Privacy policy

Who is responsible

V Aquatics Swimming Academy, z.s., IČO 11718153, with its registered office at Vaníčkova 100/6, Břevnov, 169 00 Praha 6, is the controller of your personal data within the meaning of Article 4(7) of the GDPR. Swim Monkeys is the name it trades under.

We have not appointed a data protection officer, and are not required to. Write to office@vaquatics.cz or call +420 730 555 539 about anything on this page, and a person answers.

What we hold

What the service needs to work, and nothing gathered for its own sake:

• Account details — your name, email address, phone number, the language you want to be written to in, and your password as a cryptographic hash we cannot reverse.
• Your swimmer profile, and any note the office keeps about your training. These are not medical records: anything about your health belongs with your coach in person, which is why the contact form asks you to keep it out.
• Bookings, cancellations and attendance — which session, when, and what became of it.
• Credits and payments — what you bought, what it cost, when it was paid, the method the gateway reported and its transaction reference. Your full card number never reaches us.
• Consents — which policy you agreed to, in which version, when, and the IP address it was given from. That record is the proof the agreement happened.
• The emails we sent you, so that “did I ever get that message” has an answer later.
• Messages you send through the contact form.
• A technical log of changes made in the system, for security and for answering questions about what happened to an account.

Why we hold it

Each purpose has its own legal basis under Article 6(1) of the GDPR:

• To run your account, take your bookings and payments and deliver the training — performance of a contract, Article 6(1)(b). Without these details there is no service to give you.
• To issue tax documents and keep our books — a legal obligation, Article 6(1)(c), under Czech accounting and VAT legislation.
• To keep the service secure, to prevent abuse, and to be able to show what was agreed and when — our legitimate interests, Article 6(1)(f).
• To send you news from the academy, and to use photographs taken at training — your consent, Article 6(1)(a), asked for separately and withdrawable at any time. Neither is a condition of training with us.

Who sees it

Inside the academy, the coaches and office staff who need it for the work in front of them, and nobody else.

Outside it, the service runs with the help of the processors below. Each handles your data only on our instructions and under a contract that says so. We do not sell your data, and nothing leaves the European Economic Area except as noted.

• Comgate a.s., IČO 27924505 — the payment gateway. Your card details go to it, not through us.
• Seyfor, a. s., IČO 01572377 (iDoklad) — issuing invoices and credit notes.
• Postmark, a service of ActiveCampaign, LLC (United States) — sending the email the service depends on. The transfer rests on the European Commission’s standard contractual clauses.
• ASPone, s.r.o., IČO 28274326 — the hosting the application and its database run on, in the Czech Republic.
• Google Ireland Limited — the typeface this site loads, and Google sign-in if you choose it. Loading the typeface tells Google your IP address.
• Our accountants, and public authorities where the law requires it.

Linked accounts

If you link your account with another swimmer’s, the two of you see each other’s first name, and the swimmer who pays sees the bookings they made and paid for on the other’s behalf — which session, when, and whether it was cancelled.

Nothing else is shared. The swimmer who pays does not see bookings the other pays for themselves, their attendance, their contact details or their balance. The swimmer who attends does not see what the payer was charged, or the payer’s own bookings.

An invitation is sent to the email address the inviting swimmer enters. We use that address to deliver the invitation and to recognise it when the invited swimmer signs in. An invitation that is not accepted expires after seven days.

How long we keep it

Long enough to do the job it was collected for, and then:

• Your account and what hangs off it — while the account is open, and three years after you close it, which is the general limitation period for a claim either of us might bring.
• Invoices, credit notes and payment records — ten years from the end of the tax period they fall in, because the VAT and accounting legislation requires it. This is the one retention we cannot shorten on request.
• Consent records — while the account exists and three years after, since their whole purpose is to prove what was agreed.
• The log of emails we sent — three years.
• Contact form messages — one year after the conversation ends.
• The technical change log — one year.

Your rights

Over the data we hold about you, you have the rights the GDPR gives you. Write to office@vaquatics.cz to use any of them and we will answer within one month.

• Access — a copy of what we hold and an explanation of what we do with it.
• Rectification — correction of anything wrong or incomplete.
• Erasure — deletion, where we no longer have a reason to keep it. The ten-year accounting retention above is such a reason, so an invoice outlives the account it belonged to.
• Restriction — a pause on processing while a dispute about it is settled.
• Portability — the data you gave us, in a machine-readable form, to take elsewhere.
• Objection — to anything we do on the basis of our legitimate interests.
• Withdrawal of consent — for the marketing and photograph consents, at any time, with no effect on what was done before you withdrew it.
• Complaint — to the Czech supervisory authority, Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. We would rather you came to us first, but it is your right either way.

Contact

Anything about this policy or about your data: office@vaquatics.cz, +420 730 555 539, or by post to V Aquatics Swimming Academy, z.s., Vaníčkova 100/6, Břevnov, 169 00 Praha 6.

So that we answer the right person, we may ask you to confirm who you are before acting on a request about the data itself.

This policy carries its version and effective date at the top. If we change it materially, we will tell you at the address on your account.