Privacy Policy

The data controller responsible for the processing of your personal data is:

As data controller, Collective 1X3 determines the purposes and means of processing personal data collected through the Platform, in compliance with Regulation (EU) 2016/679 (GDPR).

We collect and process different categories of personal data depending on your use of the Platform. Below is an exhaustive list of the data categories we may collect:

Your personal data is processed for the following purposes:

• Account management: creating, maintaining, and authenticating your user account.
• Service delivery: providing access to communities, courses, chat, and all Platform features.
• Payment processing: managing subscriptions, processing payments, issuing invoices, and handling refunds and disputes.
• Affiliate tracking: managing referral programs, calculating commissions, and processing affiliate payouts.
• Transactional communications: sending account, access, billing, support, security, and service emails.
• Analytics & improvement: analyzing usage patterns to improve the Platform, optimize user experience, and conduct A/B tests.
• Legal compliance: fulfilling our legal and regulatory obligations, including tax reporting and record-keeping.
• Fraud prevention & security: detecting, preventing, and investigating fraudulent activity, abuse, and security incidents.
• Platform improvement: developing new features, testing improvements, and ensuring the overall quality and reliability of the Platform.
• Dispute & chargeback defense: collecting and retaining technical evidence (timestamps, encrypted IP, user-agent, lesson events, watch time, terms acceptance with version) to prove the actual delivery of the contracted services in the event of a payment dispute (chargeback) initiated with a bank or card network. This processing is detailed in section 7.

We process your personal data on the following legal bases, as defined by Article 6(1) of the GDPR:

Your personal data may be shared with the following categories of recipients, strictly to the extent necessary for the purposes described in this policy:

We do not sell, rent, or trade your personal data to any third party. Data is shared with the above recipients solely to provide and improve our services.

Collective 1X3 is based in the United States of America (New Mexico). As a result, your personal data may be transferred to, stored, and processed in the United States or other countries outside the European Economic Area (EEA) where our service providers operate.

The following service providers may process your data outside the EU/EEA:

• Supabase (United States)
• Stripe (United States)
• Resend (United States)
• Mux (United States)
• PostHog (United States / European Union)

To ensure an adequate level of protection for your personal data in accordance with Chapter V of the GDPR, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR, ensuring contractual obligations to protect your data.
• EU-U.S. Data Privacy Framework: where applicable, our US-based providers are certified under the EU-U.S. Data Privacy Framework, providing an adequate level of data protection as recognized by the European Commission.
• Encryption: all data is encrypted in transit (TLS 1.2+) and at rest, regardless of where it is stored.

You may request a copy of the applicable safeguards by contacting us at contact@daway.club.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows:

Upon expiration of the applicable retention period, your data is securely deleted or anonymized so that it can no longer be associated with you.

In accordance with the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access (Article 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to receive a copy of that data along with information about the processing.
• Right to rectification (Article 16): You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
• Right to erasure / "right to be forgotten" (Article 17): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or when the data has been unlawfully processed.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.
• Right to object (Article 21): You have the right to object to the processing of your personal data based on legitimate interests, including profiling. You also have the right to object at any time to the processing of your data for direct marketing purposes.
• Right to restriction of processing (Article 18): You have the right to request the restriction of processing in certain circumstances, such as when you contest the accuracy of the data or when the processing is unlawful but you oppose erasure.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

We implement appropriate technical and organizational measures to ensure the security, confidentiality, integrity, and availability of your personal data, in accordance with Article 32 of the GDPR.

• Encryption at rest and in transit: All data is encrypted using industry-standard algorithms. All communications between your browser and our servers use HTTPS with TLS 1.2 or higher.
• Access control & least privilege: Access to personal data is restricted to authorized personnel on a need-to-know basis. We enforce the principle of least privilege across all systems and services.
• OTP authentication: The Platform uses one-time password (OTP) authentication via email. No passwords are stored on our servers, eliminating the risk of password database breaches.
• Infrastructure certifications: Our service providers maintain industry-leading security certifications, including SOC 2 Type II and ISO 27001, ensuring that data processing meets rigorous security standards.
• Regular security audits: We conduct regular security assessments, vulnerability scans, and code reviews to identify and remediate potential security risks.
• Monitoring & incident response: We maintain continuous monitoring of our systems and have an established incident response plan to detect and respond to security threats promptly.

In the event of a personal data breach, we will act in accordance with Articles 33 and 34 of the GDPR:

• Notification to the supervisory authority (Article 33): If the breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.
• Communication to affected individuals (Article 34): If the breach is likely to result in a high risk to the rights and freedoms of individuals, we will inform affected users without undue delay, providing clear information about the nature of the breach and the steps they can take to protect themselves.
• Documentation: All personal data breaches are documented, including the facts of the breach, its effects, and the corrective actions taken. This documentation is maintained in accordance with Article 33(5) of the GDPR and is available for review by supervisory authorities upon request.

If you believe that the processing of your personal data constitutes a violation of the GDPR or applicable data protection laws, you have the right to lodge a complaint with a supervisory authority, in accordance with Article 77 of the GDPR.

You may contact the supervisory authority in your country of residence, your place of work, or the place of the alleged infringement. Below are relevant supervisory authorities:

We reserve the right to modify this Privacy Policy at any time. Any changes will be effective immediately upon publication on this page, with the "Last updated" date revised accordingly.

In the event of substantial changes that materially affect how we process your personal data, we will notify you by email (sent to the address associated with your account) or through a prominent notice on the Platform prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, you may contact us at:

We will endeavor to respond to all legitimate inquiries within a reasonable timeframe and no later than 30 calendar days from receipt of your request.