What CoverShift collects, why, and how to exercise your rights. Updated on 5 November 2026: list of processors with their country, legal basis for each use, emails sent through Resend.
Matthieu Vanderkelen, a natural person trading as CoverShift, 52 Rue de Renissart, 7180 Seneffe, Belgium, company number BE 0716.910.370. Contact: contact@covershift.be.
Account: e-mail and password (encrypted, managed by Supabase Auth).
Coaches: last name, first name, phone (optional), city, provinces covered, certification, years of experience, minimum rate, preparation preferences, bio, affiliated and favourite gyms.
Gyms: gym name, contact name, e-mail, phone, address, city, province, replacement rules, affiliated and favourite coaches, and the details of published slots.
Reviews: scores from 1 to 5 and comments left after a job. A review marked "public" is visible to other CoverShift users; a private review is visible only to the gym and coach concerned. The data controller can hide an abusive review.
Schedule and team: the box's standard week and classes, the coach for each class, notes on a day or class, leave requests and balances, everyone's role in the box (manager, head coach, coach) and notification choices.
Hours, pay and Dimona (only for boxes that employ or pay a coach): coach status (employee, student, flexi-job, self-employed, via SMart), contract hours, rates and hourly wages, classes given, absences, monthly sheets, national number (NISS), IBAN and account holder name, VAT number where applicable, Dimona declarations and replies from the ONSS, files prepared for the payroll provider and for bank transfers, SMart invoices entered by the box. Self-billing (only if the coach accepts it): coach's name or company, address, company number and VAT regime, invoices and credit notes issued in their name, disputes. On the box side: the box's IBAN, company, address and VAT number, chosen payroll provider, ONSS access identifier and, if the box adds them, its connection keys for Wodify or Clubplanner.
Support and follow-up: messages exchanged with CoverShift through the "Help" tab, a log of actions on the platform (sign-ups, slots, applications, assignments, affiliations, reviews) and, where applicable, internal notes by the data controller about support or billing. They are used to help users, resolve disputes and bill service fees; other users cannot see them.
Site visitors: if you try "Get the fake SOS", your browser creates a notification subscription (a technical address and its keys). CoverShift stores it with the page language and a fingerprint of your IP address (not the address itself), used to limit the number of tries. Nothing else: no name, no e-mail.
Company requests: what you enter in the "Companies" form: company or organisation, name, e-mail, phone (optional), city, province, preferred date, number of participants, budget and message.
Member feedback: when a box member gives feedback on a class, through the QR code displayed at the box, CoverShift records the score, any comment and a randomly drawn device identifier, with no name or account. This identifier stays on the phone: it lets the member change their feedback and prevents duplicate votes. The box and the class coach see the result.
This data is used to organise a box's classes and its coaches' work: the schedule, cover, leave, hours, pay and Dimona.
Account, profile, schedule and cover: performance of the contract, that is the terms of use you accept when signing up.
National register number and Dimona declarations: the legal obligation of the box that employs the coach to declare them to the NSSO.
IBAN, hours, rates and invoices: performance of the contract between the box and the coach (paying them) and the box's accounting and social obligations.
Service emails (SOS, reminders, end of the pilot, support replies): performance of the contract. You choose in the app which notifications you receive.
The fake SOS is used only to send the demo notification you asked for: the legal basis is your request. A company request is used only to reply to you and make you a proposal, at your request. Member feedback lets the box and the coach know the quality of the classes: this is the box's legitimate interest, and giving feedback remains optional.
For a box's schedule, hours, pay and Dimona, CoverShift acts on behalf of that box, as processor within the meaning of the GDPR, under thedata processing agreement. The box remains responsible for this data as employer or client.
The data controller. A coach's profile (without e-mail or phone) is visible to registered gyms. When a coach applies to or joins a gym, the gym sees their contact details. When a coach is chosen for a job, they see the gym's contact details. A coach's national number (NISS) is visible only to them and to the boxes that employ them; their IBAN and billing details only to them and to the boxes that pay them. An invoice issued in their name is visible only to them and to the box that issued it. A head coach manages the schedule without seeing rates, pay, IBANs, national numbers or Dimona. The payroll provider and the ONSS receive what the box sends them. The data is neither sold nor used for advertising.
Supabase (database and accounts): European Union, Frankfurt.
Vercel (website and app): United States. On the public website (not in the app), Vercel Web Analytics counts visits without cookies and without keeping IP addresses: we see which pages are read, the country and the site the visitor comes from, not who they are.
OVH (sign-in and confirmation emails): France.
Resend (service emails: SOS, reminders, alerts, end of the pilot, copies of the Dimona follow-up to the addresses chosen by the box only): United States.
jsDelivr (download of a library used by the app): worldwide network, no cookies.
Transfers to the United States rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. Dimona declarations go to the NSSO through its official connection, which is also used to find those the box made elsewhere. Notifications go through your browser's notification service (Google, Apple or Mozilla depending on the device). CoverShift notifies boxes 30 days before adding or changing a processor.
As long as your account is active, then for at most 12 months after your last activity. A box's hours, sheets, invoices and declarations are kept as long as the box uses CoverShift, so it can meet its own retention obligations, then deleted, or handed over to the box if it asks. A box can export all its data (schedule, coaches, hours, payments, register) at any time in one click from "My gym": the data belongs to it.
Fake SOS subscription: deleted automatically after 7 days. Company request: kept for at most 12 months after our last exchange with you. Member feedback: kept with the box's classes, and deleted with them.
You can ask to access, correct or delete your data, or withdraw your consent, from the "Help" tab of your space or by writing to the contact above. You can also lodge a complaint with the Data Protection Authority (dataprotectionauthority.be).