Data deletion

1. Who can request deletion

• An adult athlete (16 or older) for their own data
• A parent or legal guardian for a minor athlete (under 16)
• A coach for their own data
• A club admin for the club account or for any athlete or coach of their club (with appropriate authority)

2. How to request deletion

Send an email to admin@flowxp.eu including:

• Subject: "Data deletion request"
• The email address used to interact with our service (or any element allowing reliable identification: club name, athlete ID, audit invitation token).
• The scope requested: delete everything, or only certain categories (Mini-Audit responses, demo bookings, audit answers of a specific season).

For security reasons, we may ask for an additional element of identity verification before proceeding.

3. Processing time

Every request receives a confirmation email within 72 hours (business days). Effective deletion takes place at most 30 days after receipt, in accordance with Article 12 GDPR.

When your request is processed, you receive a confirmation email with a unique code attesting deletion. Keep this code: it proves the execution of your request.

4. Data retained despite your request

Some data may be retained beyond your request only when law obliges us:

• Invoices and accounting records — 7 years from the end of the service (Belgian accounting obligation).
• Security logs — 12 months maximum, solely for defence against intrusions.
• Data necessary for an ongoing dispute — during the applicable legal limitation period.

For any other data, deletion is total, irreversible, and propagated to all our technical processors (Supabase, Notion, Anthropic logs).

5. Specific case — minors under 16

A parent or legal guardian who withdraws consent for their minor child triggers:

• Immediate interruption of any audit in progress for the athlete
• Full deletion of past audit responses within 30 days
• Notification to the club's coach (without disclosing the reason)

6. Appeal

If you believe your request has not been handled correctly, you may seize the Belgian Data Protection Authority: dataprotectionauthority.be, Rue de la Presse 35, 1000 Brussels, or the competent supervisory authority in your Member State.