DATA PRIVACY POLICY
1. Data Controller
THE PANASH, a single-member simplified joint-stock company with a capital of 500 euros, registered under SIREN number 948 683 982, with its principal place of business located at 430 rue Ettore Bugatti, 34000 Montpellier, France, is responsible for the processing of personal data described in this policy.
If you have any questions regarding your personal data or wish to exercise your rights, please contact us:
– by email: contact@thepanash.fr;
– by mail: THE PANASH — Personal Data, 430 Ettore Bugatti Street, 34000 Montpellier, France.
2. Scope
This policy explains how THE PANASH processes your data when you visit the https://thepanash.com website, contact us, place an order, access a program in the ThePanash app, or participate in a coaching session or seminar.
It covers treatments performed under the responsibility of THE PANASH.
Payment providers and app download platforms may also process certain data for their own purposes, in accordance with their privacy policies.
3. Data We Process
Depending on how you use our services, we may process the following categories of data.
Identity and Contact Information
Last name, first name, email address, billing address, and, when requested, phone number.
Orders and Payments
Purchased offers, amount, date, order reference, and order status; invoices; information needed to track payments, refunds, and any issues.
Payments are processed by the service providers listed at the time of order, including Axepta BNP Paribas and PayPal. THE PANASH receives the information necessary to confirm and track the transaction.
Account and Program Access
Information required to create and manage the account, authenticate the user, and grant access rights to purchased programs.
The email address you provide when placing an order is used to link your purchase to your account in the ThePanash app. Therefore, you must use the same email address on the website and in the app.
Exchanges and Services
Messages sent to THE PANASH, requests for assistance, complaints, and information needed to organize coaching sessions or seminars.
In the context of coaching, this may include athletic goals, skill level, training constraints, and progress reports provided for monitoring purposes.
Navigation and Technical Specifications
Technical information necessary for the operation and security of the services, as well as—with your consent—browsing data collected by Google Analytics: pages viewed, interactions, referral sources, browser and device information, and online identifiers.
The data actually collected depends on the features used and the tool settings.
4. Why We Use Your Data
| Responding to an inquiry regarding an offer and preparing a quote | Pre-contractual measures taken at your request |
| Processing an order, managing payment, and providing a service | Performance of the contract |
| Creating and managing your account and your rights toaccess to the program | Performance of the contract |
| Organize coaching sessions and seminars | Performance of the contract |
| Provide support related to a purchase | Performance of the contract |
| Issue invoices and comply with accounting and tax obligations | Legal obligation |
| Respond to general inquiries not related to an order | Legitimate interest in responding to individuals who contact us |
| Ensure the security of services and prevent abuse | Legitimate interest in protecting our services and their users |
| Handling complaints, retaining necessary evidence, and defending our rights | Performance of the contract, legal obligations, or legitimate interest in defending our rights, depending on the situation |
| Measuring website traffic with Google Analytics | Consent |
| Sending a newsletter to which you have subscribed | Consent |
Required information is indicated at the time it is collected. Without the data necessary to process an order or create user accounts, we cannot provide the relevant service.
Declining audience measurement cookies does not prevent you from placing an order or accessing our services.
5. Sensitive Information in the Context of Coaching
Certain information regarding injuries, medical conditions, or physical limitations may constitute health data.
We ask that you refrain from submitting medical records or health information that is not directly related to your care.
If coaching requires the processing of health data, only the information that is strictly necessary is requested. Specific information—and, when this basis is selected, separate explicit consent—is obtained prior to processing.
Simply accepting the Terms and Conditions or reading this policy does not constitute explicit consent to the processing of health data.
This consent may be withdrawn at any time. THE PANASH will then explain the potential consequences for any adjustments to the coaching that require this information.
6. Cookies and Google Analytics
Essential Cookies
This website uses cookies or similar technologies that are necessary, in particular, for managing the shopping cart, logging into your account, ensuring security, and saving your cookie preferences.
These devices do not require consent when they are strictly necessary for the provision of the requested service or for the transmission of a communication.
Audience Measurement
THE PANASH uses Google Analytics to understand website traffic and usage, and to improve its pages and services.
Google Analytics is the only audience measurement tool used on the site.
Audience measurement technologies that require consent are only enabled after you give your consent. You can accept them, decline them, or change your selection in the cookie manager.
The information collected may include the pages viewed, interactions performed, the source of the visit, technical information about the device and browser, and identifiers associated with cookies.
This information may constitute personal data, even if it does not include your name.
To learn more about how Google processes data:
https://policies.google.com/technologies/partner-sites?hl=fr
7. Recipients of the Data
Your data is accessible to authorized personnel at THE PANASH, only to the extent necessary for them to perform their duties.
They may also be disclosed to the following recipients:
– the professionals responsible for your coaching or for organizing your seminar, for the information necessary to provide the service;
– the technical service providers responsible for the hosting, maintenance, communications, and operation of the website and the app;
– Amazon Web Services, for the relevant hosting services;
– Axepta BNP Paribas and PayPal, for the relevant payments;
– Google, when you authorize audience measurement;
– professionals responsible for accounting, consulting, or the defense of our rights, when necessary;
– authorized authorities and agencies, when a legal obligation requires disclosure.
Service providers acting on our behalf are authorized to process data only in accordance with our instructions and the applicable contractual terms.
Service providers acting for their own purposes—including, in particular, certain payment transactions—are responsible for the corresponding processing activities.
8. Data Transfers Outside the European Economic Area
Some service providers may process data outside the European Economic Area, particularly in connection with Google services and depending on the configuration of the technical services used.
When a transfer takes place, it must be based on a mechanism authorized by the GDPR: an applicable adequacy decision or appropriate safeguards, including the European Commission’s standard contractual clauses, accompanied by the necessary additional measures.
Google publishes information about its data transfer mechanisms at the following address:
https://policies.google.com/privacy/frameworks?hl=fr
You can contact us at **contact@thepanash.fr** to obtain details about transfers involving your data and a copy of the applicable safeguards, subject to the need to protect confidential information.
9. Retention Periods
We retain data for as long as necessary to fulfill the purpose for which it was collected, and then we delete it, anonymize it, or archive it with restricted access when continued retention is necessary.
Account and Program Access
The data necessary to exercise your access rights is retained for the duration of your access to the program.
Retaining access rights does not imply retaining the entire technical history or all communications for the same period of time.
Orders and Services
The data necessary to fulfill the order is retained for the duration of the contractual relationship.
Once the process is complete, the data necessary to substantiate the contract and defend rights may be archived for the applicable statutory periods, generally five years from the event that triggers the statute of limitations.
The specific archiving requirements for certain electronic contracts are also complied with when applicable.
Billing
Invoices and accounting documents are retained for ten years from the end of the relevant fiscal year.
Coaching and Discussions
Tracking information is retained for the duration of the service; afterward, only the information necessary to comply with a legal obligation or to resolve a dispute is archived under restricted access.
Newsletter
The data used for the newsletter is retained until consent is withdrawn or, at the latest, for three years from the last relevant active contact.
The minimum information necessary to process your unsubscribe request may be stored separately so that we no longer contact you.
Google Analytics
Retention period for user and event data: the maximum allowed by law.
This period is distinct from the lifespan of cookies and that of aggregated statistics.
Technical Information and Cookie Preferences
Technical and safety logs: 12 months.
Retention period for cookie preferences: 12 months.
In the event of a dispute, only the necessary data may be retained until the dispute is finally resolved and for the period required to enforce the decision.
10. Safety
THE PANASH implements technical and organizational measures appropriate to the risks to protect data from unauthorized access, loss, alteration, or disclosure.
Access to the data is limited to those who need it to perform their duties.
You should also protect your login credentials and avoid sharing your password with others.
If you suspect unauthorized use of your account, please contact us at contact@thepanash.fr.
11. Your Rights
Under the terms of the GDPR, you have the following rights, among others:
– the right to access your data;
– the right to have inaccurate or incomplete information corrected;
– the right to request the erasure of your data;
– the right to request the restriction of processing;
– the right to object, for reasons related to your particular situation, to processing based on a legitimate interest;
– the right to object at any time to commercial solicitation;
– the right to data portability for the data you have provided, when the legal conditions are met;
– the right to withdraw your consent at any time for processing operations based on such consent;
– the right to establish guidelines regarding the handling of your data after your death, in accordance with French law.
These rights are not absolute. In particular, certain data may need to be retained to comply with a legal obligation or to defend a right in court.
Deleting information that is essential to your account may prevent you from continuing to access the program. The consequences will be explained to you before you proceed with such a request.
12. Exercising Your Rights
You can exercise your rights by writing to:
contact@thepanash.fr
or at:
THE PANASH — Personal Information
430 Ettore Bugatti Street
, 34000 Montpellier, France
Please provide details about your request and the email address associated with your account or order to help us process it.
Additional proof of identity is requested only when there is reasonable doubt and in a proportionate manner.
We generally respond within one month of receiving the request. This timeframe may be extended by two months if warranted by the complexity or number of requests. In such cases, you will be notified within the first month.
13. Complaint to the CNIL
If you believe that your data is not being processed in accordance with the regulations, you may file a complaint with the National Commission for Information Technology and Civil Liberties (CNIL):
Website: https://www.cnil.fr/
Address: 3 Place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07, France.
You may contact us beforehand to find a solution; however, this is not a requirement for filing a complaint with the CNIL.
14. Policy Update
This policy may be updated to reflect changes in our services, data processing practices, or regulations.
In the event of a significant change, the individuals concerned are notified by an appropriate means. If a new processing activity requires consent, such consent is obtained before the activity is implemented.
Last updated: Sept. 5, 2026.