Privacy Policy

1. Data controller

The controller of personal data is Urban Network s.r.o., company ID (IČO) 24963437, with its registered office at Jana Palacha 17, 252 63 Roztoky, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 446075, e-mail info@room4fitness.cz (the “controller”). Processing is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and by Act No. 110/2019 Coll., on the Processing of Personal Data.

2. What data we process

• Identification and contact data: first name and surname, e-mail, phone.
• Billing data (for companies, optional): business name, company ID (IČO), VAT ID (DIČ), registered address. Some of these are filled in from the public ARES register based on the company ID entered.
• Booking data: the selected Space, dates and time blocks, price, any discount code applied and an optional note on the booking.
• Payment data: we do not store your payment card or payment details; they are processed by the payment gateway. We keep only the payment result and its identifier for accounting and complaint purposes.
• Communication data: the content of communication by e-mail or through the contact form, if you contact us (e.g. a question or complaint about a booking).
• User account data (if you have one): name, e-mail, phone and password. We store the password only as an irreversible hash, never in readable form.
• Sign-in records: the date and time of a sign-in attempt, the e-mail or phone entered, the IP address and the browser. These secure the account and limit repeated attempts to guess a password.
• Technical data: data needed to deliver your booking confirmation and access code (e-mail, phone) and data stored in your browser (see Article 10).

3. Purposes and legal basis of processing

• Concluding and performing the contract (creating and carrying out the booking, sending the confirmation and access code, communicating with the customer about the booking) under Article 6(1)(b) GDPR.
• Operating a user account (creating the account, verifying the e-mail address, signing in and showing you your bookings) under point (b). An account is optional; a booking can be made just as well without one.
• Compliance with legal obligations (accounting and tax documents) under point (c).
• Legitimate interests of the controller (securing operations including sign-in records, preventing misuse, establishing and exercising legal claims in disputes or in case of damage) under point (f).

Providing contact and booking data is a contractual requirement; without it a booking cannot be created and the contract cannot be concluded.

4. Camera system (CCTV)

To protect property and the safety of people, and to check compliance with the house rules (in particular the number of people and unauthorised overtime), the Spaces are monitored by a recording camera system. By entering a Space, the visitor becomes a data subject of this processing.

• Scope: video recording of the Space. Cameras are not placed in areas with a heightened expectation of privacy (e.g. showers, changing areas).
• Legal basis: the controller's legitimate interest in protecting property and safety under Article 6(1)(f) GDPR.
• Retention period: recordings are overwritten automatically; we keep them for no longer than [7–14 days], and longer only if necessary to deal with a security incident, damage or a legal claim.
• Recipients: a recording may be made available to law enforcement authorities or an insurer if needed to deal with an incident.

Areas monitored by cameras are marked with an information sign. The data subject rights in Article 8 also apply to camera recordings.

5. Recipients and processors

We share data only to the extent necessary with trusted processors:

• GoPay payment gateway (GOPAY s.r.o.): processing of online payments.
• E-mail and SMS service provider: delivery of the confirmation and access code.
• Hosting provider: operation of the website and the booking system.
• Accountant / tax adviser: bookkeeping.

To verify company details, we query the public ARES register (administered by the Ministry of Finance of the Czech Republic). We do not pass data to third parties for their own marketing purposes.

6. Transfers outside the EU

Processing takes place within the European Union / EEA. The website does not use any external content delivery networks (CDN); fonts and all static files are hosted directly on our server. No data is transferred to third countries.

7. Retention period

• Booking and contract data: for the duration of the contractual relationship and then for the limitation periods for any claims (usually 3 years).
• Accounting and tax documents: for the statutory period of 10 years.
• User account data: for as long as the account exists. If you close the account, we anonymise the data stored in the account (name, phone, billing details, password) and release the e-mail address. The details on individual bookings are unchanged — they form part of a concluded order and are kept for the periods set out above. If you would like those erased as well, write to us under Article 8; we will comply to the extent that the law does not require us to keep them.
• Sign-in records: 90 days, after which they are deleted automatically.
• Browser data (basket): deleted automatically after 24 hours at the latest.

Once these periods expire, we delete or anonymise the data.

8. Your rights

With regard to your data, you have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. Please send requests to info@room4fitness.cz.

If you have a user account, you can correct your details directly in the “Můj účet” (My account) section and close the account there as well; what happens to your data when you do is described in Article 7.

You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.

We do not use your personal data for automated individual decision-making or profiling within the meaning of Article 22 GDPR.

9. Security of personal data

We have adopted appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unauthorised alteration. Data transferred between your browser and the server is encrypted (HTTPS).

10. Cookies and browser storage

The website does not use analytics or marketing cookies. For booking to work, it stores only strictly necessary data in your browser: the contents of the basket in localStorage, which is deleted automatically within 24 hours. This data never leaves your device and is not used for profiling.

If you sign in to a user account, we additionally store two strictly necessary cookies: a sign-in cookie valid for the session and — if you tick “Zůstat přihlášen(a)” (Stay signed in) — a persistent sign-in cookie valid for 30 days. Both exist solely so the site recognises you on your next request; signing out clears them. Neither is used for analytics or profiling.

11. Changes to this policy

The current version is always available on this page. If the scope or purpose of processing changes substantially, the controller will publish an updated version here with a new effective date.