for the Website, Platform, and Digital NeuroCoaching Services
Controller: Woosah Athletics & Performance a. s.
Last updated: August 14, 2026
Effective date: August 14, 2026
Privacy contact: info@stage.woosahx.com
This Privacy Policy explains how WoosahX processes personal data when users access or use our website, platform, user accounts, questionnaires, personalized content, and related services. It also applies to an individual’s use of the platform through a club, academy, or partner arrangement.
This overview is provided for convenience only. The complete provisions below govern.
The controller for purposes of the General Data Protection Regulation (GDPR) and applicable Slovak data protection law is:
Woosah Athletics & Performance a. s.
Fialková 5703/26
903 01 Senec
Slovak Republic
Company ID (IČO): 55 973 264
Tax ID (DIČ): 2122202038
VAT ID (IČ DPH): SK2122202038
Registered with the Bratislava III Municipal Court, Section Sa, File No. 7754/B
Privacy contact: info@stage.woosahx.com
You may use this address for any privacy-related question, withdrawal of consent, or data subject request.
This Privacy Policy applies to personal data processed in connection with:
Clubs, academies, payment service providers, social networks, and other independent controllers may also provide their own privacy notices for processing they conduct independently.
“Personal data” means any information relating to an identified or identifiable individual. “Processing” includes collecting, recording, organizing, storing, analyzing, disclosing, modifying, and deleting personal data. “Pseudonymization” means processing data so that it cannot be attributed to a specific person without additional information; pseudonymized data remains personal data. “Anonymous data” cannot reasonably be linked back to an individual and is no longer subject to the GDPR.
This includes a user’s name, email address, password or authentication credentials, user ID, language, country, account and membership status, and role information, such as user, parent, legal guardian, coach, or club contact.
For registration and basic profile assignment, we process age or date of birth, sport, and position. Depending on the offering, we may also process gender, preferred language, club, team, or similar profile details when requested or provided by the user.
Users may voluntarily provide information about performance level, athletic goals, training frequency, and subjective self-assessments regarding sleep, recovery, energy level, stress, motivation, and self-confidence. We use this information to select, design, and improve personalized performance content. As a general rule, the B2C questionnaire does not include free-text fields and does not request information about injuries, illnesses, medical or psychological diagnoses, treatment, or medication.
Where supported by a particular feature, we process photos, videos, audio files, reviews, messages, feedback, and other content uploaded or provided by users. Photos, videos, and audio files may directly identify the person shown or heard. Users should not upload medical records or other highly sensitive information that we have not requested.
4.5 Usage, Progress, and Interaction Data
We process login times, activity status, frequency of use, programs viewed or completed, training progress, drop-off points, reactions, ratings, feature interactions, and technical events occurring within the platform.
When a user contacts us, we process contact details, the content and timing of communications, attachments, support history, complaints, and the account and contract information required to address the request.
This includes the selected plan, price, currency, discount, contract start date, renewals, cancellation, payment status, invoice and transaction numbers, country, tax information, refunds, and payment issues. Full card or bank account information is generally processed by the payment service provider or Merchant of Record identified during checkout and is not stored by WoosahX.
This includes IP address, device and browser type, operating system, language setting, device identifiers, timestamps, log and error data, session information, security events, approximate region derived from an IP address, and cookie and consent identifiers.
For minors and B2B2C access, we process information required about parents or legal guardians, clubs, coaches, academies, or partners, including profile assignments, permissions, invitations, status information, and, where applicable, feedback provided by a coach.
We document the privacy notices, consents, withdrawals, cookie choices, media releases, and other statements accepted or submitted by a user, including the time of acceptance and applicable version. For minors, we may also process evidence of age, authority to act, or parental authorization.
We assign each processing activity to a specific purpose and an appropriate legal basis. Registering for WoosahX or generally acknowledging this Privacy Policy does not constitute blanket consent to all processing activities.
We process account, contract, profile, questionnaire, upload, usage, and communications data as necessary to create the user account, administer the membership, deliver content, perform personalization, save progress, provide support, and manage contractual claims. The legal basis is Article 6(1)(b) GDPR. For a minor, the parent or legal guardian enters into the agreement.
We process payment and transaction data to administer the agreement under Article 6(1)(b) GDPR and to comply with tax, commercial, accounting, and consumer protection obligations under Article 6(1)(c) GDPR.
5.3 Security, Abuse Prevention, and Legal Claims
We process technical, account, communications, and security data to protect access, detect fraud, unlawful uploads, account sharing, attacks, and other abuse, investigate security incidents, and establish, exercise, or defend legal claims. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable, and commercially sustainable operation of WoosahX and the protection of users, business partners, and third-party rights.
We may analyze usage data, technical data, ratings, and feedback to identify errors, improve usability, content, and personalization, and understand platform use statistically. Where this involves personal data, the legal basis is Article 6(1)(f) GDPR. Whenever reasonably possible, we use pseudonymized, aggregated, or anonymous data. We take into account users’ overriding interests, particularly where minors or sensitive content are involved.
We rely on Article 6(1)(a) GDPR and, where special categories of personal data are involved, additionally on Article 9(2)(a) GDPR only where voluntary, informed, and unambiguous consent is required or expressly requested by us. This applies in particular to:
Consent may be withdrawn at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Processing that is necessary to perform an agreement and is not based on consent cannot be terminated merely by withdrawing consent. Statutory rights to erasure, objection, and termination remain unaffected.
We may anonymize or sufficiently aggregate data so that users can no longer reasonably be identified. We may use such anonymous data without separate consent for statistics, security, quality control, product development, research, and improvement of personalization and AI systems. We take reasonable measures to prevent re-identification.
Age or date of birth, sport, and position are required for basic profile assignment. Without this information, we may be unable to provide a user profile or basic personalization. Information about performance level, goals, training frequency, sleep, recovery, energy level, stress, motivation, and self-confidence is generally voluntary. Choosing not to provide it may limit personalization but does not automatically prevent use of the platform’s general features.
Depending on context, combination, and analysis, subjective information about sleep, stress, recovery, or similar matters may reveal health-related information. To the extent such information constitutes a special category of personal data under Article 9 GDPR, we process it only with explicit consent or under another applicable statutory exception.
If required consent is not given or is later withdrawn, the relevant health-related questions will be removed or disabled in the applicable questionnaire or user flow. Data already collected will be deleted or excluded from further processing unless another legal basis or retention obligation applies. Personalization may consequently be less precise.
WoosahX may use artificial intelligence, rules-based systems, and human editorial processes to select, assemble, design, translate, narrate, modify, or generate content. AI may also be used for technical quality control, moderation, error analysis, and improvement of production workflows.
To the extent necessary to provide a requested service, questionnaire responses, athletic goals, messages, feedback, photos, videos, audio files, and other user-provided content may be processed by AI and production service providers engaged by WoosahX. As a general rule, we do not provide AI service providers with names, email addresses, or age or date-of-birth information. Where practicable, we use a pseudonymous user or transaction identifier instead.
Photos, videos, audio files, or messages may nevertheless directly or indirectly identify an individual. We therefore do not treat those materials as anonymous, and they remain subject to this Privacy Policy.
AI processing necessary to provide personalization requested by the user is generally based on performance of the agreement under Article 6(1)(b) GDPR. If voluntary special categories of personal data are included, Article 9(2)(a) GDPR or another applicable statutory exception also applies. Technical quality assurance and system security may be based on Article 6(1)(f) GDPR.
AI and production service providers may process personal inputs and raw uploads only on our instructions and solely for the agreed purpose. Contractually, they are not permitted to use them for their own advertising or to train general-purpose models that are not dedicated exclusively to WoosahX. We limit the scope and retention of data, use pseudonymization where practicable, and implement contractual and technical safeguards.
WoosahX creates personalized performance content and recommendations but does not make decisions based solely on automated processing that produce legal effects for users or similarly significantly affect them. AI outputs may be delivered automatically and reviewed later or on a sample basis by human personnel. Users may report questionable or unsuitable results to customer support.
WoosahX may be used by individuals age 14 or older. Individuals under age 14 may not have their own user profile. For users under age 18, a parent or legal guardian enters into and pays for the membership. We may request reasonable proof of age, identity, and authority to act.
Within the functionality made available, the registered parent or legal guardian may receive broad access to a minor’s profile. This may include use, programs, training progress, athletic goals, information about motivation, self-confidence, sleep, stress, and recovery, uploaded media, personalized content, messages, and feedback. This access will be clearly disclosed when the profile is created.
After the user reaches the age of majority, the paying parent’s contractual role and an existing parental access arrangement may remain in place until a change is requested, to the extent permitted by law. The adult user may revoke or restrict parental access at any time. Mandatory privacy or personality rights may require earlier restriction, renewed confirmation, or suspension of access.
Any consent required for a minor is obtained from the user and/or the parent or legal guardian in accordance with applicable law. We give particular consideration to the heightened protection required when processing minors’ personal data.
When a user receives access to WoosahX through a club, academy, or other partner, authorized individuals may view specified information within the agreed role and permissions framework. By default, this may include activity status, frequency of use, and completed programs. Training progress and athletic goals may also be visible when this is part of the assigned program, is clearly disclosed in the user account, and is permitted under applicable data protection law.
Personal messages, uploaded media, individualized content, and information about sleep, stress, recovery, motivation, or self-confidence are not disclosed to clubs or coaches by default. Any broader disclosure occurs only when transparently described and supported by an appropriate legal basis, particularly separate consent.
WoosahX is responsible for its own operation and security of the platform. Clubs and partners may act as independent controllers regarding their selection, invitation, support, or sports-related use of data made available to them. Where WoosahX processes data solely on behalf of a club, the processing is governed by a data processing agreement under Article 28 GDPR.
We obtain personal data primarily:
When we obtain personal data from a source other than the user, we provide the information required by Article 14 GDPR unless a statutory exception applies.
We do not sell personal data. We may engage different external providers as necessary to operate, perform, secure, and develop WoosahX. These include providers of:
Depending on their function, service providers process data as processors acting on our instructions or as independent controllers. We select providers with due care, limit access to what is necessary, and enter into the agreements required by law. Providers used during checkout or another processing activity may change. The current payment service provider or Merchant of Record is identified before the transaction is completed.
We may also disclose data when required to comply with legal obligations, respond to lawful government requests, protect rights and security, or complete a lawful corporate reorganization, financing, merger, acquisition, or sale. Prospective acquirers and advisers receive data only to the extent necessary and subject to appropriate confidentiality and security safeguards.
WoosahX may use service providers located in the United States and other countries outside the European Economic Area. Those countries may provide a different level of data protection.
We transfer personal data only where the applicable legal requirements are met, including on the basis of:
Where appropriate, we assess transfer-related risks and use additional technical or organizational measures, such as encryption, access controls, and pseudonymization. Information about the safeguards used for a particular transfer, or a copy of the relevant protections, may be requested at info@stage.woosahx.com, subject to the rights of third parties and legitimate security interests.
B2C memberships are purchased through the payment service provider integrated into checkout. That provider may act as Merchant of Record and handle payment processing, invoicing, tax administration, refunds, fraud screening, and transaction-related support. The applicable provider and its privacy notice are identified during checkout.
The payment service provider may act as an independent controller for certain processing activities and may conduct checks required by law. WoosahX generally receives only the transaction and status information required for account activation, contract administration, accounting, and resolution of payment issues.
We use cookies, local storage technologies, pixels, SDKs, and similar technologies. Strictly necessary technologies support login, security, session management, storage of privacy preferences, and features expressly requested by the user. To the extent personal data is involved, processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR and the applicable laws governing access to information on a user’s device.
Non-essential technologies used for statistics, personalized analytics, or marketing are activated only after the user has provided the required consent. Consent may be changed or withdrawn at any time with future effect through “Cookie Settings” or “Manage Cookie Preferences.” Refusing non-essential cookies will not prevent basic use of WoosahX but may affect certain convenience or personalization features.
The current Cookie Policy or cookie settings module provides additional information about the categories, providers, purposes, and durations of the technologies used.
We send contract, payment, security, account, and service communications where required to perform the agreement or pursue legitimate interests. These messages are not advertising and generally cannot be opted out of while the relevant contract or security need continues.
We send newsletters and other electronic direct marketing based on consent or another legally permitted basis. Users may object to marketing or withdraw consent at any time through an unsubscribe link, account settings, or by emailing info@stage.woosahx.com. No charge applies other than ordinary transmission costs.
We use identifiable photos, videos, audio files, names, statements, or success stories on websites, social media, paid advertising, presentations, investor decks, press materials, testimonials, or internal training only under a separate, voluntary, and documented media release or another appropriate legal basis. Acceptance of the Terms of Use alone does not constitute a media release.
A media release may be withdrawn at any time with future effect. Following withdrawal, we will discontinue future use and remove previously published digital content where legally, technically, and commercially reasonable. For minors, additional requirements apply regarding parental or guardian authorization and consideration of the minor’s interests.
We retain personal data only for as long as necessary for the applicable purpose or for as long as statutory retention, documentation, or limitation periods require. The following criteria generally apply:
| Data category | Retention period or applicable criteria |
|---|---|
| Account and profile data | For the active membership period. After the agreement ends, the profile may remain inactive for up to 90 days to permit reactivation. Personal data no longer required is then generally deleted or anonymized within 30 days. |
| Questionnaire, personalization, and progress data | For the active use period and for as long as required for the agreed features. It is then deleted or anonymized according to the periods applicable to the account unless another legal basis applies. |
| Uploads | For the active membership period and for as long as required for the applicable personalization feature. The data is then deleted or anonymized. Technical backups may remain for up to 90 days until routinely overwritten. |
| Payment, invoice, and accounting data | For the statutory retention periods under applicable tax, commercial, and accounting laws. |
| Support and communications | Until the matter has been fully resolved and for a reasonable period afterward for documentation, quality assurance, and legal defense. Contract- or claim-related content may be retained until the applicable limitation period expires. |
| Security and log data | For the period required to detect, investigate, and respond to security incidents. If a specific incident occurs, data may be retained until the matter and any related proceedings are concluded. |
| Consent, withdrawal, and verification records | For as long as the relevant processing continues and afterward for as long as necessary to demonstrate lawfulness or defend against claims. |
| Cookie and tracking data | For the periods specified in the Cookie Policy or cookie settings module. |
If a user requests ordinary account deletion during a paid subscription period, access generally remains available through the end of that period in accordance with the Terms of Use. The account and data no longer required are then deleted or anonymized. Immediate deletion may be requested where a statutory right applies; this may cause the service to end immediately.
Statutory retention obligations, the establishment or defense of legal claims, fraud prevention, and necessary security records may require longer storage of certain data. In that case, the data is restricted from use for other purposes. Anonymous data may be retained indefinitely as long as re-identification remains reasonably impossible.
We implement appropriate technical and organizational measures to protect personal data against loss, alteration, unauthorized access, disclosure, and other unlawful processing. These measures may include encryption, role-based access controls, logging, data minimization, pseudonymization, backups, security monitoring, vulnerability management, and contractual obligations imposed on service providers.
No internet-based service can guarantee absolute security. Users must keep their credentials confidential, use strong passwords, and notify WoosahX promptly if they suspect misuse or unauthorized access.
Subject to the applicable statutory requirements, individuals have the following rights:
A request may be submitted by emailing info@stage.woosahx.com. We may request reasonable information to verify identity and authority to act. We generally respond within one month. Where a request is complex or numerous requests have been received, the response period may be extended as permitted by law. Statutory exceptions and third-party rights remain unaffected.
Where we process personal data under Article 6(1)(f) GDPR, an individual may object at any time on grounds relating to that individual’s particular situation. We will then stop processing the relevant data unless we demonstrate compelling legitimate grounds that override the individual’s interests, rights, and freedoms, or the processing is required to establish, exercise, or defend legal claims.
An objection to processing for direct marketing may be made at any time without stating a reason.
Individuals may lodge a complaint with a data protection supervisory authority, particularly the authority for their habitual residence, workplace, or the location of the alleged violation. The following authority is particularly relevant to WoosahX:
Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Slovak Republic
Website: www.dataprotection.gov.sk
Email for supervisory matters: statny.dozor@pdp.gov.sk
Data required for registration, contract formation, payment, security, or compliance with legal obligations must be provided. Without that data, WoosahX may be unable to offer an account, membership, or particular feature. Voluntary information is identified as such. Choosing not to provide voluntary information generally means only that certain personalization, convenience, or communications features may be unavailable or limited.
We may update this Privacy Policy when our features, processing activities, service providers, legal requirements, or technical processes change. The current version will be published on our website. Where appropriate and required by law, we will also notify users of material changes by email or within the platform, generally before the changes take effect. If a new processing activity requires consent, we will request that consent separately.
Questions about this Privacy Policy, requests for access, correction, deletion, restriction, or data portability, objections, and withdrawals of consent may be directed to:
Woosah Athletics & Performance a. s.
Fialková 5703/26
903 01 Senec
Slovak Republic
Email: info@stage.woosahx.com
