Privacy Policy

SPONZA PRIVACY POLICY

Last updated: 31 August 2026

1. INTRODUCTION

Welcome to Sponza.

Sponza is a platform that helps people find and connect with independent coaches, trainers, instructors and other professionals in the fields of sports and wellbeing.

Users can search based on factors including:

  • sport;
  • location;
  • specialisation;
  • personal goals.

In this Privacy Policy, we explain how we collect, use, share, retain and protect personal data when you use the Sponza website, mobile applications and related services.

Together, these are referred to as the “Platform”.

We also explain your privacy rights and how you can exercise them.

This Privacy Policy informs you about our processing activities. It is not a request for general consent.

Where consent is required, we will request it separately and specifically.

 

2. WHO WE ARE

Sponza is operated by:

Wave Group B.V.
Trading as Sponza

Prins Pieter Christiaanstraat 81
3066 TB Rotterdam
The Netherlands

Chamber of Commerce number: 68602200

Email: privacy@sponza.nl

Website: www.sponza.nl

Wave Group B.V., trading as Sponza, is the data controller responsible for the processing of personal data described in this Privacy Policy.

 

3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to:

  • visitors;
  • registered Users;
  • Coaches;
  • other individuals whose personal data is processed through the Platform.

This Privacy Policy applies, among other things, to:

  • the Sponza website;
  • the Sponza applications for iOS and Android;
  • account dashboards;
  • Coach profiles;
  • search and matching functionality;
  • contact requests;
  • messages;
  • reviews;
  • subscriptions;
  • customer support;
  • related communications.

Independent Coaches may process personal data for their own purposes after you contact them or share information with them.

Where a Coach independently determines how and why personal data is processed outside Sponza, that Coach may act as a separate data controller.

In such cases, the Coach is responsible for providing you with information about that processing.

 

4. PERSONAL DATA WE COLLECT

4.1 Information you provide directly to us

We may collect personal data including:

  • name;
  • email address;
  • telephone number;
  • password in secured form;
  • profile picture;
  • preferred language;
  • city, postcode and selected location;
  • search radius;
  • sport and coaching preferences;
  • personal goals;
  • preferred training format;
  • experience level;
  • Coach preferences;
  • contact requests and messages;
  • support requests and correspondence;
  • reviews and ratings;
  • reports and complaints;
  • marketing and notification preferences.

 

4.2 Information in Coach profiles

When you create or manage a Coach profile, we may process information including:

  • biography and professional summary;
  • coaching philosophy;
  • sports and areas of expertise;
  • specialisations;
  • target groups;
  • training formats;
  • service areas and training locations;
  • availability;
  • qualifications and certificates;
  • diplomas;
  • work experience;
  • verification information;
  • company name;
  • website;
  • social media links;
  • prices and service information;
  • profile photos;
  • videos and other media;
  • reviews and ratings;
  • profile performance information;
  • response time and activity information;
  • Basic or Premium subscription status.

 

4.3 Subscription and payment information

When you purchase a Premium subscription or another paid service, we may process information including:

  • subscription status;
  • billing and contact details;
  • transaction references;
  • invoice information;
  • payment status;
  • renewal information;
  • cancellations;
  • refunds.

Web payments are processed through Stripe.

Payments made through the Sponza mobile applications may, where applicable, also be processed through:

  • the Apple App Store;
  • Google Play.

Sponza does not store full payment card details.

Payment service providers process payment information under their own privacy policies.

 

4.4 Platform, device and usage information

We may automatically collect information including:

  • IP address;
  • device type;
  • operating system;
  • browser type and browser version;
  • application version;
  • language settings;
  • login information;
  • security logs;
  • crash and diagnostic information;
  • fraud prevention signals;
  • pages and Coach profiles viewed;
  • searches performed;
  • filters used;
  • saved favourites;
  • links clicked;
  • dates and times of interactions;
  • cookie identifiers;
  • analytics identifiers;
  • advertising identifiers, where permitted;
  • push notification tokens;
  • interactions with notifications.

 

4.5 Information from connected services

If you choose to log in through or connect to an external service such as Apple or Google, we may receive information that you have authorised that provider to make available to us.

This may include:

  • name;
  • email address;
  • profile picture;
  • account identifier.

The privacy policy of the external provider also applies to the processing performed by that provider.

 

5. INFORMATION FROM PUBLIC SOURCES

Sponza may identify potential Coaches through publicly available professional sources such as:

  • a Coach’s business website;
  • a public professional business directory;
  • a public business page;
  • a public social media page;
  • other lawfully accessible public sources.

We may collect limited professional information including:

  • name;
  • company name;
  • sport;
  • specialisation;
  • city or region;
  • publicly available business contact details;
  • website;
  • public social media links;
  • source URL.

We may use this information to:

  • assess whether a Coach may be relevant to Sponza;
  • prevent duplicate registrations;
  • contact Coaches about the Platform;
  • prepare a limited profile preview for review or claiming.

Information obtained from public professional sources is initially stored in a non-public lead record.

A Coach profile will only become publicly visible after the Coach has:

  • claimed the profile;
  • reviewed the information;
  • activated the profile;

unless another lawful and transparent process applies.

Where we obtain personal data from a source other than the individual concerned, we provide the information required by applicable law.

This includes information about:

  • the source;
  • the purpose of the processing.

A Coach may request correction or deletion of this information, or object to the processing, by contacting:

privacy@sponza.nl

 

6. HEALTH DATA AND OTHER SENSITIVE INFORMATION

Certain coaching goals, preferences or messages may reveal information about a person’s health.

This may include information relating to:

  • injuries;
  • limitations;
  • medical conditions;
  • rehabilitation;
  • physical impairments;
  • weight management goals.

Health data is considered a special category of personal data under European data protection law.

Sponza does not ask Users to provide unnecessary medical information.

Where Sponza knowingly processes health data, we will identify an appropriate legal basis and a valid exception for processing special category data.

Where required, we will obtain explicit consent.

Users should not include confidential medical information in:

  • public profile fields;
  • reviews;
  • other publicly available Content.

Sponza is not a healthcare provider.

The Platform is not intended for:

  • storing medical records;
  • medical diagnosis;
  • medical treatment;
  • providing medical advice.

 

7. HOW AND WHY WE USE PERSONAL DATA

We may use personal data to:

  • create and manage User and Coach accounts;
  • publish and manage Coach profiles;
  • provide search, filtering and matching functionality;
  • recommend relevant Coaches;
  • enable communication between Users and Coaches;
  • manage Premium subscriptions;
  • process payments and refunds;
  • provide customer support;
  • verify accounts and professional information;
  • prevent fraud, spam, misuse and security incidents;
  • enforce our Terms of Service and other policies;
  • manage reviews and complaints;
  • improve the Platform and its performance;
  • analyse how the Platform is used;
  • personalise content and recommendations;
  • send service communications;
  • send marketing communications where permitted;
  • comply with legal and financial obligations;
  • establish, exercise or defend legal claims.

 

8. LEGAL BASES FOR PROCESSING

Depending on the purpose, we process personal data on one or more of the following legal bases.

8.1 Performance of a contract

We process personal data where this is necessary to:

  • create and manage your account;
  • provide Platform functionality;
  • publish Coach profiles;
  • enable communication between Users and Coaches;
  • manage Premium subscriptions.

 

8.2 Legal obligations

We process personal data where necessary to comply with obligations relating to, among other things:

  • law;
  • taxation;
  • accounting;
  • regulatory requirements;
  • law enforcement obligations.

 

8.3 Legitimate interests

We may process personal data where necessary for our legitimate interests.

These may include:

  • improving the Platform;
  • protecting accounts;
  • securing the Platform;
  • preventing fraud and misuse;
  • providing customer support;
  • measuring Platform performance;
  • promoting and developing our services;
  • establishing or defending legal claims.

We rely on legitimate interests only where our interests are not overridden by your rights, freedoms and interests.

 

8.4 Consent

Where appropriate, we rely on consent.

This may apply, for example, to certain:

  • marketing communications;
  • cookies and analytics technologies;
  • location permissions;
  • device permissions;
  • health data;
  • personalisation features.

You can withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

 

9. PUBLIC COACH PROFILES AND SEARCH ENGINES

Coach profiles are intended to help Users find and assess Coaches.

Depending on the Coach’s settings and the way the Platform is configured, profile information may:

  • be visible without an account;
  • appear on sport pages;
  • appear on goal pages;
  • appear on location pages;
  • be shared through public links;
  • be indexed by search engines such as Google;
  • appear in external search results.

Public profile information may remain visible for some time in cached search results after it has been changed or removed.

Sponza does not control copies made by third parties before removal.

Where appropriate, we will take reasonable steps within our control to help update or remove such information.

Coaches may only upload Content for which they have the necessary permission or rights.

Coaches should not publish sensitive personal data in public profile fields.

 

10. COMMUNICATION BETWEEN USERS AND COACHES

When a User contacts a Coach, Sponza may share information that is necessary to enable that contact.

This may include:

  • the User’s name;
  • profile information;
  • the contact request;
  • the message;
  • selected contact details;
  • relevant coaching preferences.

The Coach receiving the information may use it to respond to the request.

Messages and contact requests may be stored or processed for:

  • Platform security;
  • fraud prevention;
  • misuse prevention;
  • customer support;
  • enforcement of our Platform rules;
  • investigation of reports and complaints.

Access to messages is restricted to authorised persons where this is reasonably necessary.

Messages are not used for advertising purposes unless a separate valid legal basis exists.

 

11. REVIEWS, RATINGS AND USER CONTENT

Users may submit reviews, ratings and other Content.

Reviews may be displayed publicly together with information such as:

  • first name;
  • profile picture;
  • date of the review;
  • rating;
  • written review.

Users must not include in public Content:

  • personal information relating to others without a valid reason;
  • sensitive information;
  • misleading information;
  • unlawful information.

We may review, restrict or remove Content in order to:

  • enforce our Terms of Service;
  • protect Users and Coaches;
  • prevent fraud and misuse;
  • comply with legal obligations;
  • respond to reports and complaints.

 

12. AI MATCHING, RECOMMENDATIONS AND PROFILING

Sponza may use automated systems and artificial intelligence to:

  • rank search results;
  • recommend Coaches;
  • identify relevant sports or specialisations;
  • personalise Platform content;
  • improve match quality;
  • improve the User experience.

These systems may analyse information including:

  • selected goals;
  • location;
  • sport preferences;
  • Coach preferences;
  • information from Coach profiles;
  • interactions with the Platform;
  • search behaviour;
  • viewing behaviour.

Sponza’s recommendations are intended to support your own decision-making.

They do not determine which Coach you must select.

Users remain free to:

  • view other Coaches;
  • compare other Coaches;
  • contact other Coaches.

Unless expressly stated otherwise, Sponza does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.

Where required:

  • we provide information about the use of automated systems;
  • we allow Users to object to personalisation where applicable;
  • we provide appropriate options to restrict or disable personalisation.

Personal data is not used to train external AI models unless this is legally permitted and transparently communicated.

 

13. PREMIUM SUBSCRIPTIONS AND PAYMENTS

Sponza processes personal data in order to:

  • create and manage Premium subscriptions;
  • confirm payments;
  • issue invoices;
  • process renewals;
  • process cancellations;
  • process refunds;
  • prevent payment fraud;
  • comply with financial retention obligations.

Web payments are processed through Stripe.

Payments through the Sponza mobile applications may, where applicable, also be processed through:

  • the Apple App Store;
  • Google Play.

These payment service providers process payment information in accordance with their own privacy policies.

Depending on the nature of the relationship, they may act as:

  • independent data controllers;
  • processors.

Sponza receives limited payment and transaction data necessary to manage subscriptions.

 

14. MARKETING AND SERVICE COMMUNICATIONS

14.1 Service communications

We may send service communications that are necessary for the operation of the Platform.

These may include:

  • account verification;
  • security alerts;
  • contact notifications;
  • subscription confirmations;
  • payment notifications;
  • changes to our services;
  • changes to policies.

These communications are not marketing messages.

 

14.2 Marketing communications

Where permitted by law, we may send marketing communications including:

  • newsletters;
  • Platform updates;
  • offers;
  • invitations;
  • Content relating to professional development for Coaches;
  • promotional communications.

Marketing communications may be managed through Brevo.

You can unsubscribe from marketing at any time by:

  • using the unsubscribe link in the communication;
  • changing your communication preferences;
  • contacting privacy@sponza.nl.

Unsubscribing from marketing does not affect necessary service communications.

 

15. COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES

Sponza uses cookies and similar technologies to:

  • operate the Platform;
  • remember User preferences;
  • protect accounts;
  • maintain security;
  • measure Platform performance;
  • understand how the Platform is used;
  • support marketing and advertising where permitted.

Non-essential analytics and marketing technologies are only used where a valid legal basis exists.

Where required, we ask for consent.

You can manage or withdraw your cookie preferences through the cookie settings.

Further information about:

  • specific cookies;
  • providers;
  • purposes;
  • retention periods;

is available in our separate Cookie Policy.

 

16. APP PERMISSIONS

The Sponza mobile applications may request access to:

  • notifications;
  • camera;
  • photo library;
  • location;
  • other device functionality necessary for a specific feature.

We request this access only where necessary for a Platform feature and in accordance with your device settings.

You can change these permissions through your device settings.

Disabling a permission may cause the relevant feature to stop working or to work only partially.

 

17. WHEN WE SHARE PERSONAL DATA

We do not sell or rent personal data.

We may share personal data with parties such as:

  • Users and Coaches;
  • Amazon Web Services;
  • other hosting or cloud infrastructure providers;
  • Stripe;
  • other payment or subscription providers;
  • Brevo;
  • other email or CRM providers;
  • Firebase;
  • other mobile infrastructure or notification providers;
  • Apple;
  • Google;
  • customer support system providers;
  • security and fraud prevention providers;
  • analytics providers;
  • advertising providers, with consent where required;
  • AI service providers, where applicable;
  • professional advisers;
  • accountants;
  • auditors;
  • insurers;
  • courts;
  • regulators;
  • law enforcement authorities;
  • potential buyers, investors or transaction partners under appropriate confidentiality arrangements.

We only share personal data where this is necessary and lawful.

 

18. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Sponza aims to process personal data within the European Economic Area where reasonably possible.

Some service providers may process information in countries outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we use an appropriate lawful transfer mechanism where required.

This may include:

  • an adequacy decision of the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • supplementary technical and organisational safeguards.

You can request further information about safeguards relating to international transfers by contacting:

privacy@sponza.nl

 

19. RETENTION PERIODS

We do not keep personal data for longer than necessary for the purposes described in this Privacy Policy.

19.1 Account and profile data

Account and profile data is retained for as long as the account remains active.

After deletion of an account, this data is normally deleted or anonymised within 30 days unless:

  • we are legally required to retain certain information for longer;
  • another valid legal basis permits us to retain certain information for longer.

 

19.2 Public Coach profiles

Public Coach profiles are retained until:

  • the profile is deleted;
  • the profile is deactivated;
  • the account is closed.

Search engine caches may take longer to update.

 

19.3 Messages and contact requests

Messages and contact requests are generally retained for up to 24 months after the most recent communication.

A longer period may apply where necessary to:

  • investigate misuse;
  • resolve a dispute;
  • comply with a legal obligation.

 

19.4 Financial and administrative data

Financial data, invoices and accounting records are generally retained for seven years after the end of the relevant financial year, or longer where required by law.

 

19.5 Customer support data

Customer support data is generally retained for 24 months after the request has been resolved.

A longer period may apply where the information is necessary for:

  • an ongoing complaint;
  • a legal claim;
  • a security investigation.

 

19.6 Technical logs

Regular technical logs are generally retained for a maximum of 90 days.

 

19.7 Security and audit logs

Security and audit logs are generally retained for a maximum of 12 months.

Relevant data may be retained for longer where necessary to:

  • investigate an incident;
  • prevent fraud;
  • establish a legal claim;
  • exercise a legal claim;
  • defend a legal claim.

 

19.8 Marketing preferences

Marketing preferences are retained until consent is withdrawn.

We may retain limited information about an unsubscribe request to ensure that the request continues to be respected.

 

19.9 Backups

Deleted personal data may remain in encrypted rotating backups for up to 90 days before being permanently overwritten.

An exception may apply where information must be retained for legal or security reasons.

 

20. SECURITY

We implement appropriate technical and organisational measures to protect personal data against:

  • unauthorised access;
  • accidental loss;
  • misuse;
  • alteration;
  • unlawful disclosure.

These measures may include:

  • access controls;
  • encryption in transit;
  • secure development practices;
  • logging and monitoring;
  • backups;
  • supplier reviews;
  • security incident procedures.

No system can guarantee absolute security.

Users are responsible for keeping their login credentials confidential.

Users should notify Sponza immediately if they suspect that someone has gained unauthorised access to their account.

 

21. CHILDREN AND MINORS

Persons under the age of 16 may not independently create or use a Sponza account.

A parent or legal guardian may use Sponza to find and contact a Coach for a minor.

Where Coaches provide services to minors, appropriate requirements may apply in relation to:

  • parental involvement;
  • communication;
  • safeguarding and safety;
  • reviews;
  • sharing information with a Coach.

We do not knowingly collect personal data from children in breach of applicable law.

 

22. YOUR PRIVACY RIGHTS

Depending on applicable law, you may have the right to:

  • access your personal data;
  • receive a copy of your personal data;
  • correct inaccurate or incomplete personal data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • object at any time to direct marketing;
  • request portability of your personal data;
  • withdraw consent at any time;
  • receive information about automated decision-making and profiling;
  • lodge a complaint with a supervisory authority.

To exercise your rights, contact:

privacy@sponza.nl

We may request information reasonably necessary to verify your identity.

We normally respond within one month, as required by applicable law.

This period may be extended in legally permitted circumstances where requests are complex or numerous.

 

23. COMPLAINTS TO THE DUTCH DATA PROTECTION AUTHORITY

You have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Dutch Data Protection Authority

Website: autoriteitpersoonsgegevens.nl

You may also contact us first at:

privacy@sponza.nl

so that we can try to resolve your question or complaint.

 

24. ACCOUNT AND PROFILE DELETION

You can request deletion of your account through:

Following a valid deletion request, personal data associated with your account is normally deleted or anonymised within 30 days.

We may retain limited information for longer where necessary for:

  • legal retention obligations;
  • fraud prevention;
  • security;
  • dispute resolution;
  • valid reviews;
  • establishing or defending legal claims;
  • encrypted rotating backups for up to 90 days.

Where a public Coach profile has been indexed by a search engine, deletion from Sponza may not immediately remove:

  • cached results;
  • copied results;
  • other information controlled by the search engine or another third party.

 

25. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to:

  • Coach websites;
  • social media pages;
  • payment services;
  • other websites;
  • other third-party services.

These parties process personal data in accordance with their own privacy policies.

Sponza is not responsible for the independent privacy practices of third parties.

 

26. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy due to changes in:

  • the Platform;
  • technology;
  • service providers;
  • our business activities;
  • applicable laws and regulations.

We will publish the updated version with a revised date.

Where a change materially affects your rights or where renewed consent is required, we will:

  • provide additional information;
  • request consent again where necessary.

 

27. CONTACT

For questions, requests or complaints relating to privacy, please contact:

Wave Group B.V.
Trading as Sponza

Prins Pieter Christiaanstraat 81
3066 TB Rotterdam
The Netherlands

Chamber of Commerce number: 68602200

Email: privacy@sponza.nl

Website: www.sponza.nl

 

© 2026 Sponza / Wave Group B.V. All rights reserved.