Foglalás

Privacy Policy

GymRoom Smíchov ·

Effective from 18 October 2026

Effective from 18 October 2026

This is a translation. The original is the Czech version, which prevails in case of any discrepancy.

1. Who processes your data

The GymRoom Smíchov branch at Plzeňská 488/39, 150 00 Prague 5, is operated by Dio Gym Smíchov, s.r.o., Company ID (IČO): 29510422, with its registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 447148 (hereinafter the "Operator").

The website gymroom.cz, the reservation system, user accounts, credits, and vouchers are operated by GymRoom CZ s.r.o., Company ID (IČO): 21136947, with its registered office at Kurzova 2222/16, Stodůlky, 155 00 Prague 5, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 397263 (hereinafter "GymRoom").

Who is responsible for what:

  • The Operator is the controller of video surveillance recordings from the branch and payment details for reservations at this branch. Payments made using credits and vouchers do not fall under this category.
  • The Operator and GymRoom process data regarding reservations, entries to the branch, and rule violations as joint controllers (Article 26 GDPR). They have agreed that communication with you and the handling of your rights will be managed by GymRoom. The essential parts of this agreement will be made available to you upon request.
  • GymRoom is the controller of data regarding your account, credits, vouchers, training sessions, communication with us, the newsletter, and website data.

Contact: info@gymroom.cz or by mail to the registered office of the Operator or GymRoom. We have not appointed a Data Protection Officer, as we are not required to do so.

2. What data we process, why, and for how long

User account

  • Data: first name, surname, email, telephone number, login credentials
  • Controller: GymRoom
  • Legal basis: performance of a contract, Article 6(1)(b) GDPR
  • Retention period: for the duration of the account; we may delete an account that has been inactive for 24 months

Reservation and entry to the branch

  • Data: date and time, number of persons, access code, and time of its use
  • Controller: the Operator and GymRoom jointly
  • Legal basis: performance of a contract
  • Retention period: 4 years from the reservation date

Payments for branch reservations

  • Data: amount, date, payment method; card details are only visible to the Comgate payment gateway
  • Controller: the Operator
  • Legal basis: legal obligation, Article 6(1)(c) GDPR (accounting and tax regulations)
  • Retention period: 10 years

Credits and vouchers

  • Data: balance and transaction history of credits, voucher code, buyer and recipient, payments for them
  • Controller: GymRoom
  • Legal basis: performance of a contract; invoices/records: legal obligation
  • Retention period: for the duration of validity (12 months) and subsequently for 4 years; accounting documents for 10 years

Personal training sessions and classes

  • Data: name, contact details, date and time
  • Controller: GymRoom
  • Legal basis: performance of a contract
  • Retention period: 4 years from the session date

Clients aged 15 to 17

  • Data: minor's name, name and contact details of the legal guardian, guardian's consent
  • Controller: GymRoom
  • Legal basis: performance of a contract and legitimate interest in proving consent, Article 6(1)(f) GDPR
  • Retention period: 4 years from the last entry

Video surveillance system (CCTV) at the branch

  • Data: video and audio recording
  • Controller: the Operator
  • Legal basis: legitimate interest in protecting persons and property and proving rule violations, Article 6(1)(f) GDPR
  • Retention period: 14 days; in the event of an incident, until it is resolved

Rule violations and damage

  • Data: record of the incident, damage, and potential account suspension
  • Controller: the Operator and GymRoom jointly
  • Legal basis: legitimate interest in protecting property and enforcing legal claims
  • Retention period: until resolved; suspension records for the duration of the suspension

Communication with us

  • Data: name, contact details, message content (email, telephone, contact form)
  • Controller: GymRoom
  • Legal basis: legitimate interest in resolving the inquiry, or performance of a contract
  • Retention period: 4 years from resolution

Commercial communications to clients

  • Data: email
  • Controller: GymRoom
  • Legal basis: legitimate interest, Article 6(1)(f) GDPR and Section 7(3) of Act No. 480/2004 Coll.
  • Retention period: 5 years from the last reservation or until unsubscribed

Newsletter for non-clients

  • Data: email
  • Controller: GymRoom
  • Legal basis: consent, Article 6(1)(a) GDPR
  • Retention period: until consent is withdrawn

Analytical and marketing cookies

  • Data: device identifiers, website visit data
  • Controller: GymRoom
  • Legal basis: consent
  • Retention period: according to cookie settings, maximum 2 years

Defense of legal claims

  • Data: data processed for the aforementioned purposes
  • Controller: the party processing the respective data
  • Legal basis: legitimate interest
  • Retention period: until the conclusion of the dispute

Data required for a reservation is necessary to enter into a contract; without it, a reservation cannot be completed. We do not process data concerning health. We do not engage in automated decision-making producing legal effects.

We do not process any personal data regarding clients' guests other than CCTV footage. The client is responsible for informing them of this.

3. Who we share data with

  • BRJ – Jan Barášek, Company ID (IČO): 05103118 (BizKitHub system): operation of the reservation system, access codes, and credits, processor.
  • Amazon Web Services: server hosting, processor.
  • Comgate a.s., Company ID (IČO): 27924505: payment gateway, separate controller of payment data.
  • Resend, Inc.: email distribution, processor.
  • Google Ireland Ltd. and Meta Platforms Ireland Ltd.: analytics and advertising, only with your consent to cookies.
  • Trainers and instructors: name, contact details, and date and time of the training session or class. Any data you disclose to them directly is processed by them as separate controllers.
  • External accounting and legal advisors, debt collection agencies, and public authorities, if required by law.

Resend, Amazon Web Services, Google, and Meta may also process data in the USA. Such transfers are conducted on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

4. Cookies

We always use necessary cookies essential for logging in and completing reservations. Analytical cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel) are only stored with your consent. You can change your consent preferences at any time using the "Cookie Settings" link in the website footer.

5. Your rights

You have the right to:

  • access your data and obtain a copy of it,
  • rectification or completion of your data,
  • erasure of your data if it is no longer needed or if it is being processed unlawfully,
  • restriction of processing,
  • data portability for data processed based on a contract or consent,
  • object to processing based on legitimate interest; object to commercial communications at any time and without stating a reason,
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

To exercise your rights, contact us at info@gymroom.cz. We will respond within one month at the latest. We may verify your identity before processing the request.

If you disagree with the way we handle your data, you have the right to lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.