Effective from 18 October 2026
This is a translation. The original is the Czech version, which prevails in case of any discrepancy.
1. Who processes your data
The GymRoom Průhonice branch, Hlavní 19/19, 252 43 Průhonice, is operated by PrivateGR s.r.o., Company ID (IČO): 29765307, with its registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 451188 (hereinafter referred to as the "operator").
The gymroom.cz website, booking system, user accounts, credits, and vouchers are operated by GymRoom CZ s.r.o., Company ID (IČO): 21136947, with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 397263 (hereinafter referred to as "GymRoom").
Who is responsible for what:
- The operator is the controller of video surveillance recordings from the branch and payment details for reservations at this branch. Payments made with credits and vouchers do not fall under this category.
- The operator and GymRoom process data regarding reservations, branch admissions, and rule violations as joint controllers (Art. 26 GDPR). They have agreed that communication with you and the handling of your rights are managed by GymRoom. The essential arrangements of this agreement will be made available to you upon request.
- GymRoom is the controller of data regarding your account, credits, vouchers, training sessions, communication with us, the newsletter, and website data.
Contact: info@gymroom.cz or by mail to the registered office of the operator or GymRoom. We have not appointed a Data Protection Officer, as we are not required to do so.
2. What data, why, and for how long
User account
- Data: first name, last name, email, phone number, login credentials
- Controller: GymRoom
- Legal basis: performance of a contract, Art. 6(1)(b) GDPR
- Retention period: for the duration of the account; an account unused for 24 months may be cancelled
Reservations and entry to the branch
- Data: date and time, number of persons, access code, and time of its use
- Controller: operator and GymRoom jointly
- Legal basis: performance of a contract
- Retention period: 4 years from the date of the reservation
Payments for branch reservations
- Data: amount, date, payment method; card details are only accessible to the Comgate payment gateway
- Controller: operator
- Legal basis: legal obligation, Art. 6(1)(c) GDPR (accounting and tax regulations)
- Retention period: 10 years
Credits and vouchers
- Data: credit balance and transactions, voucher code, buyer and recipient, payments for them
- Controller: GymRoom
- Legal basis: performance of a contract; accounting records: legal obligation
- Retention period: during validity (12 months) and an additional 4 years; accounting records for 10 years
Training sessions with a trainer and classes
- Data: name, contact details, date and time
- Controller: GymRoom
- Legal basis: performance of a contract
- Retention period: 4 years from the session date
Clients aged 15 to 17 years
- Data: name of the minor, name and contact details of the legal guardian, guardian's consent
- Controller: GymRoom
- Legal basis: performance of a contract and legitimate interest in proving consent, Art. 6(1)(f) GDPR
- Retention period: 4 years from the last entry
CCTV system at the branch
- Data: video and audio recordings
- Controller: operator
- Legal basis: legitimate interest in protecting persons and property and proving violations of rules, Art. 6(1)(f) GDPR
- Retention period: 14 days; in the event of an incident, until it is resolved
Rule violations and damages
- Data: record of the incident, damage, and any potential blocking
- Controller: operator and GymRoom jointly
- Legal basis: legitimate interest in protecting property and enforcing claims
- Retention period: until resolved; record of blocking for its duration
Communication with us
- Data: name, contact details, message content (email, telephone, contact form)
- Controller: GymRoom
- Legal basis: legitimate interest in handling the inquiry, or performance of a contract
- Retention period: 4 years from resolution
Commercial communications to clients
- Data: email
- Controller: GymRoom
- Legal basis: legitimate interest, Art. 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.
- Retention period: 5 years from the last reservation or until unsubscribed
Newsletter for others
- Data: email
- Controller: GymRoom
- Legal basis: consent, Art. 6(1)(a) GDPR
- Retention period: until consent is withdrawn
Analytics and marketing cookies
- Data: device identifiers, website visit data
- Controller: GymRoom
- Legal basis: consent
- Retention period: according to cookie settings, maximum 2 years
Defense of legal claims
- Data: data from the above-mentioned purposes
- Controller: whoever processes the data
- Legal basis: legitimate interest
- Retention period: until the conclusion of the dispute
Data required for reservations is necessary to conclude a contract; without it, a reservation cannot be completed. We do not process data concerning health. We do not carry out automated decision-making producing legal effects.
We do not process any data about a client's guests except for CCTV footage. The client is responsible for informing them of this.
3. Who we share data with
- BRJ – Jan Barášek, Company ID (IČO): 05103118 (BizKitHub system): operation of the reservation system, access codes, and credits, processor.
- Amazon Web Services: server hosting, processor.
- Comgate a.s., Company ID (IČO): 27924505: payment gateway, separate controller of payment data.
- Resend, Inc.: email delivery, processor.
- Google Ireland Ltd. and Meta Platforms Ireland Ltd.: analytics and advertising, only with your consent to cookies.
- Trainers and instructors: name, contact details, and time of the training session or class. Data provided to them directly is processed by them as separate controllers.
- External accounting and legal advisors, debt collection services, and public authorities, if required by law.
Resend, Amazon Web Services, Google, and Meta may also process data in the USA. Transfers take place based on the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
4. Cookies
Essential cookies necessary for logging in and completing a reservation are always used. Analytical cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel) are stored only with your consent. You can change your consent at any time via the "Cookie settings" link in the website footer.
5. Your rights
You have the right:
- to access your data and obtain a copy of it,
- to rectification or completion of data,
- to erasure, if we no longer need the data or process it unlawfully,
- to restriction of processing,
- to portability of data that we process on the basis of a contract or consent,
- to object to processing based on legitimate interest; against commercial communications at any time and without giving any reason,
- to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise your rights, contact us at info@gymroom.cz. We will respond within one month at the latest. We may verify your identity.
If you disagree with the way we handle your data, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.