Privacy Policy on the processing of personal data

Unless otherwise stated, this privacy policy (the “Policy”) sets out details concerning the processing and protection of personal data processed by JoinSpace s. r. o., Company ID No.: 53 678 605, Tax ID No.: 2121469163, with its registered office at Tomislava P. Kolakoviča 7412/5, 841 07 Bratislava - Devínska Nová Ves, Slovak Republic, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 151907/B (the “Controller” or “JoinSpace”) in connection with the operation and administration of the JoinSpace web application (the “System”) available via the website www.joinspace.sk (the “Website”). The Controller operates and provides the System on a software-as-a-service basis (software as a service).

The Controller operates and administers the System, which is primarily intended for receiving and comprehensive management of reservations for sports, movement and other activities within courses, lessons, trial lessons, training sessions, workshops or other one-off events (the “Course”). The System is intended for a broad range of users, but primarily for legal entities and other entities organising leisure activities as part of their business or non-profit activities, schools and clubs organising Courses (the “Studio”), as well as instructors working in Studios (the “Instructor”), and visitors and customers attending Courses organised by Studios (the “Client”).

The purpose of the System is to create a clear environment in which persons participating in Courses can manage their agenda simply and efficiently, in particular through functionality for comprehensive management of enrollments in courses and teaching or training sessions and a multi-level calendar. Through notification services and a communication environment, the System also creates conditions for more efficient administration in the staffing and financial areas of Studio operations.

The System may also be integrated with solutions provided by third parties, including payment gateways, accounting systems and solutions for sending electronic communications or bulk emails. In operating and providing the System, the Controller also uses third-party services necessary or useful in particular for providing cloud infrastructure and hosting of the System, authentication and user account management, electronic communications, security and protection against misuse, displaying maps, locations and address suggestions, as well as monitoring the availability and technical operation of the System, error diagnostics and analytics of use of the Website or the System to the extent described in this Policy.

From a data protection perspective, when operating the System and providing System services, the Controller acts both as a controller (i.e. an entity that determines which personal data of data subjects need to be processed and for what purposes related to the System) and as a processor (i.e. an entity that processes selected personal data on behalf of third parties, which are in particular Studios, including Instructors).

This Policy applies to the processing and protection of personal data for the purposes of and in connection with operation of the System. The Controller is not the provider of Courses and does not determine the purposes for which a Studio processes personal data when organising its own activities. Where the relevant Studio is the controller for a particular processing activity, that Studio determines and is responsible for the legal basis, purpose, retention period and compliance with information obligations; to that extent, the Controller processes the data on the Studio’s behalf as a processor under the JoinSpace Terms and Conditions and the Data Processing Agreement. The relevant Studio provides data subjects with details of processing carried out for the Studio’s own purposes.

The Controller assures data subjects that it processes personal data fully in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”) and, to the extent applicable to the processing, Act No. 18/2018 Coll. on Personal Data Protection.

In connection with the operation and administration of the System, personal data are processed in relation to a data subject who, depending on the circumstances, may be a natural person acting as:

• (a)

  Owner – a person who registered the Studio in the System under their Account and who, when creating, activating and managing the Studio, acts in the name and on behalf of the Studio;

• (b)

  Administrator – a person authorised by the Owner or another authorised person of the Studio to manage selected parts of the System on behalf of the Studio, in particular Courses, Lessons or Enrollment Applications;

• (c)

  Instructor – a person in an employment, commercial or other relationship with the Studio whom the Studio authorises to organise or conduct a particular Course, teach or substitute for a Lesson, and who uses the System functions made available for managing schedules, availability, absences or attendance. If a natural person organises activities in their own name as an independent Studio, they may also act as the Owner;

• (d)

  Client – a natural person who, through the System, searches for, books, enrolls in or manages their participation in a Course, Lesson or another Studio activity. If the Client manages a Child’s participation through their Account, the Client also acts as the Child’s Legal Guardian or guardian;

• (e)

  Child – a minor whose profile in the System is managed by one or more Legal Guardians or guardians through their Accounts and who may participate in Studio activities. A Child does not have a separate user Account in the System;

Each person (other than a Child) who uses the System as a registered User has an account (the “Account”) linked to a specific natural person. Depending on the roles assigned to them, a person may use the same Account as a Client, Legal Guardian, Instructor, Administrator or Owner.

In the broader context of its activities, the Controller may also process personal data of other data subjects, namely the following persons:

• (a)

  Website visitors, where they themselves provide personal data to the Controller, for example by submitting a question about operation of the System, completing a demo interest form or another contact form. The data are processed to the extent necessary to handle the relevant request;

• (b)

  the Controller’s business partners and their representatives, where they contact the Controller or are contacted by the Controller for the purpose of establishing business cooperation or performing business and related relationships. In such cases, the Controller may process their personal data to the extent necessary to identify the data subject as a business partner or an authorised representative of a business partner. Depending on the circumstances, this may include the following personal data: (i) title, first name and surname, (ii) residential address, (iii) date of birth, (iv) bank account details, (v) job position, (vi) email address, (vii) telephone number. Depending on the particular circumstances, this may also include other personal data reasonably provided by the business partner to the Controller in connection with their business relationship; and

• (c)

  employees, in relation to whom the Controller will process personal data to the extent necessary for performance of a contract concluded with the relevant data subject, as well as personal data necessary for compliance with the Controller’s statutory obligations as an employer. Details of the processing of personal data are set out in a separate document made available to these data subjects in accordance with the Controller’s internal rules.

The Controller obtains personal data primarily directly from the data subject during registration, use of the System or communication with the Controller. Data relating to a Child are obtained primarily from the Child’s Legal Guardian or guardian. Certain data may also be entered into the System by the Studio, Owner, Administrator or Instructor within the scope of their authorisations. Technical, security and audit data may be generated automatically when the System is used.

Depending on the functionality used and the role of the data subject, the following categories of personal data may in particular be processed in the System:

• (a)

  data required to create and manage an Account, including in particular first name, surname, email address, telephone number, if provided or used, date of birth, gender, authentication identifiers and data required to manage roles and access permissions;

• (b)

  data required to create an Instructor profile, including in particular first name, surname, gender, date of birth, telephone number, email address, age, photograph, form of relationship with the Studio, data relating to the Instructor’s workload, such as a work calendar showing information on the Instructor’s availability, workload and available capacity, data on the location of the next Course conducted by the Instructor, data for performance of certain contractual obligations of the Instructor, such as reported absences from a Course, annual leave, incapacity for work and similar information, and other data the Instructor chooses to provide in their personal profile;

• (c)

  data required for use of the System by a Client and for Enrollment Applications for Studio activities, including in particular first name, surname, email address, telephone number, if provided, date of birth or age, gender, data relating to Courses, Lessons and Enrollment Applications, in particular the type of activity, the relevant Studio and Instructor, location and time, Enrollment Application status, participation and attendance, Trial Lessons and Make-up Lessons, data relating to payment and financial records, in particular payment method, Payment Instructions, payment status or reference, records of paid and unpaid amounts or documents, discounts, benefits or similar advantages applied, data relating to Child profiles linked to the Client’s Account, as well as other data reasonably provided by the Client in their profile, Enrollment Application or when using the System;

• (d)

  data required to create a Child profile and enroll the Child in a Studio activity, including in particular first name, surname, date of birth or age, gender, data relating to Courses, such as the type of Course, the Studio organising the Course, the Instructor conducting the Course, the location of the next Course in which the Child is enrolled and similar information, and information about the Accounts of Legal Guardians or guardians to which the Child’s profile is linked;

• (e)

  billing, payment and contractual data, including in particular the first name and surname of a natural person, business name or name, permanent residence address, place of business, registered office or another billing address, Company ID No., Tax ID No., VAT ID No. and other data required to identify a contracting or billing party, data stated on invoices and other accounting or tax documents, bank account or payment details, if processed, as well as data relating to the establishment, duration, amendment or termination of the relevant contractual relationship, to the extent that they constitute personal data.

• (f)

  personal data provided by Website visitors, including in particular identification, contact and other data voluntarily provided by a visitor in a form or in communications with the Controller;

• (g)

  technical, operational and security data, including in particular IP address, device type and version, browser and operating system, date and time of access, source of the visit or referring page, page visited, data on interaction with the page, screen resolution, consent status, session identifiers, audit logs, error reports and data required to protect the System against misuse;

• (h)

  cookies, browser storage data and online identifiers, the use, categories, purposes and retention periods of which are described in more detail in the Cookie Policy.

The final scope of personal data processed through the System may depend on the functionality used, the requirements of the relevant Studio and the data the data subject chooses to provide. The Controller strongly encourages data subjects to consider which personal data they provide beyond those required for the actual functionality and use of the System and recommends providing only personal data necessary to achieve their intended purposes.

The Controller does not use automated individual decision-making within the meaning of Article 22 GDPR when processing personal data of data subjects.

The processing of personal data may include elements of profiling, in particular for the purpose of personalising System content, recommending Courses or other activities and selecting suitable marketing, advertising, discount or other commercial offers of the Controller or its contractual partners for the User.

Personalisation may be based in particular on use of the System, selected activities and Enrollment Applications managed through the User’s Account. If the User manages a Child profile through their Account, personalisation may also take into account activities and Enrollment Applications managed through their Account for the Child.

Recommendations and marketing, advertising, discount or other commercial offers based on such processing are addressed to the User, not to the Child.

The Controller does not use such profiling for automated individual decision-making under Article 22 GDPR.

The Controller retains personal data of data subjects only for as long as necessary to achieve the specific purpose of processing. Unless a specific purpose or legal regulation requires a different retention period, personal data processed by JoinSpace as controller are retained after the end of the relevant legal relationship only for as long as reasonably necessary, in particular to complete related processes, protect legal claims and demonstrate compliance, generally for no longer than 4 years. This rule does not apply to data for which legal regulations require a longer retention period or to data that must be retained for longer in connection with an ongoing dispute, inspection or legal claim. Data processed on behalf of a Studio are retained in accordance with the Studio’s instructions, the Terms and Conditions and the Data Processing Agreement. Where demonstrable consent is used for direct marketing under Section 116 of Act No. 452/2021 Coll. on Electronic Communications, the record of such consent is retained for at least four years after its withdrawal, where that provision applies to the particular case.

After the applicable period has expired, the Controller may continue to retain personal data exclusively in anonymised form where necessary for statistical, analytical, research or other legally permitted purposes and provided that appropriate technical and organisational measures are taken to protect the rights and freedoms of data subjects. Data anonymised in this way are no longer personal data and the Controller may retain and further process them without a time limit, provided that a specific data subject cannot be re-identified from them.

The primary purpose of processing personal data of data subjects reflects the purpose of the System, i.e. to create a tool for organising and managing sports, movement and other leisure activities for all persons participating in Courses and Lessons, including related administration, communications and records of Payment Instructions and payment processing. The Controller processes the relevant personal data of data subjects for the purpose of providing such a service through the System. For individual data subjects, this primary purpose may overlap with the following additional purposes:

• (a)

  comprehensive management and organisation of Courses and Lessons, planning staff and venue capacity, management of Enrollment Applications, attendance and payment records in the case of Owners and Administrators;

• (b)

  management of schedules, availability, assigned Courses and Lessons, absences, substitutions and attendance in the case of Instructors;

• (c)

  organisation and management of the Client’s own participation, or the participation of a Child, in activities of one or more Studios in the case of Clients and Legal Guardians;

• (d)

  handling enquiries, forms and other communications from Website visitors or Users;

• (e)

  analysis of traffic, traffic sources, use and performance of the Website or System, evaluation of user interactions and the effectiveness of the Controller’s communications, error diagnostics and improvement of the user experience;

• (f)

  ensuring the functionality, availability and security of the Website and System, protecting Accounts and public forms and preventing misuse.

• (g)

  sending system and transactional emails, SMS messages and other notifications required for operation of the System or for communication between a Studio and a User;

• (h)

  the Controller’s marketing communications and personalisation of marketing, advertising, discount or other commercial offers of the Controller or its contractual partners for the User, in particular on the basis of use of the System and activities and Enrollment Applications managed through the User’s Account, where an appropriate legal basis exists for such processing.

The Controller processes personal data of data subjects on the following legal bases:

• (a)

  Performance of a contract and pre-contractual steps

  The processing of personal data by the Controller is necessary in order for the Controller to enter into a contract and subsequently perform the obligations arising from the relevant contract. On this legal basis, the Controller processes in particular personal data of data subjects with whom it has concluded a contract for use of the System under the Controller’s applicable Terms and Conditions. In such a case, the legal basis for processing the personal data of data subjects is therefore performance of the Controller’s obligation to provide the System service.

• (b)

  Compliance with legal obligations

  The processing of personal data by the Controller is also necessary in order for the Controller to comply with its statutory obligations, including the provision of personal data to public authorities and other public-law entities.

• (c)

  Legitimate interests of the Controller

  In certain cases, the Controller processes personal data on the basis that it has a legitimate interest in such processing. These cases include (i) asserting claims or defending against claims asserted, and (ii) demonstrating compliance with applicable legal regulations, including data protection regulations, for example in response to requests from supervisory authorities.

  Where the Controller’s processing of personal data is based on legitimate interests, the Controller has, following a careful assessment of the circumstances, concluded that the interests or fundamental rights or freedoms of the data subject requiring protection of personal data do not override the Controller’s legitimate interest. The scope of personal data processed for these purposes is limited to what is strictly necessary.

• (d)

  Consent

  The Controller may ask a data subject to consent to the processing of personal data. On the basis of consent, the Controller may process personal data in particular for the use of optional analytical and functional technologies, marketing communications and the display or sending of marketing, advertising, discount or other commercial offers of the Controller or its contractual partners.

  For the purpose of personalising such offers, the Controller may, on the basis of consent, take into account use of the System and the history of activities and Enrollment Applications managed through the User’s Account, including activities and Enrollment Applications managed through the User’s Account for a Child.

  Consent may be withdrawn at any time in the manner indicated when it was given or by sending a request to the email address specified in Article 14.3 of this Policy.

Legal basis for the Studio’s marketing communications

If a Studio uses Client contact details obtained through the System to promote its own Courses, Lessons or other services, the Studio acts as a separate controller for such processing. The relevant Studio is responsible for determining the appropriate legal basis, complying with information obligations and observing the rules on direct marketing under the GDPR and applicable legal regulations governing electronic communications.

The Controller does not currently provide Studios with functionality for obtaining, recording or managing Client consents to Studio marketing communications. Where a Studio’s marketing communications are based on the data subject’s consent, the relevant Studio is responsible for properly obtaining, recording and demonstrating that consent, as well as for enabling its withdrawal and giving effect to any withdrawal.

An integral characteristic of the System is that it connects the interests of multiple parties. The System serves as a platform on which these persons - Studios and Instructors on the one hand and Clients on the other - pursue their interests. The Controller therefore informs data subjects that their personal data will also be made available to third parties, namely:

• (a)

  personal data of the Owner and Administrator to the relevant Studio and other authorised persons of the Studio to the extent necessary to manage access rights and the Studio’s activities;

• (b)

  personal data of an Instructor to the relevant Studio, its Owner or an authorised Administrator and, to the extent necessary to organise a particular Course or Lesson, also to Clients or Legal Guardians;

• (c)

  personal data of a Client and Legal Guardian to the relevant Studio and its authorised Owners, Administrators or Instructors to the extent necessary to manage the Enrollment Application, participation, attendance, payments and communications; and

• (d)

  data relating to a Child to the relevant Studio and its authorised persons to the extent necessary to manage the Child’s participation in a particular activity, and to the Legal Guardian or guardian who manages the Child’s profile.

For processing activities in which the Controller acts as an independent controller, it may use third parties acting as its processors to process personal data. When processing personal data on behalf of a Studio, the Controller may engage additional processors (the “Sub-processors”) under the conditions set out in the Data Processing Agreement. The current list of Sub-processors is available in the manner specified in the Data Processing Agreement. The Controller’s own employees process personal data of data subjects solely on the basis of and within the scope of an authorisation granted by the Controller.

Where the data subject consents, the data subject’s personal data may also be provided to other third parties with which the Controller cooperates or will cooperate. The Controller will ensure that any such disclosure of personal data is fully compliant with applicable legal regulations.

The Controller may also transfer personal data to third parties that process them for their own purposes. Such third parties include, without limitation, public authorities and other public-law entities in connection with compliance with the Controller’s statutory obligations or for the purpose of responding to enquiries that such authorities or entities may have.

In operating the System, the Controller uses external service providers that may process personal data to the extent necessary. These include, in particular, providers of cloud infrastructure and hosting, authentication and identity management, electronic communications, security services, monitoring and diagnostics, and mapping and address services.

Sign-in using an external account

• (a)

  Authentication and user account management are technically provided by the Clerk service. Information on Clerk’s processing of personal data is available in the Clerk Privacy Policy.

• (b)

  A User may, depending on the options currently available, also sign in using a Google, Microsoft or Apple account. When such sign-in is used, JoinSpace may obtain through Clerk only the data necessary for authentication and for creating or linking the Account, in particular the User’s unique identifier, email address, first name, surname and display name, if made available by the relevant identity provider.

  JoinSpace uses these data to create or link the Account, verify the User’s identity, enable sign-in and secure the Account. Through such sign-in, JoinSpace does not obtain the User’s password or access to the content of the User’s account with the relevant provider, such as emails, files, calendars or contacts.

  When signing in with Apple ID, the User may use, instead of their actual email address, a private email address provided by Apple to protect their privacy.

• (c)

  Google, Microsoft and Apple may process personal data during authentication in accordance with their own privacy policies and, to the relevant extent, act as separate controllers:

  • (i)

    Google Privacy Policy

  • (ii)

    Microsoft Privacy Statement

  • (iii)

    Apple Privacy Policy

External services used on the Website and in the System

• (a)

  Google Maps Platform - The System uses Google Maps services primarily to display maps and provide address suggestions. When this functionality is used, the User’s browser may communicate directly with Google services, which may process in particular the User’s IP address, search data and technical device data in accordance with the Google Privacy Policy.

  Use of Google Maps is subject to the Google Maps End User Additional Terms of Service and the Google Privacy Policy.

• (b)

  Cloudflare Turnstile - The System uses Cloudflare Turnstile on selected public forms to protect against bots and automated misuse. During verification, Cloudflare may process technical and security data required to assess the request. Details are available in the Cloudflare Privacy Policy.

• (c)

  Google Analytics – The Controller may use Google Analytics, a service provided by Google, to measure traffic and analyse use of the Website and System. Depending on the consent settings, the service may process technical and analytical data relating to visits to and use of the Website or System.

  If the data subject does not allow statistical cookies, Google Analytics may be used in a limited mode without storing or reading analytics cookies or persistent analytics identifiers, while limited technical signals may be sent for the purposes of aggregated measurement and traffic modelling.

  Details of the use of Google Analytics and the relevant cookies are set out in the Cookie Policy. Information on processing of data by Google is available in the Google Privacy Policy.

Personal data are primarily processed within the European Union and the European Economic Area. If the use of an external provider results in a transfer of personal data to a third country, such transfer will take place only in accordance with the GDPR and with an appropriate personal data protection mechanism in place.

As a data subject, you have the following rights:

• (a)

  Right to information

  As a data subject, you have the right to be informed about all material aspects of the processing of your personal data, subject to exceptions provided by law. The Controller fulfils this obligation primarily through this Policy. If this Policy is amended or supplemented, we will inform you.

• (b)

  Right of access

  You have the right to access personal data concerning you that are being processed. This right includes the right to be informed whether or not your personal data are being processed, which personal data are being processed, and the purpose of the processing. The Controller is not required to provide details or the personal data being processed if doing so could adversely affect the rights and freedoms of other persons.

• (c)

  Right to rectification

  You have the right to have personal data rectified or completed if the personal data being processed are inaccurate or incomplete. If you believe that personal data processed by the Controller are inaccurate or incomplete, please notify the Controller using the contact details specified in Article 1.1 or the email address specified in Article 14.3 of this Policy, and the Controller will rectify or complete such inaccurate or incomplete data without undue delay.

• (d)

  Right to erasure (“right to be forgotten”)

  We will erase your personal data if: (i) the personal data are no longer necessary for the purpose for which they were collected or processed and there is no legal basis for further processing of those personal data, (ii) you object to the processing of your personal data and the legitimate grounds on your side override our legitimate interests, (iii) the personal data are found to have been processed unlawfully, or (iv) the Controller has a statutory obligation to erase those personal data.

  Please note that we may refuse to erase your personal data where the processing of personal data is permitted or required by law or is based on a legal basis other than your consent.

• (e)

  Right to object and restrict processing

  You also have the right to object to certain processing activities or to request restriction of the processing of personal data, for example if you believe that the personal data being processed are inaccurate, if you believe that the processing of personal data is unlawful, or if you believe that the Controller no longer needs the personal data for the purposes specified in this Policy.

  You have the right to object to the processing of personal data based on legitimate interests. In such a case, we will assess whether the legitimate grounds on our side override your legitimate interests.

• (f)

  Right to data portability

  You also have the right to request that your personal data which you have provided to us and which are processed on the basis of your consent or in connection with a contract between you and the Controller be provided to you in a structured, commonly used and machine-readable format, where technically feasible. Where technically feasible, you may also request that such personal data be transmitted to another controller.

• (g)

  Right to lodge a complaint with a supervisory authority

  If you suspect that your rights relating to the protection of your personal data have been infringed, please contact the Controller using the contact details specified in Article 1.1 or the email address specified in Article 14.3 of this Policy.

  You also have the right to lodge a complaint directly with the supervisory authority, which is:

  Name: Office for Personal Data Protection of the Slovak Republic

  Address: Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovak Republic

  Telephone: +421 2 323 132 14

  Email: statny.dozor@pdp.gov.sk

  Website: https://dataprotection.gov.sk

If your request concerns processing for which a particular Studio is the controller, JoinSpace will inform you of that fact or forward the request to the relevant Studio to the extent permitted by law and will provide the Studio with the necessary assistance as processor.

The Controller implements appropriate technical, organisational and security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the nature of the processing, these measures include, in particular, access and role management, protection of authentication, encrypted communications, audit and security logs, backups and security incident response procedures. However, the Controller cannot guarantee the security of information transmitted over the internet.

Personal data are processed primarily by automated means in electronic form through the System and related technical services. In the broader context of the Controller’s activities, in particular in connection with business, accounting or employment-related matters, certain personal data may also be processed non-automatically in paper form; appropriate measures for their protection apply in such cases as well.

This Policy takes effect on 1 September 2026.

The Controller may amend this Policy at any time at its discretion. The Controller will inform data subjects of any such amendment in advance by making the updated version of this Policy available on the Website. Data subjects who have provided their email addresses may also be sent a notice of such amendment and its planned effective date to the email address provided during registration or otherwise notified to the Controller. However, publication of the updated version on the Controller’s Website is decisive for the effectiveness of an amendment to the Policy. Website visitors and data subjects are therefore advised to review the current version of the Policy from time to time, as it will apply to them.

For communications, questions relating to personal data protection and the exercise of rights under this Policy, the Controller’s contact email address is info@joinspace.sk.