Client Data Protection in IZI

Client Data Protection in IZI

When a client registers at your club, IZI collects their name, phone number, visit history, and payment transactions. Understanding exactly who holds responsibility for that data — and how to respond when a client or regulator asks — is something to have sorted before any request arrives.

The short answer: your club is the data controller; IZI is the data processor. Your club decides what data to collect and how to use it. IZI stores and processes it on your behalf, following your configuration. IZI does not use your clients’ data for its own purposes.

This split maps to the controller/processor model in GDPR (EU), FZ-152 (Russia), and PDPL (UAE and several other jurisdictions).

Responsibility split at a glance

Role	Party	What they decide
Controller	Your club	What data to collect, retention periods, who to share with
Processor	IZI	Storage, session tracking, bonus calculation, notifications — all per your settings

As controller, your club is the point of contact for client requests and the party accountable to your local supervisory authority.

What IZI stores per client

Category	Data
Identity	Name, phone, email (if provided), date of birth (if collected)
Financial	Top-up history, transactions, bonus operations
Activity	Sessions, time in club, tariffs used
Location	Seat number or zone — not linked to specific hardware
Consents	Timestamped flags for data processing and marketing consent

IZI does not store biometrics, card payment credentials, or passport/ID document details.

Consent setup

When a client registers for the first time, IZI displays a consent form automatically — through the IZI mobile app or the club’s self-service terminal. Three consent types apply:

• Account creation and visit tracking — required; without it no profile is created
• Marketing notifications — optional, separate from the above
• Data sharing with third parties — only if your club uses connected third-party services

All consents are logged in IZI with a timestamp and accessible in the client’s profile in CRM.

Handling a client’s data request

Clients have the right to know what is stored about them, receive a copy, correct inaccuracies, or request deletion. Here is the workflow in IZI:

1. Verify identity — confirm via the phone number linked to the profile
2. Access the profile — Clients → search → open profile
3. Export data — use History / Export to generate a readable summary for the client
4. Correction — edit fields directly in the profile
5. Deletion — Clients → profile → Delete Account

IZI removes data from its storage within 30 days of the deletion request from the club. Transactional records required for financial reporting may be kept longer — up to 5 years — depending on your jurisdiction’s accounting rules.

Response deadlines vary by jurisdiction: 30 calendar days under GDPR, 10 business days under FZ-152. Check your local requirements and log the date of every request.

Data breach response

If you discover unauthorised access to your IZI account or suspect a breach:

1. Immediately change your IZI password and revoke all active sessions: Settings → Security → Active Sessions
2. Email security@izi.is — describe what happened, when, and which data categories may have been involved
3. Notify your country’s supervisory authority within the required window (GDPR: 72 hours; check your jurisdiction for others)
4. If clients’ rights are likely to be affected, notify the clients themselves as required

IZI will provide a technical incident report for submission to a regulator upon written request.

Server location and jurisdiction

IZI stores data on servers in the EU (Germany). Implications by region:

• UAE clubs — IZI is aligned with the UAE Personal Data Protection Law (PDPL, effective 2022). Cross-border transfer rules under the PDPL apply; see Tax Handling for UAE Clubs for the broader UAE regulatory context.
• Russian clubs — storage outside Russia constitutes cross-border transfer under FZ-152; see Cash Register Compliance (Russia) for related Russian regulatory requirements
• EU clubs — standard GDPR controller/processor arrangement; DPA available on request by emailing legal@izi.is

Documents to display at your club

Recommended materials to provide to clients at registration or on your premises:

• A privacy notice covering what data you collect and how it is used
• A CCTV notice if cameras are in use
• A data contact (email or form) where clients can submit requests

See also

• Client Terms and Conditions Template
• Cash Register Compliance (Russia)
• Tax Handling for UAE Clubs
• Client Profile in CRM