Privacy Notice

How Cantona BV handles personal data inside CANTONA OS.

Version 1.0 · effective 6 October 2026 · Not yet reviewed by a lawyer — see the end of this page.

Looking for something else? If you messaged GARRINCHA or OWAZA on WhatsApp, Messenger, Instagram or by email, the notice that covers you is the Chat Hub Privacy Notice. If you use the GARRINCHA Connect member app, its own notice covers that. This page is about CANTONA OS, the system our staff work in.

1. Who is responsible 2. What we hold 3. Why, and on what basis 4. Who else sees it 5. Where it is kept 6. How long 7. Your rights 8. Security 9. Contact & complaints

1Who is responsible

The controller is Cantona BV, enterprise number BE 1019.292.925, Belgium — www.cantona.group. Cantona BV operates CANTONA OS for itself and for the group companies: Kempes BV (GARRINCHA), Valderrama BV (OWAZA), United-C BV and Batigol BV.

Contact for anything in this notice: dev@garrincha.be.

2What we hold

About staff who use the system

Identity — name, staff number (CAN-####), work email, job title, the photo you upload, and which companies and clubs you cover.
Access — which modules you are granted, who granted them and when.
Sign-in records — the time you signed in, the network (IP) address you signed in from, and the browser and operating system your device reported. These are security records, not an attendance or productivity measure.
What you changed — an audit trail of records you create or edit, so a change can be traced to the person who made it.

About customers and club members

From Playtomic — bookings, wallet transactions, contact details and consent flags, mirrored into our database on an hourly copy.
From the GARRINCHA Connect app — app account, loyalty balance and tier, community activity, where a person uses the app.
Marketing — campaign sends, opens, clicks, unsubscribes and suppression records, and the segments a person falls into.
Conversations — messages sent to GARRINCHA and OWAZA, covered in detail by the Chat Hub Privacy Notice.
Support — problems reported through the system, and the notes on them.

We do not collect special-category data (health, beliefs, and so on) and ask that none be typed into free-text fields.

3Why, and on what legal basis

What for	Basis under the GDPR
Giving a staff member an account and running the business	Contract (Art. 6(1)(b)) and our legitimate interest in operating (Art. 6(1)(f))
Bookings, payments and running the clubs	Contract with the customer (Art. 6(1)(b))
Keeping the system secure — sign-in records, audit trail	Legitimate interest in security and in being able to investigate (Art. 6(1)(f))
Marketing to customers	Consent, or the existing-customer basis, with an unsubscribe in every message
Invoicing, accounting, tax	Legal obligation (Art. 6(1)(c))

Where we rely on consent you may withdraw it at any time, and where we rely on a legitimate interest you may object — see your rights.

We do not sell personal data, we do not share it for anyone else’s marketing, and we do not use it to make automated decisions that have a legal or similarly significant effect on a person.

4Who else sees it

Inside the group, only staff whose role requires it, limited by the module grants and club scope recorded in the system.

Outside the group, these processors and services, each under a contract and only for what they do here:

Who	What they do	Where
Supabase	The production database, authentication and storage	EU — Frankfurt
Vercel	Hosting, the edge gate and the serverless API	EU region
Playtomic	The booking platform the clubs run on	EU
Meta (WhatsApp, Messenger, Instagram)	The channels customers message us on	EU / US
Twilio	SMS, when switched on	EU / US
Resend	Sending email	EU / US
Anthropic	The model behind GARRY, the internal assistant	US
Sentry	Error reports from the software	EU
Upstash	Rate limiting	EU
Odoo	Invoicing and accounting	EU
Combell	Domains, DNS and mailboxes	Belgium

We also disclose data where the law requires it, or to our professional advisers.

Transfers outside the EU

Most of the above is in the EU. Where a processor is in the United States — today Anthropic, and Meta and Twilio for parts of their service — the transfer is made under the European Commission’s Standard Contractual Clauses, or an adequacy decision where one applies.

5Where it is kept

The production database is hosted by Supabase in Frankfurt, Germany (eu-central-1). The application runs on Vercel’s European region. Backups are held by those providers in the same region.

6How long we keep it

What	Kept for
Staff account and access record	While you work with us, then 12 months
Sign-in records	12 months
Audit trail of record changes	7 years, matching the accounting record
Customer bookings and wallet history	As long as the club relationship, then as the law requires
Marketing sends, opens and clicks	24 months
Unsubscribes and suppression records	Indefinitely — deleting one would start sending to that person again
Conversations with customers	As set out in the Chat Hub notice
Invoices and accounting records	7 years (Belgian law)

7Your rights

Whether you are a member of staff or a customer, you may ask us to:

tell you what we hold about you, and give you a copy;
correct anything wrong;
delete it, where we have no overriding reason or legal duty to keep it;
restrict or object to our use of it, including profiling for marketing;
receive it in a portable form, where that right applies;
withdraw consent, where consent is what we relied on.

Write to dev@garrincha.be. We answer within one month. We may need to confirm who you are first — which is itself a protection for you.

To stop marketing email, the unsubscribe link in any message is enough and takes effect at once.

8Security

Sign-in is required for every page, checked at the edge before a page is served.
The session is a signed, HttpOnly cookie that your browser will not hand to a script — see the Cookie Notice.
Access is granted per module, and a change to someone’s access ends their open sessions.
Private database schemas are not exposed to the browser; reads go through named, server-side functions.
Traffic is encrypted in transit; the database is encrypted at rest by the provider.
Keys are held in the provider’s environment and in the owner’s vault, never in our source code.

If a breach occurs that is likely to be a risk to people, we will notify the Belgian Data Protection Authority within 72 hours and tell those affected where the law requires it.

9Contact and complaints

Cantona BV — dev@garrincha.be — www.cantona.group.

We have not appointed a Data Protection Officer; we do not meet the criteria that require one. If that changes, this page will say so.

If you are not satisfied, you may complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels — www.dataprotectionauthority.be. You may also complain to the authority where you live.

Status of this document. Written on 6 October 2026 to describe accurately what CANTONA OS holds and who it is shared with, and not reviewed by a lawyer. The retention periods in section 6 in particular are a sensible starting position rather than advice. Have a Belgian lawyer read it before relying on it with an authority or a customer.