Klubos Privacy Policy
- Version
- 2026-08-01
- Effective from
Information under Art. 13 of Regulation (EU) 2016/679 (GDPR). This document covers processing for which WebHeroes s.r.o. is the controller. Processing of club members' data — where the club is the controller and WebHeroes s.r.o. the processor — is governed by the Data Processing Agreement, and informing members is the club's duty.
1. Controller
WebHeroes s.r.o., Jaseňová 3249/38, 949 01 Nitra, Slovakia, Company ID 53 202 309, Commercial Register of the District Court Nitra, Section Sro, Insert No. 52605/N. Privacy contact and data-subject requests: info@klubos.sk, +421 944 979 792.
A Data Protection Officer is not designated — following the Art. 37(1) GDPR assessment (managing director's decision, 2026-08-05): the Controller is not a public authority, its core activities do not consist of regular and systematic large-scale monitoring of data subjects nor of large-scale processing of special categories of data (sensitive data are prohibited in the Service). The contact point for all data-protection matters is info@klubos.sk.
2. What we process, why, and on what legal basis
| Purpose | Data categories | Legal basis | Retention |
|---|---|---|---|
| Registration and user-account management | name, surname, e-mail, credentials (in the identity system), adult-age attestation, document acceptances (version + time) | Art. 6(1)(b) GDPR (contract) | for the life of the account; then 2 years from account closure or erasure |
| Organization management, invoicing and accounting | Customer identification and contact data, billing data, payment data (IBAN), invoices | Art. 6(1)(b); Art. 6(1)(c) GDPR (Act No. 431/2002 Coll., Act No. 222/2004 Coll.) | accounting records ten years following the year they relate to (§ 35(3) of Act No. 431/2002 Coll.) |
| Support and communication | communication content, contact data | Art. 6(1)(b) and (f) GDPR | 4 years from closure of the request |
| Security and audit log | technical records of consequential actions (metadata, never PII values), IP addresses in operational logs | Art. 6(1)(f) GDPR (security, accountability) | audit log 7 years; operational logs carrying IP addresses 90 days |
| Transactional e-mail (invitations, notifications) | e-mail, notification content | Art. 6(1)(b) GDPR | as the account |
| Marketing communication (news and information about the Klubos service) | e-mail, marketing-consent flag (wording version, time of granting and time of withdrawal) | Art. 6(1)(a) GDPR (consent) and § 116 of Act No. 452/2021 Coll. — exclusively opt-in consent given via an un-prechecked box at registration | until consent is withdrawn; the record of the consent and of the withdrawal confirmation is kept for a further 4 years after withdrawal (§ 116(5) and (6) of Act No. 452/2021 Coll.) |
| Consent and acceptance records | document version, time, account | Art. 6(1)(c) and (f) GDPR (accountability) | for the life of the account; withdrawn consents 5 years from withdrawal; document-acceptance records 5 years from account termination |
Marketing communication is carried out only on the basis of the consent given at registration (the wording is held in the Marketing Consent document). The audience is built exclusively from the registration consent flag — never from member data processed for clubs. Withdrawing consent is as easy as granting it (a toggle in account settings, an unsubscribe link in every message); we demonstrably confirm the withdrawal within 30 days (§ 116(6) of Act No. 452/2021 Coll.), and every message contains an unsubscribe link and the sender's identity.
The Slovak national identifier (rodné číslo) is not processed and has no input field.
3. Recipients and processors
Personal data are received by the following recipients. Processors process data for the Controller under an Art. 28 GDPR agreement (the current processor list is permanently published in the Sub-processor list document); recipients that are not processors have their role marked in the table:
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | cloud infrastructure (application and live data: Falkenstein data centre; backups: Nuremberg data centre) | EU (Germany) |
| Scaleway S.A.S., 8 rue de la Ville l'Évêque, 75008 Paris, France | transactional e-mail (Transactional Email service) | EU (France) |
| MK-SK, s.r.o., Jeseňová 3249/38, 949 01 Nitra, Company ID 46 884 742 | the Controller's external bookkeeping — processor (Art 28 GDPR) for billing and accounting data; Art 28 GDPR contract concluded (confirmed by the managing director 2026-08-05) | Slovakia |
| Stripe Payments Europe, Ltd., Dublin, Ireland | payment gateway for subscription billing; when processing card data it acts as an independent controller — it is not a processor of the Controller, and Klubos has no access to card data | EU (Ireland); transfer to the USA — see Section 4 |
| The club's bank (the bank's direct "API banking") | reading the club's transactions on its instruction via a token the club generated itself in its own bank — processing for the club (processor plane); the bank is an independent controller | EU |
| Financial Administration of the Slovak Republic — QR-payment Notification Service | notification of a successful QR payment (transaction ID, time, amount) — notification of payment only, no access to the payment account; processing for the club (processor plane) | Slovakia |
| Umami (self-hosted analytics operated by the Controller) | cookieless analytics; processes IP address and user-agent; runs on the Controller's own infrastructure — not a separate recipient | EU (Hetzner infrastructure, Germany) |
| — (no external error-tracking/APM tool) | operational monitoring is exclusively self-hosted (Prometheus/Thanos, OpenSearch, Jaeger, Perses) on own infrastructure — no external recipient | EU (Hetzner infrastructure, Germany) |
The identity system (Keycloak), the database, the analytics tool (Umami) and the monitoring tools are software managed by the Controller, running on Hetzner Online GmbH infrastructure in the EU — the only party "underneath" them is therefore Hetzner as the infrastructure provider; they are not separate recipients.
Data may be disclosed to public authorities where the law requires it.
4. Third-country transfers
Personal data of club members — the data the Controller processes as a processor for clubs — are processed exclusively in the European Union (Hetzner Online GmbH, Germany; Scaleway S.A.S., France); for them no third-country transfer takes place.
When a subscription is paid by card, payment data are processed by Stripe (the contracting entity is Stripe Payments Europe, Ltd., Dublin, Ireland; payment services are provided by Stripe Technology Europe Ltd., an e-money institution licensed by the Central Bank of Ireland, ref. C187865). Stripe does not offer EU data residency and may transfer personal data to the USA. The legal basis for the transfer is the certification of Stripe, Inc. under the EU-U.S. Data Privacy Framework together with the standard contractual clauses contained in the Stripe Data Transfers Addendum. Details of Stripe's processing: stripe.com/privacy.
5. Retention
Retention periods are stated per purpose in Section 2. Accounting records are kept for ten years following the year they relate to (§ 35(3) of Act No. 431/2002 Coll.). Data under a statutory retention duty are protected by a legal hold and cannot be erased earlier.
6. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection to legitimate-interest processing (Art. 21). Consent-based processing can be withdrawn at any time without affecting prior lawfulness.
Exercise your rights at info@klubos.sk; the Service also provides self-service export and erasure requests in the user interface. We respond without undue delay, at the latest within one month.
You may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, Slovakia (pdp.gov.sk).
7. Automated decision-making
The Controller performs no automated individual decision-making or profiling under Art. 22 GDPR.
8. Cookies
The use of cookies and similar technologies is governed by the Cookie Policy.
9. Changes
This document is versioned; significant changes are notified. The Slovak version is binding. Effective from 1 August 2026 (client decision 2026-08-05).