1. Who we are

Go Doggity runs the platform at go.godoggity.com, with Go Book (bookings and registrations), Go Learn (online courses) and Go Scout (agility course scouting), and the website godoggity.com. This statement explains which data we process, why, and what your rights are.

Data controller

Go Doggity, SUSTAiL BV
Sportalaan 57, 3550 Heusden-Zolder, Belgium
Company number: BE 1005.780.627
Email: [email protected]

Who is responsible

Your platform account and Go Scout: Go Doggity is responsible for these.
Your registrations and courses with a trainer: the trainer or dog school you book with is responsible for their own customer records. Go Doggity only processes that data on behalf of the trainer, under a data processing agreement. You can also ask the trainer directly about your registration.
Your orders in a trainer's web shop (Go Shop): the trainer is responsible for their customers and orders. Go Doggity only processes that data on behalf of the trainer, under a data processing agreement. You need no platform account for a web shop: you log in with a link we email you.
Websites we make for trainers with Go Site: the trainer is responsible for what visitors send through their website (contact form, sign-ups). Go Doggity only processes it on the trainer's behalf.

2. Which data we process

We only process what is needed to run the platform.

Account: name, email address, password (stored encrypted), language. Controller: Go Doggity.
Dogs: name, breed, date of birth, level or class, notes you add yourself. Controller: Go Doggity for your account, the trainer for your registration.
Registrations: chosen activity, trainer, group, your answers to the registration questions, status, messages with the trainer, and your places on waiting lists and as a stand-in (which lessons, the dates you skip, places offered). Controller: the trainer.
Punch cards without an account: if you pay a trainer directly, the trainer can keep a punch card for you with only your name (and, if you give it, your email address), and the lessons stamped off your card. Controller: the trainer.
Places kept for you: a trainer can keep a place for you in an activity with your name and, if they have it, your email address. With an address, we send you an invitation on the trainer's behalf; registering with that address takes the place. Controller: the trainer.
Invitation to a team: when a trainer invites you to work with them, we keep your e-mail address and the role, and send you an e-mail on the trainer's behalf. Controller: the trainer.
Renting a space: which space, trainer, day and time, price, status, your note when booking, and your cancellation and refund. Controller: the trainer.
Payments and invoices: amount, date, payment status, invoice details. No card or account numbers: those stay with Mollie. Controller: the trainer (Go Doggity for trainers' subscriptions).
Courses: courses you bought or have access to, your progress and your messages in the course community. To protect course content, we recognise at most two devices on which you open a course, and we put your name and email address on PDFs you download. Controller: the trainer who offers the course.
A trainer's web shop: name, email address, phone number, delivery address, your orders and invoices, and for digital products your download links. Controller: the trainer who owns the shop.
Go Scout: scouting sessions, course maps, notes, start lists (with names of other handlers, see section 4) and the people you share a session with. Controller: Go Doggity.
Website godoggity.com: messages through the contact form (name, email address, message: we mail them on and do not store them on the website), and sign-ups to be kept posted (email address, the tools you chose, language, date of confirmation). Controller: Go Doggity.
Technical: IP address, login times, error messages in server logs, a log of the emails we send you (date, address and subject, not the content), an audit log of changes (who changed what and when, for example the status of a registration), and anonymous visit statistics without cookies (see section 8). Controller: Go Doggity.

For trainers we also process organisation details, billing details and the chosen plan.

3. Purposes and legal basis

We never use your data for third-party advertising and we never sell it.

Performance of the contract (Art. 6(1)(b) GDPR): creating and managing your account; registering, forming groups, sending payment requests and giving access to courses; service emails (confirmation, change, reminder); your own Go Scout sessions and notes, and sharing them with whom you choose.
Performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR): processing and keeping payments and invoices.
Legitimate interest (Art. 6(1)(f) GDPR): names of other handlers and dogs on start lists in Go Scout (see section 4); protecting course content (devices and watermark); anonymous visit statistics without cookies (see section 8); answering your message through the contact form; security, preventing misuse and fixing errors.
Consent (Art. 6(1)(a) GDPR): your sign-up to be kept posted, which you tick yourself and confirm by email. If we ever ask you for anything else based on consent, also only when you tick it yourself. You can always withdraw your consent: through the link on the confirmation page, or by emailing [email protected].

We make no automated decisions that affect you directly. Group allocation and admission are decided by the trainer.

4. Go Scout and data of other handlers

Start lists you upload to Go Scout contain the names of other handlers and their dogs. These people have no account themselves and did not give us this data.

We process it based on our legitimate interest: preparing for your competition and following your scouting. Start lists are usually already published by the organiser. To keep the impact small:

a start list is only in your own scouting session;
others only see it if you share your session: with a viewer you invite, or with a view link. A view link expires after 1, 7 or 30 days, you can revoke it at any time, and it is not indexed by search engines;
nobody can search for handlers across sessions;
the running orders of events in Go Scout are only shown to logged-in users and are deleted 6 months after the event.

Are you on a start list and do you not want to appear in Go Scout? Email [email protected]. We will then remove your name from the sessions and events concerned.

As a user, you only upload start lists you obtained lawfully, and you only use and share them to prepare for and follow up on competitions.

5. Who we share data with

We only share data with parties needed to run the platform. We have a data processing agreement with each processor.

Hetzner Online GmbH (Germany): hosting of server and database. Processes all platform data.
Laravel Forge, Laravel Holdings Inc. (USA): server management and updates. Has technical access to the server, but does not use your data itself.
Mollie B.V. (Netherlands): payments. Processes name, email address, amount and payment details.
Postmark (USA): sending service emails. Processes name, email address and the content of the email.
Anthropic (USA): translating course texts, and messages in a course's community when a reader asks for a translation. Only receives the text to translate, without your name or email address.
Backblaze, Inc. (USA, storage in the EU): encrypted backups of the platform. Cannot read their content.

Mollie processes payment data as an independent controller, under its own privacy statement (mollie.com/en/privacy). Payments go directly to the trainer you book with.

Trainers only see the data of customers who register or follow a course with them: name, contact details, registered dogs, registrations, progress and payment status. They see nothing of your registrations with other trainers or of your Go Scout sessions.

People you share a Go Scout session with see the results of that session, with the start list.

If the law requires it, we pass data on to public authorities.

6. Transfers outside the EU

Your data is stored on Hetzner servers in Germany. Postmark sends our emails from the USA: for that, your name, email address and the content of the email go to the USA. This is based on the standard contractual clauses of the European Commission.

Laravel Forge is also an American company. It only has technical access to the server, with the same safeguards. Anthropic only receives texts to translate (course texts and, when a reader asks, messages in a course's community), without your name or email address, based on the standard contractual clauses of the European Commission. Backblaze is also an American company. It stores our backups in the EU, encrypted with a password only we know.

7. Retention periods

We do not keep data longer than needed.

Account and dogs: as long as your account exists.
Registrations and courses: as long as your account exists, or shorter if the trainer asks.
Waiting lists and stand-ins: a place on the waiting list of a lesson that never became a place, until 30 days after that lesson; as a fixed stand-in until 30 days after you stop or the series ends.
Punch cards without an account: as long as the trainer keeps you as a customer; a card moves to your account once the trainer links it.
Places kept for you: until the place is taken or let go, at the latest 30 days after the last day of the activity or after it was cancelled; one year for an activity without a date.
Invitation to a team: until you answer or the trainer cancels it, at the latest 14 days.
Renting a space: a booking that was never paid, until 30 days after the rented time; your note on a booking until a year after it. Paid bookings stay with their invoice.
Orders in a web shop: as long as the trainer keeps you as a customer. At your request the trainer anonymises your customer data; the invoices stay as long as the law requires.
Invoices and payment data: as long as the law requires, also after your account is deleted: in Belgium up to 10 years, in Germany 8 years.
Go Scout sessions, with their start lists: as long as your account exists, or until you delete them yourself.
Running orders of events in Go Scout: until 6 months after the event.
Visit statistics: individual visits 90 days, after that only daily totals.
Sign-ups to be kept posted: until you unsubscribe; unconfirmed sign-ups 7 days.
Messages through the contact form: in our mailbox, as long as needed to handle your question.
Server logs: 30 days.
Log of sent emails: 1 year.
Audit log of changes: 2 years.
Backups: encrypted, every night. We keep a backup of every day for 7 days, then one a week for 4 weeks and one a month for 6 months. After that they are deleted.

If you delete your account, we erase your data within 30 days, except what we must keep by law. In backups it remains for up to 6 months, until those are deleted.

8. Cookies, storage on your device and statistics

The platform only uses strictly necessary cookies. No consent is needed for them, so you do not get a cookie banner.

Session cookie: keeps you logged in and remembers your language, until you log out or have been inactive for 2 hours.
XSRF-TOKEN: protects forms against misuse. Same lifetime as the session.
remember_web: only if you tick "Remember me" when logging in. You then stay logged in on that device until you log out, at most 5 years.
learn_device: recognises the device on which you follow an online course (at most two devices per student). Only for students, 5 years.
sidebar_closed: remembers which parts of the menu you folded, 1 year.

Storage on your device: Go Scout first stores your sessions in your browser's storage, so scouting also works without a connection. With an account, they are then saved in your account. Some preferences, such as light or dark mode and how you turned a course map, also stay on your device. You can always clear this storage in your browser.

In a trainer's web shop the session cookie keeps you logged in after you clicked your login link.

We use no analytics, tracking or advertising cookies. When paying, you go to Mollie's page, which may set its own cookies.

Statistics without cookies

To understand how the platform is used, we count visits to the public pages, such as the home page and Go Scout. We do not count pages behind the login or view links.

What we count: which page, the website or campaign you came from, the kind of device and browser, the country according to your browser's time zone, anonymous error reports of the app, and anonymous reports from your browser when our security rules would block a part of a page (which page and which part, without personal data).
Without cookies and without IP address: to count visitors per day, we make a code from your IP address and browser with a key that changes every day and is then deleted. So we cannot recognise you or follow you from one day to the next.
Legal basis: our legitimate interest in improving the platform (Art. 6(1)(f) GDPR).
Retention: individual visits 90 days, after that only daily totals.
We share this data with no one.

9. Security

We protect your data with technical and organisational measures:

encrypted connection (HTTPS) on the whole platform;
passwords stored encrypted, never readable;
trainers only see the data of their own customers;
administrator access limited and secured with two-factor authentication;
daily backups at a separate location.

In case of a data breach that poses a risk to you, we notify the Data Protection Authority within 72 hours and you as soon as possible.

10. Your rights

You can always view, correct, download or delete your data. You download your data and delete your account yourself, in your profile.

Access and portability: yourself, in your profile. You download a file with all your data there.
Correction: change your data in your profile.
Erasure: yourself, in your profile. You delete your account there.
Objection (for example to processing in Go Scout): email [email protected].
Restriction of processing: email [email protected].
Withdrawing consent: through the link in the email we send you based on consent, or via [email protected].

We reply within one month. If your request concerns your registrations with a trainer, we forward it to that trainer and help them carry it out.

11. Complaints, changes and contact

Complaint? Please let us know first at [email protected]. You can always file a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be), or with the supervisory authority in your own country.

Minimum age: you can create an account from the age of 16. Younger handlers register through a parent's account.

Changes: we update this statement when the platform changes. For important changes, you receive an email in advance.