Last updated: 03.08.2026
1. Data controller
The controller responsible for data processing is Club Nautique du Luxembourg (“CNL”). For any privacy question you can reach us at:
Club Nautique du Luxembourg
Luxembourg
✉️ info@cnlwaterski.lu
2. What data we process
- Account data: name, email, username, password (hashed), language.
- Booking data: booked activities, dates, participants.
- Payment and wallet data: balance, transactions, invoices.
- Waiver acceptance and safety-relevant information where applicable.
- Technical data: IP address, session cookie, timestamps (server logs).
3. Purposes and legal bases
We process your data to perform the usage and booking contract (Art. 6(1)(b) GDPR), to meet legal obligations such as retaining invoices (Art. 6(1)(c) GDPR), and based on our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR). Where required we ask for your consent (Art. 6(1)(a) GDPR).
4. Payment processing (Stripe)
Online payments are handled by Stripe Payments Europe, Ltd. Payment data is transmitted directly to Stripe; we never store full card details. Data may be transferred to third countries (incl. the USA) based on the EU Standard Contractual Clauses.
5. Cookies
We only use technically necessary cookies, in particular a session cookie for login and language selection. There is no advertising tracking.
6. Retention period
We keep account data for the duration of your membership or account usage. Invoicing and accounting data is retained according to statutory retention periods. Afterwards data is deleted or anonymised.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw any consent at any time. You also have the right to lodge a complaint with the national supervisory authority (Commission nationale pour la protection des données, CNPD, Luxembourg).
To exercise your rights, contact us at info@cnlwaterski.lu.
Note: This text is a carefully prepared template and should be legally reviewed and completed with concrete details (e.g. postal address) before official operation.