1. Data processed
Account, contact details, bookings, memberships, payments, preferences, access sessions, security logs and support communications.
2. Purposes
Account creation and security, service delivery, booking and membership management, payments, support, abuse prevention and legal compliance.
3. Retention and security
Data is retained as needed for the stated purposes and applicable obligations. Credentials are not stored in plaintext; tokens and sessions expire and can be revoked.
4. Providers and recipients
The final text must list the actual categories of processors and providers, including infrastructure, email, storage, payment and federated identity services.
5. Rights and contacts
The final document must state how to exercise privacy rights, controller and DPO contacts where applicable, and all other legally required information.