Privacy
What the Derksyon website collects, and the data processing addendum for schools' data on the platform.
This website
- If you send us a request, we keep what you wrote (your name, number, school name, city, number of captains and message) only to answer it.
- We count visits and taps as daily totals — no cookies, no IP addresses, nothing that identifies you. If your browser sends “Do Not Track”, we count nothing.
- No ads, and no scripts or fonts from other websites. The video and brochure files load from our storage provider (Supabase).
Data Processing Addendum
1. Roles
1.1 The School is the "controller" of the personal data of its learners, captains and staff; it decides the purposes and means.
1.2 The Platform is the "processor"; it processes the data on the School's behalf and instructions, only to provide the service.
2. Data processed
- Learners: name, mobile number, package and times, meeting point, notes the learner writes, the captain's arrival and each lesson's start and end, skills and the captain's notes, no-show reports, payment status and transfer receipt images, lesson ratings, WhatsApp consent, and WhatsApp conversations with the school (90 days).
- Captains: name, mobile number, photo and bio, car and plate, areas and languages, instructor licence number if entered, hours and time off, pay per lesson (the school owner only), PIN stored only as a salted hash.
- School owners and staff: e-mail, role, change history.
- Site visitors: aggregate, anonymous statistics (visits and taps), no advertising profiles.
3. Purposes
Booking, confirmations and reminders; recording lessons and attendance; payments and receipts; reports for the School; technical support; protecting the service from abuse.
4. Sub-processors
- Supabase: Database, storage, sign-in — European Union (Ireland)
- Vercel: Hosting and server functions — European Union (Dublin) and a global CDN
- Meta (WhatsApp Business): Automatic messages — once the School connects its number — per Meta's servers
- Resend: E-mail — once enabled — US or EU
- Paymob: Card payments — once enabled — Egypt
- Sentry: Error reports without personal data — once enabled — US or EU
The Platform tells the School 30 days before adding a new sub-processor.
5. Security
- Encryption in transit (HTTPS) and at rest.
- Each school's data isolated in the database (row-level security on every table).
- Learners' page links and attendance tickets are signed and reveal no personal data; PINs and passwords are stored only as hashes.
- Third-party keys (WhatsApp, payments) are encrypted with a key the database never sees.
- A log of every admin change and every platform operation.
6. Retention and deletion
6.1 A learner's name and number are anonymised 24 months after their last lesson, unless the School deletes them earlier.
6.2 The School can erase any learner's data from the admin at their request.
6.3 After the subscription ends, data is deleted or anonymised within 30 days, after the chance to export it.
7. Data subjects' rights
The Platform helps the School answer access, correction, deletion and objection requests within the legal deadlines.
8. Security incidents
The Platform notifies the School of any breach affecting its data within 72 hours of discovering it, with the details available and the remediation steps, so the School can notify the authorities and the people concerned when required.
9. Audit
On reasonable request the Platform gives the School the information needed to show compliance with this addendum.