PRIVACY
POLICY.

1. Introduction

iCORPOD (“iCORPOD”, “we”, “us” or “our”) provides a sports technology platform combining connected sensors, a mobile application, cloud services and related features to record, analyse and share badminton training and performance information. We take the protection of personal data seriously. This Privacy Policy explains what data we collect, why we process it, how we use and protect it, when we may share it, how long we retain it and what rights users have. This Privacy Policy applies to the iCORPOD mobile application, iCORPOD sensors, our websites, cloud services, Basic, Pro, Elite and Teams subscriptions, Community features, support services and any other service referring to this Privacy Policy (collectively, the “Services”). Full legal information concerning the operator of iCORPOD is available in our Legal Notice.

When iCORPOD is used on behalf of a club, federation, team, university, research organisation or other professional entity, that entity may act as controller for its own processing activities and iCORPOD may act as processor in accordance with its documented instructions.

2. Data protection principles

We process personal data in accordance with applicable data-protection law, including the General Data Protection Regulation (“GDPR”) and applicable French data-protection legislation. We apply the principles of:

• lawfulness, fairness and transparency;

• purpose limitation;

• data minimisation;

• accuracy;

• storage limitation;

• integrity and confidentiality;

• privacy by design and by default;

• accountability.

Where local law provides additional protections, those protections will also apply.

3. Personal data we collect

The personal data processed depends on the features used.

3.1 Mandatory account and profile information

To create and use an account, we may collect:

• email address;

• first name;

• last name;

• username;

• date of birth;

• gender.

Users may choose Prefer not to say in relation to gender. Date of birth is also used to determine whether age-related measures or parental authorisation are required. The information identified as mandatory is necessary to create and maintain an iCORPOD account and provide the associated Services. If a user does not provide the required information, iCORPOD may be unable to create or maintain the account or provide the relevant functionality.

3.2 Optional profile information

Users may voluntarily provide:

• nationality;

• height;

• weight;

• handedness;

• competitive level;

• preferred badminton disciplines;

• BWF ranking, where applicable;

• profile photograph.

These data may subsequently be modified. Optional profile information is not required to create an account or use the basic functionality of the Service. Depending on their nature and context, certain performance or physiological data may constitute health-related information and receive additional protection.

3.3 Profile photographs

Profile photographs may be stored through an external provider and made available to iCORPOD through a link or technical reference. iCORPOD does not use profile photographs for facial recognition, biometric identification or biometric analysis.

3.4 Training and performance information

When a session is recorded, we process sports and performance information such as training scores, workload, duration, effective playing time, number and characteristics of rallies, rally duration and recovery periods, intensity indicators, timestamps, overall session intensity, processed files, calculated metrics and other derived indicators. This description is expressed by category. iCORPOD may develop new metrics without those metrics necessarily constituting new categories of personal data. Raw accelerometer data is not retained in our cloud once the session has been processed. The cloud stores processed session information and the metrics necessary to provide the Services.

3.5 Heart-rate and physiological data

Heart-rate functionality is optional. We do not collect this information merely because a user has an account. When the user activates the functionality, we may collect and store:

• RR intervals;

• heart-rate information;

• derived indicators;

• calculated physiological metrics;

• physiological information associated with the session.

These data may constitute data concerning health or other special categories of personal data. For direct consumer use, we request explicit consent before activating the functionality for the first time. The formulas, algorithms and technical details used to calculate iCORPOD metrics are proprietary information and do not form part of the personal-data information required by this Privacy Policy.

3.6 Sensor and device information

Each iCORPOD sensor is associated with an account through a unique identifier. We may process technical information necessary to operate, maintain, diagnose and improve the product, including identifiers, firmware, hardware, technical status, battery information, connection and synchronisation data, diagnostics, errors and other parameters necessary for operation, support, security or product improvement. Sensors are generally associated with an account and may not always be freely unlinked. During normal use, data flows within the iCORPOD ecosystem. Training data is not sent to Movesense or Suunto cloud services merely because the sensor uses technology based on Movesense.

3.7 Technical, diagnostic and security data

We may collect:

• IP address;

• date and time of login;

• device information;

• operating system;

• application version;

• authentication events;

• failed login attempts;

• sensor connections and disconnections;

• synchronisation events;

• processing or download errors;

• application crashes;

• diagnostic logs;

• security and administrative events;

• other information necessary to detect problems, prevent misuse and maintain the Services.

3.8 Community and social information

When Community is available, we may process followers and following relationships, follow requests, likes, comments, posts, mentions, shared sessions, rankings, leaderboards and other interactions voluntarily created by users. Users must ensure that any information they publish concerning third parties, including photographs and personal information, is shared lawfully and with any required authorisation. iCORPOD may remove or restrict content where necessary to protect users, comply with law, enforce platform rules or protect the rights and privacy of others.

3.9 Organisations and professional accounts

For Teams subscriptions and professional customers, we may process:

• organisation name and country;

• professional contact details;

• contact persons;

• professional email addresses and telephone numbers;

• billing information;

• contractual or subscription information;

• users associated with the organisation;

• roles and permissions;

• administrative information necessary to manage the relationship.

3.10 Support information

When a user contacts iCORPOD by email, form, ticket or telephone, we process the information necessary to investigate and resolve the request. This may include contact information, the contents of the request, screenshots, logs, session information, files voluntarily provided by the user, technical information and internal support notes. Support calls are not routinely recorded.

3.11 Billing information

We process and retain only the information necessary to manage payments, issue invoices and comply with accounting, tax and legal obligations. If additional payment providers or app-store payment systems are introduced, their own privacy policies and payment terms may also apply.

4. Authentication

Users may authenticate using:

• email and password;

• Google Sign-In;

• Sign in with Apple.

Accounts created with email and password use email verification. Passwords are protected using secure cryptographic hashing and are never stored in plain text. For Google or Apple authentication, we request only the information necessary to register and authenticate the account, currently:

• email address;

• first name;

• last name.

Users may subsequently modify their first and last name within iCORPOD. Google and Apple process authentication information in accordance with their own privacy policies.

5. Purposes and legal bases

We process personal data only where an appropriate legal basis exists.

Providing the Services

We process account, profile, sensor, training, performance and technical data to create and manage accounts and provide the Services requested by users. Legal basis: performance of a contract.

Operation and security

We process security, diagnostic, authentication and certain technical data to maintain iCORPOD, detect errors, protect accounts, prevent misuse and ensure service reliability. Legal basis: our legitimate interests in operating and protecting the Services and, where applicable, performance of the contract.

Heart-rate and physiological data

Where these data constitute special-category personal data, we rely on an applicable condition under Article 9 GDPR, including explicit consent where appropriate. For direct consumer use, explicit consent is obtained before activating the functionality.

Community and publication

We process Community information to provide the social, interaction and sharing features requested by users. Users control whether their profile is public or private, subject to age-related or organisational protections. Where publication may include health-related or otherwise sensitive information, we may require additional confirmation to ensure that the intention to make such information public is clear.

Support

We process support information to provide assistance, investigate problems and protect the integrity of the Services. Legal basis: performance of the contract and/or our legitimate interests in providing support and maintaining the product.

Billing and legal obligations

We process billing information, invoices and related records to comply with contractual, accounting, tax and legal obligations. Legal basis: performance of a contract and compliance with legal obligations.

Operation and technical improvement

We may use technical and diagnostic data to maintain, test, troubleshoot and improve the reliability, security and performance of iCORPOD. Legal basis: our legitimate interests, subject to the rights and interests of users.

Research, validation and product development

Information that has been irreversibly anonymised and can no longer reasonably be linked to an identifiable individual may be used for research, statistical analysis, scientific validation, benchmarking, algorithm development, product improvement and commercial analysis. Where personal data that does not constitute special-category data is used for compatible research, validation or product-improvement purposes, iCORPOD may rely on its legitimate interests, provided the processing is proportionate, compatible with users’ reasonable expectations and does not override their rights and freedoms. Identifiable or pseudonymised health-related or other special-category personal data will not be reused for a separate research or product-development purpose unless an appropriate Article 9 GDPR condition applies and any additional consent or other legal requirement has been satisfied.

Marketing

We send commercial communications where the user has provided the required consent or where another valid legal basis exists. Marketing consent is separate from account creation and is not required to use iCORPOD.

6. Heart-rate consent and withdrawal

Heart-rate recording is optional. When activated for the first time, we request explicit consent to process RR intervals and related physiological information. If the user withdraws consent:

• we stop collecting new heart-rate and physiological data;

• we disable the functionality;

• we delete stored RR intervals and physiological metrics from active systems unless another legal basis requires or permits their continued retention;

• non-physiological parts of sessions may remain available;

• we may retain evidence of the consent and its withdrawal where necessary to demonstrate legal compliance.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. The user may later reactivate the functionality, in which case we will request explicit consent again and collect new data from that point onward.

Deleted physiological data cannot be recovered.

7. Public and private profiles

iCORPOD provides controls for managing the visibility of profiles and sessions. A discoverable profile may display limited information such as username and profile photograph. Public profiles may be followed without prior approval, while private profiles require approval.

When a user activates a public profile, new sessions may be visible to other users according to the applicable product settings. When changing from public to private, sessions and information subject to that setting cease to be available to other users. Changing from private to public does not automatically make previously private historical sessions public, unless the user separately chooses or confirms that action. We may further restrict visibility where necessary to protect children, comply with law or protect sensitive information.

8. Public sessions and physiological information

A public session may include performance metrics and, where heart-rate functionality has been enabled, physiological or heart-rate-derived indicators. We will inform users when information is being made public. Raw RR intervals are not made public merely because a session is shared. Where required by law, we will obtain any additional confirmation necessary before making sensitive or health-related information public.

9. Teams subscriptions and organisation access

iCORPOD may offer subscriptions sponsored or managed by clubs, federations, teams, universities and other organisations. Users first create a standard account. iCORPOD administrators may subsequently associate the account with an organisation. Future versions may also allow users to join through invitation links, codes or similar mechanisms.

Authorised members

The organisation determines which authorised members may access athlete information. These may include coaches, strength and conditioning staff, performance staff, physiotherapists, medical personnel, technical staff, researchers, players and other persons authorised by the organisation. This list is illustrative and not exhaustive.

Organisation access and legal responsibility

Where an organisation determines the purposes for which athlete information is accessed or used, that organisation is responsible for identifying and maintaining an appropriate legal basis for its processing and for complying with its own data-protection obligations. iCORPOD may provide the technical mechanisms required to associate an account with an organisation and enable or disable access. The user will be informed when organisational access is enabled and may be provided with controls allowing that access to be withdrawn where applicable. Access by an organisation to heart-rate, physiological or other special-category personal data will only be enabled where an appropriate legal condition for processing such data exists. Where iCORPOD acts as a processor on behalf of an organisation, we process the relevant information in accordance with the organisation’s documented instructions and the applicable data-processing agreement.

Limits of organisational permissions

Authorised organisation members may view and, where enabled, export relevant information. They do not automatically obtain the right to:

• delete sessions;

• edit the user’s profile;

• modify privacy settings;

• manage the user’s sensor;

• delete the user’s account.

These actions remain under the user’s control unless a separate lawful administrative procedure applies.

Leaving an organisation

When a user leaves an organisation or the organisation’s access ends, the organisation loses access to the user’s data through iCORPOD. The user retains the account and historical sessions and may continue under another subscription or join another organisation. If the organisation previously exported a PDF, CSV or other copy lawfully, that copy remains under the organisation’s control and responsibility for data-protection purposes.

10. Universities and third-party research

iCORPOD may be used in academic, scientific, sports or other research projects organised by third parties. Where a university, research organisation, federation, club or other customer determines the purposes and means of the project, that organisation is responsible for establishing the appropriate legal basis, obtaining any required ethical or regulatory approvals, informing participants and complying with applicable law. In such cases, iCORPOD may act as processor in accordance with the organisation’s documented instructions. Projects may involve identifiable or pseudonymised participants where permitted by the applicable legal and ethical framework. Research conducted by customers is separate from iCORPOD’s internal research and product-development activities.

11. Research, statistics and product development

We may use information to:

• scientifically validate the product;

• improve algorithms;

• develop new metrics;

• improve sensors and applications;

• study badminton performance;

• create statistical models and benchmarks;

• produce aggregated statistics;

• support scientific publications;

• prepare reports and presentations;

• develop products and services.

Where possible and appropriate, we use aggregated and irreversibly anonymised data. We may retain and use information that has been genuinely anonymised so that an individual can no longer reasonably be identified. Anonymised information may be used for scientific, statistical, technical or commercial purposes and is no longer personal data under the GDPR where the anonymisation is effectively irreversible. Pseudonymised information remains personal data. Where identifiable or pseudonymised personal data is used for research or product-development purposes, the processing will be based on an appropriate legal basis as described in Section 5. Where identifiable or pseudonymised health-related or other special-category data is involved, an applicable Article 9 GDPR condition must also exist.

12. We do not sell personal data

iCORPOD does not sell users’ personal data to third parties.

In particular, we do not sell physiological or health-related information. This does not prevent us from using service providers acting on our behalf, sharing data at the user’s express request, enabling authorised organisation access, participating in lawful research, using aggregated and anonymised information, producing anonymous statistics, reports and benchmarks, or displaying advertising within the Services.

13. Advertising

In the future, iCORPOD may display advertising from brands or commercial partners within the Services. Initially, advertising may be contextual, for example relating to badminton, equipment, competitions or sports products. If we introduce personalised advertising or tracking requiring consent or additional privacy choices, those mechanisms will be implemented before the relevant processing begins. We will not use RR intervals, heart-rate information or other special categories of health data to target advertising. Where applicable law restricts personalised advertising to children, we will apply those restrictions.

14. Marketing communications

Users may choose to receive news, product information, offers and other commercial communications. Marketing consent is optional, separate from acceptance of the Terms of Service and acknowledgement of this Privacy Policy, is not required to create an account and is disabled by default in the application. Website visitors may subscribe through dedicated forms. Information provided to our marketing provider may include the user’s email address and name, where provided. We currently expect to use Instantly. We do not provide Instantly with training, sensor or physiological data for ordinary marketing campaigns.

Email tracking

Where the user has provided the required consent, commercial emails may use technologies to measure opens, clicks and other interactions. This information may be used to evaluate and improve communications. We do not use commercial tracking merely because we send essential transactional messages such as account verification or password-reset emails. Users may withdraw consent or unsubscribe at any time.

15. Cookies and tracking technologies

Our website may use strictly necessary cookies, analytics, campaign measurement, advertising pixels, advertising and conversion technologies, forms and similar technologies. Strictly necessary technologies may operate without optional consent where permitted by law. Non-essential technologies will only be activated when the applicable legal requirements have been satisfied, including consent where required. Users may manage their preferences through the cookie or consent interface available on the website.

16. Application analytics, diagnostics and error reporting

We may use analytics, diagnostics and error-reporting systems to assess application operation and improve reliability, performance and security. Data may include application version, operating system, device type, technical events, feature-use information, crashes, performance information and diagnostic identifiers. Where processing constitutes strictly necessary operational measurement and may lawfully be carried out without consent, we may rely on another appropriate legal basis such as legitimate interests. Where consent is required, we will obtain it before using the relevant technology. This provision does not authorise unrestricted cross-application advertising tracking or unrelated third-party profiling.

17. Mobile-device permissions

Depending on the operating system and features used, the application may request permissions relating to:

• Bluetooth, which is necessary to connect to and operate the iCORPOD sensor;

• notifications;

• camera and photographs for profile or content functionality;

• files or storage, including PDF and CSV exports.

If a user does not grant a permission required for a particular feature, that feature may not function or may be unavailable. Permissions that are not necessary for the user’s chosen functionality remain optional where technically possible. A permission requested by Android, iOS or another operating system is a technical platform permission and does not by itself constitute consent to an unrelated processing activity under the GDPR. We do not currently intend to collect GPS location information as part of the ordinary operation of the Service.

18. Notifications

We may send notifications concerning account activity, session processing, service information, Community activity, followed users, organisations or Teams, pending actions and other relevant events. Push notifications may be provided through an appropriate external provider. Users may control optional notification permissions through their device and, where available, iCORPOD settings.

19. Local storage and synchronisation

A session may be stored temporarily within the application while it is being processed or transferred. Once successfully uploaded to the backend, the temporary copy is removed from persistent local application storage. The backend is the primary source of account information and session history. If the user changes phone, reinstalls the application or deletes local data, the account and history may be retrieved from the backend after authentication.

20. Hosting and service providers

The principal iCORPOD backend infrastructure is hosted using IONOS infrastructure within the European Union or European Economic Area. We may also use selected providers for hosting, infrastructure, image storage, authentication, analytics, diagnostics, push notifications, marketing, support, security and other services necessary to operate iCORPOD. Providers process personal data only for the relevant purposes and subject to appropriate contractual and legal safeguards. Where we act as controller, we remain responsible for selecting providers appropriate to the nature of the processing.

21. Recipients of personal data

Depending on the Services used and the relevant processing activity, personal data may be accessible to or shared with the following categories of recipients:

• authorised iCORPOD personnel where access is necessary for legitimate operational, technical, support, security, legal or research purposes;

• service providers processing data on our behalf, such as infrastructure, hosting, image-storage, analytics, diagnostics, notification, marketing or security providers;

• authorised members of an organisation associated with the user’s account, where the relevant access has been lawfully enabled;

• other iCORPOD users or members of the public where the user voluntarily makes profile, session or Community information public;

• universities, research institutions, federations, clubs or other organisations involved in a lawful project or processing arrangement;

• professional advisers, insurers, auditors or other persons where access is reasonably necessary to protect or operate the business;

• courts, regulators, law-enforcement bodies or other public authorities where disclosure is required or permitted by applicable law.

If iCORPOD undergoes a merger, restructuring, acquisition, transfer of business or similar corporate transaction, personal data may be transferred to the relevant successor or acquiring entity where legally permitted and subject to appropriate data-protection safeguards. Such a corporate transfer does not constitute the sale of users’ personal data for advertising or data-broker purposes.

22. International transfers

We seek to host and process core information within the EEA where reasonably possible. Some providers may process limited information outside the EEA. Where international transfers occur, we use an appropriate mechanism under applicable law, such as:

• an adequacy decision;

• Standard Contractual Clauses;

• another recognised transfer mechanism;

• supplementary safeguards where necessary.

We seek to avoid providers that cannot offer appropriate data-protection safeguards. Users may request additional information concerning the safeguards applicable to international transfers by contacting privacy@icorpod.com.

23. Data retention

We do not retain personal data for longer than necessary for the purposes described in this Privacy Policy.

Active accounts

We may retain account, profile, session and performance information while the account remains active because historical performance information is a core function of iCORPOD.

Individual sessions

Users may delete individual sessions. When a session is deleted, associated information, metrics, physiological data and related Community interactions are removed from active systems.

Technical and security logs

These logs are normally retained for a maximum of 12 months. We may retain them for longer where necessary to investigate a specific security incident, fraud, litigation, technical problem or other legitimate matter.

Support

Support requests, tickets and internal notes are normally retained for a maximum of 2 years after the matter is closed, unless a claim or legal requirement justifies longer retention.

Inactive accounts

When a user selects Deactivate Account, the account becomes inactive and may be retained for up to 2 years to allow reactivation. Before permanent deletion, we may notify the user and provide an opportunity to reactivate the account. Once the applicable period has expired, the information will be deleted or irreversibly anonymised unless a legal obligation requires continued retention.

Billing and accounting

We retain necessary information for the periods required by applicable tax, accounting and other legislation.

Consent and compliance

We may retain records of consent, withdrawal, privacy choices and compliance for the period necessary to demonstrate legal compliance.

24. Backups

We use periodic backups to protect against data loss and service failure. Backups are created according to the technical backup procedures applicable to our infrastructure and are retained for a limited period corresponding to their normal technical rotation cycle. When information is deleted from active systems, a residual copy may remain temporarily within protected backups until the relevant backup is overwritten or expires as part of that cycle. Backups are not used to restore information deliberately deleted by a user except where necessary for disaster recovery, system integrity or a specific legal obligation.

25. Deactivate Account

Users may deactivate their account. Deactivation prevents ordinary use of the account, does not immediately delete historical information and allows the account to be reactivated during the applicable period. The account may be retained for up to 2 years before being deleted or irreversibly anonymised, subject to applicable legal obligations.

26. Delete Account

Users may permanently delete their account through the application.

Delete Account is different from Deactivate Account.

When an account is deleted, we remove associated personal information from active systems, including, where applicable:

• profile information;

• profile photograph;

• sessions;

• performance metrics;

• RR intervals;

• physiological data;

• Community posts;

• comments;

• likes and interactions;

• follower and following relationships;

• organisation associations;

• other account-related information.

Community content is deleted rather than simply being attributed to a “deleted user”. We may retain certain information where required by law or strictly necessary for:

• tax and accounting obligations;

• security and fraud prevention;

• demonstrating consent or legal compliance;

• establishing, exercising or defending legal claims.

Information may remain temporarily in protected backups until the applicable backup rotation cycle expires. Where appropriate, we may transform information into irreversibly anonymised data. Once the information can no longer reasonably be linked to an identifiable person, it may be retained for statistical, scientific, technical or commercial purposes.

27. Modification of personal information

Users may modify much of their profile directly within the application. To change the email address associated with an account, users currently need to contact support so that appropriate identity and security checks can be carried out. We may retain audit records concerning sensitive account changes for security and compliance purposes.

28. Data export

Users may export sessions in formats such as PDF and CSV. Exports are currently generally available on a per-session basis. Users may voluntarily share these files with coaches, healthcare professionals, researchers, universities or other third parties. Once downloaded and shared outside iCORPOD, we no longer control how the recipient stores, uses or further shares the external copy. The recipient is responsible for its own processing. Session export is separate from the statutory rights of access and data portability.

29. Automated performance analysis

We automatically process sensor and session data to calculate metrics and analyse sporting activity. This analysis is a core part of the product. We do not currently use these algorithms to make solely automated decisions that produce legal effects or similarly significant effects concerning users. Decisions made by coaches, clubs, federations, medical personnel or other persons on the basis of iCORPOD information are decisions made by those persons or organisations.

30. Children and young athletes

iCORPOD is used in a sport that may be practised from a young age. We therefore do not impose a universal minimum age for using the product.

Users under 16

As a global rule, users under the age of 16 require authorisation from a parent or legal guardian before the account becomes fully active. During registration, we may request the email address of the user’s parent or legal guardian. The representative will receive a verification request and must confirm authorisation through the process provided. The parent or guardian may also be required to confirm that they are legally entitled to provide that authorisation. Where local law requires a higher level of parental verification, additional measures will be applied.

Parental authorisation and consent

Parental authorisation may cover the general use of the account and platform. Where separate consent is legally required for another purpose, such as the processing of physiological data, that consent will be requested separately during the authorisation process or when the relevant functionality is activated. Where applicable law requires joint consent from the child and the holder of parental responsibility, iCORPOD will obtain both expressions of consent. Parental authorisation does not automatically provide the representative with ongoing access to the child’s account or training history. A parent or legal guardian may nevertheless exercise rights concerning the child’s personal data where applicable law permits or requires it.

Age-appropriate protection

We seek to provide privacy information and settings in a form appropriate for younger users. Additional restrictions may apply to advertising, profiling, public visibility, data sharing or other features where required by local law. Where required, we may provide additional age-appropriate or local-language privacy information to ensure that children can understand how their information is used.

31. Security

We apply technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. These measures may include:

• HTTPS/TLS;

• token-based authentication;

• secure cryptographic password hashing;

• prohibition of storing passwords in plain text;

• restricted administrative access;

• role and permission controls;

• protected databases and backups;

• security and audit logs;

• monitoring and diagnostics;

• incident-response procedures.

Access by iCORPOD personnel is restricted to authorised persons who require it for legitimate purposes such as service administration, customer support, technical maintenance, troubleshooting, security, product operation, legal compliance or authorised research and development activities. No system can guarantee absolute security, and we review safeguards according to the risks and nature of the information processed.

32. Personal-data breaches

If we become aware of a personal-data breach, we will investigate and assess the incident. Where required by law, we will notify the competent supervisory authority within the applicable legal timeframe. Where the breach is likely to result in a high risk to affected individuals and notification is required, we will contact affected users using the contact information available to us.

33. User rights

Depending on applicable law and the circumstances of the processing, users may have the right to:

• access personal data;

• obtain a copy of personal data;

• correct inaccurate information;

• request deletion;

• restrict certain processing;

• object to certain processing;

• receive eligible data in a portable format;

• withdraw consent;

• object to direct marketing;

• lodge a complaint with a competent supervisory authority;

• exercise other privacy rights available under applicable local law.

Some rights may be exercised directly within the application, for example by editing profile information, deleting sessions, changing privacy settings, withdrawing permissions or consents and deleting the account. Other requests may be sent to privacy@icorpod.com. We may request reasonable information to verify identity before disclosing or modifying personal data and will respond within the time limits required by applicable law.

34. Supervisory authority

iCORPOD is established in France. Users may lodge a complaint with a competent data-protection authority. For processing subject to French jurisdiction, the competent authority is the Commission Nationale de l’Informatique et des Libertés (CNIL) in France. Users are not required to contact iCORPOD before lodging a complaint, although they may contact privacy@icorpod.com so that we can investigate the matter.

35. Rights depending on location

iCORPOD is intended to be available internationally. Users outside the European Union or EEA may benefit from additional rights under the privacy law of their country, state or territory. Where such laws apply, we will respect the rights and obligations they establish. Nothing in this Privacy Policy limits mandatory privacy rights granted by applicable law.

36. Changes to this Privacy Policy

We may update this Privacy Policy when the Services change, new features are introduced, processing activities or providers change, applicable law changes or additional privacy protections become necessary. The current version will indicate its effective date and last-updated date. Where a change materially affects the processing of personal data, we will provide appropriate information. Previous acknowledgement of this Privacy Policy does not automatically constitute consent to a new processing activity. Where additional consent is legally required, we will request it separately.

37. Privacy Policy acknowledgement and Terms of Service

During account creation, users must:

• accept the iCORPOD Terms of Service;

• confirm that they have read this Privacy Policy.

These are separate actions. We record the information necessary to demonstrate which version of each document applied and when each relevant action occurred. Acknowledging this Privacy Policy does not constitute general consent to every processing activity. Where required, we request separate consent for marketing, tracking technologies or heart-rate and physiological data.