Privacy policy
1. Who is responsible
The controller is If Not Why Not GmbH, Rosenthaler Str. 72A, 10119 Berlin, Germany, represented by its managing director Rico Seiferth. Email: hello@joinvinga.com, phone: +49 30 55574170.
Vinga has not appointed a data protection officer. For data protection questions, write to hello@joinvinga.com.
Coaches are independent businesses. For your booking with them they also use your data as controllers in their own right, for example to run the session, contact you and keep their accounting records.
2. What we process, why, and on what legal basis
Families (account holders)
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, WhatsApp number, password (stored only as a hash), preferred language, address if given | Your account, logging in, booking confirmations and reminders | Contract (Art. 6(1)(b) GDPR) |
| Bookings, packs, payments (amount, status; card details stay with Stripe) | Running and documenting your bookings, refunds | Contract; legal retention duties (Art. 6(1)(c)) |
| Consent records (who agreed to what, when, text version) | Proof that a parent agreed to a kid's participation | Contract; legitimate interest in proof (Art. 6(1)(f)) |
| Access code used at registration | Making sure only families who received the code can register | Legitimate interest (Art. 6(1)(f)) |
Kids
| Data | Purpose | Legal basis |
|---|---|---|
| First and last name, date of birth | Booking, age limits of an activity, the coach's list | Contract with the parent |
| Allergies and health notes you choose to give | So the coach can keep the kid safe | Your explicit consent (Art. 9(2)(a) GDPR); you can change or delete it at any time |
| Whether the kid arrives and leaves alone or is picked up | Safe arrival and leaving | Contract with the parent |
| Media consent (photos yes/no) | Respecting your choice about photos | Consent (Art. 6(1)(a)) |
| A kid's own WhatsApp number, if a parent adds it | Reminders to the kid | Consent of the parent |
| Attendance | The coach's record of who came | Contract; legitimate interest |
Coaches
| Data | Purpose | Legal basis |
|---|---|---|
| Name, legal name, business registration, tax ID, email, WhatsApp number, language | Coach account, communication | Contract |
| ID document, liability insurance | Approval and safety checks before a coach can offer activities | Contract; legitimate interest in kids' safety |
| Certificado de Delitos de Naturaleza Sexual | Checking the legal requirement for work with minors (Art. 57 LO 8/2021) | Art. 6(1)(b) and (c) and Art. 10 GDPR together with Art. 57 LO 8/2021, which requires the certificate for work with minors. Stored while the coach is active on Vinga |
| Stripe account ID and status | Paying the coach directly | Contract |
| Messages to Vinga's WhatsApp number, photos sent | The Vinga assistant carries out the coach's instructions | Contract |
Website visitors
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser, time of access (server logs) | Delivering the site, security | Legitimate interest (Art. 6(1)(f)) |
| Login token and language stored in your browser (local storage) | Keeping you logged in, remembering your language | Strictly necessary; no consent needed (§ 25(2) TDDDG / Art. 22.2 LSSI) |
We use no advertising cookies and no tracking across sites. Fonts are self-hosted, so no data goes to font providers.
Usage statistics (joinvinga.com and onboarding.joinvinga.com only). To understand how these two sites are used and to improve them, we use PostHog, a product-analytics service of PostHog Inc., with data stored in the EU (PostHog Cloud EU, Frankfurt). PostHog runs in cookieless mode: no cookies are set and nothing is stored in your browser for it. Visits are counted with a privacy-preserving hash that PostHog calculates on its servers with a salt that changes daily; your IP address is not stored and no user profiles are created. We record page views, clicks on links and buttons (for example "I'm interested as …"), which explainer pages are opened, copied message templates, the steps of the "send this to someone" form (without names, addresses or notes) and page-performance measurements. Session recordings are switched off. The community sites where families log in and book use no analytics. Legal basis: legitimate interest in understanding and improving the sites (Art. 6(1)(f) GDPR); you can object at any time by writing to hello@joinvinga.com or by using a content blocker.
People who use or receive the "send this to someone" form
On onboarding.joinvinga.com and joinvinga.com, anyone can ask Vinga to send one email about Vinga to someone they know, for example the school office.
| Data | Purpose | Legal basis |
|---|---|---|
| Sender: name, email address, the role they picked, the recipient's role and language, an optional note | Confirming the sender's address with a code, sending the email in the sender's name and a copy to the sender | The sender's request (Art. 6(1)(b) GDPR) |
| Recipient: email address | Sending this one email | Legitimate interest of the sender and of Vinga in passing on information about Vinga to the person it concerns (Art. 6(1)(f) GDPR) |
| Recipient: coded form of the address (keyed hash) | Making sure an address gets at most one invitation a week, and never again after it asks to be blocked | Legitimate interest in preventing misuse (Art. 6(1)(f) GDPR) |
| IP address, as a keyed hash that changes daily; a Cloudflare Turnstile check | Preventing automated misuse of the form | Legitimate interest in preventing misuse (Art. 6(1)(f) GDPR) |
The recipient's address and the note are deleted from the database as soon as the email has been sent (at the latest after one hour if the sender doesn't confirm). Each email the form sends is kept as a copy in Vinga's mailbox. Everything else, and the copies, are deleted after 90 days; a blocked address stays blocked, as a coded form only. Every email has a link to block the address.
3. Who receives data
- The coach of an activity you booked sees what they need for the session: the kid's first name and age, health notes you gave, the arrival and leaving arrangement, attendance, and your contact details for questions about the session. Vinga and the coach are each independently responsible for the data they use.
- What the coach sends to Vinga: attendance, changes to sessions (cancellations, new dates), photos of the session (only of kids whose parents agreed), and messages about the session.
- Service providers that run Vinga for us under data-processing agreements, and Stripe and WhatsApp as independent controllers. The full list, with locations, is on the service providers page.
- Schools do not receive your data. Vinga is independent of the schools.
- Authorities, only where the law requires it.
4. Transfers outside the EU
Some providers process data in the US (see the service providers list). We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses. The basis for each provider is in the service providers list.
5. Automated messages and the AI assistant
Coaches manage their activities by WhatsApp with an AI assistant (Claude, by Anthropic). It processes the coach's messages and, for the coach's own sessions, kids' first names and attendance. It makes no decisions about families. Anything involving money is confirmed by a person or by fixed rules, not by the AI. Anthropic does not use this data to train its models.
6. How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for, and no longer than the law requires.
- Account data, kid profiles, health notes: deleted when you delete your account or the kid, or when you remove a health note. Deletion runs within 30 days.
- Bookings, consent records and payment information: kept only where the law obliges us to keep them, for the statutory periods (in Germany 6 years for business letters, 8 years for accounting vouchers and 10 years for books and annual accounts, § 147 AO and § 257 HGB), then deleted. Most payment records are the coach's, not Vinga's; Vinga's own booking records are kept under German tax and commercial law.
- Coach documents, including the certificate: kept while the coach is active on Vinga, deleted when the coach leaves.
- WhatsApp messages with coaches: kept for 6 years as business correspondence (§ 257 HGB), then deleted.
- Server logs and other messages to Vinga's WhatsApp number: deleted after 90 days.
- "Send this to someone" form: the recipient's address and the note right after sending, the rest and the email copies after 90 days; blocked addresses are kept as a coded form only, for as long as the block applies.
7. Your rights
You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. You can withdraw consent at any time, for example for health notes or photos, with effect for the future. Write to hello@joinvinga.com.
You can complain to a data protection authority, for example the Berlin authority (Berliner Beauftragte für Datenschutz und Informationsfreiheit, competent for the GmbH), or the Spanish Agencia Española de Protección de Datos where you live.
8. Minors
Accounts are held by parents or legal guardians, or by participants aged 18 and over. Parents provide and manage the data of kids under 18. Vinga never asks kids for consent; all consents are given by a parent or legal guardian.
9. Changes
We update this policy when Vinga changes. The current version and its date are always on this page.
Version: 24 October 2026