing, the academy is normally the controller and Alpine Ledger GmbH provides the platform as a processor. The academy’s identity and contact details are shown on its pages, forms or communications.

Alpine Ledger GmbH processes data for its own website, owner-access requests, platform account and security administration, support, abuse prevention and legal or service-administration records. To the extent Alpine Ledger GmbH determines these purposes rather than acting on an academy’s instructions, it is the controller. Roles can differ for payments, third-party integrations and activities configured with an academy. Each party remains responsible for the processing and safeguards it actually determines or controls; these role descriptions do not transfer or exclude responsibility imposed by law. Contact the academy about academy-controlled processing. You may also write to us if you are unsure whom to contact.

2. Data we handle and where it comes from

The categories depend on the features you use:

• Identity, account and contact data: name, email, telephone number, postal address, language, login and account status.
• Student, family and academy data: date of birth, gender, level, linked family profiles, academy membership and, where the academy requires it, social-security/AHV and Jugend+Sport information.
• Applications and training operations: availability and preferences, locations, groups, camps, schedules, attendance and absences, guests, replacement trainers, notes, custom form answers and exclusion information.
• Trainer and personnel data: profile and licence information, photograph, availability, rates and compensation, address, IBAN and social-security/AHV information.
• Billing, payment and purchase data: invoice and payment status, amounts, references, refunds, discounts and credits, purchaser and attendee details, shipping address and fulfilment data. Payment and Connect onboarding may also involve Stripe receiving payment-method, bank-account, company, representative, identity and verification documents.
• Communications and files: inquiries, support messages, academy emails and newsletters, delivery/bounce/complaint events and historical open/click events, uploaded images and documents, and files generated for authorised downloads.
• Technical and activity data: IP address, request and device/browser information, session and preference data, security events, service logs, record changes and provider response identifiers.
• Generated or derived data: schedules, balances, attendance and payment summaries, age bands, newsletter segments and AI-assisted grouping output.

We receive data from you; a parent, guardian or linked account user; academy owners, trainers or authorised personnel; payment, email and anti-abuse providers; and from use of the platform. An academy may therefore enter data about you before you create an account or communicate with you through FlexCademy.

Fields marked as required are needed for the relevant account, application, schedule, invoice, payment, delivery or verification step. Without them, that step may not be completed. Optional fields are identified by the relevant form or academy. Please do not put unnecessary health or other sensitive information in free-text fields.

3. Why data is used

• to deliver the website and platform, create and secure accounts, remember language and session choices, and diagnose faults;
• to handle owner-access requests, inquiries and support;
• for academy enrollment, child and family accounts, scheduling, group and camp administration, attendance, lesson notes and academy records;
• for trainer administration, compensation reports and academy operations;
• to prepare invoices, reconcile transfers, process payments and refunds, complete payment-account verification, sell products or events and arrange fulfilment;
• to send account, application, schedule, attendance, invoice and other service messages;
• to let an academy send newsletters, select recipient groups and review delivery or engagement events;
• to provide optional translation, group-formation and academy-configured API features;
• to prevent abuse, maintain service security and reliability, establish or defend claims, meet applicable obligations and keep appropriate business records.

4. Legal grounds where the GDPR applies

Swiss data-protection law does not use the GDPR’s list of legal bases in the same way. Where the GDPR applies and Alpine Ledger GmbH is the controller, processing may, depending on the activity, rely on steps requested before entering into a contract or performance of a contract; compliance with an applicable legal obligation; legitimate interests in operating and securing the platform, preventing abuse, providing support, administering the service and establishing or defending claims; or consent where a genuinely optional choice is offered. Processing special-category data requires an additional condition. Contact us for the ground and, where relevant, the legitimate interest applying to a particular Alpine Ledger-controlled activity.

The academy is responsible for determining and stating the grounds, additional conditions and any legitimate interests for academy-controlled enrollment, employment, marketing, child, attendance and billing activities. Contact the academy for its activity-specific information. Acceptance of academy terms or use of FlexCademy is not, by itself, consent to every use of personal data.

5. Children and data supplied by parents or academies

FlexCademy supports child student accounts. A parent, guardian or authorised academy person may provide a child’s identity, contact, birth-date, gender, level, schedule, attendance and billing information and, where required by the academy, social-security/AHV or Jugend+Sport information. The academy determines why this data is needed. Questions about the enrollment relationship, authority to provide the data, age-appropriate information and any consent or other legal basis required for the academy’s activities must be addressed with that academy.

When a current FlexCademy child-enrollment flow requests an authority declaration, the enrolling adult declares that they are authorised to act and that the child has received, or will receive, age-appropriate information. Academy staff can record that the academy received this declaration. FlexCademy records the notice and declaration versions, language, time and actor capacity. This record is an attestation only: it does not independently prove guardianship or other legal authority, and no universal consent-age threshold is assumed. The academy must make any further authority or age assessment required for its activity.

Parents or guardians should contact the academy about a child’s record and tell it if information is incorrect or was supplied without authority. They may also contact Alpine Ledger GmbH for help routing a platform request.

6. Communications, segmentation and automated tools

Service emails may contain account, schedule, attendance or billing information. If an academy uses newsletters, it can select recipients by criteria such as age range, gender, level, location, application or payment status and training participation. New newsletter deliveries include a direct preference link and the application checks academy-scoped suppression immediately before submission. An adult receiving a newsletter concerning a child profile can stop newsletters for that profile or all academy newsletters to the recipient address; this choice does not verify guardianship. Opening the link alone makes no change. The application disables open and link-click tracking for new newsletter deliveries. Delivery, bounce and complaint events and historical open or link-click events may remain available to the academy. Contact the sending academy about its marketing basis or use the link to object.

An academy can start AI-assisted group formation. For this feature, OpenAI receives request-scoped opaque references, derived age or age band, gender, level rank, necessary availability and group-size preferences for students, and opaque trainer and court references with necessary availability. It does not receive names, birth dates, notes, custom answers, or academy, season and location names or database identifiers in this group-formation request. The provider request and raw response are not stored by FlexCademy; a technically validated proposal with local references is stored for review. It cannot change assignments until an authorised academy owner explicitly examines and approves it. Rejection, manual override and contest decisions are recorded without applying the proposal. AI-assisted translation is a separate feature that can send academy-entered text to OpenAI. An academy may also separately configure an external API or Custom GPT caller to query selected academy records.

Google reCAPTCHA uses a risk score to accept or block certain registration and application submissions. If a submission is blocked, retry or contact the relevant academy or Alpine Ledger GmbH. Depending on applicable law and the effect on you, you may have rights to object to profiling or request information or human review; see section 13.

7. Who receives data

Depending on the feature, data can be made available to:

• authorised academy owners, personnel, trainers and Alpine Ledger support or administration personnel according to their roles;
• academy-configured email-copy, report, test, shipping, banking, accounting or other recipients and people who receive authorised exports;
• hosting, database, file-storage, backup, logging, security, email and web-asset service providers needed to operate the service;
• Postmark for emails and message events; Stripe for payments, refunds, Connect onboarding, identity verification and payouts; OpenAI when an academy starts an AI feature; and Google for reCAPTCHA or a map that you choose to load;
• browser-resource providers when their feature is used: Stripe.js on an unpaid payment page, Google reCAPTCHA after a covered form is submitted, and the provider of an academy-configured map after you choose to load it;
• banks, payment systems, recipient mail systems, academy-configured API callers and public authorities, courts or advisers where disclosure is required or permitted for an applicable obligation or claim.

Provider roles and the data they use for their own purposes are governed by the relevant service and contractual arrangement.

8. Disclosures abroad

Some recipients and browser resources operate internationally and may process data outside Switzerland or the country where you are located. Depending on the provider, academy configuration and current infrastructure, processing can take place in Switzerland, the EU/EEA, the United Kingdom, the United States or another country in which the relevant recipient operates.

Contact the academy for disclosures it controls. For Alpine Ledger-controlled disclosures, email privacy@flexcademy.ch for current destination information and available information about the applicable transfer mechanism. Depending on the recipient and applicable law, this may include an adequacy decision, contractual data-protection safeguards or, in limited cases, a legal exception.

9. Cookies, local storage and external resources

• The _flexcademy_session cookie supports login, security, carts and multi-step forms and is configured to expire after 60 days. Abandoned form data can remain in that session until it expires or is cleared.
• A locale cookie remembers the selected language for the browser session. A trainer-invitation cookie can remain for 7 days. An academy-location preference for authorised owners can remain for one year.
• Authorised owner views use local storage for menu state and schedule scroll positions. These preferences have no automatic expiry in the application and can be removed using browser controls.
• Stripe.js loads directly on unpaid payment pages so the configured payment flow can operate. Google reCAPTCHA is loaded only after a covered registration or application form is submitted; it then supplies the score used to accept or block that submission.
• An academy-configured external map is not loaded until you select its load button. The provider then receives ordinary browser-request data. FlexCademy removes remote loading attributes from academy rich text, uses local presentation assets and placeholders, and does not request Gravatar.

At the date stated above, Alpine Ledger does not intentionally include a general behavioural-analytics service in the FlexCademy application. Historical email engagement events and the external resources described above are separate forms of measurement or third-party access. A privacy notice is not a cookie-consent choice. You can clear first-party preferences in your browser; blocking technically necessary storage can prevent login, cart or form features from working.

10. How long data is kept

Retention is determined by the controller responsible for the record. For academy-controlled student, guardian, trainer, application, lesson, attendance, billing, product and academy-communication records, the academy determines the periods or criteria, subject to its obligations and instructions to Alpine Ledger. For Alpine Ledger-controlled owner-access, account, support, security and service-administration records, the criteria include the duration of the request, account or service relationship; the need to provide or document the service; security and fault investigations; disputes, legal claims and holds; applicable accounting or other record-keeping duties; and provider or backup deletion cycles.

FlexCademy supports approval-controlled deletion or anonymisation for selected disposable data, including AI group-formation proposals, historical newsletter-event payloads, failed background jobs, unattached uploads and contact data from closed privacy-request cases. These routines run only after a period and approval record have been configured and exclude matching legal holds. Accounting/payment, attendance/training, safeguarding/child, audit-version, soft-deleted operational, log and backup records require separate retention decisions and reviewed procedures. Ask the responsible academy or Alpine Ledger for the period or criteria applying to a particular record category.

Removing an item in the interface may mark it inactive rather than immediately erase it. Account closure also does not automatically erase invoice, attendance, audit, provider, log, backup or other records for which a continuing retention reason applies. When no purpose or retention ground remains, deletion or anonymisation is assessed under the responsible controller’s applicable process and obligations. Files exported by an authorised academy or user are retained by that recipient outside FlexCademy. Ask the academy for its current periods or criteria, or contact us about the criteria applying to Alpine Ledger-controlled records.

11. Security

Alpine Ledger GmbH uses technical and organisational measures intended to address the risks of operating the platform, including account authentication, role-based access in the application and encrypted transport in production. Academies manage their users, permissions, downloaded files, configured recipients and information entered in the platform. This allocation does not limit Alpine Ledger’s responsibility for safeguards within its control or an academy’s responsibility for safeguards within its control. Service providers apply their own controls. No internet transmission or storage system can eliminate every risk.

12. Keeping data accurate

Please keep your account information current and tell the academy or Alpine Ledger GmbH when data is inaccurate. If you provide information about another person, including a child, attendee, billing contact or representative, you must be authorised to do so and should give that person the relevant privacy information.

13. Your rights and requests

Depending on the applicable law, controller and circumstances, you may have rights to request access, correction, deletion, restriction, objection or data portability, to withdraw consent for future processing where consent is used, and to receive information about or seek review of certain automated decisions. These rights can be subject to identity verification, protection of other people, legal retention duties and other statutory exceptions.

Send a request about academy records to the academy first. For Alpine Ledger-controlled data, or if you need help identifying the controller, use the secure privacy-request form or email privacy@flexcademy.ch. The form collects only contact, request-type and routing information and gives the same public confirmation for accepted or repeated submissions. State the academy and account involved and the right you want to exercise, but do not send passwords, full payment-card details or identity documents through the form or ordinary email. We or the academy may request proportionate information and explain an appropriate safe method when identity or authority verification is necessary.

14. Complaints

Please contact the responsible academy or Alpine Ledger GmbH so the issue can be examined. This does not limit remedies available under applicable law. For Swiss supervisory information, you may consult the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may lodge a complaint with the competent data-protection authority, in particular in the EU/EEA country of your habitual residence, place of work or the alleged infringement. The European Data Protection Board publishes an authority list.

15. Changes to this notice

We may update this notice when the service or applicable requirements change. The date above identifies this version. Material changes will be communicated in an appropriate way where required; please review the current notice when using the service.