Privacy
policy

01 Introduction

Welcome to AllTeams, an app that lets users create, discover, share and join group sports activities.

AllTeams offers features related to sports routes, location, exchanges between users and participation in outings.

This privacy policy explains which personal data may be collected, why it is used, who it may be shared with, how long it is retained and how users can exercise their rights.

AllTeams is committed to processing personal data in accordance with applicable regulations, in particular the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and the French Data Protection Act (Informatique et Libertés).

02 Data controller

The data controller is the person who determines the purposes and means of the processing of personal data.

• Application: AllTeams
• Data controller: Haile Eyob
• Legal status: Sole proprietor (auto-entrepreneur)
• Postal address: 25 av gaston cambot, 64110 Jurançon, France
• Contact email address: [TO BE COMPLETED]
• Website: [URL TO BE COMPLETED]

The data controller ensures compliance with the obligations applicable to the protection of personal data.

This information must be completed before this policy is published.

03 Personal data processed

The categories of data processed depend on the features used and the information provided by users.

3.1. Account and profile data

AllTeams may process the information needed to create and manage an account, including:

• name or username;
• email address;
• account identifier;
• profile information provided by the user;
• data required for authentication and account security.

Mandatory and optional fields must be specified in the relevant forms. If a mandatory item is not provided, some features may not be accessible.

3.2. Route and sports activity data

When a user creates, imports, views or shares a route, the following data may be processed:

• geographic coordinates and route trace;
• imported GPX files;
• route name and description;
• sport discipline;
• distance and elevation gain, when available;
• date, time and organisational details of an outing;
• registrations and participation in activities.

This information is used to enable the creation, display, sharing and organisation of sports activities.

3.3. Location data

Some AllTeams features may use the phone's geographic position, where this feature is offered and enabled by the user.

Location data may also be contained in imported GPX files or in routes created.

Access to location depends on the permissions granted on the phone and the features used.

This policy must specify the actual conditions of access to location, in particular whether collection is possible while the app runs in the background.

Users are encouraged to review traces before publishing them, as a route may reveal start or end locations, habits or movements.

3.4. Messages and social interactions

When the corresponding features are used, AllTeams may process:

• private messages;
• group or outing discussions;
• comments and replies;
• information relating to participation;
• data needed for moderation and handling of reports, if these functions are available.

The visibility of exchanges depends on the features used and the corresponding access rules.

3.5. Technical and security data

Technical data may be processed to ensure the app works, detect errors, prevent abuse and protect systems.

The exact categories of data, the logs kept and the tools used must be verified against the app's actual configuration.

3.6. Subscription data

AllTeams plans Premium features. As payments are not confirmed as activated to date, the specific rules for processing payment data remain to be completed before this feature is launched.

When subscriptions become available, this policy will be updated to describe the data needed to manage subscriptions, the providers involved and the information retained by AllTeams.

04 Purposes and legal bases

Personal data is processed for specified, explicit and legitimate purposes.

The legal basis applicable to each processing activity will be confirmed before publication.

Where consent is required, it will be requested under the conditions provided by regulation. Withdrawing consent must be as easy as giving it, where applicable.

Technical permission to access the phone's location does not automatically constitute consent to all processing of location data.

05 Route visibility and sharing

AllTeams lets you manage routes whose visibility may be public or private, depending on the available features and settings.

Public routes

Public routes may be viewed by the users to whom the public feature gives access. Visible information may include the route trace and characteristics as well as information published by its creator.

Private routes

Private routes are intended to restrict viewing to authorised persons according to the access rules implemented in the app.

The exact access rules for private routes must be verified before publication.

Responsibility for publication

Before publishing a route, the user must check the information they are sharing and the visibility level chosen.

Location data must not be made accessible to persons not authorised by the app's privacy settings and rules.

06 Recipients of data

Personal data may be accessible, within the limits of their duties and permissions, to:

• the data controller, for the administration and maintenance of AllTeams;
• users authorised to view the relevant routes or exchanges;
• technical providers involved in hosting, maintenance, security or operation of the service;
• competent authorities where required by law.

The list of providers and their roles must be verified and documented.

Providers processing data on behalf of AllTeams must be governed in accordance with the obligations applicable to processors, in particular those under Article 28 of the GDPR.

Personal data will not be presented as sold to third parties or used for advertising purposes without verification of the practices actually implemented.

07 Hosting and international transfers

Data is hosted on a technical infrastructure used by AllTeams. Precise information on the host, the location of data and other providers will be completed after verification of the production configuration.

If personal data is transferred to a country outside the European Economic Area, AllTeams will specify the countries concerned and the applicable safeguards, in accordance with Chapter V of the GDPR.

08 Data retention

Personal data is retained for a period proportionate to the purpose pursued and in compliance with applicable regulations.

Retention rules must be defined for each category of data, in particular:

• account data;
• routes and GPX files;
• messages, comments and participation;
• technical and security logs;
• data relating to subscriptions and legal obligations, once these functions are activated.

When data is no longer needed, it must be deleted or anonymised, unless retention remains justified by a legal obligation or for the defence of legal claims.

Specific periods or, failing that, the criteria used to determine them must be completed before publication.

09 Data security

AllTeams must implement technical and organisational measures appropriate to the risks in order to protect data against loss, alteration, disclosure or unauthorised access.

These measures must take into account the nature of the data processed, in particular location data, account information and exchanges between users.

The security measures actually implemented must be verified before adding specific technical commitments to this policy.

10 Your rights regarding your personal data

In accordance with the GDPR and the French Data Protection Act, you have the following rights, depending on the circumstances and the conditions provided by law.

10.1. Right of access

You may ask whether AllTeams processes personal data about you and obtain a copy of that data together with the information required by regulation.

10.2. Right to rectification

You may request the correction of inaccurate data and the completion of incomplete data.

10.3. Right to erasure

You may request the deletion of your personal data where the legal conditions are met.

This right is not absolute: some data may have to be retained where a legal obligation or another exception provided by the GDPR applies.

10.4. Right to restriction of processing

You may request restriction of the use of your data in the situations provided by the GDPR, for example while the accuracy of certain data is being verified.

10.5. Right to object

You may object to certain processing based on legitimate interest on grounds relating to your particular situation.

Where data is processed for direct marketing purposes, you have the right to object at any time.

10.6. Right to data portability

Where the conditions of Article 20 of the GDPR are met, you may receive the personal data you have provided in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically feasible.

This right applies to processing based on consent or on a contract and carried out by automated means. It does not apply indiscriminately to all data.

10.7. Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10.8. Right to set post-mortem directives

Under the conditions provided by French law, you may define directives regarding the retention, erasure and disclosure of your personal data after your death.

10.9. Right not to be subject to certain automated decisions

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions provided by the GDPR.

If AllTeams implements such processing, the required information must be specified.

10.10. Right to lodge a complaint

If you believe that the processing of your personal data does not comply with regulations, you may lodge a complaint with the competent supervisory authority.

In France, this is the Commission nationale de l'informatique et des libertés (CNIL): https://www.cnil.fr/.

10.11. How to exercise your rights

To exercise your rights, you may contact the data controller at the following address:

• Email address: [CONTACT ADDRESS TO BE COMPLETED]

To protect your data, information allowing your identity to be verified may be requested where necessary and proportionate.

A response must in principle be provided within one month of receipt of the request. This period may be extended under the conditions provided by the GDPR; you will then be informed.

Exercising your rights under the GDPR is free of charge in principle. Reasonable fees or a refusal may apply in the exceptional cases provided by regulation, in particular for manifestly unfounded or excessive requests.

11 Account deletion

If you wish to delete your account or request the erasure of your data, you may contact the data controller at the contact address given in this policy.

The request procedure, any necessary verifications and the deletion arrangements must be defined before publication.

Some data may be retained where necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

The actual deletion procedure must be consistent with the information given to users.

12 Premium subscriptions and payments

Premium features are planned in AllTeams, but payments are not confirmed as activated to date.

Before payments are activated, this policy will be completed to specify:

• the data needed to manage subscriptions;
• the identity of the payment platforms or providers actually used;
• the data processed by AllTeams and the data processed directly by providers;
• the applicable retention periods;
• how to exercise your rights regarding this data.

13 Cookies and similar technologies

The website and the app may use cookies, identifiers or other similar technologies depending on their configuration.

The presence and purpose of these technologies must be verified separately for the website and the mobile app.

Where consent is required, it must be obtained before the relevant trackers are placed or read, in accordance with applicable rules. Users must also have clear information on the purposes and on how to manage their choices.

This section must be completed from an actual inventory of the cookies, SDKs and other trackers used.

14 Changes to this policy

This policy may be updated to reflect changes in the app, in data processing or in regulations.

The date of the last update will be shown at the top of the document.

In the event of a significant change, users will be informed appropriately where necessary.

15 Contact

For any question about this policy or the processing of your personal data, you may contact:

• Data controller: Haile Eyob
• Email address: [ADDRESS TO BE COMPLETED]