Foglalás

Privacy Policy

GymRoom Plzeň Skvrňany ·

Effective from October 18, 2026

Effective from October 18, 2026

This is a translation. The original is the Czech version, which prevails in case of any discrepancy.

1. Who Processes Your Data

The GymRoom Plzeň Skvrňany branch, Karla Steinera 910/7, 318 00 Plzeň, is operated by GRM PrivateGym s.r.o., ID No. (IČO): 29528593, with its registered office at Luďka Pika 470/15, Doudlevce, 301 00 Plzeň, registered in the Commercial Register maintained by the Regional Court in Plzeň, Section C, Insert 48466 (hereinafter referred to as the "Operator").

The website gymroom.cz, the reservation system, user accounts, credits, and vouchers are operated by GymRoom CZ s.r.o., ID No. (IČO): 21136947, with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 397263 (hereinafter referred to as "GymRoom").

Who is responsible for what:

  • The Operator is the controller of video surveillance records from the branch and payment data for reservations of this branch. Payments made via credits and vouchers are excluded from this.
  • The Operator and GymRoom process data regarding reservations, entries to the branch, and rule violations as joint controllers (Art. 26 GDPR). They have agreed that communication with you and the handling of your rights are managed by GymRoom. Essential parts of this agreement will be provided to you upon request.
  • GymRoom is the controller of data regarding your account, credits, vouchers, training sessions, communication with us, the newsletter, and website data.

Contact: info@gymroom.cz or by mail to the registered office of the Operator or GymRoom. We have not appointed a Data Protection Officer, as it is not mandatory for us.

2. What Data, Why, and for How Long

User Account

  • Data: first name, last name, email, phone number, login credentials
  • Controller: GymRoom
  • Legal basis: performance of a contract, Art. 6(1)(b) GDPR
  • Retention period: for the duration of the account; an account unused for 24 months may be canceled

Reservations and Branch Entry

  • Data: date/time, number of persons, access code, and time of its use
  • Controller: the Operator and GymRoom jointly
  • Legal basis: performance of a contract
  • Retention period: 4 years from the date of the reservation

Payments for Branch Reservations

  • Data: amount, date, payment method; card details are visible only to the Comgate payment gateway
  • Controller: the Operator
  • Legal basis: legal obligation, Art. 6(1)(c) GDPR (accounting and tax regulations)
  • Retention period: 10 years

Credits and Vouchers

  • Data: credit balance and transactions, voucher code, buyer and recipient, payments for them
  • Controller: GymRoom
  • Legal basis: performance of a contract; tax documents: legal obligation
  • Retention period: for the duration of validity (12 months) and subsequently 4 years; accounting documents 10 years

Trainings with a Coach and Lessons

  • Data: name, contact details, date/time
  • Controller: GymRoom
  • Legal basis: performance of a contract
  • Retention period: 4 years from the date/time

Clients Aged 15 to 17

  • Data: name of the minor, name and contact details of the legal guardian, their consent
  • Controller: GymRoom
  • Legal basis: performance of a contract and legitimate interest in proving consent, Art. 6(1)(f) GDPR
  • Retention period: 4 years from the last entry

CCTV System at the Branch

  • Data: video and audio recording
  • Controller: the Operator
  • Legal basis: legitimate interest in protecting persons and property and proving violations of the rules, Art. 6(1)(f) GDPR
  • Retention period: 14 days; in the event of an incident, until it is resolved

Violations of Rules and Damages

  • Data: record of the incident, damage, and any potential blocking
  • Controller: the Operator and GymRoom jointly
  • Legal basis: legitimate interest in protecting property and enforcing claims
  • Retention period: until resolved; record of blocking for its duration

Communication with Us

  • Data: name, contact details, message content (email, telephone, contact form)
  • Controller: GymRoom
  • Legal basis: legitimate interest in handling the inquiry, or performance of a contract
  • Retention period: 4 years from handling

Commercial Communications to Clients

  • Data: email
  • Controller: GymRoom
  • Legal basis: legitimate interest, Art. 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.
  • Retention period: 5 years from the last reservation or until unsubscribing

Newsletter for Others

  • Data: email
  • Controller: GymRoom
  • Legal basis: consent, Art. 6(1)(a) GDPR
  • Retention period: until consent is withdrawn

Analytical and Marketing Cookies

  • Data: device identifiers, website visit data
  • Controller: GymRoom
  • Legal basis: consent
  • Retention period: depending on cookie settings, up to a maximum of 2 years

Defense of Legal Claims

  • Data: data from the above-mentioned purposes
  • Controller: whichever party processes the data
  • Legal basis: legitimate interest
  • Retention period: until the dispute is concluded

Data required for reservations is necessary to conclude the contract; without it, a reservation cannot be made. We do not process data concerning health. We do not engage in automated decision-making with legal effects.

We do not process any data about the client's guests other than the CCTV recordings. The client is responsible for informing them.

3. To Whom We Disclose Data

  • BRJ – Jan Barášek, ID No. (IČO): 05103118 (BizKitHub system): operation of the reservation system, access codes, and credits, processor.
  • Amazon Web Services: server hosting, processor.
  • Comgate a.s., ID No. (IČO): 27924505: payment gateway, independent controller of payment data.
  • Resend, Inc.: email distribution, processor.
  • Google Ireland Ltd. and Meta Platforms Ireland Ltd.: analytics and advertising, only with your consent to cookies.
  • Trainers and instructors: name, contact details, and date/time of the training or lesson. Data you provide directly to them is processed by them as independent controllers.
  • External accounting and legal advisors, debt recovery agencies, and public authorities, where required by law.

Resend, Amazon Web Services, Google, and Meta may also process data in the US. Transfers take place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

4. Cookies

We always use necessary cookies for logging in and completing reservations. We store analytical cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel) only with your consent. You can change your consent at any time via the "Cookie Settings" link in the footer of the website.

5. Your Rights

You have the right to:

  • access your data and receive a copy of it,
  • rectify or supplement data,
  • erasure, if we no longer need the data or process it unlawfully,
  • restriction of processing,
  • data portability for data we process on the basis of a contract or consent,
  • object to processing based on legitimate interest; against commercial communications at any time and without giving any reason,
  • withdraw consent at any time, without affecting the lawfulness of processing prior to its withdrawal.

Exercise your rights at info@gymroom.cz. We will respond within one month at the latest. We may verify your identity.

If you disagree with the way we handle your data, you can lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.