1. Data controller
The controller of your personal data is MT SPORTS, single-shareholder simplified joint-stock company (sasu) with a share capital of 5 000 €, with its registered office at 189 avenue Jean Jaurès, 69150 Décines-Charpieu, registered with the RCS Lyon under number 900 738 378.
For any question about your data, you can write to us at crossfitgratteciel.cfgc@gmail.com.
We have not appointed a Data Protection Officer (DPO): the box's activity does not process data on a large scale or sensitive data within the meaning of GDPR article 37.
2. What data we collect, and why
2.1 Contact form
When you fill in the form on the contact page, we collect:
- Name (so we can use your first name in our reply)
- Email (so we can reply to you)
- Phone (optional, if you'd rather we call you)
- Subject (trial, drop-in, membership, etc.)
- Message
Purpose: to answer your request (free trial, pricing info, drop-in booking, etc.).
Legal basis: performance of pre-contractual measures at your request (GDPR art. 6.1.b) or legitimate interest in replying to a prospect (art. 6.1.f).
Retention period: 3 years from the last contact (active lead), then intermediate archiving in line with accounting obligations if you become a member.
2.2 Audience measurement (if you accept)
If you accept audience-measurement cookies, we use Google Analytics 4 configured with IP anonymisation and Consent Mode v2 to understand how visitors use the site (page views, journeys, time on page). No usable individual data is shared with advertisers.
Purpose: to improve the relevance of the site and of our communication.
Legal basis: your consent (GDPR art. 6.1.a).
Duration: 13 months maximum, in line with CNIL recommendations.
As of the publication date of this page, GA4 is not enabled on the site. This section is documented ahead of time for when the tool is put in place.
2.3 Cookie consent preferences
We store your decision regarding cookies (accept / refuse / custom) in a technical file on the browser side (localStorage key cfgc-cookie-consent) for 13 months. No advertising identifier, no fingerprinting.
3. Who we share your data with
Your data is only accessible to:
- The CFGC team (Malcom, Manon, admin coaches) to answer your request.
- Our strictly necessary technical providers : OVH SAS (site hosting, data within the European Union) and, where applicable, Resend (transactional email delivery, servers in the United States, framed by the EU standard contractual clauses and the Data Privacy Framework).
- LEAD by Ma Salle De Sport (the prospect-management CRM used by the box, a French provider): the information from your form (first name, last name, email, phone, message) is sent there so the team can get back to you and follow up on your request.
We do not sell, rent or transfer your data to third parties. No marketing sharing.
4. Transfers outside the EU
If the Resend email-sending service is enabled, some data (your email, the subject of your request, the content of the message) may pass through servers located in the United States. This transfer is framed by the EU standard contractual clauses and Resend's adherence to the EU-US Data Privacy Framework.
5. Your GDPR rights
In accordance with articles 15 to 22 of the GDPR, you have the following rights:
- Access: obtain a copy of the data concerning you.
- Rectification: have inaccurate data corrected.
- Erasure: request the deletion of your data.
- Objection: object to processing based on legitimate interest.
- Restriction: temporarily restrict processing.
- Portability: retrieve your data in a structured format.
- Withdrawal of consent at any time (for processing based on your agreement, such as analytics cookies).
To exercise these rights, write to us at crossfitgratteciel.cfgc@gmail.com with a copy of an identity document (so we can verify it's really you). We reply within a maximum of 30 days.
If you feel your rights are not being respected, you can lodge a complaint with the CNIL : www.cnil.fr/fr/plaintes.
6. Cookies used
The details of each cookie are listed below. You can change your choices at any time via the « Manage my cookies » link at the bottom of every page.
Strictly necessary
Let the site work: cookie consent preference, contact form anti-spam, security. No opt-in possible (legitimate interest).
- cfgc-cookie-consent (CFGC (1st-party, localStorage)) : Remembers your consent preferences. Duration: 13 months.
Audience measurement
Helps us understand how visitors use the site (page views, time spent, journeys). Data aggregated and anonymised as far as possible.
- _ga, _ga_* (Google Analytics 4 (Google Ireland Ltd)) : Traffic statistics, browsing behaviour. Duration: 13 months max. (Not active for now)
Marketing & targeted advertising
Would let us measure the effectiveness of ad campaigns and personalise ads on other sites. No marketing service is active for now.
7. Security
The site is served over HTTPS (TLS). Form data is transmitted encrypted. The internal database (Prisma SQLite) is hosted on our application server and protected by the system's access controls. No user password is stored on the site (no member account).
8. Changes to this policy
This policy may change to reflect legal, technical or organisational changes. The date of the last update is shown at the bottom of the page. Substantial changes will be flagged via the cookie banner (fresh consent required if the purpose changes).
Last updated: 20 mai 2026. Contact: crossfitgratteciel.cfgc@gmail.com.