Drillia Privacy Policy
Version 1.5 |
Effective 17 September 2026
1 Who We Are
Drillia Ventures Sàrl (“Drillia”, “we”, “us”) operates the Drillia basketball development platform. Drillia is the controller of personal data processed for operation of its Platform unless a different role is identified for a particular processing activity.
Coaches and Academies generally act as independent controllers for their own coaching services and legal records. Drillia controls its marketplace payment administration, including instructions to capture, transfer, refund or recover amounts. Stripe processes payments and connected-account onboarding and may act as an independent controller for its own legal, identity-verification and fraud-prevention purposes and as a processor for other contracted activities. The applicable data-protection role depends on the processing and Stripe agreement. Drillia’s technical status as the controller of a Stripe connected account is distinct from the legal concept of a data controller.
Registered office: Chemin de Martavaux 16c, 1260 Nyon, Switzerland. Swiss company identification number (UID): CHE-415.121.241.
Privacy contact: privacy@drillia.ai. Support: support@drillia.ai.
2 Scope
This Privacy Policy explains how Drillia collects, uses, shares, stores and protects personal data when people use the website, mobile applications, marketplace, messaging, development tools and related services.
It applies to Players, Coaches, Parents/Guardians, Academy users and visitors. Some functions are age-restricted or parent-managed.
3 Data We Collect Account and Authentication
Account identifiers and status: user ID, account type or role, email, phone where provided, account and verification state, Terms acceptance and Privacy Policy acknowledgement records, document version, locale, timestamps and deletion state. Separate consent records are kept for processing that requires consent.
Authentication/security data: password hashes or encrypted authentication credentials, OTP/login codes, reset/recovery tokens, session/refresh tokens and authentication-provider data.
Google or Apple authentication data where you choose the corresponding login service.
Technical authentication logs may include IP address, user agent, device/session identifiers and login timestamps.
4 Data We Collect Profile and Marketplace Identity
Name/display name, short biography, city, country, nationality, date of birth, gender where provided, profile/cover images and language preferences.
Approximate or precise profile/location coordinates where location functionality is used.
Basketball information such as sport, club, player status, position, level/category, playing/coaching interests, specialisations and languages spoken.
Coach/commercial profile information such as session formats, prices, availability, court/facility information, academy affiliations and Stripe customer/connect identifiers.
Academy information may include organisation name, website/social links, facilities, teams, coaches, players and event information.
For Coaches who are individuals, sole traders or identifiable business contacts, onboarding may include legal and trading name, address, trader status, establishment country, tax status, VAT number, cross-border SME EX-number, registration country and effective date, and any separate EU VAT or OSS registration. We may obtain verification status and relevant identity information from Stripe or documents you provide. Tax-reporting due diligence may additionally require a tax identification number and issuing country, date of birth, business-registration details and financial-account identifier where required; a VAT or EX-number is not automatically a substitute for a tax identification number.
5 Data We Collect Young Players and Parent Relationships
For child profiles we may process parent user ID, child name, date of birth/age, nationality, gender, sport, position, playing status/style, club, avatar/cover image, performance/development data and a record of parental consent/approval where implemented.
We may process parent/guardian contact and linking data that associates the parent account with the young player.
For academy-managed player records, information may also include parent name/contact, age group and development/skill information.
For all users under 18, including those aged 16–17, booking, payment and protected Coach-messaging actions are routed through the parent or guardian. Age is checked dynamically using the date of birth recorded on the account. Parent or guardian involvement does not authorise unrestricted access to every item of a young person’s data.
6 Data We Collect Bookings and Sessions
Booking IDs, player/child profile, coach/professional, academy (where relevant), sport, session type, date/time, status, location and location coordinates, session notes, group-participant information and meeting links where applicable.
Price, gross Coach amount, separate gross Drillia fee, applicable tax rates and amounts for each service, total, currency, session count, attendance, cancellation timestamps, accepted policy version and no-show records. At launch the paying customer is an individual consumer, with the parent or guardian booking and paying for a participant under 18.
For group sessions, participant names and email addresses may be processed.
7 Data We Collect Payments and Promotions
Drillia uses Stripe Connect with separate charges and transfers. The customer payment is created on Drillia’s platform account, with Drillia as merchant of record. For card payments, Stripe authorises the amount at booking and Drillia instructs capture when the Coach accepts, or cancellation of the authorisation if the booking is declined or expires. After the session is marked complete, Drillia normally initiates the Coach transfer approximately one hour later; any agreed Academy allocation is a second separate transfer. The subsequent Coach bank payout follows Stripe’s applicable automatic country schedule. Stripe and Drillia process the payment and account information needed for those distinct steps.
Payment records include amounts, currency, authorisation, cancellation and capture status and timestamps, Stripe customer and connected-account identifiers, Payment Intent and charge references, transfer, refund and dispute references, Drillia fee, Coach and any Academy allocation, provider fees where recorded, account and payout status, promotions and related adjustments. They also include records of a transfer hold, delay, partial release, recipient correction, reversal or recovery, the reason and amount, the relevant booking and session-completion event, and any review or reconciliation.
Dispute records distinguish open, won or reinstated, permanently lost and partial-reversal outcomes. Refund records include the authorising role, policy-required or voluntary basis, amount, time, policy version and execution status. Where a refund or permanently lost chargeback affects transferred proceeds, Drillia uses the original allocation and reversed amount to calculate the corresponding Coach or Academy adjustment and instruct a transfer reversal. Processing may run through the configured payment workflow, with manual handling where review, reconciliation or an unsuccessful reversal requires it. Recovery records include any repayment or offset and the correction of duplicate or superseded adjustments.
Stripe collects full card and payout credentials and the identity and financial-account information required for connected-account onboarding under the notices presented in its flows. Drillia processes the connected-account identifiers, onboarding and verification status, payout eligibility and transaction information made available through Connect, together with relevant identity or account information made available for administration of the account. The fields available depend on the account, agreement and verification requirements. Users should not send full card or bank credentials through Drillia messaging or support. Stripe explains its own processing, relevant entities and privacy contacts at https://stripe.com/privacy and https://stripe.com/privacy-center/legal.
We record the customer’s billing country and payment-instrument country and keep a per-booking snapshot with session format, session date, relevant session-country or customer-location facts, Coach tax status and registration effective date. For in-person sessions, the venue country determines the session location. For live-online sessions, billing and payment-country information are compared; conflicts can prevent confirmation until resolved. IP or declared-location differences may be recorded for review and are not used as the sole evidence of location. Swiss-linked bookings may also require customer domicile or habitual-residence information for the separate service and fee determinations.
We may process referral, promotion, credit and points-redemption information.
8 Data We Collect Development Data
Goals/objectives, categories, target values, progress, completion and approval status, coach ratings and goal-session links.
Coach feedback, strengths, areas to improve, recommended drills, notes and attachments.
Session evaluations, ratings, feedback, Development Points, streaks, achievements/claims and other development milestones.
Academy-managed development records may include skill indicators such as speed, technique, teamwork, stamina and discipline.
Some development information may be sensitive in context even if it is not legally classified as special-category data. Drillia will apply access controls and data-minimisation principles appropriate to its use.
9 Data We Collect Messaging Reports and User Content
Chat thread/participant information, sender, message content, read state, reactions, replies, timestamps and system events.
Attachments may include media URL, filename, content type and file size.
User reports/blocks may include reporter, reported user, chat reference, reason, details and moderation status.
User-uploaded files and session materials may include filename, URL, type, size, comments/display name and links to relevant users/bookings/entities.
Videos may include uploader, booking, title, URL, thumbnail, duration, visibility, type, subject player, child profile, goal tags and group participants.
10 Data We Collect Devices Logs and Notifications
Device push tokens, Firebase installation identifiers, device type/name, app version and notification settings.
Notifications sent to users and read/unread state. Chat push notifications contain only the generic notice “Drillia – You have a new message.” They do not include the sender’s name or message content.
Error logs may include error type/message, stack trace, application method/path, status code, user ID and timestamp.
Request and session logs may include IP address, user agent, requested path, duration and device or session identifiers. Logging is limited to information needed for security, troubleshooting and service operation. Sensitive content is excluded from application logs.
11 Why We Use Personal Data
To create, authenticate, secure and manage accounts.
To provide age-appropriate player/parent functionality and manage parent-child relationships.
To enable coach discovery, contact requests, messaging, bookings and online-session invitations, payment authorisations and capture, transfers, refunds and marketplace operations, including lawful holds, dispute handling and proportionate recovery of reversed proceeds.
To provide development tools, evaluations, goals, progress records, ratings and session media.
To administer academies, teams, facilities and events where those features are used.
To send transactional notifications, security messages and service communications.
To prevent fraud, abuse, unsafe behaviour and violations of Platform rules.
To operate, troubleshoot, secure and improve the Platform.
To determine the relevant tax treatment, issue receipts and credit notes for the correct supplier, maintain transaction and allocation evidence, reconcile platform and connected-account balances, carry out applicable seller due diligence and tax reporting, and comply with accounting, regulatory and safety obligations.
To send marketing communications only where permitted and subject to applicable opt-out/consent requirements.
To locate nearby Coaches only where a user activates location functionality, and to process optional photos or videos only for the audience and purpose selected.
We receive data directly from users, from a parent or guardian who creates or manages a child relationship, from Coaches or Academies contributing authorised session or development records, from Stripe or other providers returning verification and transaction information, and from devices or logs when the service is used. Data about a person may also be contained in a report, message or uploaded media provided by another user.
12 Legal Bases
Where the GDPR applies, account administration, requested booking functions and payment processing use Article 6(1)(b) where objectively necessary for a contract with the data subject or steps requested by that person. This includes administering the customer’s payment and refund and the Coach’s or Academy’s agreed transfers and adjustments where that person is a party to the relevant contract. The fact that a parent is the contracting customer does not make Article 6(1)(b) automatically applicable to every use of the child’s data. Necessary child-development and safeguarding processing is assessed separately, including under Article 6(1)(f) only where the documented interests are not overridden by the child’s rights and interests.
Article 6(1)(c) applies where a Union or Member State obligation binding on Drillia requires the particular processing, including applicable tax reporting. A Swiss-law duty alone is not automatically an Article 6(1)(c) basis under the GDPR; where the GDPR also governs, we assess an appropriate basis, including Article 6(1)(f) for necessary compliance records with safeguards. Our legitimate interests include proportionate fraud prevention, account and child safety, service reliability, accurate payment reconciliation, prevention of duplicate recovery, and the establishment or defence of claims. Optional marketing, non-essential tracking, precise-location uses and optional media uses rely on consent where required; essential service processing is not made conditional on unnecessary consent.
When consent is the legal basis for an information-society service offered directly to a child, GDPR Article 8 requires parental authorisation below the applicable national age threshold, which ranges from 13 to 16. Drillia’s under-16 parent-managed model does not replace this legal assessment or national contract-capacity and safeguarding rules. Consent can be withdrawn through the relevant setting or privacy@drillia.ai without affecting earlier lawful processing.
Drillia does not intentionally collect health, injury, disability or other special-category data at launch. Users are instructed not to place it in free text. If such a feature is introduced, Drillia will first define a GDPR Article 9 condition, safeguards, access rules and retention. Core processing of a child’s data is not described as based on parental consent where a different lawful basis is actually used.
13 Who We Share Data With
Stripe Payments Europe, Limited (Ireland) is the Stripe data-processing counterparty for Drillia’s account outside North and South America. Stripe and its relevant payment and connected-account service entities receive the information needed for authorisation, capture, onboarding, transfer and payout administration, refunds, payment disputes and fraud or identity checks. Drillia sends payment instructions and necessary transaction or dispute evidence and receives related status and reconciliation information. Stripe’s own controller processing and privacy contacts are explained at https://stripe.com/privacy. International transfers are addressed in Section 14.
Amazon Web Services EMEA SARL (Luxembourg) provides production database, storage and backup services for Drillia’s Swiss account. Production data and Drillia’s nightly backups are hosted in eu-north-1 (Stockholm, Sweden). Media is held in private S3 storage and accessed using short-lived signed URLs.
Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, is the relevant Google Cloud contracting entity for Drillia’s Swiss/EMEA configuration. Firebase Authentication and Google authentication process account and authentication information, including email, name and verification data. Firebase Authentication processes authentication data in the United States.
Sign in with Apple provides Drillia with an authentication identifier and the email address and name supplied through that sign-in flow. Apple Distribution International Limited (Ireland) is Apple’s relevant controller for individuals in the EEA and Switzerland. Apple may also process or store data through Apple Inc. in the United States. Apple’s own controller processing is described at https://www.apple.com/legal/privacy/.
Firebase Cloud Messaging (FCM) uses device tokens and installation identifiers to deliver push notifications through Google’s global infrastructure. Chat notifications use the generic wording described in Section 10. This does not make notification delivery anonymous.
For online sessions, the Google Calendar API receives the Player’s and Coach’s names and email addresses and the session date and time needed to create the calendar invitation and Google Meet link. The invitation discloses the session information needed by the invited participants.
Microsoft Azure Translator is used for application and interface localisation. Drillia does not intentionally submit user-generated content or personal data for translation. Provider account and support administration is separate from the translation content flow. No analytics, advertising or crash-reporting SDK is active in the production app.
Framer B.V. (Netherlands) hosts the public Drillia website and provides its built-in aggregate visitor analytics. Website delivery and measurement involve technical visit information, such as network, browser, page and referral information. Framer’s role, website measurement and transfers are described in Sections 14 and 20.
Prighter EU Rep GmbH and Prighter DSA GmbH (Austria) receive information supplied through their respective representative contact and rights-request channels in Section 23, to handle those requests and regulatory communications.
Coaches receive booking, participant and contact information needed to deliver the selected service, including relevant session, payment, transfer, payout and adjustment information. Academies receive only information needed for the authorised roster, session or agreed revenue allocation, including their own transfers and any applicable reversal or recovery. Their access does not automatically include a young user’s full development history, private messages, customer billing evidence or another Coach’s non-public data. Coaches and Academies generally act as independent controllers for their own services and legal duties; any feature involving joint control will be separately identified and documented. Players and parents or guardians receive data within their respective permissions.
Professional advisers, insurers, auditors or authorities where reasonably necessary and legally permitted/required.
Where legally required, Drillia discloses reportable Coach identity, tax and financial-account information, consideration paid or credited, relevant activity totals, and fees, commissions or taxes charged or withheld to the competent tax authority, including under EU platform-reporting rules known as DAC7. The authority may exchange the information with other competent tax authorities under the applicable regime. Reportable Coaches receive the information required by law. We do not publish tax returns, bank-account details or due-diligence documents in public profiles.
We do not sell personal data.
14 International Data Transfers
Drillia is established in Switzerland. Its AWS production database, storage and nightly backups are hosted in Stockholm, Sweden, under its contract with AWS in Luxembourg. AWS states that customer content remains in the selected Region by default; permitted support access, fraud/abuse prevention and legal requirements may involve access or processing elsewhere. Where AWS support or onward processing requires protection for transfers outside an adequate jurisdiction, the AWS Data Processing Addendum, EU standard contractual clauses and Swiss adaptations apply.
Google’s relevant contracting entity is in Ireland, while Firebase Authentication processes authentication data in the United States. FCM and Google Calendar use Google’s international infrastructure; they are not represented as confined to Sweden, the EEA or a single country. Google’s applicable data-processing terms provide European and Swiss transfer safeguards, including standard contractual clauses where required. Current service-specific subprocessor and processing-location information is available at https://firebase.google.com/support/privacy and https://cloud.google.com/terms/subprocessors.
Apple’s relevant controller for EEA and Swiss individuals is in Ireland, with processing also possible in the United States through Apple Inc. Apple identifies standard contractual clauses as safeguards for international transfers of EEA and Swiss personal data. Stripe’s Irish data-processing counterparty uses the mechanisms in its Data Transfers Addendum, including EU standard contractual clauses with Swiss adaptations where required. Stripe’s service providers and processing locations are described at https://stripe.com/legal/service-providers; its transfer terms are at https://stripe.com/legal/data-transfers.
Framer B.V. is established in the Netherlands and states that its services are hosted on AWS infrastructure in the United States. This website hosting is separate from Drillia’s Stockholm app infrastructure. Framer’s Data Processing Addendum provides for adequacy decisions or standard contractual clauses and includes Swiss transfer provisions. Its transfer terms and current subprocessor information are available at https://www.framer.com/legal/data-processing-addendum and https://trust.framer.com.
Where a destination is covered by an applicable adequacy decision, we rely on that decision within its scope. For other transfers requiring protection under the GDPR or Swiss FADP, we use an appropriate safeguard, such as standard contractual clauses with the necessary Swiss adaptations, and assess any additional measures required. You may request information about the applicable safeguard and a copy, subject to appropriate redaction, from privacy@drillia.ai.
15 Data Retention
Drillia keeps personal data only for as long as needed for the purpose for which it was collected and for applicable legal, accounting, fraud-prevention, dispute-resolution, safeguarding and security obligations.
Profile and account data is retained while the account is active. When the account is deleted, the profile/account data is deleted or de-identified, goals and development data are deleted, and photos/videos are hard-deleted from active S3 storage unless a separate lawful retention requirement applies. De-identification does not necessarily make the remaining records anonymous.
Minimum booking/session, payment, refund and payout records are retained where necessary for accounting, tax, disputes or compliance, for up to 10 years. Accounting and invoice records are retained for 10 years where legally required, calculated from the end of the relevant financial year.
Ireland is Drillia’s selected Member State for DAC7 registration. Under Regulation 9 of S.I. No. 705/2022, records of the procedures applied and information relied upon for DAC7 compliance are retained for six years from the end of the year in which the procedures were applied or the information was relied upon. A separate legal duty may require particular accounting or other records to be kept longer. These periods do not authorise retention of every profile, message or uploaded file.
Messages are retained for 24 months after the last conversation activity, subject to a proportionate extension for an active dispute, safeguarding matter or legal hold. Support records are retained for 24 months after the support matter is closed, unless a legal, dispute or safeguarding reason requires longer retention.
Reviews and ratings may remain after account deletion to preserve relevant information about completed coaching services and marketplace integrity, with the deleted user’s authorship de-identified. Identifying free text is retained only while necessary and proportionate to that purpose. It is reviewed and, where appropriate, redacted or removed on an account-deletion request, privacy request or report, or when the content is no longer relevant. The continuing usefulness of a review does not justify indefinite retention of identifying content.
Application and error logs are retained for 30 days from creation. Serious safeguarding and incident records are generally retained for up to five years after case closure, subject to case-specific necessity and legal requirements. Evidence of Terms acceptance is retained for up to 10 years after the relevant contractual relationship ends where needed to establish that relationship or address related claims.
A legal hold or extension is limited to information necessary for the particular claim, investigation or legal obligation and is reviewed when that reason ends. Drillia does not need to retain full payment-card credentials to keep accounting and transaction evidence.
Drillia’s nightly production backups expire after 14 days. This is Drillia’s own backup cycle, not a universal external-provider deletion period. Firebase Authentication retains authentication information until the Firebase customer initiates deletion of the associated user. Firebase installation identifiers require the corresponding deletion API instruction. Google states that removal of the associated data from live and backup systems can then take up to 180 days. Logging and other service-specific retention may differ. Apple, Stripe and other providers acting as independent controllers may retain information for their own legal obligations.
16 Account and Content Deletion
Users may request deletion of their account or content through available Platform functionality or by contacting Drillia.
Account deletion hard-deletes media from active S3 storage where no separate retention requirement applies, deletes goals and development data, and de-identifies the account record. Minimum shared booking, payment and other participant records may remain only where necessary for a legal, contractual, dispute or safeguarding purpose. They are associated with the de-identified account rather than the deleted profile. Messages and reviews follow their specific retention and redaction rules in Section 15. Text, context or links may still identify a person, so privacy rights continue to apply.
Retention of another participant’s record is not a blanket exception to deletion. Drillia must limit remaining personal data to a necessary purpose and lawful basis, restrict access where appropriate and delete or redact unnecessary identifying content. You can request review through privacy@drillia.ai. Requests follow applicable legal deadlines, including the GDPR one-month response period and any lawful extension. Active-storage deletion does not establish immediate erasure from backups or external providers. Backup expiry, restoration handling and provider deletion instructions must preserve a valid deletion request; information that must lawfully be retained remains subject to the restrictions above.
17 Children and Young People
Drillia is designed for young athletes and applies privacy by design, data minimisation and age-appropriate defaults. It does not use a child’s data for profiling-based advertising.
Under 16, the parent or guardian manages protected actions: the young user cannot independently message Coaches, book or pay.
Users aged 16–17 cannot independently book, pay or message Coaches. These protected actions are routed through the parent or guardian.
Drillia uses the recorded date of birth to apply age restrictions, parent-linked protected actions, report/block tools and a safeguarding escalation process. A submitted report generates an immediate alert to the Support inbox for review. The safeguarding process distinguishes standard, serious and critical reports and covers restrictions, evidence preservation and escalation where a child may be at risk. Reports are not a substitute for emergency services. A parent does not receive blanket access to a young person’s private communications merely because of parental status.
Age is checked from the date of birth recorded on the account when protected functionality is used. When a user reaches 18, the age-based restrictions cease and the former parent link is cleared. Permissions based only on the user’s minority do not continue over the adult account. Before independently booking, paying or initiating protected Coach messaging, the adult user must accept the then-current Terms. The current Privacy Policy is presented separately; its acknowledgement is not general consent to processing. Contact support@drillia.ai if the recorded age or account permissions are incorrect.
For young users: we use your information to run your account, help you find coaching and protect people using Drillia. Until you are 18, your parent or guardian handles bookings, payments and protected messages to Coaches. Do not share private or health information in public posts or messages. Use Report or Block if someone makes you uncomfortable, and tell a trusted adult. You can ask us about your information or request deletion at privacy@drillia.ai. When you turn 18, the old parent link ends and you accept the current Terms before using protected functions independently.
18 Photos Videos and Other People in User Content
Users may upload content only if they have the rights and permissions needed to do so.
An uploader may not be the only person whose data appears in a video or photo. Drillia may therefore process both uploader information and information relating to identifiable subjects.
Where content involves minors, appropriate parent/guardian permissions and safeguarding rules may apply.
Users appearing in content may contact Drillia to exercise privacy rights or request review/removal where applicable.
19 Artificial Intelligence
No user data is sent to an AI/LLM provider for an AI feature at launch. Azure Translator is used only for application/interface localisation; no user-generated content or personal data is intentionally submitted for translation.
If Drillia introduces AI-assisted features in the future, this Privacy Policy and relevant product notices will be updated before or when such processing is activated.
Future AI features are intended to assist and augment human decision-making, not replace it. Use of identifiable user content for model training/improvement will not be assumed to be part of the core service and will be subject to the transparency, lawful-basis and consent requirements applicable at that time.
20 Website Analytics App Storage Notifications and Marketing
The production app does not use analytics, advertising or crash-reporting SDKs. Firebase Authentication uses authentication and session tokens for sign-in and secure access. ID tokens normally last about one hour; refresh tokens remain valid until expiry, revocation or an event such as user deletion under Firebase’s lifecycle. FCM uses device tokens and installation identifiers needed for push delivery. These are functional service identifiers, not advertising or analytics tracking identifiers. Their use still involves processing device data.
You can control push-notification permissions through your device settings. Refusing notifications does not withdraw information that has already been lawfully processed. Retention and deletion are described in Sections 15–16.
The public website is built and hosted through Framer. It currently uses Framer’s built-in analytics, without Google Analytics, Meta Pixel, HubSpot or another third-party advertising/tracking integration. Framer describes its built-in measurement as using no cookies or persistent identifiers and a daily-rotating mechanism for aggregate visitor measurement. It is not used by Drillia to build advertising profiles.
We use website delivery, security and proportionate aggregate measurement to operate and improve the website. To the extent this involves personal data and the GDPR applies, we rely on our legitimate interests under Article 6(1)(f), subject to your rights in Section 22. The absence of analytics cookies does not mean that website hosting involves no personal data. Framer’s technical processing and deletion are governed by its service-specific lifecycle; Drillia’s 14-day backup period does not apply to Framer. Aggregate information that no longer identifies individuals may be kept for website-performance comparisons.
The current website configuration has no non-essential analytics or advertising cookie layer. Before introducing non-essential cookies, device storage or tracking, including Google Analytics or Meta Pixel, Drillia will provide the applicable notices and implement any required consent controls before activation.
Drillia will distinguish service/transactional communications from optional marketing communications and provide required consent/opt-out mechanisms.
21 Security
Drillia uses technical and organisational measures intended to protect personal data against unauthorised access, disclosure, alteration or loss.
Production is separate from development and staging. Production storage uses encryption at rest, private S3 storage and short-lived signed URLs. Nightly backups expire after 14 days, and a backup restore test has been completed. Sensitive content is excluded from application logs; chat push notifications omit sender names and message content.
No online service can guarantee absolute security.
22 Your Rights
Depending on applicable law, users may request access/information, correction, deletion, restriction, objection and portability; withdraw consent without affecting prior processing; and complain to a competent supervisory authority. Users may also object at any time to direct marketing and to processing based on legitimate interests on grounds relating to their situation.
Routine transaction checks and payment or reconciliation steps may be automated as described in Sections 7 and 11. You can request human review of a disputed transaction block, hold, allocation or recovery, explain your position and contest the result through support@drillia.ai or privacy@drillia.ai. Where applicable law protects you against a decision based solely on automated processing that produces legal or similarly significant effects, those rights remain available. Such a decision requires a permitted legal basis and the information and safeguards required by that law; technical automation alone does not remove these protections.
Under Swiss FADP, individuals have rights including access to information about whether and how personal data concerning them is processed.
Under the GDPR, additional rights may apply where the GDPR governs the processing.
Requests may be submitted to privacy@drillia.ai. Drillia may need to verify the requester’s identity before acting.
Account and booking information marked as required is needed to provide the requested service, establish eligibility or meet an applicable obligation. If it is missing, a feature, booking, Coach transfer or payout may be unavailable. Optional profile, marketing and media choices are identified separately. A location or eligibility check can temporarily block a transaction; you may contact support to correct inaccurate information or request human review. Stripe may also apply its own verification or account restrictions; Drillia will assist with platform-related questions and direct you to the relevant provider process where necessary.
GDPR complaints may be made to the supervisory authority in the user’s habitual residence, workplace or place of the alleged infringement. Swiss complaints may be directed to the Federal Data Protection and Information Commissioner (FDPIC). Drillia’s EU representative is not a supervisory authority.
23 EU Representatives and Regulatory Contacts
Drillia Ventures Sàrl has appointed Prighter EU Rep GmbH as its representative in the European Union under Article 27 GDPR. Postal address: Schellinggasse 3/10, 1010 Vienna, Austria.
Prighter gives you an easy way to exercise your privacy-related rights, including requests to access or erase personal data. To contact us through our representative or exercise those rights, visit https://app.prighter.com/portal/18429329258. Select “EU GDPR Rep” for the representative’s full contact details. Please quote ID-18429329258 in correspondence. You can also contact Drillia directly at privacy@drillia.ai.
Drillia Ventures Sàrl has designated Prighter DSA GmbH as its EU legal representative under Article 13 of the Digital Services Act. Prighter DSA GmbH serves as the addressee for competent authorities in the Member States and the European Union on matters relating to the DSA. Postal address: Schellinggasse 3/10, 1010 Vienna, Austria. Telephone: +43 1 997 41 24. Email: support@prighter.com. Public contact information is available by selecting “DSA Rep” at https://app.prighter.com/portal/18429329258. Please quote ID-18429329258 in correspondence.
The GDPR and DSA roles are separate. These representatives do not replace Drillia as controller or the competent supervisory authorities.
Drillia is established in Switzerland and therefore does not require a Swiss representative merely by reason of the FADP representative rule applicable to certain foreign controllers.
24 Data Breaches and Safety Incidents
Drillia maintains an incident-response process to contain, investigate, document and remediate security incidents. It notifies the FDPIC as soon as possible of a qualifying high-risk breach under the FADP and, where the GDPR applies, notifies the competent supervisory authority without undue delay and where feasible within 72 hours unless the breach is unlikely to risk individuals; affected individuals are informed where legally required.
Safeguarding incidents, including serious risks involving minors, may also require escalation, preservation of evidence and/or reporting to competent authorities where legally required.
25 Changes to This Policy
Drillia may update this Privacy Policy when the product, processors, laws or data practices change.
Material changes will be communicated in a manner appropriate to their significance and as required by applicable law.
The version and effective date appear at the beginning of this Policy.
26 Contact
Privacy enquiries and data-subject requests: privacy@drillia.ai.
General support: support@drillia.ai.
Postal contact: Drillia Ventures Sàrl, Chemin de Martavaux 16c, 1260 Nyon, Switzerland.