Privacy Policy

Last updated: May 13, 2026

Cette page est également disponible en français.

1. Who we are

US Athletic Performance Sàrl(hereinafter "USAP", "we" or "our")

• Registered office: Route des Acacias 48, 1227 Carouge (GE), Switzerland
• Legal form: Swiss limited liability company (Sàrl)
• Share capital: CHF 20,000
• UID / Business identification number: CHE-243.693.381
• Geneva Commercial Register number: CH-660.1.979.024-9
• Phone: +1-872-279-0009
• Email: nicolas@usathleticperformance.com
• Publication director: Nicolas Pierre Paviet, Founder

USAP is a Swiss agency specialized in placing European young golfers into U.S. college golf programs (NCAA Division I, II, III, NAIA, JUCO).

USAP acts as data controller under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP).

2. Data protection contact

USAP has not appointed a Data Protection Officer (DPO). For any question or to exercise your rights:

• Email: nicolas@usathleticperformance.com
• Phone: +1-872-279-0009

We commit to responding within one month maximum (Article 12 GDPR).

3. What data we collect

3.1. Athlete data

• Identification: first name, last name, gender, nationality, year of birth (not full date — minimization)
• Contact: email, phone (of the minor athlete or legal guardian)
• Sports data: golf club, FFGOLF / EGR / WAGR rankings, tournament results (past two seasons), swing videos, profile picture
• Academic data: GPA, SAT / ACT / TOEFL / Duolingo scores, translated transcripts, NCAA / NAIA evaluations
• Recruitment criteria: family budget, target regions and divisions, academic goals
• Internal notes: confidential observations produced by the dedicated USAP agent

3.2. Legal guardian data

• First name, last name, relationship to the athlete
• Email, phone
• Contract data: signatures, payment proofs, banking references (for billing only)

3.3. U.S. college coach data

• Name, university, golf program, role
• Institutional email, professional phone
• Interaction history, call notes, relationship status

3.4. Technical data

• IP address, browser, pages visited, session duration (30 days)
• Technical cookies for authentication and preferences

4. Why we process your data and legal basis

• Placement of the athlete in a U.S. college program → contract performance
• Communication with U.S. coaches → contract performance + legitimate interest
• Administrative management (billing, accounting) → legal obligation (Swiss law)
• Internal statistics → legitimate interest, aggregated data only
• Security and fraud prevention → legitimate interest

5. Who has access to your data

5.1. Within USAP

• The dedicated USAP agent accesses the full profile of the athlete they support
• Founder Nicolas Paviet has access to all data (operational oversight)
• Parents/guardians access their child's profile

5.2. Technical subprocessors

• Supabase (database and auth) — Frankfurt (EU)
• Vercel (web application hosting) — United States with global CDN
• Resend (transactional emails) — United States
• Framer (marketing site) — Netherlands (EU) with global CDN
• Mailmeteor (bulk personalized email outreach to U.S. coaches) — EU
• Google LLC (Google Workspace) — United States / EU depending on the service
• Anthropic (AI assistant Claude — see clause 5.4) — United States

5.3. External recipients

• U.S. college coaches: receive only the sports and academic profile (not contract data, not internal notes)
• Competent authorities: only upon legal request

5.4. AI processing

USAP uses the AI assistant Claude (Anthropic, Inc.) for limited operational tasks: sports results updates, data consistency checks, file tracking optimization.

• This processing does not produce decisions with legal or significant effects on the athlete within the meaning of Article 22 GDPR
• Recruitment decisions, strategy and communication are exclusively made by human USAP agents
• Data is not used to train third-party AI models

6. Data transfers outside the EU

All our databases are hosted in the EU (Frankfurt). However, some data may be transferred to the United States in the context of our U.S.-based subprocessors (Vercel, Resend, Google LLC, Anthropic) and communication with U.S. college coaches — the very purpose of our service.

These transfers are framed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914)
• Contractual commitments of our subprocessors to respect GDPR-equivalent guarantees
• The EU-US Data Privacy Framework (DPF) for adhering subprocessors

7. Retention periods

• Active athlete profile: contract duration + 7 years
• Prospect without signed contract: 24 months after last contact
• Accounting and billing documents: 10 years (Swiss art. 958f CO)
• Emails and notifications: 24 months
• Technical logs: 30 days
• Unused pending invitations: 6 months

At the end of these periods, data is permanently deleted or anonymized.

8. Cookies

We use only strictly necessary cookies for application functionality (authentication, preferences). No advertising or third-party profiling cookies are used.

For the scout.usap platform, a first-party analytics tool (Flock by Lovable) is used without identifying cookies and without third-party data transfers.

9. Your rights

Under GDPR (Articles 15-22) and FADP (Articles 25-32), you have the following rights:

• Access — obtain a copy of all your data
• Rectification — request correction of inaccurate data
• Deletion (right to be forgotten) — within legal limits
• Restriction — temporary suspension of processing
• Portability — receive your data in a structured format
• Objection — to certain processing (legitimate interest)
• Consent withdrawal — at any time, for consent-based processing
• Automated decisions — human intervention on any automated decision

How to exercise: write to nicolas@usathleticperformance.com specifying the nature of your request. Reply within one month maximum.

In case of dispute:

• France: CNIL
• Switzerland: FDPIC
• Other EU countries: your national authority

10. Processing of minors' data

A large part of our business concerns minor athletes (typically aged 14 to 18). Enhanced measures:

• Parental consent required for any athlete under 16
• Adapted information in clear and accessible language
• Enhanced minimization: only year of birth is stored, not the full date
• No advertising profiling, no marketing transmission
• No automated decision-making affecting the minor: all recommendations are validated by a human agent
• Image usage (photos, swing videos) framed by written consent in the contract signed between USAP and the legal guardian
• Facilitated right of withdrawal at majority (deletion or portability under the athlete's control)

11. Security

• EU hosting (Frankfurt, Germany) via Supabase
• Encryption in transit (HTTPS / TLS 1.2+)
• Encryption at rest (AES-256)
• Compromised password protection (HaveIBeenPwned), mandatory email verification
• Access control by roles (athlete, parent, agent, coach, administrator) — Row-Level Security
• Encrypted daily backups
• Quarterly audit of access and security logs
• Breach notification within 72 hours (Article 33 GDPR)

12. Changes to this policy

This policy may evolve (subprocessor change, new feature, regulatory change). Any material modification will be notified by email to affected users and the update date will be modified at the top of this document.

13. Contact

For any question, request or complaint regarding your data:

• Email: nicolas@usathleticperformance.com
• Phone: +1-872-279-0009
• Mail: US Athletic Performance Sàrl, Route des Acacias 48, 1227 Carouge (GE), Switzerland