Privacy policy
This policy explains what personal data is processed in the membrz application and in the client zone of Pugiles, why, for how long, and what your rights are.
1. Who processes your data
The controller of your data is Pugiles. The organisation decides what data it keeps about its members and their contact persons and what it uses that data for.
The processor is membrz – the service in which the organisation keeps its records. It processes the data only on the organisation's instructions and for the purposes set out below. Contact: support@membrz.sk.
2. What data we process
- Contact details of a parent, legal guardian or adult member: first name, surname, e-mail address, telephone number and, where given, date of birth.
- Member details (for example a child's): first name, surname, date or year of birth, member number, the courses and seasons they attend and – if the organisation uses them – a photograph.
- Fees and payments: the fees charged, discounts, payments received and the bank movement details that belong to them (the payer's name and account number, amount, date, symbols and message for the recipient).
- Communication: e-mails the organisation sends you (invitations, fee notices, payment reminders, bulk messages) and whether they were delivered; messages and registrations you send through the client zone.
- Signing in: your e-mail address, one-time sign-in codes and links, and, if you sign in with Google, your Google account's identifier and its e-mail address. The client zone uses no password.
- Technical data: cookies needed for signing in (see below) and error logs.
3. Why we process data and on what legal basis
- Keeping membership, courses and fees – performance of the contract or membership relationship with the organisation.
- Matching payments and accounting – performance of the contract and the organisation's legal obligations (in particular accounting and tax).
- The client zone – so that you can see your members, fees and payments and send registrations and messages.
- Invitations, notices and reminders – performance of the contract and the organisation's legitimate interest in informing you about matters of the membership.
- Member photographs – only if the organisation uses them, and on the basis of consent, which you may withdraw at any time.
- Security and operation of the service – legitimate interest (protection against misuse, fixing errors).
4. Who we share data with
We do not sell data and do not use it for advertising. To run the service we use these further processors:
- WebSupport s. r. o. (Slovakia) – hosting of the application and the database.
- Brevo (EU) – sending e-mails and reporting their delivery.
- Google – only if you choose to sign in with Google; we receive your name, e-mail address and account identifier from it.
- The organisation's bank – statements of movements on the organisation's account, from which payments are matched.
The data is stored in the European Union. Where a provider also processes data outside the EU, it does so under the safeguards required by the GDPR.
5. Signing in with Google
You can also sign in to the client zone with your Google account. This is optional – you can sign in just as well with a one-time code sent by e-mail.
- What we receive from Google: your name, your e-mail address, whether Google has verified that address, and your Google account's identifier. We ask only for the basic scopes openid, email and profile; we have no access to your Gmail, contacts, files or anything else in your Google account.
- What we use it for: solely for signing you in. We compare the verified e-mail address with the address the organisation keeps for you, and store the account identifier together with that address so that we recognise you the next time you sign in. We do not store the name Google sends – you fill in your name and telephone number yourself in your profile. If nobody keeps that address, a new client-zone account is created with it.
- What we do not do with it: we do not sell data received from Google, do not use it for advertising or profiling, and do not share it with anyone other than the processors listed in section 4, and with them only to run the service.
- How long: we keep the link to your Google account for as long as your client-zone account exists. You can remove it at any time – write to the organisation or to us at support@membrz.sk – and you can also revoke membrz's access yourself at myaccount.google.com/permissions.
The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. How long we keep data
For as long as the membership lasts, and after that only as long as the law or the organisation's legitimate needs require. Accounting documents and payment records are kept for 10 years under the Slovak Accounting Act. Sign-in codes are valid for 15 minutes and their records are deleted after 30 days.
7. Cookies
We use only strictly necessary cookies: to keep you signed in (for at most one year when you choose “Stay signed in on this device”) and to protect forms. The browser also stores a few small display settings. We use no analytics or advertising cookies.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent. Send your request to the organisation or to us at support@membrz.sk; we will handle it without undue delay and within one month at the latest.
If you believe your data is being handled incorrectly, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk.
9. Changes
We may update this policy. The current version is always on this page. This English text is a translation; where it differs from the Slovak version, the Slovak version prevails.