Privacy Policy
Last updated
This Privacy Policy explains how FOP Avilov K. V. (a Ukrainian sole proprietor; “CoFlexA”, “we”) processes personal data on coflexa.com and in the CoFlexA service. It is an integral part of the Terms of Use and follows the Law of Ukraine “On Personal Data Protection”.
This English version is a translation. If it differs from the Ukrainian version, the Ukrainian version prevails.
If you do not agree with this Policy, please do not use the website or the service.
1. Who we are and how to contact us
- Data controller: FOP Avilov K. V.
- Email: support@coflexa.com
- Telegram: @CoflexaBot
2. Who is responsible for which data
2.1. For the data of website visitors, our customers (rental shops, clubs, event organizers, trainers) and their staff who use the service, CoFlexA is the controller.
2.2. For the data a customer enters about its own visitors (rental customers, event participants, class attendees), the customer is the controller. CoFlexA acts as a processor: it processes this data only on the customer’s instructions and only to provide the service (section 8 of the Terms of Use).
2.3. If you are a visitor of a rental shop or club that uses CoFlexA, please contact that shop or club about your data. We will help them handle your request.
3. What data we process
3.1. Website visitors
- your email, phone number and any other details you enter in the demo request form;
- technical data: IP address, browser and device type, pages visited, date and time of the visit;
- cookies and browser local storage (section 8).
3.2. Customers and users of the service
- name, email, phone number, job title;
- business name, company details, location addresses;
- login details, account settings, activity logs;
- plan, invoices and payment history. We do not receive or store payment card data: banks process it;
- correspondence with support.
3.3. Data customers enter into the service (we are the processor)
- visitors’ names, phone numbers and emails;
- bookings, tickets, class sign-ups, memberships, visit history;
- sizes and other gear parameters;
- deposits, payment statuses, electronic contracts;
- consents to receive marketing messages;
- children’s data, when a customer signs them up for classes. In that case the customer is responsible for having the consent of their parents or other legal guardians.
4. Why we process data and on what basis
| Purpose | Basis |
|---|---|
| Providing access to the service, managing plans and payments | Performance of the contract (Terms of Use) |
| Responding to a demo request, consultations | Your consent, given by submitting the form |
| Technical support | Performance of the contract |
| Service security, abuse prevention, backups | CoFlexA’s legitimate interest |
| Improving the service with anonymized statistics | CoFlexA’s legitimate interest |
| Website traffic statistics (Google Analytics) | Your consent, given in the cookie banner |
| Telling you about new features and offers | Your consent; you can opt out at any time |
| Accounting and reporting | Legal obligations |
5. Who we share data with
We do not sell personal data. We share it only to the extent needed for the relevant purpose:
- hosting providers with servers in European Union countries, to store service data and backups;
- Cloudflare, for website delivery, DNS and attack protection;
- Google (Google Analytics), for website traffic statistics, only with your consent (section 8);
- Universal Bank JSC (monobank) and PrivatBank JSC CB, to accept payments;
- email, SMS, Viber and other messaging providers, only when a customer sets up such messages;
- advertising and analytics platforms (Meta, Google, TikTok and others), only when a customer connects the integration; data is sent on the customer’s instructions;
- AI model providers, to run the AI assistant, only to the extent needed to answer the user’s request;
- public authorities, only in the cases and manner required by law.
Everyone we share data with must keep it confidential and use it only for the stated purpose. We will provide an up-to-date list of our providers on request.
6. Where data is stored
Service data is stored on servers in European Union countries. These countries are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, so the transfer complies with Article 29 of the Law of Ukraine “On Personal Data Protection”.
7. How long we keep data
- Account and customer data: for the term of the contract and 30 days after it ends, so the customer can export it. After that the data is deleted, and backups are overwritten within the following 30 days.
- Demo requests: up to 12 months if you do not become a customer.
- Invoices and payment documents: for the periods required by tax law.
- Technical logs: up to 6 months.
8. Cookies
The website and the service use necessary cookies and browser local storage: to sign you in, remember settings and protect against attacks. The service does not work without them.
With your consent, the website also uses Google Analytics 4 (Google Ireland Limited) to count visits and see which pages are useful. It sets the _ga and _ga_* cookies, which last up to 2 years. Google Analytics 4 does not store IP addresses, and its statistics are kept for up to 14 months. Google may process this data in the United States, among other places; it participates in the EU-US Data Privacy Framework.
On your first visit the website asks for your consent. Until you give it, no analytics cookies are set, and Google Analytics only receives anonymous signals without cookies or identifiers (Google Consent Mode). Your choice is saved in your browser’s local storage. You can change it at any time with the “Cookie settings” link at the bottom of the website; if you withdraw consent, we delete the analytics cookies from your browser.
The website does not use advertising cookies. If we start using them, we will update this Policy and ask for your consent.
9. How we protect data
- all connections to the website and the service are encrypted (HTTPS);
- only staff and contractors who need access to do their work have it;
- data is backed up regularly;
- passwords are stored only in protected (hashed) form.
No method of transmitting or storing data is completely secure. If an incident affects personal data, we will notify the affected customers without undue delay and, where the law requires, the Ukrainian Parliament Commissioner for Human Rights.
10. Your rights
Under Article 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to:
- know which of your data we process, why, where it is stored and who it is shared with;
- access your data;
- have inaccurate data corrected or your data deleted;
- object to the processing of your data;
- withdraw your consent where processing is based on consent;
- protect your data from unlawful processing;
- complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.
To exercise your rights, write to support@coflexa.com. We will reply within 30 calendar days.
11. Children
The service is intended for businesses and may only be used by people aged 18 or over. Children’s data can enter the service only when a customer signs them up for classes or events (section 3.3).
12. Changes to this Policy
We may update this Policy. The date of the current version is shown at the top of the page. We will email customers about material changes at least 14 days before they take effect.