Reservierung

Privacy Policy

GymRoom Vinohrady ·

Effective from 18 October 2026

Effective from 18 October 2026

This is a translation. The original is the Czech version, which prevails in case of any discrepancy.

1. Who Processes Your Data

The GymRoom Vinohrady branch, located at Varšavská 512/11, 120 00 Prague 2, is operated by SoloGMR s.r.o., Company ID: 29762073, with its registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 451184 (hereinafter referred to as the "operator").

The website gymroom.cz, reservation system, user accounts, credits, and vouchers are operated by GymRoom CZ s.r.o., Company ID: 21136947, with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 397263 (hereinafter referred to as "GymRoom").

Who is responsible for what:

  • The operator is the controller of CCTV footage from the branch and payment details for reservations at this branch. Payments made with credits and vouchers do not fall under this.
  • The operator and GymRoom process data regarding reservations, branch access, and rule violations as joint controllers (Art. 26 GDPR). They have agreed that GymRoom handles communication with you and the administration of your rights. The essential parts of the agreement will be provided to you upon request.
  • GymRoom is the controller of data concerning your account, credits, vouchers, training sessions, communication with us, the newsletter, and website data.

Contact: info@gymroom.cz or by mail to the registered office of the operator or GymRoom. We have not appointed a Data Protection Officer, as this is not mandatory for us.

2. What Data, Why, and for How Long

User Account

  • Data: first name, last name, email, phone number, login credentials
  • Controller: GymRoom
  • Legal basis: performance of a contract, Art. 6(1)(b) GDPR
  • Retention period: for the duration of the account; we may cancel an account that has been inactive for 24 months

Reservations and Branch Access

  • Data: date and time, number of persons, access code, and time of its use
  • Controller: the operator and GymRoom jointly
  • Legal basis: performance of a contract
  • Retention period: 4 years from the date of the reservation

Payments for Branch Reservations

  • Data: amount, date, payment method; card details are only accessible to the Comgate payment gateway
  • Controller: the operator
  • Legal basis: legal obligation, Art. 6(1)(c) GDPR (accounting and tax regulations)
  • Retention period: 10 years

Credits and Vouchers

  • Data: balance and credit movements, voucher code, purchaser and recipient, related payment details
  • Controller: GymRoom
  • Legal basis: performance of a contract; accounting documents: legal obligation
  • Retention period: during validity (12 months) and an additional 4 years; accounting documents 10 years

Training Sessions with a Trainer and Classes

  • Data: name, contact details, date and time
  • Controller: GymRoom
  • Legal basis: performance of a contract
  • Retention period: 4 years from the session date

Clients Aged 15 to 17

  • Data: minor's name, name and contact details of the legal guardian, their consent
  • Controller: GymRoom
  • Legal basis: performance of a contract and legitimate interest in proving consent, Art. 6(1)(f) GDPR
  • Retention period: 4 years from the last visit

CCTV System at the Branch

  • Data: video and audio recordings
  • Controller: the operator
  • Legal basis: legitimate interest in the protection of persons and property and in proving rule violations, Art. 6(1)(f) GDPR
  • Retention period: 14 days; in the event of an incident, until it is resolved

Rule Violations and Damage

  • Data: incident report, record of damage, and possible access block
  • Controller: the operator and GymRoom jointly
  • Legal basis: legitimate interest in property protection and the enforcement of claims
  • Retention period: until resolution; record of an access block for its duration

Communication with Us

  • Data: name, contact details, message content (email, telephone, contact form)
  • Controller: GymRoom
  • Legal basis: legitimate interest in processing the inquiry, or performance of a contract
  • Retention period: 4 years from resolution

Commercial Communications to Clients

  • Data: email
  • Controller: GymRoom
  • Legal basis: legitimate interest, Art. 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.
  • Retention period: 5 years from the last reservation or until unsubscribed

Newsletter for Others

  • Data: email
  • Controller: GymRoom
  • Legal basis: consent, Art. 6(1)(a) GDPR
  • Retention period: until consent is withdrawn

Analytics and Marketing Cookies

  • Data: device identifiers, website visit data
  • Controller: GymRoom
  • Legal basis: consent
  • Retention period: according to cookie settings, up to a maximum of 2 years

Defence of Legal Claims

  • Data: data from the purposes mentioned above
  • Controller: the entity processing the respective data
  • Legal basis: legitimate interest
  • Retention period: until the end of the dispute

Data required for reservations are necessary for concluding the contract; without them, a reservation cannot be made. We do not process health data. We do not engage in automated decision-making that has legal effects.

We do not process any data regarding the client's guests, except for CCTV footage. The client is responsible for informing them of this.

3. Who We Share Data With

  • BRJ – Jan Barášek, Company ID: 05103118 (BizKitHub system): operation of the reservation system, access codes, and credits; processor.
  • Amazon Web Services: server hosting; processor.
  • Comgate a.s., Company ID: 27924505: payment gateway; independent controller of payment data.
  • Resend, Inc.: email delivery; processor.
  • Google Ireland Ltd. and Meta Platforms Ireland Ltd.: analytics and advertising, only with your cookie consent.
  • Trainers and instructors: name, contact details, and date and time of the training session or class. Any data you disclose to them directly is processed by them as independent controllers.
  • External accounting and legal advisors, debt collection services, and public authorities where required by law.

Resend, Amazon Web Services, Google, and Meta may also process data in the USA. Transfers take place based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

4. Cookies

We always use essential cookies necessary for logging in and completing reservations. We store analytical cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel) only with your consent. You can change your consent at any time via the "Cookie Settings" link in the website footer.

5. Your Rights

You have the right:

  • to access your data and receive a copy thereof,
  • to rectification or completion of your data,
  • to erasure, if we no longer need the data or process it unlawfully,
  • to restriction of processing,
  • to data portability for data processed based on a contract or consent,
  • to object to processing based on legitimate interest; and against commercial communications at any time and without giving a reason,
  • to withdraw consent at any time, without affecting the lawfulness of prior processing.

Exercise your rights at info@gymroom.cz. We will respond within one month at the latest. We may verify your identity.

If you disagree with the way we handle your data, you can file a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.