1.1 These rules govern the rights and obligations of the operator and the data subject in accordance with personal data protection regulations. At the same time, they represent information for the data subject regarding the processing of their personal data according to personal data protection regulations.
1.2 These rules are always valid in their latest version, and the provider is not required to notify the user after every change.
1.3 These rules take effect on December 1, 2025.
2.1 In these Privacy Policy and Personal Data Processing Rules, the following terms are used with the following meanings:
Application: the PAYSY Member application provided for the data subject by the operator.
Data Subject: a person who is a user, i.e., a person who uses the application.
Personal Data: the customer's personal data specified in point 3.3, which is processed by the provider for the purposes of providing the application, related services, fulfilling contractual obligations, and exercising rights under the contract.
Rules: these Privacy Policy and Personal Data Processing Rules.
Personal Data Protection Regulations: the General Data Protection Regulation (GDPR) and the Personal Data Protection Act.
Operator: Paysy s. r. o., Vajanského 1955/58, 921 01 Piešťany, ID No.: 50 835 271, TAX ID: 2120499689, VAT ID: SK2120499689, registered in the Commercial Register of the District Court Trnava, Section: Sro, Entry No. 39845/T.
General Data Protection Regulation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) or any other relevant legal regulation that replaces it.
Electronic Communications Act: Act No. 452/2021 Coll. on Electronic Communications, as amended, or any other relevant legal regulation that replaces it.
Personal Data Protection Act: Act No. 18/2018 Coll. on Personal Data Protection and on amendments to certain acts, as amended, or any other relevant legal regulation that replaces it.
3.1 The purpose of processing the data subject's personal data by the operator is (i) providing the application and services associated with the application, (ii) concluding and fulfilling the contract, (iii) collection and enforcement of claims from contracts and (iv) keeping records of application users and contractual relationships, including purchase agreements where the subject is the payment of membership fees via the application, (v) protection of the rights of the operator and third parties, (vi) preparation and analysis of statistical data, where in this case the data is usually anonymized and aggregated so that the user's identity cannot be determined, (vii) measuring Application traffic, (viii) improving application content and its development, (ix) ensuring the security of the operator's systems against unauthorized interventions and access, (x) fulfillment of the operator's legal obligations, especially according to tax and accounting regulations, and (xi) direct marketing in the form of sending offers of similar goods and services to the Data Subject, whereby the consent of the data subject under this sentence is granted by concluding the contract according to § 116 paragraphs 14 and 15 of the Electronic Communications Act and is revocable at any time, (xii) sending so-called push notifications to the data subject's device on which the application is installed, with offers of goods and services or current information about the club, (xiii) storing backups for the purpose of protecting the rights of the operator and third parties after the termination of the Contract, security of the operator's systems, and demonstrating compliance with legal regulations by the operator.
3.2 The legal basis for processing personal data is (i) fulfillment of the operator's contractual obligations under the contract (Article 6(1)(b) of the General Data Protection Regulation and §13(1)(b) of the Personal Data Protection Act) and (ii) legitimate interest of the operator (Article 6(1)(f) of the General Data Protection Regulation and §13(1)(f) of the Personal Data Protection Act), which consists, for example, in the interest of proper and complete fulfillment of the contract if concluded, and potential enforcement of the operator's or a third party's claims against the Data Subject, processing data for statistical purposes, traffic measurement, analysis of Data Subject preferences, improving content and development of the Application, securing the operator's systems, demonstrating compliance with legal regulations by the operator, and direct marketing, and demonstrating performance by the operator of individual tabs/parts within the application that are business partners of the operator.
3.3 The operator will process the personal data of the data subject in the following scope (list of personal data), whereby personal data is obtained directly from the Data Subject during registration or from communication with the data subject or within the logging of the data subject's activity in the application:
▪ Mandatory identification data: first name, last name, e-mail, password (in encrypted form), date of birth, and country of residence
▪ Other automatically processed data: method and time of registration, IP address, unique device identifier, logs of data subject activities within the data subject's account in the application, unique OS ID of the device from which the data subject logs in, dates and times of accessing the application, changes in the application
▪ Data upon termination of the contract: the above-mentioned data subject data and the reason for canceling the contract, which are necessary to prevent re-conclusion of the contract and/or registration
3.4 The period of processing and storage of personal data is the duration of the contract + 4 years (limitation period) from the fulfillment/termination of the contract. In the case of claim enforcement, it is the time necessary to enforce the claims of the data subject and/or the operator in court proceedings determined according to the relevant legal regulation (limitation period + necessary reserve of at least twelve months) and subsequently the duration of such proceedings including execution. Personal data processing will always last at least for the duration of the contract.
3.5 The Data Protection Officer of the operator, if appointed, is listed on the operator's website.
4.1 Providing personal data is a contractual requirement as well as a requirement for concluding a contract between the operator and the data subject, which is necessary for the purposes stated in point 3.1 of the rules. Providing personal data is voluntary in terms of the voluntariness of concluding the contract; however, if not provided, the operator cannot conclude a contract with the data subject. Providing consent for personal data processing is not a condition for concluding the contract. Without providing personal data, it is not possible to use the application in its full scope.
4.2 The operator uses automated decision-making and profiling. Given that automated decision-making and profiling are necessary for the fulfillment of the Contract by the Operator, the Data Subject does not have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which has legal effects concerning them or similarly significantly affects them. However, the Data Subject has (i) the right to verify a decision made by automated means and based on profiling by non-automated means, (ii) the right to express their view on a decision made by automated means and based on profiling, and (iii) the right to contest a decision made through automated decision-making and based on profiling. The Data Subject may exercise their rights under this point via email.
4.3 In automated decision-making and profiling, the operator processes information about paid fees and information about participation in events/trainings. Profiling and automation will manifest such that the user may receive calls for action, notifications regarding attendance or non-attendance at events/trainings, marketing offers, or other messages from the club related to the aforementioned behavior.
5.1 The Data Subject acknowledges that their personal data may also be provided to third parties, which are:
▪ Employees of the operator.
▪ Persons providing accounting, tax, financial, legal, and other advisory services to the operator.
▪ External service providers (programming and other supporting technical services, server services, call center, e-mail distribution, services related to traffic measurement, and tailoring content to the preferences of data subjects).
▪ Operators of backup servers and operators of technologies used by the operator to ensure the functionality of services.
▪ Persons managing and enforcing the operator's claims and collection agencies.
▪ Public authorities in accordance with legal regulations.
6.1 The data subject has data subject rights according to Chapter III of the General Data Protection Regulation and the second head of the Personal Data Protection Act, in particular, they have (i) the right to information according to Articles 13 and 14 of the General Data Protection Regulation and §19 to 21 of the Personal Data Protection Act and notifications according to Articles 15 to 22 and Article 34 of the General Data Protection Regulation and §22 to 28 and §41 of the Personal Data Protection Act regarding processing, in a concise, transparent, intelligible, and easily accessible form, formulated clearly and simply and provided in writing or by other means, and if necessary, by electronic means, (ii) the right of access to their Personal Data, (iii) the right to rectification of Personal Data, (iv) the right to erasure of Personal Data (right to be forgotten), (v) the right to restriction of processing of Personal Data, (vi) the right to notification that Personal Data have been rectified, erased, or their processing restricted, (vii) the right to portability of Personal Data if their processing is carried out based on consent or a contract and is performed by automated means, (viii) the right to object to the processing of Personal Data, (ix) the right to verify a decision made by automated means and based on profiling by non-automated means, the right to express their view on a decision made by automated means and based on profiling, and the right to contest a decision made through automated decision-making and based on profiling, (x) the right to withdraw consent to the processing of Personal Data at any time, and (xi) the right to lodge a complaint with a supervisory authority (Office for Personal Data Protection of the Slovak Republic, www.dataprotection.gov.sk) and a proposal to initiate personal data protection proceedings. The scope, limitations, and methods of exercising these rights are set out in Chapter III of the General Data Protection Regulation and the second head of the Personal Data Protection Act.
6.2 The data subject has the right to object to the processing of personal data if they are processed for reasons of public interest, legitimate interest, or for direct marketing purposes. Objecting to the processing of personal data can be done via email.
6.3 The data subject is entitled to withdraw consent for the processing of personal data if the processing occurs solely based on their consent, via email.
6.4 In the case of personal data of a person under 18 years of age, the data subject may request the erasure of Personal Data provided before reaching the age of 18.
6.5 In connection with the offer of information society services, the operator processes personal data based on the data subject's consent lawfully if the data subject has reached 16 years of age. If the data subject is under 16 years old, such processing of personal data is lawful only if and to the extent that such consent was given or authorized by their legal representative.
7.1 If the Data Subject has the possibility to exercise their rights under these Rules or Personal Data Protection Regulations against the Operator via email, they can exercise them at info@paysy.sk. The Data Subject may also contact the Operator at the stated e-mail address with any other question regarding privacy protection and the processing of Personal Data.
7.2 Supervision of personal data processing is performed by the Office for Personal Data Protection of the Slovak Republic, located at Hraničná 4826/12, 820 07 Bratislava - Ružinov. The data subject is entitled to submit a proposal to initiate personal data protection proceedings to this office as the supervisory authority.
We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We share information about your use of our site with our social media, advertising and analytics partners.
Below you can choose which categories of cookies to allow. Strictly necessary cookies cannot be turned off — the site would not work without them.