Privacy policy

Who is responsible for the information

The service is operated by BGAN Technologies Ltd. ("the Company").

When you register for an activity, the business that runs the activity is the database owner (the controller). The Company processes the information on the business's behalf, following its instructions and an agreement between them. The business's contact details are on the activity page.

For website visitors and for business owners and their staff, the Company is the database owner.

Website visitors

On the Company's own public pages only (the home page, business signup, the help center, the accessibility statement and this policy) we use Google Analytics, a Google service, to understand how many people visit the site and where they come from. Google Analytics sets cookies in your browser and collects information such as the pages viewed, device and browser type, approximate location (country and city, from the IP address) and the site you came from.

We turned off Google Signals and ad personalization, and we do not use this information for advertising.

Google Analytics does not run on business pages, activity registration, the health declaration, the personal area or the businesses' management app. Nothing entered there reaches Google Analytics.

You can block this collection by blocking cookies in your browser or with Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Businesses and their staff

When a business opens an account, we collect the name, email and business details of the person who opened it and of invited staff. You can also sign in with a Google account; Google then shares only your name and email with us. This information is used to run the account, for sign-in, for support and for service notices.

Participants and parents: what is collected

• Contact details of the parent or payer: full name, email, mobile number and message language.
• Participant details: name, date of birth, your relationship to the participant, and any extra fields the business set for the activity.
• Health declaration: yes/no answers, details only for a "yes" answer, the signer's name, the signature and the date. Medical information is information of special sensitivity.
• Evidence of signing and of accepting the terms: time of signing, IP address, browser and device identification, and a "fingerprint" of the accepted terms text.
• Registration and payment details: the dates, the amount and the payment status. Card details are entered with the business's payment provider and are not stored in the service.
• There is no legal obligation to provide this information, but without it you cannot register for an activity that requires it.

Participants and parents: why

To register you for the activity, let the business prepare the instructor and keep participants safe, send confirmations, reminders and schedule updates, and record the signature and the acceptance of the terms. Business pages, registration and the personal area have no browsing analytics or advertising tools, and the information is never sold.

Who can see medical information

Only the business's owners and managers can open a full declaration, and every view is recorded in an access log. Instructors see only a flag that medical information exists or that a doctor's approval is needed. Company staff do not open declarations. Medical information is encrypted and is never sent by email.

Service providers and transfers abroad

• Hosting: servers in the European Union (Railway in Amsterdam, and files in Cloudflare R2 in the EU). Traffic to the site passes through Cloudflare's network.
• Email: sent through Postmark, a US company, and never includes medical information.
• Google: Google Analytics on the site's public pages only, and Google sign-in for business staff who choose it.
• Payments: the business's payment provider.
• Maps and videos: when a business adds a map (OpenStreetMap) or a video (YouTube or Vimeo) to an activity page, it loads from that service.

How long information is kept

Health declarations are kept for the period the business set on the day of signing (default: 24 months), then deleted automatically together with the signed document. Only a record that a declaration existed and was deleted remains.

Registration details are kept as long as the business and the operation of the service need them, or as the law requires. The access and activity logs contain only identifiers, times and IP addresses, and cannot be changed, for security and evidence.

Your rights

You have the right to see the information about you and to ask to correct or delete it, under the Israeli Privacy Protection Law, 1981. Participants and parents contact the business; you can also contact us and we will pass the request on to the business. You can view your declarations in the personal area at any time. You can ask to stop receiving messages that are not essential to your registration.

Security

Information is protected with encryption, separation between businesses, access logs and controls in line with the Privacy Protection (Data Security) Regulations, 2017. In a significant security incident, the business and the Company will act as the law requires, including notifying the Privacy Protection Authority and affected people where needed.

Minors

Information about minors is provided only by a parent or guardian, who signs on their behalf.

Updates

We will update this policy from time to time and show the update date at the top of the page.

Privacy questions

For any privacy question or request, write to us at [email protected].