TSM Sokol Vysočanycourt booking · clay

Privacy Policy

Here we explain what personal data we process about you when you book a court on tsmsokolvysocany.cz, why we need it, who receives it and how long we keep it. It follows Regulation (EU) 2016/679 (GDPR), in particular Article 13. Effective from 4 November 2026. The Czech version is authoritative.

1. Data controller

The controller of your personal data is the club:

  • TSM SOKOL VYSOČANY, z.s. (registered association)
  • Company ID (IČO): 02278120
  • Registered office: Novoškolská 696/2, Vysočany, 190 00 Prague 9, Czech Republic
  • Registered in the register of associations kept by the Municipal Court in Prague, file no. L 26305
  • E-mail: rezervace@tsmsokolvysocany.cz

The booking website is run for the club, and payments for bookings are received, by Viktoriya Bon, company ID 21665885, with registered office at Sobí 1178/6, 198 00 Prague 9.

We have no data protection officer. For questions and requests, contact rezervace@tsmsokolvysocany.cz.

2. What data we process, why and on what basis

Data you give us yourself or that arises when you use the website:

  • Sign-in — the phone number or e-mail we send a one-time code to, and a fingerprint (hash) of that code (the code is valid for 10 minutes). If you set a password, we store only its secure hash. Legal basis: performance of a contract, so that you can create an account and book (Art. 6(1)(b) GDPR).
  • Account and bookings — first name, surname, e-mail, phone, court, time, price, booking status and cancellation. Legal basis: performance of a contract.
  • Payments — payment status, amount, payment reference and bank transfer details (account number, payment message). You enter card details directly with Stripe; we have no access to them. Legal basis: performance of a contract.
  • Booking messages — confirmations, a reminder two hours before the start, information about payment, rescheduling or cancellation, by e-mail or, where applicable, SMS. Legal basis: performance of a contract. We do not send you advertising.
  • Questions and complaints — the first name, surname, phone, message text and optional booking reference you enter in the contact form, or what you write by e-mail to the contact address. Legal basis: legitimate interest in handling your enquiry (Art. 6(1)(f) GDPR); for a complaint, performance of a contract.
  • Accounting and tax records — the data the law requires on a document. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • Protection against sign-in abuse and technical server logs — see below. Legal basis: legitimate interest in securing and properly operating the service (Art. 6(1)(f) GDPR).

Data marked as required at sign-in or booking is needed to conclude the contract; without it a booking cannot be made.

We do not ask for consent, because the website does not need it to operate.

3. Protection against sign-in abuse

So that nobody can flood someone else’s phone or e-mail with codes through our website, for every code sent we keep for a short time the destination e-mail or phone, the channel (e-mail, SMS), the IP address (for IPv6 only its first half, the /64 network), a device identifier from the tsm_device cookie and the time of sending. We use it to limit the number of codes per hour and per day; at least 30 seconds must pass between two codes to the same number or e-mail. A code you enter correctly does not count towards the limits.

  • Records of codes sent (e-mail and SMS together) — 25 hours.
  • Records of SMS codes sent — 2 days.
  • Records of e-mail codes sent — 31 days.

We do not use this data to identify you or for anything else. Exceeding a limit only temporarily blocks sending the next code.

When you request a code, the site may use Cloudflare Turnstile to check that you are not an automated program. Cloudflare processes your IP address and technical browser data for this and may use its own technical browser storage. Legal basis: legitimate interest in protection against abuse. Pages without the sign-in form do not load this service.

On the My bookings page the nearest booking shows a map of the way to the club. When the map is displayed, your browser downloads map data and label fonts from the servers of OpenFreeMap, operated by Hyperknot Software Kft. (Hungary). The service therefore sees your IP address and technical browser data; according to its privacy policy it uses no cookies or tracking technologies, its access logs contain no IP addresses, its error logs may contain them and are deleted after 7 days, and it may deliver content through Cloudflare. Legal basis: legitimate interest in showing you how to reach the club. We load the map code from our own website, and no other page loads the map. The links to Mapy.com, Google Maps, Apple Maps and Waze open only when you tap them and are governed by those services' own policies.

4. Who receives your data

We share data only with those who need it to run the service:

  • Viktoriya Bon, company ID 21665885, with registered office at Sobí 1178/6, 198 00 Prague 9 — running the booking website for the club and receiving payments for bookings.
  • Railway Corporation (USA) — application and database hosting; servers in the EU (EU West, Amsterdam, Netherlands).
  • Plus Five Five, Inc., the Resend service (USA) — sending e-mails with codes and confirmations; e-mails go out through a region in Ireland, while account data and sending logs may be stored in the US.
  • Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland — payment processing. The payment provider also processes card data on its own for its own purposes, for example fraud prevention, and to that extent is an independent controller.
  • Cloudflare, Inc. (USA) — DNS, which translates the website name into the server address, and the Turnstile visitor check when you request a sign-in code.
  • Hyperknot Software Kft. (Hungary), the OpenFreeMap service — map data for the map on the My bookings page; it sees the visitor's IP address when the map is displayed.
  • Public authorities and courts — only where the law requires it.

We do not sell your data or use it for advertising. If a provider is based or processes data outside the EU/EEA, this happens on the basis of a European Commission adequacy decision or standard contractual clauses under Art. 46 GDPR; we will give you a copy of the safeguards on request.

5. How long we keep your data

  • Account (name, phone, e-mail) — for as long as the account exists. You can delete the account yourself at any time in the account settings on the My bookings page (/bookings); your name, phone and e-mail are then erased. Data we must keep by law stays (see the following points).
  • Bookings and payments — for the duration of the contract and thereafter as necessary to protect legal claims.
  • Accounting records — 5 years; tax records — 10 years (Czech Accounting Act, VAT Act).
  • Questions and complaints — until handled and thereafter as necessary to protect legal claims.
  • Records of codes sent — 25 hours; SMS codes 2 days; e-mail codes 31 days.
  • Technical server logs — as a rule 30 days.

When the period ends we erase the data without undue delay.

6. Cookies and browser storage

We use only technically necessary cookies and browser storage. There are no third-party analytics, advertising or tracking tools on the website, so it shows no cookie banner. The map on the My bookings page stores no cookies or browser storage from us.

  • refresh_token — keeps you signed in; 30 days; cookie of our website, set after sign-in; scripts on the page cannot read it (httpOnly).
  • tsm_device — a random device number we use to limit code sending; 1 year; cookie of our website, set on the first code request; httpOnly. It is not tracking across websites.
  • bk.locale and bk.locale.profile in localStorage — your chosen language; until you delete them; storage in your browser.
  • bk.signed in localStorage — a flag that a session may exist; it contains no personal data and is removed on logout, account deletion or a failed session refresh.
  • bk.phone in sessionStorage — the phone number entered at sign-in so it does not have to be typed again; until the tab is closed.

You can delete cookies and storage in your browser at any time. Without the refresh_token cookie you cannot stay signed in.

7. Security

The connection to the website is encrypted (HTTPS). We store one-time codes only as a hash and they stop being valid after five wrong attempts. We store passwords only as a secure hash. Only persons who need the data for their work have access to the administration.

If a security breach occurred that would pose a high risk to you, we would notify you and report it to the Office for Personal Data Protection.

8. Your rights

You can ask for access to your data and a copy, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interest. Send your request by e-mail to rezervace@tsmsokolvysocany.cz; we will reply within one month at the latest. If we doubt your identity, we may ask you to verify it. You can also delete your account yourself in the account settings on the My bookings page (/bookings). Data we must keep by law, for example payment records and accounting documents, stays; after the account is deleted it is no longer linked to your name or contact details.

If you believe we handle your data in breach of the rules, you have the right to lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Prague 7, web: uoou.gov.cz.

9. Changes

We may amend this policy, for example when a supplier changes. The current version is always on this page.