Privacy Policy
Apprenaline Ltd
Last updated: 30 June 2026
1. Who we are (Data Controller)
Apprenaline ("Apprenaline", "we", "us", "our") is the controller of the personal data described in this policy.
- Legal entity: Apprenaline Ltd (registered in England and Wales)
- Registered address: 85 Great Portland Street, First Floor, London, England, W1W 7LT
- Company registration no.: 15220303
- Contact for privacy matters: info@apprenaline.com
If you have any question about this policy or how we handle your data, please contact us at the address above before contacting the supervisory authority — we will do our best to resolve it directly.
2. Scope
Apprenaline is a booking concierge for extreme-sports activities in Hungary. You browse activities, book and pay online, and we confirm your slot with a local operator on your behalf. This policy explains what personal data we collect when you use our website and booking service, why we collect it, who we share it with, and the rights you have.
This policy covers the Apprenaline website and booking flow only. Activities are delivered by independent local operators; once your booking is confirmed and handed over, the operator acts as an independent controller for any additional data it collects on-site (for example, a physical liability waiver you sign in person). We are not responsible for operators' own privacy practices.
3. What data we collect, why, and on what legal basis
We only collect what we need to take and fulfil a booking, and to understand in aggregate how our site is used. We do not run advertising trackers or social-media login, we do not sell your data, and our analytics is cookieless — it does not profile you or track you across other websites (see Section 5).
| Data | When / how collected | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Full name | You enter it in the booking form | Identify the booking; address you in confirmations | Performance of a contract — Art. 6(1)(b) |
| Email address | Booking form | Send booking confirmation and the final voucher with meeting point | Contract — Art. 6(1)(b) |
| Phone number | Booking form | Contact you to confirm the slot and coordinate logistics | Contract — Art. 6(1)(b) |
| Requested date, time, activity, party size | Booking form | Arrange the booking with the operator | Contract — Art. 6(1)(b) |
| Waiver acceptance (acknowledgement that you accepted the Terms and Liability Waiver) | Booking-form checkbox | Record your acceptance of risk and terms | Contract — Art. 6(1)(b); legitimate interest in evidencing acceptance — Art. 6(1)(f) |
| Payment confirmation data (amount, Stripe payment reference, payment status) | Returned by Stripe after you pay | Confirm payment, issue refunds, keep accounting records | Contract — Art. 6(1)(b); legal obligation (tax/accounting) — Art. 6(1)(c) |
| Participant weight and/or height (only for activities that require it, e.g. paragliding, kitesurf) | Collected after payment, during our confirmation contact — never at checkout | Safe equipment sizing and operator safety limits | See Section 4 |
| Technical data: IP address, browser/device type, server logs | Automatically when you visit the site | Operate, secure and troubleshoot the site; prevent fraud and abuse | Legitimate interest — Art. 6(1)(f) |
| Aggregate usage data (pages viewed, booking-funnel steps) via cookieless analytics — no profile, no cross-site tracking | Automatically when you use the site | Understand site usage and improve the booking experience | Legitimate interest — Art. 6(1)(f) |
We do not collect card or banking details ourselves. Payment is handled entirely on Stripe's hosted checkout (see Section 5).
4. Weight and height (equipment-sizing data)
Some activities require each participant's weight and/or height so the operator can size equipment safely and apply its safety limits. We deliberately do not ask for these at checkout — we collect them from you only after payment, when we confirm your booking, and only for the activities that need them.
We collect weight and height solely to size equipment and apply the operator's safety limits. We do not use this information to assess your health or fitness, we do not combine it with any health information, and we draw no health conclusions from it. We treat it conservatively in any event: it is shared only with the operator delivering your activity, is used for no other purpose, and is deleted on the same schedule as the rest of the booking (Section 7).
5. Who we share data with (processors and recipients)
We share personal data only with the parties needed to deliver your booking and operate our website. Each acts under a data-processing agreement and may process data only on our instructions.
| Recipient | Role | Data shared | Where processed |
|---|---|---|---|
| The local operator delivering your activity | Independent controller — the operator provides the activity; Apprenaline books on its behalf as agent | Name, phone, party size, date/time, and weight/height where required | Hungary (EU) |
| Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) | Payment processing | Name, email, payment amount, and the card data you enter directly on Stripe | Ireland (EU) and United States — see Section 6 |
| Supabase | Database hosting (stores the booking record) | All booking-form data and payment references | EU region (Frankfurt, Germany) |
| Resend | Transactional email delivery (confirmations and voucher) | Name, email, booking details | United States — see Section 6 |
| Vercel | Website and application hosting | Technical/server-log data, plus booking data in transit | EU region (Frankfurt, Germany) |
| PostHog | Cookieless product analytics (aggregate site usage and booking funnel) | Anonymous usage events; no personal profile and no cross-site tracking | EU region (PostHog EU Cloud) |
We may also disclose data where required by law, to comply with a legal obligation, or to establish, exercise or defend legal claims.
We never sell your personal data, and we do not share it for advertising or cross-context behavioural advertising.
6. International transfers and our EU representative
Apprenaline is established in the United Kingdom. Some processors (notably Resend and Stripe) may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards — the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and/or the EU–US / UK Data Privacy Framework where the recipient is certified. You can ask us for a copy of the relevant safeguards using the contact details in Section 1.
Because we offer our services to people in the European Union, we are required to appoint an EU representative under Article 27 of the EU GDPR. You may contact us — or, once appointed, our representative — on any matter relating to our processing of your personal data:
EU representative: to be appointed — in the meantime, please contact us at info@apprenaline.com.
7. How long we keep your data
We keep personal data only as long as needed for the purpose it was collected for:
- Booking and contact data: retained for the duration of the booking and for 12 months after the activity date, to handle follow-up, complaints or refunds, then deleted or anonymised.
- Weight/height data: deleted once the activity is completed (or the booking is cancelled/refunded), on the same schedule as the booking record.
- Payment and accounting records: retained for 6 years, in line with UK tax and VAT record-keeping requirements. Under the agency model the operator issues the customer VAT invoice and keeps the Hungarian accounting records for the activity sale; Apprenaline keeps records of its own commission income and payment collection.
- Server logs: retained for a short technical/security window, then rotated out.
Once the retention period expires, the data is deleted. After deletion we can no longer act on access, rectification, erasure or portability requests for that data.
8. Your rights under the GDPR
To the extent the law allows, you have the right to:
- Access — confirm whether we process your data and obtain a copy.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted ("right to be forgotten").
- Restriction — limit how we process your data in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
- Object — object to processing based on our legitimate interests, on grounds relating to your particular situation.
- Withdraw consent — where processing is based on consent, withdraw it at any time (without affecting processing already carried out).
To exercise any of these, contact us using the details in Section 1. Requests are free of charge and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you). We may need to verify your identity before acting.
9. Right to complain (supervisory authority)
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a supervisory authority. For our customers in Hungary, the competent authority is:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Web: https://naih.hu — Email: ugyfelszolgalat@naih.hu
You may also complain to the supervisory authority in your own EU country of residence. As Apprenaline is established in the United Kingdom, you may alternatively contact the UK Information Commissioner's Office (ICO, https://ico.org.uk).
10. Cookies and local storage
The Apprenaline website uses no advertising, analytics, or social-media tracking cookies.
To improve your booking experience, we temporarily store a draft of your booking form in your browser's sessionStorage so that if you leave the payment page and come back, your entries (name, email, phone, date) are not lost. This data:
- stays in your browser only and is never transmitted to us as a cookie or in logs;
- is cleared automatically when your booking goes through or when you close the browser tab.
Any cookies we use are strictly necessary — limited to those required to operate the site and keep it secure. Because we use only strictly-necessary mechanisms and same-origin sessionStorage, and no advertising or analytics trackers, we do not display a cookie-consent banner. A separate Cookie Policy sets this out in more detail. If we ever add analytics or advertising tools, we will introduce consent controls and update this policy first.
11. Security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. These include encryption of data in transit (HTTPS), restricting access to booking data to authorised staff, keeping payment card data entirely within Stripe's PCI-DSS environment, and verifying payment webhooks cryptographically before any record is written. No system is completely secure, but we work to protect your data and to notify you and the authority of any breach where required.
12. Children
The Apprenaline platform is not directed at children, and bookings must be made by an adult. Where a participant is a minor, the booking adult makes the booking, provides the limited details we need about that participant (their name, and their weight/height where the activity requires it), and consents on the minor's behalf. We process that data only to arrange the booking and support the participant's safety, on the booking adult's authority. We do not knowingly collect data directly from anyone under 18. If you believe a child has provided us data directly, contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and change the "Last updated" date above. Where changes materially affect how we use your data, we will take reasonable steps to notify you, and seek fresh consent where the law requires it.
14. Contact
Questions, requests, or concerns about your privacy:
info@apprenaline.com — Apprenaline Ltd, 85 Great Portland Street, First Floor, London, England, W1W 7LT.