Privacy policy

1. Data Controller

ClubSystem is the data controller for personal data processed in connection with our own website, sales, onboarding, support, billing, and platform administration. For privacy-related inquiries about these activities, contact us at: contact@clubsystem.app

If you submit personal data on a club booking page powered by ClubSystem, the club shown on that booking page is the controller of your reservation data. In that case ClubSystem acts on behalf of that club as a processor providing the booking infrastructure.

2. What Data We Collect

When you register your club, contact us, or use our services, we may collect:

• Registration data: Club name, address, contact email, phone number (optional)
• Account data: Username, password (encrypted), admin contact information
• Reservation-platform data: Reservation details and customer contact data submitted on booking pages operated by clubs using ClubSystem. The relevant club is the controller of this data, while ClubSystem processes it under a data processing agreement.
• Usage data: System logs, session statistics, feature usage analytics
• Technical data: IP addresses, browser type, device information, cookies

3. Purpose and Legal Basis

We process personal data for the following purposes:

• Service delivery — providing booking system functionality, SMS notifications, account management to clubs using ClubSystem (Legal basis: Contract performance, Art. 6(1)(b) GDPR)
• Reservation processing on behalf of clubs — storing reservation requests, SMS verification, reminders, and reservation-related operational messages sent through the platform on behalf of a club (Legal basis applied by the club as controller; ClubSystem acts as processor under Art. 28 GDPR)
• Pre-contractual activities — responding to trial registration, preparing quotes, scheduling deployment (Legal basis: Pre-contractual measures, Art. 6(1)(b) GDPR)
• Communication — responding to inquiries, customer support, service updates (Legal basis: Legitimate interest, Art. 6(1)(f) GDPR)
• System security — preventing fraud, ensuring service stability, troubleshooting (Legal basis: Legitimate interest, Art. 6(1)(f) GDPR)
• Legal compliance — fulfilling legal obligations, accounting requirements (Legal basis: Legal obligation, Art. 6(1)(c) GDPR)

4. Data Recipients

We share personal data only with recipients who need it to provide the service, and only to the extent they need. They fall into these categories:

• Hosting providers — servers, databases and backups, website delivery (CDN) and protection against attacks
• SMS gateways — booking verification codes and notifications; they receive phone numbers and message content
• Email delivery providers — verification emails, notifications and other service messages; they receive email addresses and message content
• Payment operator — subscription payments; it receives billing details and the payment data needed to take the payment
• E-invoicing authority — the Polish National e-Invoicing System (KSeF), which receives invoice data where Polish law requires invoices to be issued through it. It acts under statute, not on our behalf.
• Monitoring providers — error tracking and server monitoring; they may receive technical data such as IP addresses, URLs and server logs
• Analytics providers — cookieless website and product analytics, described in section 7
• Remote support tools — remote access to the club computer running the ClubSystem agent, used to install, diagnose and support it
• Legal authorities — when required by law or to protect our legal rights

The current sub-processors, with their names, countries, purposes and transfer safeguards, are listed in one place: the table in Article 5 of our Data Processing Agreement. Every provider that processes personal data on our behalf is bound by a data processing agreement in accordance with GDPR Art. 28.

5. Data Retention

We retain your personal data for the following periods:

• Registration inquiries: 12 months from last contact
• Active accounts: Duration of service usage plus 30 days after termination
• Reservation-platform data: retained according to the club's instructions as controller and the service configuration used for operational purposes
• Financial records: As required by law (typically 5-7 years)
• Technical logs: 90 days for security and troubleshooting purposes

After these periods, data is securely deleted or anonymized.

6. Your Rights

Under GDPR, you have the following rights:

• Right to access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent, withdraw it at any time
• Right to lodge a complaint — file a complaint with your local data protection authority

To exercise these rights, contact us at contact@clubsystem.app for data controlled directly by ClubSystem. If your request concerns reservation data submitted to a specific club, please contact that club first as the controller named on the booking page. We will assist the club as processor where required.

7. Cookies and Tracking

Our website uses only essential cookies that are strictly necessary for core functionality (for example, authentication and session management in the booking and admin areas). We do not use advertising cookies or any non-essential tracking cookies.

For analytics we use Google Analytics and PostHog in cookieless mode: they collect anonymous, aggregated usage statistics without storing cookies or persistent identifiers on your device. Because no information is stored on or read from your device, no cookie-consent banner is required under the ePrivacy Directive, and this processing falls outside the scope that requires consent.

Essential cookies cannot be disabled as they are required for the service to function, but they do not track you across other websites. If you have any questions about our use of cookies, contact us at contact@clubsystem.app.

8. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encrypted data transmission (HTTPS/TLS)
• Password encryption using industry-standard algorithms
• Regular security updates and vulnerability assessments
• Access controls and authentication mechanisms
• Secure backup procedures

9. International Data Transfers

Most of your data is stored and processed within the European Economic Area (EEA): our backend servers and database are hosted in Germany.

Some service providers are based outside the EEA, mainly in the USA. Transfers to them are made on the basis of the EU–US Data Privacy Framework or Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46(2)(c). The sub-processor table in Article 5 of our Data Processing Agreement shows the country and transfer basis for each provider.

10. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated via email or prominent notice on our website.

12. Contact Us

For any questions or concerns about this Privacy Policy or our data practices:

Email: contact@clubsystem.app

Subject line: Privacy Policy Inquiry