[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"legal:en-GB:privacy_policy":3},{"version":4,"publishedAt":5,"html":6},1,"2026-10-19T08:03:23.422545Z","\u003Ch1>PRIVACY POLICY\u003C\u002Fh1>\n\u003Chr>\n\u003Ch2>1. Introduction\u003C\u002Fh2>\n\u003Cp>Wattson is a sports training planning and tracking application. It allows users to set up an athlete profile, calculate personalised training zones, generate and follow workouts, and synchronise those workouts with their connected device.\u003C\u002Fp>\n\u003Cp>This privacy policy describes in full which personal data we collect, why we collect it, on what legal basis, who it is shared with, how long it is kept, and how it is protected.\u003C\u002Fp>\n\u003Cp>It is drafted in accordance with Regulation (EU) 2016\u002F679 of 27 April 2016 (the "\u003Cstrong>GDPR\u003C\u002Fstrong>") and French Law No. 78-17 of 6 January 1978 as amended (the "Data Protection Act").\u003C\u002Fp>\n\u003Cp>We process your data according to the principles of \u003Cstrong>lawfulness, fairness and transparency\u003C\u002Fstrong>, \u003Cstrong>data minimisation\u003C\u002Fstrong> (we collect only what is strictly necessary for the service) and \u003Cstrong>purpose limitation\u003C\u002Fstrong> (your data is never used for purposes other than those described below).\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Core commitment:\u003C\u002Fstrong> Wattson uses no analytics tools, no advertising pixels, no third-party trackers and no marketing profiling tools. Your data is \u003Cstrong>never sold, rented or transferred\u003C\u002Fstrong> to third parties for commercial purposes, under any circumstances.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Chr>\n\u003Ch2>2. Data controller\u003C\u002Fh2>\n\u003Cp>The data controller within the meaning of Article 4(7) GDPR is:\u003C\u002Fp>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Legal name\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Pierre Halloo EI\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Trading name\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Wattson\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Legal form\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Sole trader (entrepreneur individuel) under the French micro-enterprise regime\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Registered office\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>4 rue de la gare, 80710 Quevauvillers, Somme, France\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>SIREN number\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>890589674\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>SIRET number\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>89058967400021\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>EU VAT number\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>FR64890589674\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Publication director\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Pierre Halloo\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>General contact\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>support@getwattson.io\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data protection contact\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>privacy@getwattson.io\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>\u003Cstrong>Data Protection Officer (DPO):\u003C\u002Fstrong>\nAppointing a Data Protection Officer is not mandatory under Article 37 GDPR given the nature and scale of our processing. Any question relating to data protection may be addressed to the contact above, which serves as our permanent point of contact for such matters.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>3. Scope\u003C\u002Fh2>\n\u003Cp>This policy applies to all processing carried out in connection with:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>the Wattson web application for athletes (the "\u003Cstrong>Application\u003C\u002Fstrong>");\u003C\u002Fli>\n\u003Cli>Wattson's internal administration interface (the "\u003Cstrong>Back office\u003C\u002Fstrong>");\u003C\u002Fli>\n\u003Cli>the Wattson API underlying both interfaces.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>It does not apply to processing carried out by third-party services you choose to connect your account to (in particular connected-device manufacturers and training platforms), nor by our payment provider, each of which has its own privacy policy. These services are identified in sections 7.2 and 7.3.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>4. Data we collect\u003C\u002Fh2>\n\u003Ch3>4.1 Data you provide directly\u003C\u002Fh3>\n\u003Cp>\u003Cstrong>Identification and account data\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>First name, last name\u003C\u002Fli>\n\u003Cli>Email address\u003C\u002Fli>\n\u003Cli>Password (never stored in clear text, see section 10)\u003C\u002Fli>\n\u003Cli>Avatar colour (display preference)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Athlete profile data\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Date of birth\u003C\u002Fli>\n\u003Cli>Gender\u003C\u002Fli>\n\u003Cli>Weight\u003C\u002Fli>\n\u003Cli>Height\u003C\u002Fli>\n\u003Cli>Sport practised, self-declared level, preferred intensity unit\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Physiological and performance data\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>FTP (Functional Threshold Power)\u003C\u002Fli>\n\u003Cli>MAS (maximal aerobic speed)\u003C\u002Fli>\n\u003Cli>Maximum heart rate and resting heart rate\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Training data\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Content of workouts created or scheduled (structure, effort blocks, intensities, durations)\u003C\u002Fli>\n\u003Cli>Training calendar\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Billing data\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>This data (name, billing address, payment method) is entered by you \u003Cstrong>in an interface hosted by our payment provider\u003C\u002Fstrong> and collected directly by them. It never passes through our servers and is not stored in our database. We retain only the \u003Cstrong>subscription and customer identifiers\u003C\u002Fstrong> issued by that provider, which tell us what level of access is open to you. Invoices, which contain your billing address, are issued and archived by the provider; we access them through their interface for the accounting and tax purposes described in section 9.2.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Communication preferences\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Consent to receive the newsletter\u003C\u002Fli>\n\u003Cli>Consent to receive marketing communications\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>4.2 Data collected automatically\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>IP address\u003C\u002Fstrong>, recorded when you accept our terms and conditions as proof of consent, and used for rate limiting on sensitive endpoints to prevent abuse\u003C\u002Fli>\n\u003Cli>\u003Cstrong>User-Agent\u003C\u002Fstrong> (browser and operating system type), recorded in the same circumstances\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Timestamps\u003C\u002Fstrong> of creation, modification and acceptance of legal documents\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Account status\u003C\u002Fstrong>: role, active account, verified email address\u003C\u002Fli>\n\u003Cli>\u003Cstrong>IP address, User-Agent, account identifier and email address\u003C\u002Fstrong>, together with the technical content of a failed request (error message, stack trace), transmitted in the event of a malfunction or for a sample of requests to our error-monitoring tool (see section 7.2). Authentication and session cookies are systematically excluded.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>4.3 Data from your connected devices and platforms\u003C\u002Fh3>\n\u003Cp>If, and only if, you explicitly authorise a connection to a third-party device or service:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>OAuth authorisation tokens (access token and refresh token), \u003Cstrong>encrypted at rest\u003C\u002Fstrong> in our database\u003C\u002Fli>\n\u003Cli>Your account identifier at the third-party provider (provider user ID)\u003C\u002Fli>\n\u003Cli>The scopes granted\u003C\u002Fli>\n\u003Cli>Synchronisation status of transmitted workouts\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Scope of the permissions we request.\u003C\u002Fstrong> Wattson requests \u003Cstrong>write\u003C\u002Fstrong> access from each platform in order to publish your workouts to it, and \u003Cstrong>strictly limited read\u003C\u002Fstrong> access covering only what is required to link and validate the account. We do not currently request read access to completed activities, GPS tracks, daily health metrics or sleep data.\u003C\u002Fp>\n\u003Cp>Should we extend this scope in future for example to compare your planned workouts against completed ones this policy would be updated beforehand, the new data category and its purpose would be described in it, and \u003Cstrong>fresh explicit consent\u003C\u002Fstrong> would be requested from you. No scope extension can take effect on already-granted authorisations without a new action on your part.\u003C\u002Fp>\n\u003Ch3>4.4 Data we do not collect\u003C\u002Fh3>\n\u003Cp>By design, Wattson \u003Cstrong>does not receive, process or store\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Your \u003Cstrong>payment card details\u003C\u002Fstrong>: entry takes place in an isolated frame (iframe) hosted by our PCI-DSS certified payment provider. This data never transits through our servers.\u003C\u002Fli>\n\u003Cli>Your \u003Cstrong>billing address\u003C\u002Fstrong> in our database: it is transmitted directly to our payment provider, who is its custodian (see section 4.1).\u003C\u002Fli>\n\u003Cli>Your \u003Cstrong>location data\u003C\u002Fstrong>: the Application never requests access to your position. The corresponding permission is explicitly blocked at the level of the \u003Ccode>Permissions-Policy\u003C\u002Fcode> header on our web servers, as are camera and microphone access. Wattson also receives no GPS tracks from the third-party platforms you connect your account to, as the authorisation scope we request does not allow it (see section 4.3).\u003C\u002Fli>\n\u003Cli>Any \u003Cstrong>browsing data for advertising or statistical purposes\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Chr>\n\u003Ch2>5. Purposes and legal bases\u003C\u002Fh2>\n\u003Cp>In accordance with Article 6 GDPR, each processing operation rests on a determined legal basis.\u003C\u002Fp>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Data category\u003C\u002Fth>\n\u003Cth>Purpose\u003C\u002Fth>\n\u003Cth>Legal basis (Art. 6 GDPR)\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>First name, last name, email\u003C\u002Ftd>\n\u003Ctd>Account creation and management, authentication, contractual communication\u003C\u002Ftd>\n\u003Ctd>Performance of a contract, Art. 6(1)(b)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Password (hashed)\u003C\u002Ftd>\n\u003Ctd>Authentication and account security\u003C\u002Ftd>\n\u003Ctd>Performance of a contract, Art. 6(1)(b)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Date of birth, gender, weight, height\u003C\u002Ftd>\n\u003Ctd>Estimating physiological thresholds (FTP, MAS, max HR, heart rate reserve) and calculating training zones\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>Explicit consent, Art. 6(1)(a) and Art. 9(2)(a)\u003C\u002Fstrong> (see section 6)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>FTP, MAS, max HR, resting HR\u003C\u002Ftd>\n\u003Ctd>Generating and calibrating personalised training plans\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>Explicit consent, Art. 6(1)(a) and Art. 9(2)(a)\u003C\u002Fstrong> (see section 6)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Sport, level, intensity unit\u003C\u002Ftd>\n\u003Ctd>Personalising the interface and the workouts offered\u003C\u002Ftd>\n\u003Ctd>Performance of a contract, Art. 6(1)(b)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Workout content\u003C\u002Ftd>\n\u003Ctd>Providing the planning and tracking service\u003C\u002Ftd>\n\u003Ctd>Performance of a contract, Art. 6(1)(b)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>OAuth tokens, third-party provider identifier\u003C\u002Ftd>\n\u003Ctd>Synchronising workouts with your connected device\u003C\u002Ftd>\n\u003Ctd>Consent, Art. 6(1)(a)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Payment provider subscription and customer identifiers\u003C\u002Ftd>\n\u003Ctd>Subscription management, access to paid features\u003C\u002Ftd>\n\u003Ctd>Performance of a contract, Art. 6(1)(b)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Invoices and accounting records (issued and archived by the payment provider)\u003C\u002Ftd>\n\u003Ctd>Billing, tax and accounting compliance\u003C\u002Ftd>\n\u003Ctd>Legal obligation, Art. 6(1)(c)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>IP address, User-Agent (consent register)\u003C\u002Ftd>\n\u003Ctd>Establishing proof of acceptance of the terms and conditions\u003C\u002Ftd>\n\u003Ctd>Legal obligation (accountability, Art. 5(2)), Art. 6(1)(c)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>IP address (rate limiting)\u003C\u002Ftd>\n\u003Ctd>Preventing abuse, brute-force attacks and automated sign-ups\u003C\u002Ftd>\n\u003Ctd>Legitimate interests, Art. 6(1)(f)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Newsletter \u002F marketing preferences\u003C\u002Ftd>\n\u003Ctd>Sending non-contractual communications\u003C\u002Ftd>\n\u003Ctd>Consent, Art. 6(1)(a)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Account status and role\u003C\u002Ftd>\n\u003Ctd>Access-rights control, service administration\u003C\u002Ftd>\n\u003Ctd>Legitimate interests, Art. 6(1)(f)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>IP address, User-Agent, account identifier (error monitoring)\u003C\u002Ftd>\n\u003Ctd>Diagnosing, fixing and preventing technical malfunctions; service performance monitoring\u003C\u002Ftd>\n\u003Ctd>Legitimate interests, Art. 6(1)(f)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Authentication and security cookies\u003C\u002Ftd>\n\u003Ctd>Session maintenance, CSRF protection\u003C\u002Ftd>\n\u003Ctd>Necessary to provide the service exempt from consent (see section 12)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>\u003Cstrong>On legitimate interests:\u003C\u002Fstrong> where we rely on this basis, we have carried out a balancing exercise between our interests and your fundamental rights and freedoms. The processing concerned (service security, technical administration) is limited to what is strictly necessary and has no significant impact on your privacy. You have a right to object (see section 11).\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>6. Processing of body-composition and physiological data\u003C\u002Fh2>\n\u003Cp>This section warrants particular attention and is the subject of a reinforced commitment on our part.\u003C\u002Fp>\n\u003Ch3>6.1 Data concerned\u003C\u002Fh3>\n\u003Cp>Wattson collects your \u003Cstrong>date of birth, gender, weight and height\u003C\u002Fstrong>, together with your \u003Cstrong>physiological values\u003C\u002Fstrong> (FTP, MAS, maximum and resting heart rate).\u003C\u002Fp>\n\u003Ch3>6.2 Sole and exclusive purpose\u003C\u002Fh3>\n\u003Cp>This data is collected and processed for the \u003Cstrong>sole and exclusive purpose\u003C\u002Fstrong> of:\u003C\u002Fp>\n\u003Col>\n\u003Cli>Estimating your physiological thresholds where you do not know them (theoretical max HR calculation, FTP or MAS estimation from your characteristics and declared level);\u003C\u002Fli>\n\u003Cli>Calculating your \u003Cstrong>training zones\u003C\u002Fstrong> (power, pace and heart-rate zones);\u003C\u002Fli>\n\u003Cli>Calibrating the intensity of the workouts offered to you.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>It is used for \u003Cstrong>no other purpose\u003C\u002Fstrong>. In particular, it is subject to no commercial profiling, no aggregated statistical analysis for research or product-development purposes, no algorithmic model training, no marketing segmentation, and is \u003Cstrong>never transmitted to third parties\u003C\u002Fstrong> with the sole exception, for the physiological values, of your connected device's platform where you have explicitly authorised synchronisation, and only to the extent necessary for the workouts to execute correctly on that device.\u003C\u002Fp>\n\u003Ch3>6.3 Legal characterisation and legal basis\u003C\u002Fh3>\n\u003Cp>Article 9(1) GDPR establishes a general prohibition on processing data concerning health. Wattson is not a health service, makes no diagnosis, provides no medical advice and is not intended to assess your state of health.\u003C\u002Fp>\n\u003Cp>Nevertheless, \u003Cstrong>as a precaution\u003C\u002Fstrong>, we consider that the combination of these parameters may qualify as data concerning health within the meaning of Article 4(15) GDPR. We therefore apply the protective regime of Article 9 and base this processing on the exception in \u003Cstrong>Article 9(2)(a), the explicit consent\u003C\u002Fstrong> of the data subject for a specified purpose.\u003C\u002Fp>\n\u003Ch3>6.4 How consent is obtained\u003C\u002Fh3>\n\u003Cp>Accordingly:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Your consent to this processing is obtained \u003Cstrong>separately\u003C\u002Fstrong> from acceptance of the terms of use and terms of sale, by way of a clear, dedicated affirmative action;\u003C\u002Fli>\n\u003Cli>The purpose is presented to you in explicit terms at the point of collection;\u003C\u002Fli>\n\u003Cli>This consent is \u003Cstrong>timestamped and logged\u003C\u002Fstrong> (date, version of the text accepted) in order to meet our demonstration obligation under Article 7(1);\u003C\u002Fli>\n\u003Cli>You may \u003Cstrong>withdraw your consent at any time\u003C\u002Fstrong>, as easily as you gave it, from your account settings. Withdrawal results in erasure of the data concerned and loss of the personalisation features that depend on it, without affecting the lawfulness of processing carried out beforehand;\u003C\u002Fli>\n\u003Cli>Refusing consent does not deprive you of access to the service, but makes the automatic training-zone calculation features unavailable.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>6.5 No automated decision-making within the meaning of Article 22\u003C\u002Fh3>\n\u003Cp>Wattson automatically generates suggested workouts and training zones from your data. This processing \u003Cstrong>does not constitute an automated decision producing legal effects concerning you or similarly significantly affecting you\u003C\u002Fstrong> within the meaning of Article 22 GDPR: it is a training-planning aid that you remain free to modify, ignore or not follow. You retain full control of your calendar and workout content at all times.\u003C\u002Fp>\n\u003Ch3>6.6 Disclaimer\u003C\u002Fh3>\n\u003Cp>Wattson is not a medical device. The calculated values are \u003Cstrong>estimates for sporting purposes\u003C\u002Fstrong>. They are in no way a substitute for medical advice, a laboratory exercise test or supervision by a healthcare professional. It is your responsibility to confirm with a doctor that your state of health is compatible with physical activity and with the effort intensities proposed.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>7. Recipients of your data\u003C\u002Fh2>\n\u003Ch3>7.1 Internal access\u003C\u002Fh3>\n\u003Cp>Within Wattson, access to personal data is \u003Cstrong>strictly limited\u003C\u002Fstrong> to those who need it in the performance of their duties, through server-side role-based access control.\u003C\u002Fp>\n\u003Cp>The back office allows a restricted number of administrators holding the highest role to consult the \u003Cstrong>legal document acceptance register\u003C\u002Fstrong>, which contains the user identifier, IP address and User-Agent at the time of acceptance. This access is justified by the need to be able to demonstrate that consent was obtained in the event of a dispute or an inspection.\u003C\u002Fp>\n\u003Cp>No member of the Wattson team has access to your passwords, which are stored only as an irreversible cryptographic hash, nor to your connected devices' authorisation tokens, which are encrypted at rest.\u003C\u002Fp>\n\u003Ch3>7.2 Our processors\u003C\u002Fh3>\n\u003Cp>The following providers process personal data \u003Cstrong>on our behalf and on our instructions\u003C\u002Fstrong> within the meaning of Article 28 GDPR. Each is bound by a data processing agreement prohibiting any use of the data for their own purposes and imposing appropriate security safeguards.\u003C\u002Fp>\n\u003Ch4>Payment provider\u003C\u002Fh4>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Contracting entity\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Stripe Payments Europe, Limited, Ireland\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Purpose\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Payment processing, invoicing, subscription and payment-method management\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data transmitted\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>First name, last name, email address, billing address, payment method details (entered directly with the provider), subscription identifiers\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Processing location\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>European Union (Ireland), with transfers to the United States necessary for service provision\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Transfer safeguard\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Data transfer addendum incorporated into the contract, based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021\u002F914)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Specific safeguards\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>PCI-DSS Level 1 certification, audited annually by a Qualified Security Assessor. AES-256 encryption at rest and TLS in transit. Card numbers are encrypted separately and held in an isolated data vault. Data breach notification within contractually agreed timeframes.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Sub-processors\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Public, up-to-date list at \u003Ccode>stripe.com\u002Flegal\u002Fservice-providers\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Agreement in place\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Yes the data processing agreement forms an integral part of the services agreement accepted on account opening\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>This provider also acts as an \u003Cstrong>independent controller\u003C\u002Fstrong> for certain purposes of its own, in particular fraud prevention, compliance with its own anti-money-laundering and know-your-customer obligations, and improvement of its own services. Its privacy policy applies to that processing, for which we determine neither the purposes nor the means.\u003C\u002Fp>\n\u003Ch4>Transactional email provider\u003C\u002Fh4>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Contracting entity\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Plus Five Five, Inc. United States (San Francisco, California)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Purpose\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Delivery of transactional email: address verification, password reset, account notifications\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data transmitted\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Email address, first name, message content and delivery metadata\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Processing location\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>United States\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Transfer safeguard\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Certification under the \u003Cstrong>EU-U.S. Data Privacy Framework\u003C\u002Fstrong> with the U.S. Department of Commerce, supplemented by the European Commission's Standard Contractual Clauses\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Specific safeguards\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Subject to the investigative and enforcement powers of the Federal Trade Commission. Commitment to cooperate with European data protection authorities on unresolved complaints, and the possibility for the data subject to invoke binding arbitration. Annual penetration testing, static code analysis, encryption in transit and at rest.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Retention at the provider\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Data deleted within 90 days following termination of our account\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Sub-processors\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Public list at \u003Ccode>resend.com\u002Flegal\u002Fsubprocessors\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Agreement in place\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Ye the data processing addendum becomes binding on acceptance of the terms of service\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch4>Infrastructure host\u003C\u002Fh4>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Contracting entity\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Railway Corporation, United States (San Francisco, California)\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Purpose\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Hosting of the application and database, TLS termination, backups\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data transmitted\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>All data processed by the service, in transit and at rest\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Storage location\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>EU West region, Amsterdam, Netherlands\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Access from a third country\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>As the contracting entity is established in the United States, \u003Cstrong>remote access from the United States\u003C\u002Fstrong> by its authorised technical staff is possible in the course of operations and support. This access constitutes a transfer within the meaning of Chapter V GDPR and is covered by the safeguards below.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Transfer safeguard\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021\u002F914), controller-to-processor module, governed by Irish law and subject to the Irish courts. Reliance on the Data Privacy Framework where the transfer recipient is certified under it.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Specific safeguards\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Database encryption at rest and encryption of data in transit. Logical isolation between customer environments. Daily backups distributed across multiple sites and regions, with regular restore testing. Mandatory two-factor authentication for internal access. Comprehensive logging and anomaly analysis. Continuously verified automated compliance controls.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Principal sub-processor\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Google Cloud Platform, which provides physical data centre security\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Sub-processors\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Public list at \u003Ccode>trust.railway.com\u002Fitem\u002Fsubprocessors\u003C\u002Fcode>, with ten days' prior notice before any addition\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Agreement in place\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Yes the data processing agreement forms an integral part of the services agreement accepted on account opening\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch4>Application error monitoring\u003C\u002Fh4>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Contracting entity\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Functional Software GmbH, the European entity of the Sentry group, competent for organisations whose data processing region is set to the European Union, as ours is. The full entity identification, registered office and storage region are set out in the data processing agreement in force, a copy of which is available on request.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Purpose\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Diagnosing, fixing and preventing technical malfunctions; service performance monitoring, both server-side and within our web application\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data transmitted\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Cem>Server-side:\u003C\u002Fem> IP address, User-Agent and other non-sensitive request headers, account identifier and email address of the authenticated user where applicable, error message and stack trace, technical performance data (response times, database queries) excluding authentication and session cookies and local code variables, which are systematically filtered before transmission (see section 10.4). \u003Cem>Web application:\u003C\u002Fem> error message and stack trace, URL and page load\u002Fnavigation timings, browser type unlike the server, the web application transmits \u003Cstrong>neither account identifier nor email address\u003C\u002Fstrong>. The connection IP address nevertheless remains visible to the provider as the technical recipient of the network request, as with any service your browser connects to.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Processing location\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Data processing region set to the European Union for event data; United States for account metadata, audit logs and support exchanges, which fall outside the scope of the chosen processing region\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Transfer safeguard\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021\u002F914) for residual flows to the United States, supplemented by the group's US entity certification under the EU-U.S. Data Privacy Framework\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Specific safeguards\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Filtering of authentication and session cookies via a denylist dedicated to the cookie names used by Wattson, in addition to the vendor's standard list; local-variable capture in stack traces disabled; encryption in transit (TLS) and at rest\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Retention at the provider\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>As defined by our subscription (90 days by default for error events, subject to change with the plan subscribed); deletion of all data on termination of the contract, save where legally required to retain\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Sub-processors\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Public, up-to-date list at \u003Ccode>sentry.io\u002Flegal\u002Fsubprocessors\u003C\u002Fcode>, with a change notification feed\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Agreement in place\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Yes the data processing agreement is incorporated into the terms of service accepted when our organisation was created\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>This tool is deployed server-side and within our web application (getwattson.io); it may be deployed within any future client application under the same safeguards. \u003Cstrong>No physiological data, no training data, no payment identifier and no third-party authorisation token is transmitted to it\u003C\u002Fstrong>, and no Session Replay is performed (see section 7.4).\u003C\u002Fp>\n\u003Ch3>7.3 Disclosures to third-party controllers\u003C\u002Fh3>\n\u003Cp>Some data disclosures do not amount to processing on our behalf: the recipient determines the purposes and means of the processing itself, and becomes an \u003Cstrong>independent controller\u003C\u002Fstrong> for the data it receives.\u003C\u002Fp>\n\u003Ch4>Connected device manufacturers and training platforms\u003C\u002Fh4>\n\u003Cp>If, and only if, you explicitly choose to connect your Wattson account to a device manufacturer's platform or a third-party training service, we transmit to that platform the data required to synchronise your workouts: the content and parameters of the workouts, together with the physiological values needed for them to execute correctly on your device.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Key point to understand:\u003C\u002Fstrong> these platforms do not process this data on our behalf. They process it \u003Cstrong>for their own account, according to their own purposes and their own privacy policy\u003C\u002Fstrong>, over which Wattson has no control.\u003C\u002Fp>\n\u003Cp>In practical terms:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>The disclosure rests on \u003Cstrong>your explicit consent\u003C\u002Fstrong>, expressed through the authorisation you grant during the OAuth connection flow. It never takes place without that authorisation.\u003C\u002Fli>\n\u003Cli>From the moment the data reaches the third-party platform, \u003Cstrong>its privacy policy applies\u003C\u002Fstrong>, not this one. We encourage you to read it before connecting your account.\u003C\u002Fli>\n\u003Cli>These platforms may have practices different from ours, in particular as regards analytics, targeted advertising or sharing with their own commercial partners practices Wattson does not engage in.\u003C\u002Fli>\n\u003Cli>Several of these manufacturers are established \u003Cstrong>outside the European Union\u003C\u002Fstrong>, primarily in the United States, and transfer data to their country of establishment.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch4>Revoking a connection\u003C\u002Fh4>\n\u003Cp>You may \u003Cstrong>revoke a connection at any time\u003C\u002Fstrong>, in two ways:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>From Wattson\u003C\u002Fstrong>, in your account settings. Revocation triggers a revocation call to the platform's API, followed by immediate deletion of the authorisation tokens from our database.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>From the third-party platform itself\u003C\u002Fstrong>, where it offers a connected-applications management screen. In that case, we expose dedicated endpoints (deregistration and user permissions change) allowing the platform to notify us of the withdrawal. On receipt of such a notification, we \u003Cstrong>delete the corresponding authorisation tokens and immediately cease all transmission\u003C\u002Fstrong> to that platform, without any action required from you.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>In both cases, revocation does not retroactively delete data already transmitted to the platform: for that, you must exercise your rights directly with the platform concerned.\u003C\u002Fp>\n\u003Ch4>Retention of data received from a third-party platform\u003C\u002Fh4>\n\u003Cp>Where a third-party platform sends data back to us (currently limited to the account identifier, the authorisation scope and synchronisation status), it is retained \u003Cstrong>only for the duration of the active connection\u003C\u002Fstrong> and is deleted as soon as the authorisation is revoked, whether by you or by the platform, or when your Wattson account is deleted. It is \u003Cstrong>never retained after the connection ends\u003C\u002Fstrong>, is never kept in aggregated or anonymised form for other purposes, and is never used for any purpose other than synchronising your workouts.\u003C\u002Fp>\n\u003Ch4>Platforms currently connectable\u003C\u002Fh4>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Platform\u003C\u002Fth>\n\u003Cth>Entity\u003C\u002Fth>\n\u003Cth>Establishment\u003C\u002Fth>\n\u003Cth>Applicable policy\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Wahoo\u003C\u002Ftd>\n\u003Ctd>Wahoo Fitness, LLC\u003C\u002Ftd>\n\u003Ctd>United States (Atlanta, Georgia), with a UK subsidiary and a fiscal representative in the Netherlands\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>https:\u002F\u002Ffr-eu.wahoofitness.com\u002Fprivacy-policy\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Intervals.icu\u003C\u002Ftd>\n\u003Ctd>Intervals.icu Ltd\u003C\u002Ftd>\n\u003Ctd>United Kingdom (London), with a designated EU\u002FUK representative (Prighter Group); data processed in Germany and Finland, with possible cloud storage via Google, Backblaze and Wasabi\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>https:\u002F\u002Fintervals.icu\u002Fprivacy-policy\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Garmin\u003C\u002Ftd>\n\u003Ctd>Garmin Würzburg GmbH (for users residing in the EEA, UK and Switzerland)\u003C\u002Ftd>\n\u003Ctd>Germany (Würzburg); personal data may be stored on servers in the United States, the UK and\u002For Australia\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>https:\u002F\u002Fwww.garmin.com\u002Fen-GB\u002Fprivacy\u002Fconnect\u002Fpolicy\u002F\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Suunto\u003C\u002Ftd>\n\u003Ctd>Suunto Oy and relevant affiliated companies acting as joint controllers\u003C\u002Ftd>\n\u003Ctd>Finland (Vantaa); personal data for users outside mainland China is stored on servers in the EEA\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>https:\u002F\u002Fwww.suunto.com\u002Fen-gb\u002FPrivacy-Policy\u002F\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>COROS\u003C\u002Ftd>\n\u003Ctd>COROS Wearables, Inc.\u003C\u002Ftd>\n\u003Ctd>United States (Irvine, California), with an EU representative, COROS Netherlands BV, in Almere, the Netherlands; personal data for users in the EEA and UK is stored on servers in the EEA\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>https:\u002F\u002Fcoros.com\u002Fprivacy\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>This list is exhaustive: no platform may be added without this policy being updated beforehand. \u003Cstrong>Any new connectable platform will result in an amendment to this table, notified in accordance with section 15, and in a separate consent being obtained at the point where you choose whether or not to enable that connection.\u003C\u002Fstrong> Adding a platform has no effect on accounts that do not connect to it.\u003C\u002Fp>\n\u003Ch3>7.4 No third-party trackers or analytics tools\u003C\u002Fh3>\n\u003Cp>We expressly confirm that \u003Cstrong>none\u003C\u002Fstrong> of the following is integrated into Wattson:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Analytics or behavioural measurement tools;\u003C\u002Fli>\n\u003Cli>Advertising pixels or beacons;\u003C\u002Fli>\n\u003Cli>Ad networks or bidding platforms;\u003C\u002Fli>\n\u003Cli>Third-party chat or conversational support tools;\u003C\u002Fli>\n\u003Cli>Client-side session recording tools.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>The sharing surface for your data is therefore strictly limited to the recipients listed in sections 7.2 and 7.3.\u003C\u002Fp>\n\u003Ch3>7.5 Other recipients\u003C\u002Fh3>\n\u003Cp>Your data may be disclosed to administrative or judicial authorities where the law requires it, pursuant to a valid legal request, and strictly within the limits of what is requested.\u003C\u002Fp>\n\u003Cp>Our processors have contractually undertaken, in the event of an access request from a government authority or intelligence service in the country to which data is exported, to attempt to redirect that request to us, to inform us within a reasonable time unless legally prohibited, and to make no voluntary disclosure.\u003C\u002Fp>\n\u003Cp>In the event of a merger, acquisition or asset sale, your data could be transferred to the acquiring entity. You would be informed beforehand and would retain all your rights, including the right to delete your account before completion.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>8. Transfers outside the European Union\u003C\u002Fh2>\n\u003Ch3>8.1 Principle\u003C\u002Fh3>\n\u003Cp>The GDPR strictly regulates transfers of personal data outside the European Economic Area. Such a transfer is lawful only where it is covered by one of the mechanisms in Chapter V of the Regulation: a European Commission adequacy decision, Standard Contractual Clauses, or one of the other tools provided for in Articles 46 to 49.\u003C\u002Fp>\n\u003Cp>Wattson uses providers for which part of the processing, or of the access, takes place in the United States. Each of these transfers is covered as set out below.\u003C\u002Fp>\n\u003Ch3>8.2 Summary of transfers\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Recipient\u003C\u002Fth>\n\u003Cth>Role\u003C\u002Fth>\n\u003Cth>Processing and access location\u003C\u002Fth>\n\u003Cth>Safeguard\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Stripe Payments Europe, Limited\u003C\u002Ftd>\n\u003Ctd>Processor\u003C\u002Ftd>\n\u003Ctd>Ireland (EU), with transfers to the United States\u003C\u002Ftd>\n\u003Ctd>Standard Contractual Clauses (Decision (EU) 2021\u002F914) via the data transfer addendum\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Plus Five Five, Inc.\u003C\u002Ftd>\n\u003Ctd>Processor\u003C\u002Ftd>\n\u003Ctd>United States\u003C\u002Ftd>\n\u003Ctd>EU-U.S. Data Privacy Framework, supplemented by Standard Contractual Clauses\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Railway Corporation\u003C\u002Ftd>\n\u003Ctd>Processor\u003C\u002Ftd>\n\u003Ctd>Storage in EU West region, Amsterdam, Netherlands; possible remote access from the United States by the contracting entity's technical staff\u003C\u002Ftd>\n\u003Ctd>Standard Contractual Clauses (Decision (EU) 2021\u002F914), controller-to-processor module\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Functional Software GmbH (Sentry group)\u003C\u002Ftd>\n\u003Ctd>Processor\u003C\u002Ftd>\n\u003Ctd>Processing region set to the European Union for events; residual account-metadata processing in the United States\u003C\u002Ftd>\n\u003Ctd>Standard Contractual Clauses (Decision (EU) 2021\u002F914), supplemented by the Data Privacy Framework for residual flows to the United States\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Wahoo Fitness, LLC\u003C\u002Ftd>\n\u003Ctd>Independent controller\u003C\u002Ftd>\n\u003Ctd>United States\u003C\u002Ftd>\n\u003Ctd>Safeguard and transfer mechanism to be confirmed against the applicable API agreement and actual data flows; explicit consent under Article 49(1)(a) GDPR should not automatically be treated as the applicable transfer mechanism\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Intervals.icu Ltd\u003C\u002Ftd>\n\u003Ctd>Independent controller\u003C\u002Ftd>\n\u003Ctd>United Kingdom (London); processing in Germany and Finland, with possible cloud storage via Google, Backblaze and Wasabi\u003C\u002Ftd>\n\u003Ctd>UK adequacy decision under Article 45 GDPR, subject to its scope and any onward transfers\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Garmin International, Inc. \u002F Garmin Würzburg GmbH\u003C\u002Ftd>\n\u003Ctd>Independent controller\u003C\u002Ftd>\n\u003Ctd>United States and Germany, respectively; international transfers may occur depending on the data flow\u003C\u002Ftd>\n\u003Ctd>Standard Contractual Clauses (Decision (EU) 2021\u002F914), Module 1 (controller-to-controller), as provided for in the Garmin Connect Developer Program Agreement\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Suunto Oy and relevant affiliated companies\u003C\u002Ftd>\n\u003Ctd>Independent controller(s), subject to the applicable API agreement\u003C\u002Ftd>\n\u003Ctd>Finland and other EEA locations; transfers to countries outside the EEA may occur\u003C\u002Ftd>\n\u003Ctd>EU-U.S. Data Privacy Framework for certified US recipients and\u002For Standard Contractual Clauses (Decision (EU) 2021\u002F914), with applicable supplementary measures, depending on the recipient and transfer\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>COROS Wearables, Inc.\u003C\u002Ftd>\n\u003Ctd>Independent controller\u003C\u002Ftd>\n\u003Ctd>United States; personal data collected from EEA and UK customers is stored on servers in the EEA; access or transfers to COROS group companies outside the EEA may occur\u003C\u002Ftd>\n\u003Ctd>COROS identifies explicit consent under Article 49(1)(a) GDPR for certain transfers to group companies in countries without an adequate level of protection; the mechanism applicable to the specific API data flow must be confirmed\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch3>8.3 Supplementary measures\u003C\u002Fh3>\n\u003Cp>In addition to the legal mechanisms above, our processors apply supplementary technical and organisational measures: encryption of data at rest and in transit, logical isolation between environments, restriction of internal access on a least-privilege basis, access logging, and a commitment to make no voluntary disclosure to a foreign authority.\u003C\u002Fp>\n\u003Cp>The parties have contractually undertaken to jointly reassess the appropriateness of these transfers should the level of protection offered by the destination country be called into question, and to suspend the transfers or put alternative arrangements in place if required to do so by a supervisory authority.\u003C\u002Fp>\n\u003Ch3>8.4 Transparency\u003C\u002Fh3>\n\u003Cp>You may obtain a copy of the safeguards put in place for these transfers by writing to the address in section 2.\u003C\u002Fp>\n\u003Cp>If you wish to avoid any transfer of your training data to a controller established outside the European Union, you need simply \u003Cstrong>not connect a third-party platform\u003C\u002Fstrong>: synchronisation is entirely optional and the service remains fully functional without it.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>9. Retention periods\u003C\u002Fh2>\n\u003Cp>In accordance with the storage limitation principle (Article 5(1)(e) GDPR), your data is retained only for as long as is strictly necessary for the purposes pursued.\u003C\u002Fp>\n\u003Ch3>9.1 Account and service data\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Data\u003C\u002Fth>\n\u003Cth>Retention period\u003C\u002Fth>\n\u003Cth>When the period starts\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Account and profile data (identity, email, preferences)\u003C\u002Ftd>\n\u003Ctd>Duration of the contractual relationship, then deletion\u003C\u002Ftd>\n\u003Ctd>Account deletion or end of the inactivity period\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Body-composition and physiological data\u003C\u002Ftd>\n\u003Ctd>Duration of the contractual relationship, or until consent is withdrawn\u003C\u002Ftd>\n\u003Ctd>Consent withdrawal, account deletion or end of the inactivity period\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Workouts and calendar\u003C\u002Ftd>\n\u003Ctd>Duration of the contractual relationship, then deletion\u003C\u002Ftd>\n\u003Ctd>Account deletion or end of the inactivity period\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Connected platform authorisation tokens\u003C\u002Ftd>\n\u003Ctd>Until the connection is revoked\u003C\u002Ftd>\n\u003Ctd>Revocation by you, withdrawal notification from the platform, or account deletion\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Third-party account identifier, authorisation scope, synchronisation status\u003C\u002Ftd>\n\u003Ctd>Duration of the active connection\u003C\u002Ftd>\n\u003Ctd>Connection revocation or account deletion\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Inactive account\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>3 years with no sign-in\u003C\u002Fstrong>, then permanent deletion\u003C\u002Ftd>\n\u003Ctd>Last sign-in\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>\u003Cstrong>Procedure for inactive accounts:\u003C\u002Fstrong> the deletion period runs from your last sign-in. At the end of the \u003Cstrong>second\u003C\u002Fstrong> year of inactivity, you receive a message informing you that your account is due for deletion and inviting you to sign in if you wish to keep it. A \u003Cstrong>reminder is sent one month before the three-year mark\u003C\u002Fstrong>. At the end of the three years, the account and all associated data are permanently deleted. Any sign-in during this period resets the period to zero.\u003C\u002Fp>\n\u003Ch3>9.2 Billing and accounting data\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Data\u003C\u002Fth>\n\u003Cth>Retention period\u003C\u002Fth>\n\u003Cth>Basis\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Invoices and accounting records (issued and archived by the payment provider, accessible through its interface)\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>10 years\u003C\u002Fstrong> from the close of the financial year\u003C\u002Ftd>\n\u003Ctd>Article L. 123-22 of the French Commercial Code\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Payment provider subscription and customer identifiers\u003C\u002Ftd>\n\u003Ctd>Duration of the subscription, then intermediate archiving for the accounting retention period\u003C\u002Ftd>\n\u003Ctd>Legal obligation\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>At the end of the contractual relationship, this data is placed in \u003Cstrong>intermediate archiving\u003C\u002Fstrong>: it is no longer accessible in day-to-day operation of the service and may be consulted only by persons who need to know for accounting, tax or litigation reasons.\u003C\u002Fp>\n\u003Ch3>9.3 Security and evidential data\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Data\u003C\u002Fth>\n\u003Cth>Retention period\u003C\u002Fth>\n\u003Cth>Basis\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Legal document acceptance register (identifier, IP, User-Agent, version accepted)\u003C\u002Ftd>\n\u003Ctd>Duration of the contract, then \u003Cstrong>5 years\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>General limitation period, Article 2224 of the French Civil Code\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Proof of consent to physiological data processing\u003C\u002Ftd>\n\u003Ctd>Duration of the contract, then \u003Cstrong>5 years\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Demonstration obligation, Article 7(1) GDPR\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Technical application logs\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>6 months\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>CNIL recommendation on event logging\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Connection data (within the meaning of the LCEN)\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>1 year\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Article 6 of Law No. 2004-575 of 21 June 2004\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Cp>Wattson's application logs are designed to \u003Cstrong>exclude all personal data\u003C\u002Fstrong>: request headers, cookies and request bodies are explicitly stripped before logging.\u003C\u002Fp>\n\u003Cp>This principle applies to the internal technical logs referred to above. It does not apply to events transmitted to our error-monitoring tool (see section 7.2), which is a separate channel whose content broader by nature, since its purpose is technical diagnosis is described and governed in that same section, with a retention period specific to that provider.\u003C\u002Fp>\n\u003Ch3>9.4 Technical lifetimes of tokens and sessions\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Item\u003C\u002Fth>\n\u003Cth>Lifetime\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Session access token\u003C\u002Ftd>\n\u003Ctd>30 minutes\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Session refresh token\u003C\u002Ftd>\n\u003Ctd>7 days, rotated on each use\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Password reset token\u003C\u002Ftd>\n\u003Ctd>15 minutes, single use\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Email verification token\u003C\u002Ftd>\n\u003Ctd>60 minutes, single use\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Platform authorisation flow security state (OAuth \u003Ccode>state\u003C\u002Fcode>)\u003C\u002Ftd>\n\u003Ctd>10 minutes\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch3>9.5 Account deletion at your request\u003C\u002Fh3>\n\u003Cp>When you delete your account from the Application's settings:\u003C\u002Fp>\n\u003Col>\n\u003Cli>Authorisations granted to your connected platforms are \u003Cstrong>revoked with each third-party provider\u003C\u002Fstrong>, by calling its revocation endpoint, before any other operation;\u003C\u002Fli>\n\u003Cli>Your subscription is \u003Cstrong>immediately cancelled\u003C\u002Fstrong> with the payment provider;\u003C\u002Fli>\n\u003Cli>Your account and all linked data (athlete profile, workouts, calendar, platform connections, tokens, third-party account identifiers) are \u003Cstrong>permanently erased without delay\u003C\u002Fstrong> from our database, by cascading physical deletion this is not a mere deactivation;\u003C\u002Fli>\n\u003Cli>Only data we are legally required to retain remains: accounting records and the consent evidence register, on the terms and for the periods described in sections 9.2 and 9.3.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>As deletion is irreversible, it is protected by an explicit confirmation requiring manual entry of a validation word.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>10. Data security\u003C\u002Fh2>\n\u003Cp>In accordance with Article 32 GDPR, we implement the following technical and organisational measures.\u003C\u002Fp>\n\u003Ch3>10.1 Credential protection\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Passwords are hashed using \u003Cstrong>Argon2id\u003C\u002Fstrong>, the Password Hashing Competition winner, with high cost parameters (time cost 3, 64 MB memory, parallelism 4). They are \u003Cstrong>never\u003C\u002Fstrong> stored or transmitted in clear text, and are automatically re-hashed if the security parameters change.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Account enumeration defence\u003C\u002Fstrong> is in place: verifying a non-existent identifier triggers a dummy hash computation of equivalent duration, preventing timing analysis from revealing whether an email address is registered.\u003C\u002Fli>\n\u003Cli>Sensitive tokens (session refresh, password reset, email verification) are stored \u003Cstrong>hashed with SHA-256\u003C\u002Fstrong>, never in clear text.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>10.2 Session management\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>Session tokens are transmitted in \u003Ccode>HttpOnly\u003C\u002Fcode> cookies, \u003Cstrong>inaccessible to JavaScript\u003C\u002Fstrong>, protecting them against theft via script injection (XSS).\u003C\u002Fli>\n\u003Cli>Refresh tokens are \u003Cstrong>opaque\u003C\u002Fstrong>, stored in a time-limited store, subject to \u003Cstrong>systematic rotation\u003C\u002Fstrong> on each use, with \u003Cstrong>replay detection\u003C\u002Fstrong>: reuse of an already-consumed token immediately invalidates the entire session chain concerned.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>10.3 Encryption\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>In transit:\u003C\u002Fstrong> all communications are TLS-encrypted, with an HSTS (HTTP Strict Transport Security) policy enforcing HTTPS only.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>At rest:\u003C\u002Fstrong> your connected platforms' authorisation tokens are \u003Cstrong>encrypted\u003C\u002Fstrong> in the database using authenticated symmetric encryption (Fernet, based on AES-128-CBC with HMAC-SHA256 authentication).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>10.4 Application protection\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>CSRF protection\u003C\u002Fstrong> via a dedicated token on all state-changing operations.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Restrictive CORS policy\u003C\u002Fstrong>, limiting allowed origins to the Application and Back office domains only.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Rate limiting\u003C\u002Fstrong> on sensitive endpoints: authentication, data export, subscription creation, with identification of the client's real IP address.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>HTTP security headers\u003C\u002Fstrong>: HSTS, a restrictive Content Security Policy allowing only strictly necessary scripts, \u003Ccode>X-Frame-Options: DENY\u003C\u002Fcode> against clickjacking, and \u003Ccode>Permissions-Policy\u003C\u002Fcode> blocking access to geolocation, camera and microphone.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Systematic sanitisation\u003C\u002Fstrong> of all editorial content before display, preventing code injection into pages.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Cryptographic signature verification\u003C\u002Fstrong> of incoming notifications from our payment provider and from third-party platforms before any processing.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Dedicated filtering before transmission to our error-monitoring tool\u003C\u002Fstrong>: authentication and session cookies are excluded by a denylist specific to the cookie names used by Wattson, in addition to the vendor's standard list, and local-variable capture in stack traces is disabled (see section 7.2).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>10.5 Access control and minimisation\u003C\u002Fh3>\n\u003Cul>\n\u003Cli>\u003Cstrong>Server-side authorisation checks\u003C\u002Fstrong> on all endpoints: systematic verification that the authenticated user owns the requested resource, and role verification for administrative operations.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Sensitive fields excluded from API responses\u003C\u002Fstrong>: password hashes and authorisation tokens are exposed in no response, under any circumstances.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Logging without personal data\u003C\u002Fstrong>, as set out in section 9.3.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>10.6 Limits\u003C\u002Fh3>\n\u003Cp>No information system can guarantee absolute security. We undertake to implement measures appropriate to the state of the art, the cost of implementation and the nature of the data processed, and to keep those measures under continuous review.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>11. Your rights\u003C\u002Fh2>\n\u003Cp>Under Articles 15 to 22 GDPR, you have the following rights.\u003C\u002Fp>\n\u003Ch3>11.1 Nature of the rights\u003C\u002Fh3>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Right\u003C\u002Fth>\n\u003Cth>Scope\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right of access\u003C\u002Fstrong> (Art. 15)\u003C\u002Ftd>\n\u003Ctd>Obtain confirmation that your data is being processed and receive a copy of it\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to rectification\u003C\u002Fstrong> (Art. 16)\u003C\u002Ftd>\n\u003Ctd>Have inaccurate data corrected or incomplete data completed\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to erasure\u003C\u002Fstrong> (Art. 17)\u003C\u002Ftd>\n\u003Ctd>Obtain deletion of your data, subject to our legal retention obligations\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to restriction\u003C\u002Fstrong> (Art. 18)\u003C\u002Ftd>\n\u003Ctd>Obtain a temporary freeze on processing, in particular while a contested point is verified\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to data portability\u003C\u002Fstrong> (Art. 20)\u003C\u002Ftd>\n\u003Ctd>Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to object\u003C\u002Fstrong> (Art. 21)\u003C\u002Ftd>\n\u003Ctd>Object, on grounds relating to your particular situation, to processing based on our legitimate interests\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Withdrawal of consent\u003C\u002Fstrong> (Art. 7(3))\u003C\u002Ftd>\n\u003Ctd>Withdraw at any time your consent to the processing that depends on it, without retroactive effect on the lawfulness of prior processing\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Right to give post-mortem directions\u003C\u002Fstrong> (Art. 85 of the French Data Protection Act)\u003C\u002Ftd>\n\u003Ctd>Set directions concerning the fate of your data after your death\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch3>11.2 Rights you can exercise directly in the Application\u003C\u002Fh3>\n\u003Cp>Several of these rights are directly actionable from your account, with no prior request to us:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Access and portability\u003C\u002Fstrong> a full export of your personal data in CSV format is available at any time from your settings. It covers your profile, your athlete profile, your workouts, your connected platforms and your legal acceptance history.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Rectification\u003C\u002Fstrong> your identity and athlete profile data can be edited directly from your account settings.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Erasure\u003C\u002Fstrong> account deletion is available from the settings and executes immediately, on the terms described in section 9.5.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Withdrawal of marketing consent\u003C\u002Fstrong> your communication preferences can be changed at any time from the settings, and every non-transactional email includes an unsubscribe link.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Withdrawal of consent to physiological data processing\u003C\u002Fstrong> available from your athlete profile settings.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Revoking a connected platform\u003C\u002Fstrong> available from the integration settings, or from the third-party platform itself (see section 7.3).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch3>11.3 How to exercise your rights with us\u003C\u002Fh3>\n\u003Cp>For rights that are not directly actionable, or if you encounter a difficulty, send your request to:\u003C\u002Fp>\n\u003Cp>privacy@getwattson.io\n4 rue de la gare, 80710 Quevauvillers, Somme, France\u003C\u002Fp>\n\u003Cp>In order to handle your request, we must be able to identify you. The request must therefore be made from the email address associated with your account. Where we have reasonable doubt as to your identity, we may ask for additional proof, of which we will retain no copy beyond the handling of the request.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Response time:\u003C\u002Fstrong> we respond within \u003Cstrong>one month\u003C\u002Fstrong> of receiving the request. This period may be extended by two further months for complex or numerous requests; you would be informed within one month of your request, with reasons for the extension.\u003C\u002Fp>\n\u003Cp>Exercising these rights is \u003Cstrong>free of charge\u003C\u002Fstrong>, save for manifestly unfounded or excessive requests, in particular because of their repetitive character.\u003C\u002Fp>\n\u003Ch3>11.4 Complaints\u003C\u002Fh3>\n\u003Cp>If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the competent supervisory authority. In France, this is the \u003Cstrong>Commission nationale de l'informatique et des libertés (CNIL)\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France\n\u003Ca href=\"https:\u002F\u002Fwww.cnil.fr\">www.cnil.fr\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>If you reside in another EU Member State, you may also contact the supervisory authority of your country of residence.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>12. Cookies and trackers\u003C\u002Fh2>\n\u003Ch3>12.1 Cookies used\u003C\u002Fh3>\n\u003Cp>Wattson sets \u003Cstrong>four cookies\u003C\u002Fstrong>, all strictly necessary for the service to function:\u003C\u002Fp>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Cookie\u003C\u002Fth>\n\u003Cth>Purpose\u003C\u002Fth>\n\u003Cth>Contents\u003C\u002Fth>\n\u003Cth>Attributes\u003C\u002Fth>\n\u003Cth>Duration\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>Access token cookie\u003C\u002Ftd>\n\u003Ctd>Maintaining your authenticated session\u003C\u002Ftd>\n\u003Ctd>Session token\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>HttpOnly\u003C\u002Fcode>, \u003Ccode>Secure\u003C\u002Fcode>, \u003Ccode>SameSite\u003C\u002Fcode>\u003C\u002Ftd>\n\u003Ctd>30 minutes\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Refresh token cookie\u003C\u002Ftd>\n\u003Ctd>Renewing the session without re-entering credentials\u003C\u002Ftd>\n\u003Ctd>Opaque token\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>HttpOnly\u003C\u002Fcode>, \u003Ccode>Secure\u003C\u002Fcode>, \u003Ccode>SameSite\u003C\u002Fcode>\u003C\u002Ftd>\n\u003Ctd>7 days\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>CSRF token cookie\u003C\u002Ftd>\n\u003Ctd>Protection against cross-site request forgery\u003C\u002Ftd>\n\u003Ctd>Anti-CSRF token\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Secure\u003C\u002Fcode>, \u003Ccode>SameSite\u003C\u002Fcode>\u003C\u002Ftd>\n\u003Ctd>Session\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Sign-in state indicator\u003C\u002Ftd>\n\u003Ctd>Allowing the interface to know whether a user is signed in and display the appropriate UI elements\u003C\u002Ftd>\n\u003Ctd>\u003Cstrong>Boolean value only no personal data, no identifier, no token\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>Secure\u003C\u002Fcode>, \u003Ccode>SameSite\u003C\u002Fcode> (readable by the Application's JavaScript, by functional necessity)\u003C\u002Ftd>\n\u003Ctd>Aligned with the session\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch3>12.2 No consent required\u003C\u002Fh3>\n\u003Cp>These cookies are \u003Cstrong>exclusively intended to enable or facilitate electronic communication\u003C\u002Fstrong> and are \u003Cstrong>strictly necessary for the provision of an online communication service at your request\u003C\u002Fstrong>, within the meaning of Article 82 of the French Data Protection Act transposing Directive 2002\u002F58\u002FEC (the "ePrivacy" Directive).\u003C\u002Fp>\n\u003Cp>They therefore benefit from the \u003Cstrong>consent exemption\u003C\u002Fstrong>: no consent banner is required, and none is displayed.\u003C\u002Fp>\n\u003Ch3>12.3 No local storage of personal data\u003C\u002Fh3>\n\u003Cp>Wattson uses \u003Cstrong>neither browser \u003Ccode>localStorage\u003C\u002Fcode> nor \u003Ccode>sessionStorage\u003C\u002Fcode>\u003C\u002Fstrong> to hold personal data or authentication credentials. This architectural choice significantly reduces the exposure surface in the event of a script-injection compromise.\u003C\u002Fp>\n\u003Ch3>12.4 Managing cookies\u003C\u002Fh3>\n\u003Cp>You may configure your browser to refuse cookies. However, blocking the cookies described above \u003Cstrong>will prevent authentication from working\u003C\u002Fstrong> and will render the service unusable.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>13. Minors\u003C\u002Fh2>\n\u003Cp>Access to Wattson is restricted to persons aged at least \u003Cstrong>16\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>This threshold corresponds to the age set by Article 8(1) GDPR at which a minor may validly consent alone to the processing of their personal data in the context of information society services, in its most protective formulation, applicable across all EU Member States.\u003C\u002Fp>\n\u003Cp>By creating an account, you declare that you are at least 16. We do not knowingly collect data concerning persons below that age. If you hold parental authority and find that a minor under 16 has created an account, contact us at the address in section 2: the account and associated data will be deleted without delay.\u003C\u002Fp>\n\u003Cp>Some connectable third-party platforms apply their own age requirements, which may differ from ours. It is your responsibility to comply with them.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>14. Personal data breaches\u003C\u002Fh2>\n\u003Cp>We maintain an internal procedure for detecting, assessing and handling personal data breaches.\u003C\u002Fp>\n\u003Cp>In the event of a breach likely to result in a risk to your rights and freedoms, we undertake to:\u003C\u002Fp>\n\u003Col>\n\u003Cli>\u003Cstrong>Notify the CNIL\u003C\u002Fstrong> without undue delay and, where feasible, \u003Cstrong>no later than 72 hours\u003C\u002Fstrong> after becoming aware of it, in accordance with Article 33 GDPR. Where notification is made later, it will be accompanied by the reasons for the delay.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Inform you directly, without undue delay\u003C\u002Fstrong>, where the breach is likely to result in a \u003Cstrong>high risk\u003C\u002Fstrong> to your rights and freedoms (Article 34 GDPR). That communication will describe in clear and plain language the nature of the breach, its likely consequences, the measures taken to address it and recommendations for mitigating its effects.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Inform without undue delay any third-party platform\u003C\u002Fstrong> whose data or authorisation tokens are affected by the breach, in accordance with its partner agreement.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Document every breach\u003C\u002Fstrong> in an internal register, including those not giving rise to notification, recording the facts, the effects and the remedial action taken.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Chr>\n\u003Ch2>15. Changes to this policy\u003C\u002Fh2>\n\u003Cp>We may amend this privacy policy, in particular to reflect changes to the service, to our processors, to the connectable platforms or to the regulatory framework.\u003C\u002Fp>\n\u003Cp>Any material change will be notified to you by email and on your next sign-in, within a reasonable time before it takes effect. The version number and update date appear at the top of this document. The history of successive versions is retained and remains available at the address given at the top of this document.\u003C\u002Fp>\n\u003Cp>Where a change affects processing based on your consent in particular the addition of a connectable platform or an extension of an authorisation scope fresh consent will be requested, and your failure to respond will never constitute acceptance.\u003C\u002Fp>\n\u003Chr>\n\u003Ch2>16. Contact\u003C\u002Fh2>\n\u003Cp>For any question relating to this policy or to the processing of your personal data:\u003C\u002Fp>\n\u003Cp>privacy@getwattson.io\n4 rue de la gare, 80710 Quevauvillers, Somme, France\u003C\u002Fp>\n\u003Chr>\n\u003Chr>\n\u003Ch1>Technical Annex : For third-party API providers\u003C\u002Fh1>\n\u003Cp>\u003Cem>This annex is intended for device manufacturers and platform operators evaluating a request for access to their API. It summarises Wattson's commitments regarding data obtained through their interfaces.\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch2>A.0 Organisation details\u003C\u002Fh2>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>\u003C\u002Fth>\n\u003Cth>\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Legal entity\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Pierre Halloo EI, a sole trader established under French law\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>National identifiers\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>SIREN 890589674, SIRET 89058967400021\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>EU VAT\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>FR64890589674\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Jurisdiction\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>France, European Union, subject to the GDPR\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Product\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>Wattson (\u003Ccode>getwattson.io\u003C\u002Fcode>), a subscription-based web application for training planning\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Data protection contact\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>privacy@getwattson.io\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Technical contact\u003C\u002Fstrong>\u003C\u002Ftd>\n\u003Ctd>\u003Ccode>support@getwattson.io\u003C\u002Fcode>\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\n\u003C\u002Ftable>\n\u003Ch2>A.1 Nature of the access requested\u003C\u002Fh2>\n\u003Cp>Wattson requests \u003Cstrong>write\u003C\u002Fstrong> access in order to push structured workouts created by the user or generated from their profile to the provider's platform, and \u003Cstrong>read\u003C\u002Fstrong> access limited to the data strictly necessary to link the account.\u003C\u002Fp>\n\u003Cp>Wattson does \u003Cstrong>not\u003C\u002Fstrong> request read access to completed activities, GPS tracks, daily health data, sleep data or cycle data. Any change to this scope would be the subject of a separate request to the provider and of a prior update to the privacy policy, with fresh user consent obtained.\u003C\u002Fp>\n\u003Ch2>A.2 Obtaining authorisation\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>A connection to a third-party platform is \u003Cstrong>always\u003C\u002Fstrong> initiated by an explicit user action from their account settings.\u003C\u002Fli>\n\u003Cli>It takes place exclusively through the provider's \u003Cstrong>standard OAuth 2.0 authorisation flow\u003C\u002Fstrong>, with a time-limited \u003Ccode>state\u003C\u002Fcode> parameter protecting against request forgery.\u003C\u002Fli>\n\u003Cli>Wattson \u003Cstrong>never requests, receives or stores\u003C\u002Fstrong> the user's credentials for the provider's account.\u003C\u002Fli>\n\u003Cli>Only the strictly necessary authorisation scopes are requested.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.3 Token handling\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Access and refresh tokens are \u003Cstrong>encrypted at rest\u003C\u002Fstrong> in the database using authenticated symmetric encryption.\u003C\u002Fli>\n\u003Cli>They are \u003Cstrong>never exposed\u003C\u002Fstrong> in a Wattson API response, in application logs, or client-side.\u003C\u002Fli>\n\u003Cli>They are \u003Cstrong>never transmitted to any third party\u003C\u002Fstrong> including our error-monitoring tool (see A.7).\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.4 Use of the data obtained\u003C\u002Fh2>\n\u003Cp>Data exchanged with the provider's platform is used \u003Cstrong>exclusively\u003C\u002Fstrong> to synchronise the workouts of the user concerned. It is subject to:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>no resale, rental or transfer\u003C\u002Fstrong> to a third party;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>no advertising or marketing use\u003C\u002Fstrong>;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>no aggregation\u003C\u002Fstrong> for statistical purposes, algorithmic model training or product development;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>no cross-referencing\u003C\u002Fstrong> with data from other sources;\u003C\u002Fli>\n\u003Cli>\u003Cstrong>no transfer\u003C\u002Fstrong> to a third country other than the provider's own.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.5 Revocation and deletion\u003C\u002Fh2>\n\u003Cp>Wattson supports revocation in \u003Cstrong>both directions\u003C\u002Fstrong>:\u003C\u002Fp>\n\u003Cp>\u003Cstrong>User-initiated revocation from Wattson\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Available at any time from account settings.\u003C\u002Fli>\n\u003Cli>Triggers a call to the \u003Cstrong>provider's API revocation endpoint\u003C\u002Fstrong>, followed by immediate deletion of the tokens from our database.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Revocation initiated from the provider's platform\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Wattson exposes a \u003Cstrong>deregistration endpoint\u003C\u002Fstrong> and a \u003Cstrong>user permissions change endpoint\u003C\u002Fstrong>, publicly reachable, authenticated by signature verification, returning HTTP 200 within the timeframes expected by the provider.\u003C\u002Fli>\n\u003Cli>On receipt of a deregistration notification, Wattson \u003Cstrong>immediately deletes the tokens and the third-party account identifier\u003C\u002Fstrong>, marks the connection as inactive and ceases all transmission attempts to the platform.\u003C\u002Fli>\n\u003Cli>On receipt of a permissions change notification, Wattson updates the stored scope and \u003Cstrong>ceases any operation no longer covered\u003C\u002Fstrong> by the remaining scope.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Wattson account deletion\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Automatically triggers revocation of \u003Cstrong>all\u003C\u002Fstrong> third-party authorisations with each provider, prior to erasure of local data.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.6 Retention of provider-sourced data\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Data received from the provider (account identifier, authorisation scope, synchronisation status, tokens) is retained \u003Cstrong>only for the duration of the active connection\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>It is \u003Cstrong>deleted immediately\u003C\u002Fstrong> on revocation, whatever its origin, or on deletion of the Wattson account.\u003C\u002Fli>\n\u003Cli>It is \u003Cstrong>never retained after the connection ends\u003C\u002Fstrong>, including in aggregated, anonymised or pseudonymised form.\u003C\u002Fli>\n\u003Cli>No copy is made outside the production database and its encrypted backups, whose rotation cycle does not exceed the applicable retention period.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.7 Security and compliance\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>No third-party analytics tool and no advertising pixel is integrated into Wattson.\u003C\u002Fli>\n\u003Cli>No client-side session recording (Session Replay) is performed.\u003C\u002Fli>\n\u003Cli>Wattson uses an error-monitoring tool (see section 7.2 of the privacy policy) exclusively for technical diagnosis. It is configured to exclude authentication and session cookies (via a denylist dedicated to the cookie names used by Wattson) and never to capture local variables in stack traces: \u003Cstrong>the authorisation tokens you entrust to us are therefore, by construction, never transmitted to it.\u003C\u002Fstrong>\u003C\u002Fli>\n\u003Cli>Application logs exclude headers, cookies and request bodies by construction.\u003C\u002Fli>\n\u003Cli>Data is stored in the European Union (EU West region, Amsterdam, Netherlands). As the contracting hosting entity is US-based, remote access from the United States by its authorised technical staff is possible and is covered by the European Commission's Standard Contractual Clauses.\u003C\u002Fli>\n\u003Cli>All communications are TLS-encrypted; third-party tokens are encrypted at rest using authenticated symmetric encryption.\u003C\u002Fli>\n\u003Cli>Incoming notifications from the provider are subject to \u003Cstrong>cryptographic signature verification\u003C\u002Fstrong> before any processing.\u003C\u002Fli>\n\u003Cli>Wattson is established in the European Union and subject to the GDPR. Processing activities are documented in a register maintained in accordance with Article 30.\u003C\u002Fli>\n\u003Cli>A dedicated data protection point of contact is published and reachable.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>A.8 Incident notification\u003C\u002Fh2>\n\u003Cp>In the event of a data breach affecting data or tokens originating from your platform, Wattson undertakes to inform you \u003Cstrong>without undue delay\u003C\u002Fstrong>, through the partner contact channel you designate, specifying the nature of the incident, the user identifiers concerned, the containment measures taken and the remediation timeline. Wattson will also pre-emptively revoke the tokens concerned.\u003C\u002Fp>\n\u003Ch2>A.9 Branding and presentation\u003C\u002Fh2>\n\u003Cp>Wattson undertakes to comply with the provider's brand guidelines: use of the name and logo in accordance with published rules, explicit identification of the provider in the connection screen and in user documentation, and no wording implying a partnership, endorsement or affiliation that has not been granted.\u003C\u002Fp>\n\u003Chr>\n"]