Data protection statement
Last updated: Aug 1st 2026
This page explains how data protection law applies to ProAgenda, who is responsible for what, and where we stand on security. It replaces our earlier GDPR statement.
It is written for the businesses, organisations and venues who use ProAgenda — coaching academies, sports clubs, studios, salons, practices and similar — and for anyone assessing us as a supplier.
Which laws apply
ProAgenda is a registered trading name of Golf Financial Services B.V. (KvK 34130467), a company registered in the Netherlands.
- The EU GDPR applies to our processing in the EU
- The UK GDPR and the Data Protection Act 2018 apply where we process personal data for UK-based customers
- Dutch implementing law applies to us as a Dutch company
We treat both regimes as our baseline rather than the lower of the two.
Who is responsible for what
This is the part most often misunderstood, including in our own earlier statement, so we set it out plainly.
We are the processor for your client records
The records you create about your clients — bookings, notes, video where used, progress — are yours. You decide what to collect and why. You are the controller. We hold and process that data on your instructions and for no other purpose.
As controller, you are responsible for:
- having a lawful basis for what you record
- telling your clients what you hold and why
- obtaining consent where consent is genuinely required — including from a parent or guardian for a client under 18, and for any video recording
- responding to requests from clients to see, correct or delete their data
- deciding how long to keep records
We will not sign you up to obligations that are ours, and we will not claim to have discharged obligations that are yours. Our earlier statement said we had "done all the work for you" on consent. That was wrong, and we have corrected it.
We are the controller for your own account
Your name, contact details, login and billing information are ours to look after, and we are responsible for that processing. See our Privacy Notice for Businesses and Organisations.
What we do as processor
- process personal data only on your documented instructions
- keep it confidential and limit access to those who need it
- apply appropriate security measures
- notify you of a personal data breach within 24 hours of becoming aware of it
- help you respond to requests from data subjects
- not engage a new sub-processor without notifying you first
- return or delete your data when our agreement ends
One correction worth making explicitly: as a processor we do not notify the data protection authority of a breach. We notify you, and you decide whether to notify the regulator. Our earlier statement said otherwise and was incorrect.
Data Processing Agreement
If you are a controller using ProAgenda, you are required by Article 28 to have a written agreement with us. We can provide a Data Processing Agreement, and we are equally happy to work to your own template.
Request one at info@proagenda.com.
Where your data is held
| What | Where |
|---|---|
| Application and database | Dedicated physical server, Amsterdam, Netherlands (Hypersolid) |
| Backups | Hypersolid managed service, in a data centre separate from the production server. Daily, retained 7 days |
| Video files | Bitmovin, Inc. (US entity). Stored in AWS eu-west-1 (Ireland); delivered via AWS CloudFront, a global network |
| Payment data | Stripe Payments Europe (Ireland), with onward transfer to the United States |
| Service emails | Twilio SendGrid, United States |
Sub-processors
| Provider | Location | Purpose | Basis for transfer outside the UK/EEA |
|---|---|---|---|
| Hypersolid | Netherlands | Hosting, infrastructure, backups | None needed — within the EEA |
| Bitmovin | Bitmovin, Inc., United States. EEA representative Bitmovin GmbH, Austria. Video stored in Ireland; delivered via AWS CloudFront | Video encoding, storage, delivery | Bitmovin is a US entity, so an Article 46 mechanism is required regardless of storage location. We are obtaining their data processing agreement to confirm which applies. AWS is Bitmovin's sub-processor |
| Twilio SendGrid | United States | Transactional email | EU Standard Contractual Clauses and the UK International Data Transfer Agreement |
| Stripe | Ireland, with onward transfer to the US | Payments | EU–US Data Privacy Framework, with Standard Contractual Clauses and the UK Addendum as fallback |
| Google Analytics | United States | Website statistics only — not platform data | Standard Contractual Clauses |
We give 30 days' notice before adding or replacing a sub-processor, so you have the opportunity to object.
We do not sell personal data, and we do not use customer data to train machine learning models.
Security
What is in place
- All traffic over HTTPS/TLS
- Role-based access control: coaches restricted to their assigned clients; academy-level permissions
- Change log recording amendments to records, with user and timestamp
- Daily backups, encrypted at rest, in a separate data centre, with a tested restore
- Recovery objectives: 24 hours for both recovery point and recovery time, based on an actual tested restore
- A documented incident response procedure, with a named incident lead and a breach register
- No security incidents or data breaches in the last three years
What is not in place
We would rather tell you than have you discover it.
| Gap | What we are doing | Target |
|---|---|---|
| Video files are not deleted when a record is deleted | Implementing deletion, including for records already erased | During 2026 |
| Video links do not expire and cannot be withdrawn | Our video provider has confirmed expiring links are not available on its managed delivery network. We are scoping a change to our own storage and delivery, which would also let us restrict delivery to European locations | Scoping |
| Encryption at rest not yet enabled on the server (backups are encrypted) | Being enabled by our hosting provider | 2026 |
| No multi-factor authentication | On our roadmap | To be confirmed |
| Record views are not logged, only changes | On our roadmap | To be confirmed |
| No ISO 27001, SOC 2 or Cyber Essentials certification | We are considering certification and can discuss requirements | On request |
| Transfer mechanism for video not yet evidenced | Obtaining Bitmovin's data processing agreement and completing a transfer risk assessment | 2026 |
| No penetration testing carried out to date | We intend to commission an external test | To be confirmed |
| No contractual availability SLA | Putting monitoring in place first, so any commitment is evidence-based | To be confirmed |
If you are assessing us as a supplier, we can provide a fuller security overview, our incident response procedure, a data flow diagram and a completed due diligence response. Ask at info@proagenda.com.
Special category and children's data
Health information. Client notes are a free-text field, and many of our customers record information that is health data under Article 9 — an injury or physical limitation at a sports or fitness business, an allergy or skin condition at a salon, a medical note relevant to a treatment. Video, where used, is inherently physical. The platform is not designed as a health record system, but we treat notes and video as potentially containing health data, and apply the same access controls and audit logging to them.
Clients under 18. The platform holds records relating to under-18s, including video where it is used. As processor we act on our customer's instructions. Our customer is the controller and is responsible for the lawful basis and for obtaining parental or guardian consent where required.
Retention and deletion
- Data is retained for the life of the account, and for 12 months after an account becomes inactive, so that customers who operate seasonally can reactivate without losing records. Retention periods are not currently configurable per customer
- An account holder can permanently delete their own account
- A record deleted by another user is removed from the platform but retained in our database; permanent erasure is actioned on written request within five working days
- Video files are not yet deleted — see the table above
- Payment and invoice records are kept for seven years, as Dutch law requires
- Backups are overwritten on a 7-day rolling cycle
- On termination you may request a full export within 30 days. Data is then deleted 12 months after the account becomes inactive, or within 30 days of a written request to delete sooner. We confirm in writing
Breach notification
If we become aware of a personal data breach affecting your data, we notify you within 24 hours. We tell you what happened, how many people and records are affected, whether health data or data about under-18s is involved, the likely consequences, and what we are doing.
We do not contact the regulator or your clients directly — that is your decision as controller. We keep a register of all breaches, including those we assess as not requiring notification, as Article 33(5) requires.
Your rights, and your clients' rights
If you are a customer, see our Privacy Notice for Businesses and Organisations.
If you are a client of one of our customers, see our Privacy Notice for Clients. In short: approach the business you booked with first, because they hold the record; contact us if that does not resolve it.
Everyone has the right to complain to a supervisory authority:
- Netherlands: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl
- United Kingdom: Information Commissioner's Office — ico.org.uk
Contact
Golf Financial Services B.V., trading as ProAgenda Jan van Krimpenweg 9e, 2031 CE Haarlem, the Netherlands info@proagenda.com · +31 20 449 60 99 · KvK 34130467