This policy explains what personal data Apointa handles, why, and the choices you have. It covers our website, the admin portal clubs use, and the booking apps we run for clubs.
1. Who we are
Apointa (FZC) is a free zone company licensed by the Sharjah Research Technology and Innovation Park Free Zone Authority (licence SC242058501), at 049-Block C VL10, SRTIP, Sharjah, United Arab Emirates. We handle personal data in line with applicable data protection law, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the EU and UK GDPR.
2. Our role: club data and our data
If you are a member of a club, the club decides how your data is used. It is the controller, and Apointa processes your data on the club's behalf and under its instructions. The club's own privacy notice also applies, and the club is your first point of contact for requests about your data.
For our own customers and visitors, meaning club owners, staff accounts, people who contact us and visitors to this website, Apointa is the controller.
3. What we collect
Members using a club's booking app
- Identity and contact: name, email, mobile number, date of birth and gender, if the club asks for them.
- Account: login details (passwords are stored hashed, never in plain text), or your Google account name and email if you sign in with Google.
- Family members you add and book for, such as children.
- Activity: bookings, attendance and check-ins, packages, memberships, vouchers, wallet balance, invoices and payment status.
- Preferences and levels: sports, services, coaches, locations, preferred days and times, session lengths and assessed playing levels.
- Payments: amount, date, status and a reference from the payment provider. Your card details go directly to the payment provider; we don't store full card numbers.
- Communications: messages sent to you and whether they were delivered, opened or read, and your marketing preferences.
- Technical: IP address, browser and device type, and logs of sign-ins and errors.
Club owners and staff
- Name, email, phone, role and permissions, and a log of actions taken in the admin portal.
- Billing contacts and company details for invoicing.
Website visitors and prospects
- Whatever you send us when you contact us or ask for a demo, such as your name, club, email and phone.
4. How we use it
- To run the service: show availability, take bookings and payments, manage packages and memberships, and send booking messages. Legal basis: performing a contract.
- To personalise booking: suggest slots and "book again" options based on your preferences and booking history. Legal basis: legitimate interests; you can change your preferences at any time.
- To give clubs reports on bookings, attendance, revenue and retention for their own business. Legal basis: the club's instructions.
- To support, secure and improve Apointa: fix problems, prevent fraud and abuse, and understand how features are used. Legal basis: legitimate interests.
- To meet legal obligations, such as tax, accounting and lawful requests from authorities.
- For marketing, only where you have opted in. See section 5.
We don't sell personal data, and we don't use member data to advertise to members on behalf of other businesses.
5. Messages and marketing
Clubs use Apointa to send service messages, such as booking confirmations, reminders, cancellations and payment links, by email, WhatsApp or push notification. These are part of the service.
Marketing messages, such as offers and campaigns, are sent only to members who have opted in. Every marketing message includes a way to opt out, and you can also change this in your account preferences. Clubs can set quiet hours so automated messages aren't sent late at night.
6. Who we share it with
- Your club and its authorised staff and coaches.
- Service providers who help us run Apointa, under contracts that require them to protect your data and use it only for our service. They include cloud hosting and database providers, an email delivery provider, WhatsApp messaging through Meta's WhatsApp Business Platform and its service partners, a licensed card payment provider, and Google, if you choose Google sign-in.
- Authorities, where the law requires it or to protect the rights and safety of people or the service.
- A buyer or successor, if Apointa is sold or merged. They will be bound by this policy.
Contact us for a current list of our service providers.
7. Where it is stored
Apointa is hosted in data centres in the European Union. Some service providers may process data in other countries. When data moves across borders, we rely on safeguards recognised by applicable law, such as contractual protections with each provider.
8. How long we keep it
- Member data: for as long as the club uses Apointa, or less if the club deletes it or tells us to.
- When a club leaves: the club can export its data within 30 days of its subscription ending. After that we delete it or make it anonymous, unless the law requires us to keep it.
- Our own records, such as invoices and contracts, are kept for as long as tax and company law requires.
9. Security
We protect data with encryption in transit, hashed passwords, role-based staff permissions and access controls on our systems. No system is perfectly secure. If a breach affects your data, we will tell the club, and where required the authorities and you, as the law requires.
10. Children and families
Many clubs coach juniors. Children's details are added and managed by a parent or guardian through a family account, or by the club with the parent's consent. You need to be 18 or over to hold your own account. If you think a child's data has been added without consent, contact the club or us and we will help remove it.
11. Your rights
Depending on the law that applies to you, you can ask to:
- access a copy of your data;
- correct data that is wrong or incomplete;
- delete your data, or restrict how it is used;
- object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent, for example to marketing, at any time.
Members should contact their club first, because the club controls their data. You can also contact us and we will pass your request on and help the club respond. You may also complain to your data protection authority.
12. Cookies and local storage
We use essential cookies and browser storage to keep you signed in, remember your settings and keep the service secure. We don't use advertising cookies. If we add optional analytics, we will update this policy and ask for consent where the law requires it.
13. Changes
We will post any update here with a new date. If a change is significant, we will tell clubs by email and show a notice in the app.
14. Contact
Apointa (FZC), 049-Block C VL10, SRTIP, Sharjah, United Arab Emirates · sales@apointa.com