Draft version for approval dated 11 September 2026 — version 3.5
This Policy sets out the procedure for processing personal data when visiting the website clubbase.fit and using the ClubBase system. The provider of the Service is Individual Entrepreneur (FOP) Maksym Vasylovych Shapoval, RNOKPP (individual taxpayer registration number) 3684002118, hereinafter “ClubBase” or the “Licensor”.
The Policy applies to visitors, Clients, Administrators and Users, and to personal data contained in the Content that they transmit to the Service. The meanings of terms are established by the Terms of Access to and Use of the ClubBase System.
1. General provisions
1.1. ClubBase processes personal data in accordance with the Law of Ukraine “On Personal Data Protection” and other mandatory rules applicable to the relevant relations. This Policy applies together with the Terms of Access and Use.
1.2. During registration, the Client reads this Policy and confirms having read it by ticking the corresponding box. Consent to processing, where such consent is required, is given by a separate confirmation stating the purpose. Such consent does not constitute permission to use data for any purposes that have not been disclosed.
1.3. Data required for creating an account, performing the contract, settlements, security and statutory accounting obligations are also processed on the relevant contractual and legal grounds. Withdrawal of consent does not terminate processing that has another proper legal basis. Consent to advertising or to optional technologies is not a condition of access to the core Service.
1.4. The Client ensures the lawfulness of transmitting Content and the data of other persons, in particular by obtaining the necessary permissions and notifying the relevant persons. With respect to the Client’s database, ClubBase acts on the Client’s instructions within the functions of the Service. For its own registration, support and settlements, ClubBase independently determines the appropriate purposes of processing.
2. Data and purposes of processing
2.1. ClubBase may receive the name, contact details, name and details of the organisation or entrepreneur, the User’s role, profile settings and other information provided during registration or when contacting support. These are needed to create and maintain the account, manage access and communicate. Where it is necessary to verify the territorial availability of the Service, information on the country of residence provided by the Client is also processed.
2.2. Content includes records, contacts, messages, documents, files and other materials entered by the Client or its Users, including through integrations. It is processed to perform the ordered functions of the Service and to handle support requests. The client database is not used by ClubBase as its own list for advertising.
2.3. For settlements, the following are processed: payer details, invoices, amounts, currencies, dates and statuses of transactions, their identifiers, fixed exchange rates and offer validity periods, contributions, separate bonuses, their use and adjustments. Information on billing periods and the applied version of the terms is also stored. These are needed for the correct calculation of charges, separate accounting of own funds and bonus funds, confirmation of payments, performance of accounting obligations and resolution of disputes.
2.3.1. For automatic top-up, the following are stored: the fact, date, time and content or version of the authorisation, the selected amount and cycle, the schedule, its changes, information on withdrawal, and prior notices with the agreed parameters of the transaction. To execute payments, ClubBase stores an encrypted token of the payment provider with restricted access, and not the full card number or CVV/CVC. Payment details are processed by the payment provider in its own interface. PIN, CVV/CVC or one-time bank codes should not be provided to ClubBase support. After automatic top-up is disabled, the token is not used for new automatic debits under the withdrawn authorisation; information on the authorisation already given and on the transactions executed may be stored under clause 4.6.
2.4. Technical data may include the IP address, device and browser type, and information on the session, actions and errors. They are used for operating the Service, protection, diagnostics and improvement of functions. Cookies and similar technologies are used for sign-in, settings and, on an appropriate legal basis, analytics. Optional technologies for which consent is required are not enabled until such consent is obtained; their purpose, retention periods and method of management are communicated through the settings of such technologies.
2.5. The contact details of Clients and Users may be used for service messages, surveys, information about new features and marketing offers of ClubBase. For advertising, consent is obtained or another legal basis permitted by law is applied. Advertising messages may be declined through the unsubscribe mechanism or by writing to the contact address. Necessary messages concerning the contract, payment and security are sent regardless of the advertising subscription.
2.6. Integrations connected by the Client may transmit to ClubBase permitted contacts, messages, identifiers and other data. The Client independently manages such connections and the rights of its team. Liability for the Client’s disclosure of passwords or access keys to third parties is determined by the Terms of Use.
2.7. Data are processed on infrastructure engaged for operating the Service. An international transfer must have a proper legal basis. Information on the actual recipients and countries of processing is provided before the relevant transfer where required by law, and upon a proper request. The terms of external functions, in particular artificial intelligence, may provide for processing in other countries; the location of the main database does not by itself determine the location of all such operations.
2.8. ClubBase may publish reviews and materials about the use of the Service. Providing a text, image or video specifically for publication means permission to use it to the agreed extent, in particular on the website and in marketing materials. The existence of private correspondence or use of the Service does not by itself constitute permission to publish it or a person’s image. For materials containing the data of other persons, the appropriate permissions must be in place. Requests to correct or remove a review are sent to the ClubBase email address.
2.9. To distinguish simulated payments from real payments, the following are processed: the mode flag, demonstration transactions and balances, the date of transition, the notice of it and the corresponding confirmations of the Client. Test payment records are kept separate from information on funds actually received. They do not constitute confirmation of a real payment or consent to a real automatic top-up.
3. Transfer of data
3.1. Administrators and Users authorised by the Client have access to Content within the rights defined by the Client. Employees and contractors of ClubBase receive access only to perform the relevant tasks and subject to a confidentiality obligation.
3.2. Data may be provided to providers of infrastructure, storage, communications, payments and support to the extent necessary for operating the Service and performing the contract. The engagement of a provider does not by itself permit it to use the data for unrelated purposes of its own. Prior notice or approval is ensured where it is mandatory.
3.3. Transfer to third-party integrations is carried out according to the Client’s settings and permissions. Independent processing by a third-party provider is also governed by its terms. The specifics of transmitting requests to artificial intelligence are set out in section 6.
3.4. Information may be provided to a court or a competent authority upon a proper lawful demand, and may also be used to the necessary extent to protect rights in a dispute. A request from a third party without an appropriate basis does not give the right to disclose the Client’s database.
4. Rights of individuals and retention periods
4.1. An individual may request access to their personal data and information on the purpose, sources and recipients, and may demand correction, cessation of unlawful processing and deletion in the cases established by law. The rights to restriction, objection and data portability also apply where they are provided for by the relevant legislation.
4.2. Consent may be withdrawn by contacting ClubBase. Withdrawal does not render prior processing unlawful and does not cancel other proper grounds for continuing it. A complaint concerning processing may be filed with the Ukrainian Parliament Commissioner for Human Rights, another competent authority or a court.
4.3. Requests are sent to [email protected]. ClubBase may verify the identity and authority of the requester to the necessary extent. Requests concerning the Content of a specific Client are handled together with that Client; this does not permit transferring the data of other persons to the requester without a proper basis. Requests are considered within the time limits established by law.
4.4. Data are stored for the period necessary for the relevant purpose and for performance of the contract. After blocking for non-payment or termination of use, including voluntary termination, working Content is stored for 14 calendar days from the relevant date. During this period the Client may obtain it through the available export or through support, and in the case of blocking for non-payment may also resume use after repaying the debt.
4.5. After this period expires, working Content may be deleted without further approval if work has not been resumed. Longer mandatory periods for obtaining or transferring data are preserved. A timely export request is processed before the relevant data are deleted. These rules are consistent with section 4 of the Terms of Use.
4.6. Billing documents, confirmations of consents and information needed to comply with the law or to resolve a dispute may be stored for longer with restricted access. Deletion from backup copies depends on their update cycle; deleted data must not return to ordinary use after a copy is restored. Retention periods for data in external functions are also determined by section 6.
5. Protection of information
5.1. ClubBase implements legal, organisational and technical measures aimed at protection against unauthorised access, loss, alteration and disclosure of data. The measures cover access management, protection of sessions and of data transmission, and review of security settings taking risks into account.
5.2. The Client protects its own devices, sign-in credentials and integration keys and promptly terminates the access of unauthorised Users. These obligations do not cancel ClubBase’s own security obligations.
5.3. If an incident is suspected, support must be notified. ClubBase examines the circumstances, takes measures to limit the consequences and ensures the notifications that are mandatory under applicable legislation.
6. Data in artificial intelligence functions
6.1. For built-in artificial intelligence functions, the use of OpenAI services and Claude models of Anthropic through the respective APIs is provided for. When a request is executed, text, the selected context, files and other data necessary for the task may be transmitted. Requests and results are used to provide the relevant function, support and security. Transmission of the entire client database without a need arising from a specific task is not provided for.
6.2. Under the standard API terms of OpenAI and Anthropic, input data and results are by default not used to train models. A separate consent to transmit data for improving models, or sending feedback containing such data, may change the terms of their use in accordance with the provider’s rules. An ordinary permission of the Client of ClubBase to execute a request is not such an approval. Separate use of data for training requires a proper legal basis and the necessary approvals.
6.3. Storage of requests and results by the external provider depends on the selected function, the integration settings and the applicable API terms. This Policy does not guarantee zero retention or the deletion of all external technical logs simultaneously with the closure of the account. ClubBase limits transmission to the necessary extent and takes appropriate actions for deletion when grounds for it arise.
6.4. The Client uses the function only with respect to data that it is entitled to transmit for the relevant purpose. Passwords, payment codes or unnecessary sensitive information should not be added. Possible errors in results do not remove the obligations of the parties regarding lawful processing of data.
6.5. Before engaging another provider, ClubBase communicates its name and the material terms of transmission and, where necessary, obtains additional approval. Requests concerning data in artificial intelligence functions are submitted using the contact details in this Policy.
7. Changes and contacts
7.1. ClubBase may update the Policy by publishing a new version on the website indicating the date. Clients are recommended to check the current version. Mandatory notices of changes are sent in an appropriate manner; publication alone does not replace new consent where such consent is required.
7.2. Use of the Service is governed by the Terms of Access and Use. This Policy explains the processing of personal data and does not cancel the mandatory rights of individuals.
7.3. Requests are addressed to FOP Maksym Vasylovych Shapoval, RNOKPP 3684002118. Address: Ukraine, 01133, Kyiv, Konovaltsia St., bldg. 36A, apt. 152. Email: [email protected]. Phone: +38 (096) 449-00-33. Website: clubbase.fit.