DOME5ALPINE PERFORMANCESign in
Menu
PRIVACY POLICY

How DOME5 handles your data

Last updated: 29 October 2026

This policy explains which personal data DOME5 processes, why, who can see it and which rights you have under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Controller

Bostjan Cerkovnik, Sole trader (selbständig)
5542 Flachau, Austria
Email: info@domefive.com

For any question about your data or to exercise your rights, write to info@domefive.com.

2. Which data we process

  • Account: name and email address. You sign in with a six-digit code we send to your email; the code is stored only as a hash and expires after 10 minutes. Older accounts may also have a password, stored only as a salted hash.
  • Athlete profile: name, date of birth, category, ski club or organisation (optional), athlete or guardian contact, important training information and the linked parent, guardian and coaches.
  • Diaries: athlete answers about readiness, sleep, wellbeing, nutrition, digestive comfort, training focus and reflection, and the coach’s own observations, plans and recommendations.
  • Documents and measurements: files you upload, physical measurements, season reviews and issued PDF reports.
  • Race plans: races the athlete adds or a coach assigns (name, date, place, discipline, level and an optional link to the race page on the FIS website).
  • Week plans: the training, race and rest days a coach plans for their athletes, with discipline, minutes, focus and a short note. The athlete sees the plan in the diary.
  • Reminders and weekly summary: whether a coach has turned on daily diary reminders (time and days) or a weekly summary, whether an athlete has turned reminders off, and the dates on which a reminder or summary was sent, so it is never sent twice.
  • Language: whether you use DOME5 in English or German, saved with your account so that the app, reports and emails use it, and in your browser before you sign in.
  • Coach groups: group names a coach creates and which of their athletes belong to them. Groups are visible only to that coach and give no access.
  • Consent records: the date on which an athlete, parent or guardian gave consent in the app.
  • Device data: which devices the athlete uses (such as WHOOP, Garmin, Polar, Apple Watch or Samsung), readings entered manually and, only if the athlete connects WHOOP, Garmin, Polar or Suunto, imported sleep, recovery, HRV, heart rate, stress, steps and workouts from the last 30 days. Access tokens are stored encrypted. The athlete decides which coaches see imported readings and can disconnect at any time, which deletes the imported readings.
  • Technical data: a session cookie, and IP addresses in server logs and short-lived limits on sign-in attempts.
  • Website statistics: when you open a public page of domefive.com (not the workspace or the diaries), your browser sends our server the page address, the screen width and, for the first page, the website you came from. From your IP address our server derives only the country (with the DB-IP Lite database, IP Geolocation by DB-IP, CC BY 4.0) and then discards the address. Visitors per day are counted with a code made from the address, the browser and a random value that exists only for that day and only in memory, so the stored numbers cannot be traced back to you. We store only daily totals by page, country, device type (phone, tablet, computer) and source. No cookies are used, nothing is stored in your browser, and no other company receives the data. Signed-in users and bots are not counted, and we respect “do not track” and Global Privacy Control.

3. Health data

Information about sleep, wellbeing, nutrition, heart rate and recovery is health data, a special category under Art. 9 GDPR. We process it only with explicit consent from the athlete or, for children under 14, from a parent or guardian (Art. 9(2)(a) GDPR, § 4(4) DSG). You can withdraw consent at any time by email. Withdrawal does not affect processing that took place before it.

4. Purposes and legal bases

  • Providing your account and the application: performance of a contract (Art. 6(1)(b) GDPR).
  • Diary and device health data: explicit consent (Art. 9(2)(a) GDPR).
  • Security, abuse prevention and backups: legitimate interest in a secure service (Art. 6(1)(f) GDPR).
  • Diary reminders to athletes and the weekly summary to coaches: performance of a contract (Art. 6(1)(b) GDPR) — they are part of the service the coach chose; athletes can turn reminders off in their profile, coaches turn both on or off themselves.
  • Anonymous website statistics: legitimate interest in knowing how the public website is used and where it is read, without identifying visitors (Art. 6(1)(f) GDPR).
  • Payments and invoices, once payments are introduced: contract and legal obligations (Art. 6(1)(b) and (c) GDPR).

5. Children

Athletes join through their coach’s invitation and give their explicit consent when they accept it; athletes who joined earlier confirm it once in the app. The date is recorded. For athletes under 14, the coach confirms in the app that a parent or guardian has agreed before inviting the athlete. The parent then receives their own invitation and gives consent in the app; both confirmations are recorded with the date. Parents see the reports coaches issue, not the daily diary.

6. Who can see your data

  • The athlete sees their profile, diaries, documents and reports.
  • Coaches connected through an invitation see the athlete’s entries, the races the athlete adds and their own professional records. They see earlier history only with the athlete’s permission. Other coaches’ entries stay private.
  • Guardians invited by the coach give consent for a child under 14, see issued reports, manage the child’s profile and coach connections and, for children up to U14, can approve agreed actions. They do not see diary entries, documents or device readings.
  • Report recipients, for example a second parent, see issued reports only.
  • Clubs and organisations cannot read personal diaries, documents or reports.
  • The administrator manages accounts and access and only views personal data when needed to provide support or keep the service secure. For this, the administrator sees an overview of accounts and coaching connections with the dates and number of entries, but never the content of diaries, ratings, health data, device readings or documents.
  • Hosting: the data is stored on a server operated for us by our hosting provider, which acts as our processor.
  • Email: sign-in codes, notices about your access and — only if your coach turned them on — diary reminders and the coach’s weekly summary are sent from no-reply@domefive.com through our own mail server. They contain names, counts and links, never diary answers. We do not send marketing email.
  • Device providers: if the athlete connects WHOOP, Garmin, Polar or Suunto, data is exchanged with that company (WHOOP Inc., Garmin Ltd., Polar Electro Oy or Suunto Oy) under its own privacy policy.

We do not sell personal data, show advertising or use tracking or analytics services from other companies. DOME5 does not create a public athlete directory.

7. Cookies

DOME5 uses one strictly necessary cookie, __Host-dome5_session, to keep you signed in. If you choose “remember this device”, it expires after 7 days without use and after 30 days at most; otherwise after 12 hours. No consent is required for it, and we do not use advertising or tracking cookies. The website statistics use no cookies.

The app also keeps two things in your browser’s local storage, only on your device and never sent to us by themselves: an unsaved diary entry, so it is not lost if the connection drops (removed when you save it, after 14 days, or when you sign out), the choice to hide the “install the app” hint, and your language choice. They are strictly necessary for features you use, so no consent is required.

8. How long we keep data

We keep account and athlete data while the account is active. Diary entries of a finished season (1 June – 31 May) are archived: they stay readable for the athlete and their connected coaches but can no longer be changed. When you ask us to delete an account, we delete it within 30 days. Copies in backups are overwritten within 14 days after that. Server logs are kept only as long as needed for security. Website statistics are daily totals without personal data; we keep them for 24 months. The record of sent reminders and summaries is kept for 4 months. Invoices, once introduced, are kept as long as tax law requires.

9. Security

Connections are encrypted (HTTPS). Passwords are hashed, device access tokens are encrypted and sign-in attempts are limited. Backups are made daily.

10. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to data portability and to withdraw consent. Write to info@domefive.com. We reply within one month.

You can also lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at, or with the supervisory authority in your EU country of residence.

11. Changes

We will publish changes to this policy on this page and tell account holders about important changes before they take effect.